Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 00/21] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+Mostly straightforward bugfixes. The new Xilinx devices are
-as well put them in to rc0...
+arguably 'new feature', but they're fixing a regression where
 our changes to PSCI in commit 3f37979bf mean that EL3 guest
 code now needs to talk to a proper emulated power-controller
 device to turn on secondary CPUs; and it's not yet rc1 and
 they only affect the Xilinx board, so it seems OK to me.
 thanks
 -- PMM
-The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
+The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
+  Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * Fix sve2 ldnt1 and stnt1
- * dump: Update correct kdump phys_base field for AArch64
+ * Fix pauth_check_trap vs SEL2
- * char: i.MX: Add support for "TX complete" interrupt
+ * Fix handling of LPAE block descriptors
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
-   to boot a Debian Linux kernel on raspi3
+ * hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
  * nsis installer: List emulators in alphabetical order
  * nsis installer: Suppress "ANSI targets are deprecated" warning
  * nsis installer: Fix mouse-over descriptions for emulators
  * hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
  * Improve M-profile vector table access logging
  * Xilinx ZynqMP: model CRF and APU control
  * Fix compile issues on modern Solaris
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Andrew Deason (3):
-      char: i.MX: Simplify imx_update()
+      util/osdep: Avoid madvise proto on modern Solaris
-      char: i.MX: Add support for "TX complete" interrupt
+      hw/i386/acpi-build: Avoid 'sun' identifier
       util/osdep: Remove some early cruft
-Guenter Roeck (1):
+Edgar E. Iglesias (6):
-      fsl-imx6: Swap Ethernet interrupt defines
+      hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
       target/arm: Make rvbar settable after realize
       hw/misc: Add a model of the Xilinx ZynqMP CRF
       hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
       hw/misc: Add a model of the Xilinx ZynqMP APU Control
       hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control
-Peter Maydell (9):
+Eric Auger (2):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
-      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+      hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
       hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
       hw/arm/bcm2386: Fix parent type of bcm2386
       hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
       hw/arm/bcm2836: Create proper bcm2837 device
       hw/arm/bcm2836: Use correct affinity values for BCM2837
       hw/arm/bcm2836: Hardcode correct CPU type
       hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
-Wei Huang (1):
+Peter Maydell (8):
-      dump: Update correct kdump phys_base field for AArch64
+      target/arm: Fix handling of LPAE block descriptors
       hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
       hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
       nsis installer: List emulators in alphabetical order
       nsis installer: Suppress "ANSI targets are deprecated" warning
       nsis installer: Fix mouse-over descriptions for emulators
       target/arm: Log M-profile vector table accesses
       target/arm: Log fault address for M-profile faults
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+Richard Henderson (2):
- include/hw/arm/fsl-imx6.h    |  4 +-
+      target/arm: Fix sve2 ldnt1 and stnt1
- include/hw/char/imx_serial.h |  3 ++
+      target/arm: Fix pauth_check_trap vs SEL2
  dump.c                       | 14 +++++--
  hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
  hw/arm/boot.c                | 12 ++++++
  hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
  hw/char/imx_serial.c         | 44 ++++++++++++++++------
  hw/net/imx_fec.c             | 28 +++++++++++++-
 files changed, 237 insertions(+), 63 deletions(-)
+ meson.build                            |  23 ++-
+ include/hw/arm/xlnx-zynqmp.h           |   4 +
+ include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 ++++++++++++
+ include/hw/misc/xlnx-zynqmp-crf.h      | 211 ++++++++++++++++++++++++++
+ include/qemu/osdep.h                   |   8 +
+ target/arm/cpu.h                       |   3 +-
+ target/arm/sve.decode                  |   5 +-
+ hw/arm/virt.c                          |   7 +-
+ hw/arm/xlnx-zynqmp.c                   |  46 +++++-
+ hw/dma/xlnx_csu_dma.c                  |   1 +
+ hw/i386/acpi-build.c                   |   4 +-
+ hw/misc/npcm7xx_clk.c                  |   4 +-
+ hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++++++++
+ hw/misc/xlnx-zynqmp-crf.c              | 266 +++++++++++++++++++++++++++++++++
+ target/arm/cpu.c                       |  17 ++-
+ target/arm/helper.c                    |  20 ++-
+ target/arm/m_helper.c                  |  11 ++
+ target/arm/pauth_helper.c              |   2 +-
+ target/arm/translate-sve.c             |  51 ++++++-
+ tests/tcg/aarch64/test-826.c           |  50 +++++++
+ util/osdep.c                           |  10 --
+ hw/intc/Kconfig                        |   2 +-
+ hw/intc/meson.build                    |   4 +-
+ hw/misc/meson.build                    |   2 +
+ qemu.nsi                               |   8 +-
+ scripts/nsis.py                        |  17 ++-
+ tests/tcg/aarch64/Makefile.target      |   4 +
+ tests/tcg/configure.sh                 |   4 +
+files changed, 1084 insertions(+), 46 deletions(-)
+ create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+ create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
+ create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
+ create mode 100644 hw/misc/xlnx-zynqmp-crf.c
+ create mode 100644 tests/tcg/aarch64/test-826.c

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 01/21] target/arm: Fix sve2 ldnt1 and stnt1
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Code of imx_update() is slightly confusing since the "flags" variable
+For both ldnt1 and stnt1, the meaning of the Rn and Rm are different
-doesn't really corespond to anything in real hardware and server as a
+from ld1 and st1: the vector and integer registers are reversed, and
-kitchensink accumulating events normally reported via USR1 and USR2
+the integer register 31 refers to XZR instead of SP.
-registers.
+Secondly, the 64-bit version of ldnt1 was being interpreted as
-Change the code to explicitly evaluate state of interrupts reported
+-bit unpacked unscaled offset instead of 64-bit unscaled offset,
-via USR1 and USR2 against corresponding masking bits and use the to
+which discarded the upper 32 bits of the address coming from
-detemine if IRQ line should be asserted or not.
+the vector argument.
-NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
+Thirdly, validate that the memory element size is in range for the
-reasons:
+vector element size for ldnt1.  For ld1, we do this via independent
+decode patterns, but for ldnt1 we need to do it manually.
-. Emulation code implements a single character FIFO, so this flag
-       will always be set since characters are trasmitted as a part of
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826
-       the code emulating "push" into the FIFO
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 . imx_update() is really just a function doing ORing and maksing
        of reported events, so checking for UTS1_TXEMPTY should happen,
        if it's ever really needed should probably happen outside of
        it.
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220308031655.240710-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/imx_serial.c | 24 ++++++++++++++++--------
+ target/arm/sve.decode             |  5 ++-
-file changed, 16 insertions(+), 8 deletions(-)
+ target/arm/translate-sve.c        | 51 +++++++++++++++++++++++++++++--
+ tests/tcg/aarch64/test-826.c      | 50 ++++++++++++++++++++++++++++++
-diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+ tests/tcg/aarch64/Makefile.target |  4 +++
  tests/tcg/configure.sh            |  4 +++
 files changed, 109 insertions(+), 5 deletions(-)
  create mode 100644 tests/tcg/aarch64/test-826.c
 diff --git a/target/arm/sve.decode b/target/arm/sve.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/target/arm/sve.decode
-+++ b/hw/char/imx_serial.c
++++ b/target/arm/sve.decode
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@ USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
- static void imx_update(IMXSerialState *s)
+ ### SVE2 Memory Gather Load Group
 -# SVE2 64-bit gather non-temporal load
 -#   (scalar plus unpacked 32-bit unscaled offsets)
 +# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)
  LDNT1_zprz      1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \
 -                &rprr_gather_load xs=0 esz=3 scale=0 ff=0
 +                &rprr_gather_load xs=2 esz=3 scale=0 ff=0
  # SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)
  LDNT1_zprz      1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \
 diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)
  static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)
  {
--    uint32_t flags;
++    gen_helper_gvec_mem_scatter *fn = NULL;
-+    uint32_t usr1;
++    bool be = s->be_data == MO_BE;
-+    uint32_t usr2;
++    bool mte = s->mte_active[0];
-+    uint32_t mask;
++
++    if (a->esz < a->msz + !a->u) {
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
++        return false;
--    if (s->ucr1 & UCR1_TXMPTYEN) {
++    }
--        flags |= (s->uts1 & UTS1_TXEMPTY);
+     if (!dc_isar_feature(aa64_sve2, s)) {
--    } else {
+         return false;
--        flags &= ~USR1_TRDY;
+     }
--    }
+-    return trans_LD1_zprz(s, a);
-+    /*
++    if (!sve_access_check(s)) {
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
++        return true;
-+     * UCR1, so we can get away with something as simple as the
++    }
-+     * following:
++
-+     */
++    switch (a->esz) {
-+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
++    case MO_32:
-+    /*
++        fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];
-+     * Bits that we want in USR2 are not as conveniently laid out,
++        break;
-+     * unfortunately.
++    case MO_64:
-+     */
++        fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];
-+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
++        break;
-+    usr2 = s->usr2 & mask;
++    }
++    assert(fn != NULL);
--    qemu_set_irq(s->irq, !!flags);
++
-+    qemu_set_irq(s->irq, usr1 || usr2);
++    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
 +               cpu_reg(s, a->rm), a->msz, false, fn);
 +    return true;
  }
- static void imx_serial_reset(IMXSerialState *s)
+ /* Indexed by [mte][be][xs][msz].  */
@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)
  static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)
  {
 +    gen_helper_gvec_mem_scatter *fn;
 +    bool be = s->be_data == MO_BE;
 +    bool mte = s->mte_active[0];
 +
 +    if (a->esz < a->msz) {
 +        return false;
 +    }
      if (!dc_isar_feature(aa64_sve2, s)) {
          return false;
      }
 -    return trans_ST1_zprz(s, a);
 +    if (!sve_access_check(s)) {
 +        return true;
 +    }
 +
 +    switch (a->esz) {
 +    case MO_32:
 +        fn = scatter_store_fn32[mte][be][0][a->msz];
 +        break;
 +    case MO_64:
 +        fn = scatter_store_fn64[mte][be][2][a->msz];
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
 +               cpu_reg(s, a->rm), a->msz, true, fn);
 +    return true;
  }
  /*
 diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/test-826.c
@@ -XXX,XX +XXX,XX @@
 +#include <sys/mman.h>
 +#include <unistd.h>
 +#include <signal.h>
 +#include <stdlib.h>
 +#include <stdio.h>
 +#include <assert.h>
 +
 +static void *expected;
 +
 +void sigsegv(int sig, siginfo_t *info, void *vuc)
 +{
 +    ucontext_t *uc = vuc;
 +
 +    assert(info->si_addr == expected);
 +    uc->uc_mcontext.pc += 4;
 +}
 +
 +int main()
 +{
 +    struct sigaction sa = {
 +        .sa_sigaction = sigsegv,
 +        .sa_flags = SA_SIGINFO
 +    };
 +
 +    void *page;
 +    long ofs;
 +
 +    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
 +        perror("sigaction");
 +        return EXIT_FAILURE;
 +    }
 +
 +    page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
 +    if (page == MAP_FAILED) {
 +        perror("mmap");
 +        return EXIT_FAILURE;
 +    }
 +
 +    ofs = 0x124;
 +    expected = page + ofs;
 +
 +    asm("ptrue p0.d, vl1\n\t"
 +        "dup z0.d, %0\n\t"
 +        "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"
 +        "dup z1.d, %1\n\t"
 +        "ldnt1h {z0.d}, p0/z, [z1.d, %0]"
 +        : : "r"(page), "r"(ofs) : "v0", "v1");
 +
 +    return EXIT_SUCCESS;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls
  EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls
  endif
 +endif
 +ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)
 +AARCH64_TESTS += test-826
 +test-826: CFLAGS+=-march=armv8.1-a+sve2
  endif
  TESTS += $(AARCH64_TESTS)
 diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/tcg/configure.sh
 +++ b/tests/tcg/configure.sh
@@ -XXX,XX +XXX,XX @@ for target in $target_list; do
                               -march=armv8.1-a+sve -o $TMPE $TMPC; then
                    echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak
                fi
 +              if do_compiler "$target_compiler" $target_compiler_cflags \
 +                             -march=armv8.1-a+sve2 -o $TMPE $TMPC; then
 +                  echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak
 +              fi
                if do_compiler "$target_compiler" $target_compiler_cflags \
                               -march=armv8.3-a -o $TMPE $TMPC; then
                    echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+[PULL 02/21] target/arm: Fix pauth_check_trap vs SEL2
-The TypeInfo and state struct for bcm2386 disagree about what the
+From: Richard Henderson <richard.henderson@linaro.org>
 parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
 but the BCM2386State struct only defines the parent_obj field
 as DeviceState. This would have caused problems if anything
 actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
 Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
 need any of the additional functionality TYPE_SYS_BUS_DEVICE
 provides.
+When arm_is_el2_enabled was introduced, we missed
+updating pauth_check_trap.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788
+Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20220315021205.342768-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 2 +-
+ target/arm/pauth_helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/pauth_helper.c
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/pauth_helper.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
- static const TypeInfo bcm2836_type_info = {
+ static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)
-     .name = TYPE_BCM2836,
+ {
--    .parent = TYPE_SYS_BUS_DEVICE,
+-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-+    .parent = TYPE_DEVICE,
++    if (el < 2 && arm_is_el2_enabled(env)) {
-     .instance_size = sizeof(BCM2836State),
+         uint64_t hcr = arm_hcr_el2_eff(env);
-     .instance_init = bcm2836_init,
+         bool trap = !(hcr & HCR_API);
-     .class_init = bcm2836_class_init,
+         if (el == 0) {
 --
-.16.2
+.25.1

-New patch
+[PULL 03/21] target/arm: Fix handling of LPAE block descriptors
+LPAE descriptors come in three forms:
+ * table descriptors, giving the address of the next level page table
+ * page descriptors, which occur only at level 3 and describe the
+   mapping of one page (which might be 4K, 16K or 64K)
+ * block descriptors, which occur at higher page table levels, and
+   describe the mapping of huge pages
+QEMU's page-table-walk code treats block and page entries
+identically, simply ORing in a number of bits from the input virtual
+address that depends on the level of the page table that we stopped
+at; we depend on the previous masking of descaddr with descaddrmask
+to have already cleared out the low bits of the descriptor word.
+This is not quite right: the address field in a block descriptor is
+smaller, and so there are bits which are valid address bits in a page
+descriptor or a table descriptor but which are not supposed to be
+part of the address in a block descriptor, and descaddrmask does not
+clear them.  We previously mostly got away with this because those
+descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)
+block descriptor bit 16 is defined to be the nT bit.  No emulated
+QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might
+see it when using KVM or hvf.
+Explicitly zero out all the descaddr bits we're about to OR vaddr
+bits into.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 10 ++++++++--
+file changed, 8 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+             indexmask = indexmask_grainsize;
+             continue;
+         }
+-        /* Block entry at level 1 or 2, or page entry at level 3.
++        /*
++         * Block entry at level 1 or 2, or page entry at level 3.
+          * These are basically the same thing, although the number
+-         * of bits we pull in from the vaddr varies.
++         * of bits we pull in from the vaddr varies. Note that although
++         * descaddrmask masks enough of the low bits of the descriptor
++         * to give a correct page or table address, the address field
++         * in a block descriptor is smaller; so we need to explicitly
++         * clear the lower bits here before ORing in the low vaddr bits.
+          */
+         page_size = (1ULL << ((stride * (4 - level)) + 3));
++        descaddr &= ~(page_size - 1);
+         descaddr |= (address & (page_size - 1));
+         /* Extract attributes from the descriptor */
+         attrs = extract64(descriptor, 2, 10)
+--
+.25.1

-New patch
+[PULL 04/21] hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
+In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its
+own class struct, but forgot to update the TypeInfo::class_size
+accordingly.  This meant that not enough memory was allocated for the
+class struct, and the initialization of xcdc->read in the class init
+function wrote off the end of the memory. Add the missing line.
+Found by running 'check-qtest-aarch64' with a clang
+address-sanitizer build, which complains:
+==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8
+WRITE of size 8 at 0x61000000ab00 thread T0
+    #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16
+    #1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9
+    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
+    #3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)
+    #4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5
+    #5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5
+    #6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24
+    #7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35
+    #8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5
+    #9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5
+    #10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
+    #11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)
+x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)
+allocated by thread T0 here:
+    #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)
+    #1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)
+    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
+Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org
+---
+ hw/dma/xlnx_csu_dma.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/dma/xlnx_csu_dma.c
++++ b/hw/dma/xlnx_csu_dma.c
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {
+     .parent        = TYPE_SYS_BUS_DEVICE,
+     .instance_size = sizeof(XlnxCSUDMA),
+     .class_init    = xlnx_csu_dma_class_init,
++    .class_size    = sizeof(XlnxCSUDMAClass),
+     .instance_init = xlnx_csu_dma_init,
+     .interfaces = (InterfaceInfo[]) {
+         { TYPE_STREAM_SINK },
+--
+.25.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 05/21] hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
-Now we have separate types for BCM2386 and BCM2387, we might as well
+In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().
-just hard-code the CPU type they use rather than having it passed
+Use g_autofree so we free it rather than leaking it.
 through as an object property. This then lets us put the initialization
 of the CPU object in init rather than realize.
-Note that this change means that it's no longer possible on
+(Detected with the clang leak sanitizer.)
 the command line to use -cpu to ask for a different kind of
 CPU than the SoC supports. This was never a supported thing to
 do anyway; we were just not sanity-checking the command line.
 This does require us to only build the bcm2837 object on
 TARGET_AARCH64 configs, since otherwise it won't instantiate
 due to the missing cortex-a53 device and "make check" will fail.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
+Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 24 +++++++++++++++---------
+ hw/misc/npcm7xx_clk.c | 4 ++--
- hw/arm/raspi.c   |  2 --
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 15 insertions(+), 11 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/hw/misc/npcm7xx_clk.c
-+++ b/hw/arm/bcm2836.c
++++ b/hw/misc/npcm7xx_clk.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)
+     NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
- struct BCM283XInfo {
-     const char *name;
+     for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
-+    const char *cpu_type;
+-        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
-     int clusterid;
+-                g_strdup_printf("clock-in[%d]", i),
- };
++        g_autofree char *s = g_strdup_printf("clock-in[%d]", i);
++        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,
- static const BCM283XInfo bcm283x_socs[] = {
+                 npcm7xx_clk_update_sel_cb, sel, ClockUpdate);
-     {
+     }
-         .name = TYPE_BCM2836,
+     sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
 +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
          .clusterid = 0xf,
      },
 +#ifdef TARGET_AARCH64
      {
          .name = TYPE_BCM2837,
 +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
          .clusterid = 0x0,
      },
 +#endif
  };
  static void bcm2836_init(Object *obj)
  {
      BCM283XState *s = BCM283X(obj);
 +    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
 +    const BCM283XInfo *info = bc->info;
 +    int n;
 +
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
 +        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 +                          info->cpu_type);
 +        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 +                                  &error_abort);
 +    }
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
 -    obj = OBJECT(dev);
 -    for (n = 0; n < BCM283X_NCPUS; n++) {
 -        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 -                          s->cpu_type);
 -        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 -                                  &error_abort);
 -    }
 -
      obj = object_property_get_link(OBJECT(dev), "ram", &err);
      if (obj == NULL) {
          error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
  static Property bcm2836_props[] = {
 -    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
      DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                         BCM283X_NCPUS),
      DEFINE_PROP_END_OF_LIST()
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      /* Setup the SOC */
      object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                     &error_abort);
 -    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
 -                            &error_abort);
      object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                              &error_abort);
      int board_rev = version == 3 ? 0xa02082 : 0xa21041;
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 06/21] nsis installer: List emulators in alphabetical order
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+We currently list the emulators in the Windows installer's dialog
-CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
+in an essentially random order (it's whatever glob.glob() returns
-is required for Linux to boot.
+them to, which is filesystem-implementation-dependent). Add a
 call to sorted() so they appear in alphabetical order.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
+Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Reviewed-by: John Snow <jsnow@redhat.com>
 Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ scripts/nsis.py | 4 ++--
-file changed, 7 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/scripts/nsis.py b/scripts/nsis.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/scripts/nsis.py
-+++ b/hw/arm/bcm2836.c
++++ b/scripts/nsis.py
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ def main():
+         with open(
- struct BCM283XInfo {
+             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
-     const char *name;
+         ) as nsh:
-+    int clusterid;
+-            for exe in glob.glob(
- };
++            for exe in sorted(glob.glob(
+                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
- static const BCM283XInfo bcm283x_socs[] = {
+-            ):
-     {
++            )):
-         .name = TYPE_BCM2836,
+                 exe = os.path.basename(exe)
-+        .clusterid = 0xf,
+                 arch = exe[12:-4]
-     },
+                 nsh.write(
      {
          .name = TYPE_BCM2837,
 +        .clusterid = 0x0,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
  static void bcm2836_realize(DeviceState *dev, Error **errp)
  {
      BCM283XState *s = BCM283X(dev);
 +    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
 +    const BCM283XInfo *info = bc->info;
      Object *obj;
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
      for (n = 0; n < BCM283X_NCPUS; n++) {
 -        /* Mirror bcm2836, which has clusterid set to 0xf
 -         * TODO: this should be converted to a property of ARM_CPU
 -         */
 -        s->cpus[n].mp_affinity = 0xF00 | n;
 +        /* TODO: this should be converted to a property of ARM_CPU */
 +        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
          /* set periphbase/CBAR value for CPU-local registers */
          object_property_set_int(OBJECT(&s->cpus[n]),
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+[PULL 07/21] nsis installer: Suppress "ANSI targets are deprecated" warning
-Our BCM2836 type is really a generic one that can be any of
+When we build our Windows installer, it emits the warning:
 the bcm283x family. Rename it accordingly. We change only
 the names which are visible via the header file to the
 rest of the QEMU code, leaving private function names
 in bcm2836.c as they are.
-This is a preliminary to making bcm283x be an abstract
+   warning 7998: ANSI targets are deprecated
-parent class to specific types for the bcm2836 and bcm2837.
 Fix this by making our installer a Unicode installer instead.  These
 won't work on Win95/98/ME, but we already do not support those.
 See
 https://nsis.sourceforge.io/Docs/Chapter4.html#aunicodetarget
 for the documentation of the Unicode directive.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
+Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Message-id: 20220305105743.2384766-3-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 12 ++++++------
+ qemu.nsi | 3 +++
- hw/arm/bcm2836.c         | 17 +++++++++--------
+file changed, 3 insertions(+)
  hw/arm/raspi.c           | 16 ++++++++--------
 files changed, 23 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/qemu.nsi b/qemu.nsi
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/qemu.nsi
-+++ b/include/hw/arm/bcm2836.h
++++ b/qemu.nsi
 @@ -XXX,XX +XXX,XX @@
- #include "hw/arm/bcm2835_peripherals.h"
+ !define OUTFILE "qemu-setup.exe"
- #include "hw/intc/bcm2836_control.h"
+ !endif
--#define TYPE_BCM2836 "bcm2836"
++; Build a unicode installer
--#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
++Unicode true
-+#define TYPE_BCM283X "bcm283x"
++
-+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
+ ; Use maximum compression.
+ SetCompressor /SOLID lzma
--#define BCM2836_NCPUS 4
 +#define BCM283X_NCPUS 4
 -typedef struct BCM2836State {
 +typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
      /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
      char *cpu_type;
      uint32_t enabled_cpus;
 -    ARMCPU cpus[BCM2836_NCPUS];
 +    ARMCPU cpus[BCM283X_NCPUS];
      BCM2836ControlState control;
      BCM2835PeripheralState peripherals;
 -} BCM2836State;
 +} BCM283XState;
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2836.c
 +++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
  static void bcm2836_init(Object *obj)
  {
 -    BCM2836State *s = BCM2836(obj);
 +    BCM283XState *s = BCM283X(obj);
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
  static void bcm2836_realize(DeviceState *dev, Error **errp)
  {
 -    BCM2836State *s = BCM2836(dev);
 +    BCM283XState *s = BCM283X(dev);
      Object *obj;
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
      obj = OBJECT(dev);
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                            s->cpu_type);
          object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          /* Mirror bcm2836, which has clusterid set to 0xf
           * TODO: this should be converted to a property of ARM_CPU
           */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
  static Property bcm2836_props[] = {
 -    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
 -    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
 +    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
 +    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
 +                       BCM283X_NCPUS),
      DEFINE_PROP_END_OF_LIST()
  };
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
  }
  static const TypeInfo bcm2836_type_info = {
 -    .name = TYPE_BCM2836,
 +    .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
 -    .instance_size = sizeof(BCM2836State),
 +    .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
      .class_init = bcm2836_class_init,
  };
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
  typedef struct RasPiState {
 -    BCM2836State soc;
 +    BCM283XState soc;
      MemoryRegion ram;
  } RasPiState;
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
  }
  DEFINE_MACHINE("raspi3", raspi3_machine_init)
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+[PULL 08/21] nsis installer: Fix mouse-over descriptions for emulators
-If we're directly booting a Linux kernel and the CPU supports both
+We use the nsis.py script to write out an installer script Section
-EL3 and EL2, we start the kernel in EL2, as it expects. We must also
+for each emulator executable, so the exact set of Sections depends on
-set the SCR_EL3.HCE bit in this situation, so that the HVC
+which executables were built.  However the part of qemu.nsi which
-instruction is enabled rather than UNDEFing. Otherwise at least some
+specifies mouse-over descriptions for each Section still has a
-kernels will panic when trying to initialize KVM in the guest.
+hard-coded and very outdated list (with just i386 and alpha).  This
 causes two problems.  Firstly, if you build the installer for a
 configuration where you didn't build the i386 binaries you get
 warnings like this:
   warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)
   warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)
 (this happens in our gitlab CI jobs, for instance).
 Secondly, most of the emulators in the generated installer don't have
 any mouseover text.
 Make nsis.py generate a second output file which has the necessary
 MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can
 include that at the right point in qemu.nsi to set the mouse-over
 text.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: John Snow <jsnow@redhat.com>
 Message-id: 20220305105743.2384766-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 5 +++++
+ qemu.nsi        |  5 +----
-file changed, 5 insertions(+)
+ scripts/nsis.py | 13 ++++++++++++-
 files changed, 13 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/qemu.nsi b/qemu.nsi
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/qemu.nsi
-+++ b/hw/arm/boot.c
++++ b/qemu.nsi
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ SectionEnd
-                     assert(!info->secure_board_setup);
+ ; Descriptions (mouse-over).
-                 }
+ !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
+     !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
-+                    /* If we have EL2 then Linux expects the HVC insn to work */
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
-+                    env->cp15.scr_el3 |= SCR_HCE;
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
-+                }
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
 +!include "${BINDIR}\system-mui-text.nsh"
      !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
  !ifdef DLLDIR
      !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
 diff --git a/scripts/nsis.py b/scripts/nsis.py
 index XXXXXXX..XXXXXXX 100644
 --- a/scripts/nsis.py
 +++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
          subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])
          with open(
              os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
 -        ) as nsh:
 +        ) as nsh, open(
 +            os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"
 +        ) as muinsh:
              for exe in sorted(glob.glob(
                  os.path.join(destdir + args.prefix, "qemu-system-*.exe")
              )):
@@ -XXX,XX +XXX,XX @@ def main():
                          arch, exe
                      )
                  )
 +                if arch.endswith('w'):
 +                    desc = arch[:-1] + " emulation (GUI)."
 +                else:
 +                    desc = arch + " emulation."
 +
-                 /* Set to non-secure if not a secure boot */
++                muinsh.write(
-                 if (!info->secure_boot &&
++                    """
-                     (cs != first_cpu || !info->secure_board_setup)) {
++                !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"
 +                """.format(arch, desc))
          for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):
              signcode(exe)
 --
-.16.2
+.25.1

-New patch
+[PULL 09/21] hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
+From: Eric Auger <eric.auger@redhat.com>
+CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3
+specific files. So let's rename it into CONFIG_ARM_GICV3_TCG
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20220308182452.223473-2-eric.auger@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/intc/Kconfig     | 2 +-
+ hw/intc/meson.build | 4 ++--
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/Kconfig
++++ b/hw/intc/Kconfig
+@@ -XXX,XX +XXX,XX @@ config APIC
+     select MSI_NONBROKEN
+     select I8259
+-config ARM_GIC_TCG
++config ARM_GICV3_TCG
+     bool
+     default y
+     depends on ARM_GIC && TCG
+diff --git a/hw/intc/meson.build b/hw/intc/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/meson.build
++++ b/hw/intc/meson.build
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
+   'arm_gicv3_common.c',
+   'arm_gicv3_its_common.c',
+ ))
+-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
++softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(
+   'arm_gicv3.c',
+   'arm_gicv3_dist.c',
+   'arm_gicv3_its.c',
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
+ specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
+ specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
+ specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
+-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
++specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))
+ specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
+ specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
+ specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
+--
+.25.1

-New patch
+[PULL 10/21] hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
+From: Eric Auger <eric.auger@redhat.com>
+In TCG mode, if gic-version=max we always select GICv3 even if
+CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.
+This also brings the benefit of fixing qos tests errors for tests
+using gic-version=max with CONFIG_ARM_GICV3_TCG unset.
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20220308182452.223473-3-eric.auger@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/virt.c | 7 ++++++-
+file changed, 6 insertions(+), 1 deletion(-)
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
+         vms->gic_version = VIRT_GIC_VERSION_2;
+         break;
+     case VIRT_GIC_VERSION_MAX:
+-        vms->gic_version = VIRT_GIC_VERSION_3;
++        if (module_object_class_by_name("arm-gicv3")) {
++            /* CONFIG_ARM_GICV3_TCG was set */
++            vms->gic_version = VIRT_GIC_VERSION_3;
++        } else {
++            vms->gic_version = VIRT_GIC_VERSION_2;
++        }
+         break;
+     case VIRT_GIC_VERSION_HOST:
+         error_report("gic-version=host requires KVM");
+--
+.25.1

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+[PULL 11/21] target/arm: Log M-profile vector table accesses
-For the rpi1 and 2 we want to boot the Linux kernel via some
+Currently the CPU_LOG_INT logging misses some useful information
-custom setup code that makes sure that the SMC instruction
+about loads from the vector table.  Add logging where we load vector
-acts as a no-op, because it's used for cache maintenance.
+table entries.  This is particularly helpful for cases where the user
-The rpi3 boots AArch64 kernels, which don't need SMC for
+has accidentally not put a vector table in their image at all, which
-cache maintenance and always expect to be booted non-secure.
+can result in confusing guest crashes at startup.
-Don't fill in the aarch32-specific parts of the binfo struct.
 Here's an example of the new logging for a case where
 the vector table contains garbage:
 Loaded reset SP 0x0 PC 0x0 from vector table
 Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table
 Taking exception 3 [Prefetch Abort] on CPU 0
 ...with CFSR.IACCVIOL
 ...BusFault with BFSR.STKERR
 ...taking pending nonsecure exception 3
 ...loading from element 3 of non-secure vector table at 0xc
 ...loaded new PC 0x20000558
 ----------------
 IN:
 x20000558:  08000079  stmdaeq  r0, {r0, r3, r4, r5, r6}
 (The double reset logging is the result of our long-standing
 "CPUs all get reset twice" weirdness; it looks a bit ugly
 but it'll go away if we ever fix that :-))
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20220315204306.2797684-2-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 17 +++++++++++++----
+ target/arm/cpu.c      | 5 +++++
-file changed, 13 insertions(+), 4 deletions(-)
+ target/arm/m_helper.c | 5 +++++
 files changed, 10 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/cpu.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@
-     binfo.board_id = raspi_boardid[version];
+ #include "qemu/osdep.h"
-     binfo.ram_size = ram_size;
+ #include "qemu/qemu-print.h"
-     binfo.nb_cpus = smp_cpus;
+ #include "qemu/timer.h"
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
++#include "qemu/log.h"
--    binfo.write_board_setup = write_board_setup;
+ #include "qemu-common.h"
--    binfo.secure_board_setup = true;
+ #include "target/arm/idau.h"
--    binfo.secure_boot = true;
+ #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
              initial_pc = ldl_phys(s->as, vecbase + 4);
          }
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "Loaded reset SP 0x%x PC 0x%x from vector table\n",
 +                      initial_msp, initial_pc);
 +
-+    if (version <= 2) {
+         env->regs[13] = initial_msp & 0xFFFFFFFC;
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         env->regs[15] = initial_pc & ~1;
-+         * mode before booting a kernel (to set up the SMC vectors so
+         env->thumb = initial_pc & 1;
-+         * that we get a no-op SMC; this is used by Linux to call the
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-+         * firmware for some cache maintenance operations.
+index XXXXXXX..XXXXXXX 100644
-+         * The rpi3 doesn't need this.
+--- a/target/arm/m_helper.c
-+         */
++++ b/target/arm/m_helper.c
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
-+        binfo.write_board_setup = write_board_setup;
+     ARMMMUIdx mmu_idx;
-+        binfo.secure_board_setup = true;
+     bool exc_secure;
-+        binfo.secure_boot = true;
-+    }
++    qemu_log_mask(CPU_LOG_INT,
++                  "...loading from element %d of %s vector table at 0x%x\n",
-     /* Pi2 and Pi3 requires SMP setup */
++                  exc, targets_secure ? "secure" : "non-secure", addr);
-     if (version >= 2) {
++
      mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
      /*
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
          goto load_fail;
      }
      *pvec = vector_entry;
 +    qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
      return true;
  load_fail:
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 12/21] target/arm: Log fault address for M-profile faults
-Add some assertions that if we're about to boot an AArch64 kernel,
+For M-profile, the fault address is not always exposed to the guest
-the board code has not mistakenly set either secure_boot or
+in a fault register (for instance the BFAR bus fault address register
-secure_board_setup. It doesn't make sense to set secure_boot,
+is only updated for bus faults on data accesses, not instruction
-because all AArch64 kernels must be booted in non-secure mode.
+accesses).  Currently we log the address only if we're putting it
+into a particular guest-visible register.  Since we always have it,
-It might in theory make sense to set secure_board_setup, but
+log it generically, to make logs of i-side faults a bit clearer.
 we don't currently support that, because only the AArch32
 bootloader[] code calls this hook; bootloader_aarch64[] does not.
 Since we don't have a current need for this functionality, just
 assert that we don't try to use it. If it's needed we'll add
 it later.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ target/arm/m_helper.c | 6 ++++++
-file changed, 7 insertions(+)
+file changed, 6 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/m_helper.c
-+++ b/hw/arm/boot.c
++++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-                     } else {
+          * Note that for M profile we don't have a guest facing FSR, but
-                         env->pstate = PSTATE_MODE_EL1h;
+          * the env->exception.fsr will be populated by the code that
-                     }
+          * raises the fault, in the A profile short-descriptor format.
-+                    /* AArch64 kernels never boot in secure mode */
++         *
-+                    assert(!info->secure_boot);
++         * Log the exception.vaddress now regardless of subtype, because
-+                    /* This hook is only supported for AArch32 currently:
++         * logging below only logs it when it goes into a guest visible
-+                     * bootloader_aarch64[] will not call the hook, and
++         * register.
-+                     * the code above has already dropped us into EL2 or EL1.
+          */
-+                     */
++        qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
-+                    assert(!info->secure_board_setup);
++                      (uint32_t)env->exception.vaddress);
-                 }
+         switch (env->exception.fsr & 0xf) {
+         case M_FAKE_FSR_NSC_EXEC:
-                 /* Set to non-secure if not a secure boot */
+             /*
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 13/21] hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+Add an unimplemented SERDES (Serializer/Deserializer) area.
 it is needed to support guests other than Linux.
-Based on the patch by Bill Paul as found here:
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-https://bugs.launchpad.net/qemu/+bug/1753314
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Cc: qemu-devel@nongnu.org
+Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Bill Paul <wpaul@windriver.com>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/char/imx_serial.h |  3 +++
+ include/hw/arm/xlnx-zynqmp.h | 2 +-
- hw/char/imx_serial.c         | 20 +++++++++++++++++---
+ hw/arm/xlnx-zynqmp.c         | 5 +++++
-files changed, 20 insertions(+), 3 deletions(-)
+files changed, 6 insertions(+), 1 deletion(-)
-diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/include/hw/char/imx_serial.h
++++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
  /*
   * Unimplemented mmio regions needed to boot some images.
   */
 -#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
 +#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
  struct XlnxZynqMPState {
      /*< private >*/
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
 @@ -XXX,XX +XXX,XX @@
- #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+ #define QSPI_DMA_ADDR       0xff0f0800
- #define UCR2_SRST       (1<<0)    /* Reset complete */
+ #define NUM_QSPI_IRQ_LINES  2
-+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
++/* Serializer/Deserializer.  */
 +#define SERDES_ADDR         0xfd400000
 +#define SERDES_SIZE         0x20000
 +
- #define UTS1_TXEMPTY    (1<<6)
+ #define DP_ADDR             0xfd4a0000
- #define UTS1_RXEMPTY    (1<<5)
+ #define DP_IRQ              113
- #define UTS1_TXFULL     (1<<4)
-@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
-     uint32_t ubmr;
+         hwaddr size;
-     uint32_t ubrc;
+     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
-     uint32_t ucr3;
+         { .name = "apu", APU_ADDR, APU_SIZE },
-+    uint32_t ucr4;
++        { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
+     };
-     qemu_irq irq;
+     unsigned int nr;
-     CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
  static const VMStateDescription vmstate_imx_serial = {
      .name = TYPE_IMX_SERIAL,
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_INT32(readbuff, IMXSerialState),
          VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
 +     * TCEN and TXDC are both bit 3
 +     */
 +    mask |= s->ucr4 & UCR4_TCEN;
 +
      usr2 = s->usr2 & mask;
      qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
          return s->ucr3;
      case 0x23: /* UCR4 */
 +        return s->ucr4;
 +
      case 0x29: /* BRM Incremental */
          return 0x0; /* TODO */
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
              s->usr1 &= ~USR1_TRDY;
 +            s->usr2 &= ~USR2_TXDC;
              imx_update(s);
              s->usr1 |= USR1_TRDY;
 +            s->usr2 |= USR2_TXDC;
              imx_update(s);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
          s->ucr3 = value & 0xffff;
          break;
 -    case 0x2d: /* UTS1 */
      case 0x23: /* UCR4 */
 +        s->ucr4 = value & 0xffff;
 +        imx_update(s);
 +        break;
 +
 +    case 0x2d: /* UTS1 */
          qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                        HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
          /* TODO */
 --
-.16.2
+.25.1

-New patch
+[PULL 14/21] target/arm: Make rvbar settable after realize
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Make the rvbar property settable after realize. This is done
+in preparation to model the ZynqMP's runtime configurable rvbar.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  3 ++-
+ target/arm/cpu.c    | 12 +++++++-----
+ target/arm/helper.c | 10 +++++++---
+files changed, 16 insertions(+), 9 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+             uint64_t vbar_el[4];
+         };
+         uint32_t mvbar; /* (monitor) vector base address register */
++        uint64_t rvbar; /* rvbar sampled from rvbar property at reset */
+         struct { /* FCSE PID. */
+             uint32_t fcseidr_ns;
+             uint32_t fcseidr_s;
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
+     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
+     uint32_t dcz_blocksize;
+-    uint64_t rvbar;
++    uint64_t rvbar_prop; /* Property/input signals.  */
+     /* Configurable aspects of GIC cpu interface (which is part of the CPU) */
+     int gic_num_lrs; /* number of list registers */
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+         } else {
+             env->pstate = PSTATE_MODE_EL1h;
+         }
+-        env->pc = cpu->rvbar;
++
++        /* Sample rvbar at reset.  */
++        env->cp15.rvbar = cpu->rvbar_prop;
++        env->pc = env->cp15.rvbar;
+ #endif
+     } else {
+ #if defined(CONFIG_USER_ONLY)
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_cbar_property =
+ static Property arm_cpu_reset_hivecs_property =
+             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
+-static Property arm_cpu_rvbar_property =
+-            DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);
+-
+ #ifndef CONFIG_USER_ONLY
+ static Property arm_cpu_has_el2_property =
+             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
+     }
+     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+-        qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);
++        object_property_add_uint64_ptr(obj, "rvbar",
++                                       &cpu->rvbar_prop,
++                                       OBJ_PROP_FLAG_READWRITE);
+     }
+ #ifndef CONFIG_USER_ONLY
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+             ARMCPRegInfo rvbar = {
+                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
+                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
+-                .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
++                .access = PL1_R,
++                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
+             };
+             define_one_arm_cp_reg(cpu, &rvbar);
+         }
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+             ARMCPRegInfo rvbar = {
+                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
+                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
+-                .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
++                .access = PL2_R,
++                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
+             };
+             define_one_arm_cp_reg(cpu, &rvbar);
+         }
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+         ARMCPRegInfo el3_regs[] = {
+             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
+-              .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
++              .access = PL3_R,
++              .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
++            },
+             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
+               .access = PL3_RW,
+--
+.25.1

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 15/21] hw/misc: Add a model of the Xilinx ZynqMP CRF
-The bcm2837 is pretty similar to the bcm2836, but it does have
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
 some differences. Notably, the MPIDR affinity aff1 values it
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
-Rather than trying to have one device with properties that
+Add a model of the Xilinx ZynqMP CRF. At the moment this
-configure it differently for the two cases, create two
+is mostly a stub model.
 separate QOM devices for the two SoCs. We use the same approach
 as hw/arm/aspeed_soc.c and share code and have a data table
 that might differ per-SoC. For the moment the two types don't
 actually have different behaviour.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20220316164645.2303510-4-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+ hw/misc/xlnx-zynqmp-crf.c         | 266 ++++++++++++++++++++++++++++++
- hw/arm/raspi.c           |  3 ++-
+ hw/misc/meson.build               |   1 +
-files changed, 53 insertions(+), 6 deletions(-)
+files changed, 478 insertions(+)
  create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
  create mode 100644 hw/misc/xlnx-zynqmp-crf.c
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX
-+++ b/include/hw/arm/bcm2836.h
+--- /dev/null
 +++ b/include/hw/misc/xlnx-zynqmp-crf.h
 @@ -XXX,XX +XXX,XX @@
++/*
- #define BCM283X_NCPUS 4
++ * QEMU model of the CRF - Clock Reset FPD.
++ *
-+/* These type names are for specific SoCs; other than instantiating
++ * Copyright (c) 2022 Xilinx Inc.
-+ * them, code using these devices should always handle them via the
++ * SPDX-License-Identifier: GPL-2.0-or-later
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
++ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + */
-+#define TYPE_BCM2836 "bcm2836"
++#ifndef HW_MISC_XLNX_ZYNQMP_CRF_H
-+#define TYPE_BCM2837 "bcm2837"
++#define HW_MISC_XLNX_ZYNQMP_CRF_H
 +
- typedef struct BCM283XState {
++#include "hw/sysbus.h"
-     /*< private >*/
++#include "hw/register.h"
-     DeviceState parent_obj;
++
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
++#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"
-     BCM2835PeripheralState peripherals;
++OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPCRF, XLNX_ZYNQMP_CRF)
- } BCM283XState;
++
++REG32(ERR_CTRL, 0x0)
-+typedef struct BCM283XInfo BCM283XInfo;
++    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
-+
++REG32(IR_STATUS, 0x4)
-+typedef struct BCM283XClass {
++    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
-+    DeviceClass parent_class;
++REG32(IR_MASK, 0x8)
-+    const BCM283XInfo *info;
++    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
-+} BCM283XClass;
++REG32(IR_ENABLE, 0xc)
-+
++    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
-+#define BCM283X_CLASS(klass) \
++REG32(IR_DISABLE, 0x10)
-+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
++    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
-+#define BCM283X_GET_CLASS(obj) \
++REG32(CRF_WPROT, 0x1c)
-+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
++    FIELD(CRF_WPROT, ACTIVE, 0, 1)
-+
++REG32(APLL_CTRL, 0x20)
- #endif /* BCM2836_H */
++    FIELD(APLL_CTRL, POST_SRC, 24, 3)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
++    FIELD(APLL_CTRL, PRE_SRC, 20, 3)
-index XXXXXXX..XXXXXXX 100644
++    FIELD(APLL_CTRL, CLKOUTDIV, 17, 1)
---- a/hw/arm/bcm2836.c
++    FIELD(APLL_CTRL, DIV2, 16, 1)
-+++ b/hw/arm/bcm2836.c
++    FIELD(APLL_CTRL, FBDIV, 8, 7)
 +    FIELD(APLL_CTRL, BYPASS, 3, 1)
 +    FIELD(APLL_CTRL, RESET, 0, 1)
 +REG32(APLL_CFG, 0x24)
 +    FIELD(APLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(APLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(APLL_CFG, LFHF, 10, 2)
 +    FIELD(APLL_CFG, CP, 5, 4)
 +    FIELD(APLL_CFG, RES, 0, 4)
 +REG32(APLL_FRAC_CFG, 0x28)
 +    FIELD(APLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(APLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(APLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(APLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(APLL_FRAC_CFG, DATA, 0, 16)
 +REG32(DPLL_CTRL, 0x2c)
 +    FIELD(DPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(DPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(DPLL_CTRL, CLKOUTDIV, 17, 1)
 +    FIELD(DPLL_CTRL, DIV2, 16, 1)
 +    FIELD(DPLL_CTRL, FBDIV, 8, 7)
 +    FIELD(DPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(DPLL_CTRL, RESET, 0, 1)
 +REG32(DPLL_CFG, 0x30)
 +    FIELD(DPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(DPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(DPLL_CFG, LFHF, 10, 2)
 +    FIELD(DPLL_CFG, CP, 5, 4)
 +    FIELD(DPLL_CFG, RES, 0, 4)
 +REG32(DPLL_FRAC_CFG, 0x34)
 +    FIELD(DPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(DPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(DPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(DPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(DPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(VPLL_CTRL, 0x38)
 +    FIELD(VPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(VPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(VPLL_CTRL, CLKOUTDIV, 17, 1)
 +    FIELD(VPLL_CTRL, DIV2, 16, 1)
 +    FIELD(VPLL_CTRL, FBDIV, 8, 7)
 +    FIELD(VPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(VPLL_CTRL, RESET, 0, 1)
 +REG32(VPLL_CFG, 0x3c)
 +    FIELD(VPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(VPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(VPLL_CFG, LFHF, 10, 2)
 +    FIELD(VPLL_CFG, CP, 5, 4)
 +    FIELD(VPLL_CFG, RES, 0, 4)
 +REG32(VPLL_FRAC_CFG, 0x40)
 +    FIELD(VPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(VPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(VPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(VPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(VPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(PLL_STATUS, 0x44)
 +    FIELD(PLL_STATUS, VPLL_STABLE, 5, 1)
 +    FIELD(PLL_STATUS, DPLL_STABLE, 4, 1)
 +    FIELD(PLL_STATUS, APLL_STABLE, 3, 1)
 +    FIELD(PLL_STATUS, VPLL_LOCK, 2, 1)
 +    FIELD(PLL_STATUS, DPLL_LOCK, 1, 1)
 +    FIELD(PLL_STATUS, APLL_LOCK, 0, 1)
 +REG32(APLL_TO_LPD_CTRL, 0x48)
 +    FIELD(APLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(DPLL_TO_LPD_CTRL, 0x4c)
 +    FIELD(DPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(VPLL_TO_LPD_CTRL, 0x50)
 +    FIELD(VPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(ACPU_CTRL, 0x60)
 +    FIELD(ACPU_CTRL, CLKACT_HALF, 25, 1)
 +    FIELD(ACPU_CTRL, CLKACT_FULL, 24, 1)
 +    FIELD(ACPU_CTRL, DIVISOR0, 8, 6)
 +    FIELD(ACPU_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TRACE_CTRL, 0x64)
 +    FIELD(DBG_TRACE_CTRL, CLKACT, 24, 1)
 +    FIELD(DBG_TRACE_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_TRACE_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_FPD_CTRL, 0x68)
 +    FIELD(DBG_FPD_CTRL, CLKACT, 24, 1)
 +    FIELD(DBG_FPD_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_FPD_CTRL, SRCSEL, 0, 3)
 +REG32(DP_VIDEO_REF_CTRL, 0x70)
 +    FIELD(DP_VIDEO_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_VIDEO_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_VIDEO_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_VIDEO_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DP_AUDIO_REF_CTRL, 0x74)
 +    FIELD(DP_AUDIO_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_AUDIO_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_AUDIO_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_AUDIO_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DP_STC_REF_CTRL, 0x7c)
 +    FIELD(DP_STC_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_STC_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_STC_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_STC_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DDR_CTRL, 0x80)
 +    FIELD(DDR_CTRL, CLKACT, 24, 1)
 +    FIELD(DDR_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DDR_CTRL, SRCSEL, 0, 3)
 +REG32(GPU_REF_CTRL, 0x84)
 +    FIELD(GPU_REF_CTRL, PP1_CLKACT, 26, 1)
 +    FIELD(GPU_REF_CTRL, PP0_CLKACT, 25, 1)
 +    FIELD(GPU_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(GPU_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(GPU_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SATA_REF_CTRL, 0xa0)
 +    FIELD(SATA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(SATA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(SATA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(PCIE_REF_CTRL, 0xb4)
 +    FIELD(PCIE_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(PCIE_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(PCIE_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GDMA_REF_CTRL, 0xb8)
 +    FIELD(GDMA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(GDMA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(GDMA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DPDMA_REF_CTRL, 0xbc)
 +    FIELD(DPDMA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DPDMA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DPDMA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(TOPSW_MAIN_CTRL, 0xc0)
 +    FIELD(TOPSW_MAIN_CTRL, CLKACT, 24, 1)
 +    FIELD(TOPSW_MAIN_CTRL, DIVISOR0, 8, 6)
 +    FIELD(TOPSW_MAIN_CTRL, SRCSEL, 0, 3)
 +REG32(TOPSW_LSBUS_CTRL, 0xc4)
 +    FIELD(TOPSW_LSBUS_CTRL, CLKACT, 24, 1)
 +    FIELD(TOPSW_LSBUS_CTRL, DIVISOR0, 8, 6)
 +    FIELD(TOPSW_LSBUS_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TSTMP_CTRL, 0xf8)
 +    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
 +REG32(RST_FPD_TOP, 0x100)
 +    FIELD(RST_FPD_TOP, PCIE_CFG_RESET, 19, 1)
 +    FIELD(RST_FPD_TOP, PCIE_BRIDGE_RESET, 18, 1)
 +    FIELD(RST_FPD_TOP, PCIE_CTRL_RESET, 17, 1)
 +    FIELD(RST_FPD_TOP, DP_RESET, 16, 1)
 +    FIELD(RST_FPD_TOP, SWDT_RESET, 15, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM5_RESET, 12, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM4_RESET, 11, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM3_RESET, 10, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM2_RESET, 9, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM1_RESET, 8, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM0_RESET, 7, 1)
 +    FIELD(RST_FPD_TOP, GDMA_RESET, 6, 1)
 +    FIELD(RST_FPD_TOP, GPU_PP1_RESET, 5, 1)
 +    FIELD(RST_FPD_TOP, GPU_PP0_RESET, 4, 1)
 +    FIELD(RST_FPD_TOP, GPU_RESET, 3, 1)
 +    FIELD(RST_FPD_TOP, GT_RESET, 2, 1)
 +    FIELD(RST_FPD_TOP, SATA_RESET, 1, 1)
 +REG32(RST_FPD_APU, 0x104)
 +    FIELD(RST_FPD_APU, ACPU3_PWRON_RESET, 13, 1)
 +    FIELD(RST_FPD_APU, ACPU2_PWRON_RESET, 12, 1)
 +    FIELD(RST_FPD_APU, ACPU1_PWRON_RESET, 11, 1)
 +    FIELD(RST_FPD_APU, ACPU0_PWRON_RESET, 10, 1)
 +    FIELD(RST_FPD_APU, APU_L2_RESET, 8, 1)
 +    FIELD(RST_FPD_APU, ACPU3_RESET, 3, 1)
 +    FIELD(RST_FPD_APU, ACPU2_RESET, 2, 1)
 +    FIELD(RST_FPD_APU, ACPU1_RESET, 1, 1)
 +    FIELD(RST_FPD_APU, ACPU0_RESET, 0, 1)
 +REG32(RST_DDR_SS, 0x108)
 +    FIELD(RST_DDR_SS, DDR_RESET, 3, 1)
 +    FIELD(RST_DDR_SS, APM_RESET, 2, 1)
 +
 +#define CRF_R_MAX (R_RST_DDR_SS + 1)
 +
 +struct XlnxZynqMPCRF {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +    qemu_irq irq_ir;
 +
 +    RegisterInfoArray *reg_array;
 +    uint32_t regs[CRF_R_MAX];
 +    RegisterInfo regs_info[CRF_R_MAX];
 +};
 +
 +#endif
 diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/xlnx-zynqmp-crf.c
 @@ -XXX,XX +XXX,XX @@
- /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
++/*
- #define BCM2836_CONTROL_BASE    0x40000000
++ * QEMU model of the CRF - Clock Reset FPD.
++ *
-+struct BCM283XInfo {
++ * Copyright (c) 2022 Xilinx Inc.
-+    const char *name;
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/sysbus.h"
 +#include "hw/register.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "migration/vmstate.h"
 +#include "hw/irq.h"
 +#include "hw/misc/xlnx-zynqmp-crf.h"
 +#include "target/arm/arm-powerctl.h"
 +
 +#ifndef XLNX_ZYNQMP_CRF_ERR_DEBUG
 +#define XLNX_ZYNQMP_CRF_ERR_DEBUG 0
 +#endif
 +
 +#define CRF_MAX_CPU    4
 +
 +static void ir_update_irq(XlnxZynqMPCRF *s)
 +{
 +    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
 +    qemu_set_irq(s->irq_ir, pending);
 +}
 +
 +static void ir_status_postw(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    ir_update_irq(s);
 +}
 +
 +static uint64_t ir_enable_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_IR_MASK] &= ~val;
 +    ir_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t ir_disable_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_IR_MASK] |= val;
 +    ir_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t rst_fpd_apu_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +    uint32_t val_old = s->regs[R_RST_FPD_APU];
 +    unsigned int i;
 +
 +    for (i = 0; i < CRF_MAX_CPU; i++) {
 +        uint32_t mask = (1 << (R_RST_FPD_APU_ACPU0_RESET_SHIFT + i));
 +
 +        if ((val ^ val_old) & mask) {
 +            if (val & mask) {
 +                arm_set_cpu_off(i);
 +            } else {
 +                arm_set_cpu_on_and_reset(i);
 +            }
 +        }
 +    }
 +    return val64;
 +}
 +
 +static const RegisterAccessInfo crf_regs_info[] = {
 +    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
 +    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
 +        .w1c = 0x1,
 +        .post_write = ir_status_postw,
 +    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
 +        .reset = 0x1,
 +        .ro = 0x1,
 +    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
 +        .pre_write = ir_enable_prew,
 +    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
 +        .pre_write = ir_disable_prew,
 +    },{ .name = "CRF_WPROT",  .addr = A_CRF_WPROT,
 +    },{ .name = "APLL_CTRL",  .addr = A_APLL_CTRL,
 +        .reset = 0x12c09,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "APLL_CFG",  .addr = A_APLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "APLL_FRAC_CFG",  .addr = A_APLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "DPLL_CTRL",  .addr = A_DPLL_CTRL,
 +        .reset = 0x2c09,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "DPLL_CFG",  .addr = A_DPLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "DPLL_FRAC_CFG",  .addr = A_DPLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "VPLL_CTRL",  .addr = A_VPLL_CTRL,
 +        .reset = 0x12809,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "VPLL_CFG",  .addr = A_VPLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "VPLL_FRAC_CFG",  .addr = A_VPLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
 +        .reset = 0x3f,
 +        .rsvd = 0xc0,
 +        .ro = 0x3f,
 +    },{ .name = "APLL_TO_LPD_CTRL",  .addr = A_APLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "DPLL_TO_LPD_CTRL",  .addr = A_DPLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "VPLL_TO_LPD_CTRL",  .addr = A_VPLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "ACPU_CTRL",  .addr = A_ACPU_CTRL,
 +        .reset = 0x3000400,
 +        .rsvd = 0xfcffc0f8,
 +    },{ .name = "DBG_TRACE_CTRL",  .addr = A_DBG_TRACE_CTRL,
 +        .reset = 0x2500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DBG_FPD_CTRL",  .addr = A_DBG_FPD_CTRL,
 +        .reset = 0x1002500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DP_VIDEO_REF_CTRL",  .addr = A_DP_VIDEO_REF_CTRL,
 +        .reset = 0x1002300,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DP_AUDIO_REF_CTRL",  .addr = A_DP_AUDIO_REF_CTRL,
 +        .reset = 0x1032300,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DP_STC_REF_CTRL",  .addr = A_DP_STC_REF_CTRL,
 +        .reset = 0x1203200,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DDR_CTRL",  .addr = A_DDR_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "GPU_REF_CTRL",  .addr = A_GPU_REF_CTRL,
 +        .reset = 0x1500,
 +        .rsvd = 0xf8ffc0f8,
 +    },{ .name = "SATA_REF_CTRL",  .addr = A_SATA_REF_CTRL,
 +        .reset = 0x1001600,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "PCIE_REF_CTRL",  .addr = A_PCIE_REF_CTRL,
 +        .reset = 0x1500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "GDMA_REF_CTRL",  .addr = A_GDMA_REF_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DPDMA_REF_CTRL",  .addr = A_DPDMA_REF_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "TOPSW_MAIN_CTRL",  .addr = A_TOPSW_MAIN_CTRL,
 +        .reset = 0x1000400,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "TOPSW_LSBUS_CTRL",  .addr = A_TOPSW_LSBUS_CTRL,
 +        .reset = 0x1000800,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
 +        .reset = 0xa00,
 +        .rsvd = 0xffffc0f8,
 +    },
 +    {   .name = "RST_FPD_TOP",  .addr = A_RST_FPD_TOP,
 +        .reset = 0xf9ffe,
 +        .rsvd = 0xf06001,
 +    },{ .name = "RST_FPD_APU",  .addr = A_RST_FPD_APU,
 +        .reset = 0x3d0f,
 +        .rsvd = 0xc2f0,
 +        .pre_write = rst_fpd_apu_prew,
 +    },{ .name = "RST_DDR_SS",  .addr = A_RST_DDR_SS,
 +        .reset = 0xf,
 +        .rsvd = 0xf3,
 +    }
 +};
 +
-+static const BCM283XInfo bcm283x_socs[] = {
++static void crf_reset_enter(Object *obj, ResetType type)
-+    {
++{
-+        .name = TYPE_BCM2836,
++    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
-+    },
++    unsigned int i;
-+    {
++
-+        .name = TYPE_BCM2837,
++    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 +        register_reset(&s->regs_info[i]);
 +    }
 +}
 +
 +static void crf_reset_hold(Object *obj)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
 +    ir_update_irq(s);
 +}
 +
 +static const MemoryRegionOps crf_ops = {
 +    .read = register_read_memory,
 +    .write = register_write_memory,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
- static void bcm2836_init(Object *obj)
++static void crf_init(Object *obj)
- {
++{
-     BCM283XState *s = BCM283X(obj);
++    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
-@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-     DEFINE_PROP_END_OF_LIST()
++
- };
++    s->reg_array =
++        register_init_block32(DEVICE(obj), crf_regs_info,
--static void bcm2836_class_init(ObjectClass *oc, void *data)
++                              ARRAY_SIZE(crf_regs_info),
-+static void bcm283x_class_init(ObjectClass *oc, void *data)
++                              s->regs_info, s->regs,
- {
++                              &crf_ops,
-     DeviceClass *dc = DEVICE_CLASS(oc);
++                              XLNX_ZYNQMP_CRF_ERR_DEBUG,
-+    BCM283XClass *bc = BCM283X_CLASS(oc);
++                              CRF_R_MAX * 4);
++    sysbus_init_mmio(sbd, &s->reg_array->mem);
--    dc->props = bcm2836_props;
++    sysbus_init_irq(sbd, &s->irq_ir);
-+    bc->info = data;
++}
-     dc->realize = bcm2836_realize;
++
-+    dc->props = bcm2836_props;
++static void crf_finalize(Object *obj)
- }
++{
++    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
--static const TypeInfo bcm2836_type_info = {
++    register_finalize_block(s->reg_array);
-+static const TypeInfo bcm283x_type_info = {
++}
-     .name = TYPE_BCM283X,
++
-     .parent = TYPE_DEVICE,
++static const VMStateDescription vmstate_crf = {
-     .instance_size = sizeof(BCM283XState),
++    .name = TYPE_XLNX_ZYNQMP_CRF,
-     .instance_init = bcm2836_init,
++    .version_id = 1,
--    .class_init = bcm2836_class_init,
++    .minimum_version_id = 1,
-+    .class_size = sizeof(BCM283XClass),
++    .fields = (VMStateField[]) {
-+    .abstract = true,
++        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCRF, CRF_R_MAX),
- };
++        VMSTATE_END_OF_LIST(),
  static void bcm2836_register_types(void)
  {
 -    type_register_static(&bcm2836_type_info);
 +    int i;
 +
 +    type_register_static(&bcm283x_type_info);
 +    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
 +        TypeInfo ti = {
 +            .name = bcm283x_socs[i].name,
 +            .parent = TYPE_BCM283X,
 +            .class_init = bcm283x_class_init,
 +            .class_data = (void *) &bcm283x_socs[i],
 +        };
 +        type_register(&ti);
 +    }
- }
++};
++
- type_init(bcm2836_register_types)
++static void crf_class_init(ObjectClass *klass, void *data)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
++{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_crf;
 +    rc->phases.enter = crf_reset_enter;
 +    rc->phases.hold = crf_reset_hold;
 +}
 +
 +static const TypeInfo crf_info = {
 +    .name              = TYPE_XLNX_ZYNQMP_CRF,
 +    .parent            = TYPE_SYS_BUS_DEVICE,
 +    .instance_size     = sizeof(XlnxZynqMPCRF),
 +    .class_init        = crf_class_init,
 +    .instance_init     = crf_init,
 +    .instance_finalize = crf_finalize,
 +};
 +
 +static void crf_register_types(void)
 +{
 +    type_register_static(&crf_info);
 +}
 +
 +type_init(crf_register_types)
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/hw/misc/meson.build
-+++ b/hw/arm/raspi.c
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
-     BusState *bus;
+ ))
-     DeviceState *carddev;
+ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+ softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
--    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
++specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
-+    object_initialize(&s->soc, sizeof(s->soc),
+ softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
-+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
+   'xlnx-versal-xramc.c',
-     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
+   'xlnx-versal-pmc-iou-slcr.c',
                                &error_abort);
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+[PULL 16/21] hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
-From: Wei Huang <wei@redhat.com>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-For guest kernel that supports KASLR, the load address can change every
+Connect the ZynqMP CRF - Clock Reset FPD device.
 time when guest VM runs. To find the physical base address correctly,
 current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
 However this string pattern is only available on x86_64. AArch64 uses a
 different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
 QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20220316164645.2303510-5-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- dump.c | 14 +++++++++++---
+ include/hw/arm/xlnx-zynqmp.h |  2 ++
-file changed, 11 insertions(+), 3 deletions(-)
+ hw/arm/xlnx-zynqmp.c         | 16 ++++++++++++++++
 files changed, 18 insertions(+)
-diff --git a/dump.c b/dump.c
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/dump.c
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/dump.c
++++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/nvram/xlnx-bbram.h"
-     lines = g_strsplit((char *)vmci, "\n", -1);
+ #include "hw/nvram/xlnx-zynqmp-efuse.h"
-     for (i = 0; lines[i]; i++) {
+ #include "hw/or-irq.h"
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
++#include "hw/misc/xlnx-zynqmp-crf.h"
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
-+        const char *prefix = NULL;
+ #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
  OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
      XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
      XlnxCSUDMA qspi_dma;
      qemu_or_irq qspi_irq_orgate;
 +    XlnxZynqMPCRF crf;
      char *boot_cpu;
      ARMCPU *boot_cpu_ptr;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
  #define QSPI_DMA_ADDR       0xff0f0800
  #define NUM_QSPI_IRQ_LINES  2
 +#define CRF_ADDR            0xfd1a0000
 +#define CRF_IRQ             120
 +
-+        if (s->dump_info.d_machine == EM_X86_64) {
+ /* Serializer/Deserializer.  */
-+            prefix = "NUMBER(phys_base)=";
+ #define SERDES_ADDR         0xfd400000
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+ #define SERDES_SIZE         0x20000
-+            prefix = "NUMBER(PHYS_OFFSET)=";
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
-+        }
+     sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
  }
 +static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
 +{
 +    SysBusDevice *sbd;
 +
-+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
++    object_initialize_child(OBJECT(s), "crf", &s->crf, TYPE_XLNX_ZYNQMP_CRF);
-+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
++    sbd = SYS_BUS_DEVICE(&s->crf);
-                               &phys_base) < 0) {
++
--                warn_report("Failed to read NUMBER(phys_base)=");
++    sysbus_realize(sbd, &error_fatal);
-+                warn_report("Failed to read %s", prefix);
++    sysbus_mmio_map(sbd, 0, CRF_ADDR);
-             } else {
++    sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
-                 s->dump_info.phys_base = phys_base;
++}
-             }
++
  static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
  {
      static const struct UnimpInfo {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      xlnx_zynqmp_create_bbram(s, gic_spi);
      xlnx_zynqmp_create_efuse(s, gic_spi);
 +    xlnx_zynqmp_create_crf(s, gic_spi);
      xlnx_zynqmp_create_unimp_mmio(s);
      for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
 --
-.16.2
+.25.1

-New patch
+[PULL 17/21] hw/misc: Add a model of the Xilinx ZynqMP APU Control
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Add a model of the Xilinx ZynqMP APU Control.
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20220316164645.2303510-6-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 +++++++++
+ hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++
+ hw/misc/meson.build                    |   1 +
+files changed, 347 insertions(+)
+ create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+ create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
+diff --git a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QEMU model of ZynqMP APU Control.
++ *
++ * Copyright (c) 2013-2022 Xilinx Inc
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
++ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ *
++ */
++#ifndef HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
++#define HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
++
++#include "hw/sysbus.h"
++#include "hw/register.h"
++#include "target/arm/cpu.h"
++
++#define TYPE_XLNX_ZYNQMP_APU_CTRL "xlnx.apu-ctrl"
++OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPAPUCtrl, XLNX_ZYNQMP_APU_CTRL)
++
++REG32(APU_ERR_CTRL, 0x0)
++    FIELD(APU_ERR_CTRL, PSLVERR, 0, 1)
++REG32(ISR, 0x10)
++    FIELD(ISR, INV_APB, 0, 1)
++REG32(IMR, 0x14)
++    FIELD(IMR, INV_APB, 0, 1)
++REG32(IEN, 0x18)
++    FIELD(IEN, INV_APB, 0, 1)
++REG32(IDS, 0x1c)
++    FIELD(IDS, INV_APB, 0, 1)
++REG32(CONFIG_0, 0x20)
++    FIELD(CONFIG_0, CFGTE, 24, 4)
++    FIELD(CONFIG_0, CFGEND, 16, 4)
++    FIELD(CONFIG_0, VINITHI, 8, 4)
++    FIELD(CONFIG_0, AA64NAA32, 0, 4)
++REG32(CONFIG_1, 0x24)
++    FIELD(CONFIG_1, L2RSTDISABLE, 29, 1)
++    FIELD(CONFIG_1, L1RSTDISABLE, 28, 1)
++    FIELD(CONFIG_1, CP15DISABLE, 0, 4)
++REG32(RVBARADDR0L, 0x40)
++    FIELD(RVBARADDR0L, ADDR, 2, 30)
++REG32(RVBARADDR0H, 0x44)
++    FIELD(RVBARADDR0H, ADDR, 0, 8)
++REG32(RVBARADDR1L, 0x48)
++    FIELD(RVBARADDR1L, ADDR, 2, 30)
++REG32(RVBARADDR1H, 0x4c)
++    FIELD(RVBARADDR1H, ADDR, 0, 8)
++REG32(RVBARADDR2L, 0x50)
++    FIELD(RVBARADDR2L, ADDR, 2, 30)
++REG32(RVBARADDR2H, 0x54)
++    FIELD(RVBARADDR2H, ADDR, 0, 8)
++REG32(RVBARADDR3L, 0x58)
++    FIELD(RVBARADDR3L, ADDR, 2, 30)
++REG32(RVBARADDR3H, 0x5c)
++    FIELD(RVBARADDR3H, ADDR, 0, 8)
++REG32(ACE_CTRL, 0x60)
++    FIELD(ACE_CTRL, AWQOS, 16, 4)
++    FIELD(ACE_CTRL, ARQOS, 0, 4)
++REG32(SNOOP_CTRL, 0x80)
++    FIELD(SNOOP_CTRL, ACE_INACT, 4, 1)
++    FIELD(SNOOP_CTRL, ACP_INACT, 0, 1)
++REG32(PWRCTL, 0x90)
++    FIELD(PWRCTL, CLREXMONREQ, 17, 1)
++    FIELD(PWRCTL, L2FLUSHREQ, 16, 1)
++    FIELD(PWRCTL, CPUPWRDWNREQ, 0, 4)
++REG32(PWRSTAT, 0x94)
++    FIELD(PWRSTAT, CLREXMONACK, 17, 1)
++    FIELD(PWRSTAT, L2FLUSHDONE, 16, 1)
++    FIELD(PWRSTAT, DBGNOPWRDWN, 0, 4)
++
++#define APU_R_MAX ((R_PWRSTAT) + 1)
++
++#define APU_MAX_CPU    4
++
++struct XlnxZynqMPAPUCtrl {
++    SysBusDevice busdev;
++
++    ARMCPU *cpus[APU_MAX_CPU];
++    /* WFIs towards PMU. */
++    qemu_irq wfi_out[4];
++    /* CPU Power status towards INTC Redirect. */
++    qemu_irq cpu_power_status[4];
++    qemu_irq irq_imr;
++
++    uint8_t cpu_pwrdwn_req;
++    uint8_t cpu_in_wfi;
++
++    RegisterInfoArray *reg_array;
++    uint32_t regs[APU_R_MAX];
++    RegisterInfo regs_info[APU_R_MAX];
++};
++
++#endif
+diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QEMU model of the ZynqMP APU Control.
++ *
++ * Copyright (c) 2013-2022 Xilinx Inc
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
++ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/error.h"
++#include "qemu/log.h"
++#include "migration/vmstate.h"
++#include "hw/qdev-properties.h"
++#include "hw/sysbus.h"
++#include "hw/irq.h"
++#include "hw/register.h"
++
++#include "qemu/bitops.h"
++#include "qapi/qmp/qerror.h"
++
++#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
++
++#ifndef XILINX_ZYNQMP_APU_ERR_DEBUG
++#define XILINX_ZYNQMP_APU_ERR_DEBUG 0
++#endif
++
++static void update_wfi_out(void *opaque)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
++    unsigned int i, wfi_pending;
++
++    wfi_pending = s->cpu_pwrdwn_req & s->cpu_in_wfi;
++    for (i = 0; i < APU_MAX_CPU; i++) {
++        qemu_set_irq(s->wfi_out[i], !!(wfi_pending & (1 << i)));
++    }
++}
++
++static void zynqmp_apu_rvbar_post_write(RegisterInfo *reg, uint64_t val)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    int i;
++
++    for (i = 0; i < APU_MAX_CPU; ++i) {
++        uint64_t rvbar = s->regs[R_RVBARADDR0L + 2 * i] +
++                         ((uint64_t)s->regs[R_RVBARADDR0H + 2 * i] << 32);
++        if (s->cpus[i]) {
++            object_property_set_int(OBJECT(s->cpus[i]), "rvbar", rvbar,
++                                    &error_abort);
++        }
++    }
++}
++
++static void zynqmp_apu_pwrctl_post_write(RegisterInfo *reg, uint64_t val)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    unsigned int i, new;
++
++    for (i = 0; i < APU_MAX_CPU; i++) {
++        new = val & (1 << i);
++        /* Check if CPU's CPUPWRDNREQ has changed. If yes, update GPIOs. */
++        if (new != (s->cpu_pwrdwn_req & (1 << i))) {
++            qemu_set_irq(s->cpu_power_status[i], !!new);
++        }
++        s->cpu_pwrdwn_req &= ~(1 << i);
++        s->cpu_pwrdwn_req |= new;
++    }
++    update_wfi_out(s);
++}
++
++static void imr_update_irq(XlnxZynqMPAPUCtrl *s)
++{
++    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
++    qemu_set_irq(s->irq_imr, pending);
++}
++
++static void isr_postw(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    imr_update_irq(s);
++}
++
++static uint64_t ien_prew(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    uint32_t val = val64;
++
++    s->regs[R_IMR] &= ~val;
++    imr_update_irq(s);
++    return 0;
++}
++
++static uint64_t ids_prew(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    uint32_t val = val64;
++
++    s->regs[R_IMR] |= val;
++    imr_update_irq(s);
++    return 0;
++}
++
++static const RegisterAccessInfo zynqmp_apu_regs_info[] = {
++#define RVBAR_REGDEF(n) \
++    {   .name = "RVBAR CPU " #n " Low",  .addr = A_RVBARADDR ## n ## L,    \
++            .reset = 0xffff0000ul,                                         \
++            .post_write = zynqmp_apu_rvbar_post_write,                     \
++    },{ .name = "RVBAR CPU " #n " High", .addr = A_RVBARADDR ## n ## H,    \
++            .post_write = zynqmp_apu_rvbar_post_write,                     \
++    }
++    {   .name = "ERR_CTRL",  .addr = A_APU_ERR_CTRL,
++    },{ .name = "ISR",  .addr = A_ISR,
++        .w1c = 0x1,
++        .post_write = isr_postw,
++    },{ .name = "IMR",  .addr = A_IMR,
++        .reset = 0x1,
++        .ro = 0x1,
++    },{ .name = "IEN",  .addr = A_IEN,
++        .pre_write = ien_prew,
++    },{ .name = "IDS",  .addr = A_IDS,
++        .pre_write = ids_prew,
++    },{ .name = "CONFIG_0",  .addr = A_CONFIG_0,
++        .reset = 0xf0f,
++    },{ .name = "CONFIG_1",  .addr = A_CONFIG_1,
++    },
++    RVBAR_REGDEF(0),
++    RVBAR_REGDEF(1),
++    RVBAR_REGDEF(2),
++    RVBAR_REGDEF(3),
++    { .name = "ACE_CTRL",  .addr = A_ACE_CTRL,
++        .reset = 0xf000f,
++    },{ .name = "SNOOP_CTRL",  .addr = A_SNOOP_CTRL,
++    },{ .name = "PWRCTL",  .addr = A_PWRCTL,
++        .post_write = zynqmp_apu_pwrctl_post_write,
++    },{ .name = "PWRSTAT",  .addr = A_PWRSTAT,
++        .ro = 0x3000f,
++    }
++};
++
++static void zynqmp_apu_reset_enter(Object *obj, ResetType type)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    int i;
++
++    for (i = 0; i < APU_R_MAX; ++i) {
++        register_reset(&s->regs_info[i]);
++    }
++
++    s->cpu_pwrdwn_req = 0;
++    s->cpu_in_wfi = 0;
++}
++
++static void zynqmp_apu_reset_hold(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++
++    update_wfi_out(s);
++    imr_update_irq(s);
++}
++
++static const MemoryRegionOps zynqmp_apu_ops = {
++    .read = register_read_memory,
++    .write = register_write_memory,
++    .endianness = DEVICE_LITTLE_ENDIAN,
++    .valid = {
++        .min_access_size = 4,
++        .max_access_size = 4,
++    }
++};
++
++static void zynqmp_apu_handle_wfi(void *opaque, int irq, int level)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
++
++    s->cpu_in_wfi = deposit32(s->cpu_in_wfi, irq, 1, level);
++    update_wfi_out(s);
++}
++
++static void zynqmp_apu_init(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    int i;
++
++    s->reg_array =
++        register_init_block32(DEVICE(obj), zynqmp_apu_regs_info,
++                              ARRAY_SIZE(zynqmp_apu_regs_info),
++                              s->regs_info, s->regs,
++                              &zynqmp_apu_ops,
++                              XILINX_ZYNQMP_APU_ERR_DEBUG,
++                              APU_R_MAX * 4);
++    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->reg_array->mem);
++    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq_imr);
++
++    for (i = 0; i < APU_MAX_CPU; ++i) {
++        g_autofree gchar *prop_name = g_strdup_printf("cpu%d", i);
++        object_property_add_link(obj, prop_name, TYPE_ARM_CPU,
++                                 (Object **)&s->cpus[i],
++                                 qdev_prop_allow_set_link_before_realize,
++                                 OBJ_PROP_LINK_STRONG);
++    }
++
++    /* wfi_out is used to connect to PMU GPIs. */
++    qdev_init_gpio_out_named(DEVICE(obj), s->wfi_out, "wfi_out", 4);
++    /* CPU_POWER_STATUS is used to connect to INTC redirect. */
++    qdev_init_gpio_out_named(DEVICE(obj), s->cpu_power_status,
++                             "CPU_POWER_STATUS", 4);
++    /* wfi_in is used as input from CPUs as wfi request. */
++    qdev_init_gpio_in_named(DEVICE(obj), zynqmp_apu_handle_wfi, "wfi_in", 4);
++}
++
++static void zynqmp_apu_finalize(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    register_finalize_block(s->reg_array);
++}
++
++static const VMStateDescription vmstate_zynqmp_apu = {
++    .name = TYPE_XLNX_ZYNQMP_APU_CTRL,
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .fields = (VMStateField[]) {
++        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPAPUCtrl, APU_R_MAX),
++        VMSTATE_END_OF_LIST(),
++    }
++};
++
++static void zynqmp_apu_class_init(ObjectClass *klass, void *data)
++{
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
++    DeviceClass *dc = DEVICE_CLASS(klass);
++
++    dc->vmsd = &vmstate_zynqmp_apu;
++
++    rc->phases.enter = zynqmp_apu_reset_enter;
++    rc->phases.hold = zynqmp_apu_reset_hold;
++}
++
++static const TypeInfo zynqmp_apu_info = {
++    .name              = TYPE_XLNX_ZYNQMP_APU_CTRL,
++    .parent            = TYPE_SYS_BUS_DEVICE,
++    .instance_size     = sizeof(XlnxZynqMPAPUCtrl),
++    .class_init        = zynqmp_apu_class_init,
++    .instance_init     = zynqmp_apu_init,
++    .instance_finalize = zynqmp_apu_finalize,
++};
++
++static void zynqmp_apu_register_types(void)
++{
++    type_register_static(&zynqmp_apu_info);
++}
++
++type_init(zynqmp_apu_register_types)
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/meson.build
++++ b/hw/misc/meson.build
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
+ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+ softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
+ specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
++specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
+ softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
+   'xlnx-versal-xramc.c',
+   'xlnx-versal-pmc-iou-slcr.c',
+--
+.25.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 18/21] hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control
-The raspi3 has AArch64 CPUs, which means that our smpboot
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
 code for keeping the secondary CPUs in a pen needs to have
 a version for A64 as well as A32. Without this, the
 secondary CPUs go into an infinite loop of taking undefined
 instruction exceptions.
+Connect the ZynqMP APU Control device.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20220316164645.2303510-7-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ include/hw/arm/xlnx-zynqmp.h |  4 +++-
-file changed, 40 insertions(+), 1 deletion(-)
+ hw/arm/xlnx-zynqmp.c         | 25 +++++++++++++++++++++++--
 files changed, 26 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/hw/arm/raspi.c
++++ b/include/hw/arm/xlnx-zynqmp.h
 @@ -XXX,XX +XXX,XX @@
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+ #include "hw/nvram/xlnx-bbram.h"
- #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
+ #include "hw/nvram/xlnx-zynqmp-efuse.h"
- #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+ #include "hw/or-irq.h"
-+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
++#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
+ #include "hw/misc/xlnx-zynqmp-crf.h"
- /* Table of Linux board IDs for different Pi versions */
- static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
+ #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
-@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
-                        info->smp_loader_start);
+ /*
   * Unimplemented mmio regions needed to boot some images.
   */
 -#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
 +#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
  struct XlnxZynqMPState {
      /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
      XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
      XlnxCSUDMA qspi_dma;
      qemu_or_irq qspi_irq_orgate;
 +    XlnxZynqMPAPUCtrl apu_ctrl;
      XlnxZynqMPCRF crf;
      char *boot_cpu;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
  #define DPDMA_IRQ           116
  #define APU_ADDR            0xfd5c0000
 -#define APU_SIZE            0x100
 +#define APU_IRQ             153
  #define IPI_ADDR            0xFF300000
  #define IPI_IRQ             64
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
      sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
++static void xlnx_zynqmp_create_apu_ctrl(XlnxZynqMPState *s, qemu_irq *gic)
 +{
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
++    SysBusDevice *sbd;
-+     * The mechanism for doing the spin-table is also entirely different.
++    int i;
 +     * We must have four 64-bit fields at absolute addresses
 +     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
 +     * our CPUs, and which we must ensure are zero initialized before
 +     * the primary CPU goes into the kernel. We put these variables inside
 +     * a rom blob, so that the reset for ROM contents zeroes them for us.
 +     */
 +    static const uint32_t smpboot[] = {
 +        0xd2801b05, /*        mov     x5, 0xd8 */
 +        0xd53800a6, /*        mrs     x6, mpidr_el1 */
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
-+    static const uint64_t spintables[] = {
++    object_initialize_child(OBJECT(s), "apu-ctrl", &s->apu_ctrl,
-+        0, 0, 0, 0
++                            TYPE_XLNX_ZYNQMP_APU_CTRL);
-+    };
++    sbd = SYS_BUS_DEVICE(&s->apu_ctrl);
 +
-+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
++    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
-+                       info->smp_loader_start);
++        g_autofree gchar *name = g_strdup_printf("cpu%d", i);
-+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
++
-+                       SPINTABLE_ADDR);
++        object_property_set_link(OBJECT(&s->apu_ctrl), name,
 +                                 OBJECT(&s->apu_cpu[i]), &error_abort);
 +    }
 +
 +    sysbus_realize(sbd, &error_fatal);
 +    sysbus_mmio_map(sbd, 0, APU_ADDR);
 +    sysbus_connect_irq(sbd, 0, gic[APU_IRQ]);
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
+ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
  {
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
+     SysBusDevice *sbd;
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
-     /* Pi2 and Pi3 requires SMP setup */
+         hwaddr base;
-     if (version >= 2) {
+         hwaddr size;
-         binfo.smp_loader_start = SMPBOOT_ADDR;
+     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
--        binfo.write_secondary_boot = write_smpboot;
+-        { .name = "apu", APU_ADDR, APU_SIZE },
-+        if (version == 2) {
+         { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
-+            binfo.write_secondary_boot = write_smpboot;
+     };
-+        } else {
+     unsigned int nr;
-+            binfo.write_secondary_boot = write_smpboot64;
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-+        }
-         binfo.secondary_cpu_reset_hook = reset_secondary;
+     xlnx_zynqmp_create_bbram(s, gic_spi);
-     }
+     xlnx_zynqmp_create_efuse(s, gic_spi);
 +    xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
      xlnx_zynqmp_create_crf(s, gic_spi);
      xlnx_zynqmp_create_unimp_mmio(s);
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 19/21] util/osdep: Avoid madvise proto on modern Solaris
-From: Guenter Roeck <linux@roeck-us.net>
+From: Andrew Deason <adeason@sinenomine.net>
-The sabrelite machine model used by qemu-system-arm is based on the
+On older Solaris releases (before Solaris 11), we didn't get a
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+prototype for madvise, and so util/osdep.c provides its own prototype.
-controller which is supported in QEMU using the imx_fec.c module
+Some time between the public Solaris 11.4 release and Solaris 11.4.42
-(actually called imx.enet for this model.)
+CBE, we started getting an madvise prototype that looks like this:
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
+    extern int madvise(void *, size_t, int);
 imx.enet device like this:
- #define FSL_IMX6_ENET_MAC_1588_IRQ 118
+which conflicts with the prototype in util/osdeps.c. Instead of always
- #define FSL_IMX6_ENET_MAC_IRQ 119
+declaring this prototype, check if we're missing the madvise()
 prototype, and only declare it ourselves if the prototype is missing.
 Move the prototype to include/qemu/osdep.h, the normal place to handle
 platform-specific header quirks.
-According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
+The 'missing_madvise_proto' meson check contains an obviously wrong
-page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
+prototype for madvise. So if that code compiles and links, we must be
-interrupts are as follows.
+missing the actual prototype for madvise.
-ENET MAC 0 IRQ
+Signed-off-by: Andrew Deason <adeason@sinenomine.net>
-ENET MAC 0 1588 Timer interrupt
+Message-id: 20220316035227.3702-2-adeason@sinenomine.net
 where
 - 32 == 118
 - 32 == 119
 In other words, the vector definitions in the fsl-imx6.h file are reversed.
 Fixing the interrupts alone causes problems with older Linux kernels:
 The Ethernet interface will fail to probe with Linux v4.9 and earlier.
 Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
 error handling. This is a Linux kernel problem, not a qemu problem:
 the Linux kernel only worked by accident since it requested both interrupts.
 For backward compatibility, generate the Ethernet interrupt on both interrupt
 lines. This was shown to work from all Linux kernel releases starting with
 v3.16.
 Link: https://bugs.launchpad.net/qemu/+bug/1753309
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ meson.build          | 23 +++++++++++++++++++++--
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+ include/qemu/osdep.h |  8 ++++++++
-files changed, 29 insertions(+), 3 deletions(-)
+ util/osdep.c         |  3 ---
 files changed, 29 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/meson.build
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+   #error Not supported
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+   #endif
- #define FSL_IMX6_MLB150_LOW_IRQ 117
+   }'''))
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
+-config_host_data.set('CONFIG_MADVISE', cc.links(gnu_source_prefix + '''
--#define FSL_IMX6_ENET_MAC_IRQ 119
++
-+#define FSL_IMX6_ENET_MAC_IRQ 118
++has_madvise = cc.links(gnu_source_prefix + '''
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
+   #include <sys/types.h>
- #define FSL_IMX6_PCIE1_IRQ 120
+   #include <sys/mman.h>
- #define FSL_IMX6_PCIE2_IRQ 121
+   #include <stddef.h>
- #define FSL_IMX6_PCIE3_IRQ 122
+-  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }'''))
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
++  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }''')
 +missing_madvise_proto = false
 +if has_madvise
 +  # Some platforms (illumos and Solaris before Solaris 11) provide madvise()
 +  # but forget to prototype it. In this case, has_madvise will be true (the
 +  # test program links despite a compile warning). To detect the
 +  # missing-prototype case, we try again with a definitely-bogus prototype.
 +  # This will only compile if the system headers don't provide the prototype;
 +  # otherwise the conflicting prototypes will cause a compiler error.
 +  missing_madvise_proto = cc.links(gnu_source_prefix + '''
 +    #include <sys/types.h>
 +    #include <sys/mman.h>
 +    #include <stddef.h>
 +    extern int madvise(int);
 +    int main(void) { return madvise(0); }''')
 +endif
 +config_host_data.set('CONFIG_MADVISE', has_madvise)
 +config_host_data.set('HAVE_MADVISE_WITHOUT_PROTOTYPE', missing_madvise_proto)
 +
  config_host_data.set('CONFIG_MEMFD', cc.links(gnu_source_prefix + '''
    #include <sys/mman.h>
    int main(void) { return memfd_create("foo", MFD_ALLOW_SEALING); }'''))
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/include/qemu/osdep.h
-+++ b/hw/net/imx_fec.c
++++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
+@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
+ #define SIGIO SIGPOLL
- static void imx_eth_update(IMXFECState *s)
+ #endif
- {
--    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
++#ifdef HAVE_MADVISE_WITHOUT_PROTOTYPE
-+    /*
++/*
-+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
++ * See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for discussion
-+     * interrupts swapped. This worked with older versions of Linux (4.14
++ * about Solaris missing the madvise() prototype.
-+     * and older) since Linux associated both interrupt lines with Ethernet
++ */
-+     * MAC interrupts. Specifically,
++extern int madvise(char *, size_t, int);
-+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
++#endif
-+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
++
-+     *   with swapped interrupt assignments.
+ #if defined(CONFIG_LINUX)
-+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+ #ifndef BUS_MCEERR_AR
-+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+ #define BUS_MCEERR_AR 4
-+     *   work, though that is accidental.
+diff --git a/util/osdep.c b/util/osdep.c
-+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+index XXXXXXX..XXXXXXX 100644
-+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+--- a/util/osdep.c
-+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
++++ b/util/osdep.c
-+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+@@ -XXX,XX +XXX,XX @@
-+     *   interrupt never fired since IOMUX is currently not supported in qemu.
-+     *   Linux instead received MAC interrupts on the timer interrupt.
+ #ifdef CONFIG_SOLARIS
-+     *   As a result, qemu versions with the swapped interrupt assignment work,
+ #include <sys/statvfs.h>
-+     *   albeit accidentally, but qemu versions with the correct interrupt
+-/* See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for
-+     *   assignment fail.
+-   discussion about Solaris header problems */
-+     *
+-extern int madvise(char *, size_t, int);
-+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+ #endif
-+     * interrrupts on both interrupt lines. This should be changed if and when
-+     * qemu supports IOMUX.
+ #include "qemu-common.h"
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.25.1

-New patch
+[PULL 20/21] hw/i386/acpi-build: Avoid 'sun' identifier
+From: Andrew Deason <adeason@sinenomine.net>
+On Solaris, 'sun' is #define'd to 1, which causes errors if a variable
+is named 'sun'. Slightly change the name of the var for the Slot User
+Number so we can build on Solaris.
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+Signed-off-by: Andrew Deason <adeason@sinenomine.net>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Message-id: 20220316035227.3702-3-adeason@sinenomine.net
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/i386/acpi-build.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
+     Aml *bnum = aml_arg(4);
+     Aml *func = aml_arg(2);
+     Aml *rev = aml_arg(1);
+-    Aml *sun = aml_arg(5);
++    Aml *sunum = aml_arg(5);
+     method = aml_method("PDSM", 6, AML_SERIALIZED);
+@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
+     UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
+     ifctx = aml_if(aml_equal(aml_arg(0), UUID));
+     {
+-        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sun), acpi_index));
++        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
+         ifctx1 = aml_if(aml_equal(func, zero));
+         {
+             uint8_t byte_list[1];
+--
+.25.1

-New patch
+[PULL 21/21] util/osdep: Remove some early cruft
+From: Andrew Deason <adeason@sinenomine.net>
+The include for statvfs.h has not been needed since all statvfs calls
+were removed in commit 4a1418e07bdc ("Unbreak large mem support by
+removing kqemu").
+The comment mentioning CONFIG_BSD hasn't made sense since an include
+for config-host.h was removed in commit aafd75841001 ("util: Clean up
+includes").
+Remove this cruft.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Andrew Deason <adeason@sinenomine.net>
+Message-id: 20220316035227.3702-4-adeason@sinenomine.net
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ util/osdep.c | 7 -------
+file changed, 7 deletions(-)
+diff --git a/util/osdep.c b/util/osdep.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/osdep.c
++++ b/util/osdep.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+-
+-/* Needed early for CONFIG_BSD etc. */
+-
+-#ifdef CONFIG_SOLARIS
+-#include <sys/statvfs.h>
+-#endif
+-
+ #include "qemu-common.h"
+ #include "qemu/cutils.h"
+ #include "qemu/sockets.h"
+--
+.25.1

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

Mostly straightforward bugfixes. The new Xilinx devices are
arguably 'new feature', but they're fixing a regression where
our changes to PSCI in commit 3f37979bf mean that EL3 guest
code now needs to talk to a proper emulated power-controller
device to turn on secondary CPUs; and it's not yet rc1 and
they only affect the Xilinx board, so it seems OK to me.

thanks
-- PMM

The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:

Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318

for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:

util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)

----------------------------------------------------------------
target-arm queue:
 * Fix sve2 ldnt1 and stnt1
 * Fix pauth_check_trap vs SEL2
 * Fix handling of LPAE block descriptors
 * hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
 * hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
 * nsis installer: List emulators in alphabetical order
 * nsis installer: Suppress "ANSI targets are deprecated" warning
 * nsis installer: Fix mouse-over descriptions for emulators
 * hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
 * Improve M-profile vector table access logging
 * Xilinx ZynqMP: model CRF and APU control
 * Fix compile issues on modern Solaris

----------------------------------------------------------------
Andrew Deason (3):
      util/osdep: Avoid madvise proto on modern Solaris
      hw/i386/acpi-build: Avoid 'sun' identifier
      util/osdep: Remove some early cruft

Edgar E. Iglesias (6):
      hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
      target/arm: Make rvbar settable after realize
      hw/misc: Add a model of the Xilinx ZynqMP CRF
      hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
      hw/misc: Add a model of the Xilinx ZynqMP APU Control
      hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control

Eric Auger (2):
      hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
      hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

Peter Maydell (8):
      target/arm: Fix handling of LPAE block descriptors
      hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
      hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
      nsis installer: List emulators in alphabetical order
      nsis installer: Suppress "ANSI targets are deprecated" warning
      nsis installer: Fix mouse-over descriptions for emulators
      target/arm: Log M-profile vector table accesses
      target/arm: Log fault address for M-profile faults

Richard Henderson (2):
      target/arm: Fix sve2 ldnt1 and stnt1
      target/arm: Fix pauth_check_trap vs SEL2

meson.build                            |  23 ++-
 include/hw/arm/xlnx-zynqmp.h           |   4 +
 include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 ++++++++++++
 include/hw/misc/xlnx-zynqmp-crf.h      | 211 ++++++++++++++++++++++++++
 include/qemu/osdep.h                   |   8 +
 target/arm/cpu.h                       |   3 +-
 target/arm/sve.decode                  |   5 +-
 hw/arm/virt.c                          |   7 +-
 hw/arm/xlnx-zynqmp.c                   |  46 +++++-
 hw/dma/xlnx_csu_dma.c                  |   1 +
 hw/i386/acpi-build.c                   |   4 +-
 hw/misc/npcm7xx_clk.c                  |   4 +-
 hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++++++++
 hw/misc/xlnx-zynqmp-crf.c              | 266 +++++++++++++++++++++++++++++++++
 target/arm/cpu.c                       |  17 ++-
 target/arm/helper.c                    |  20 ++-
 target/arm/m_helper.c                  |  11 ++
 target/arm/pauth_helper.c              |   2 +-
 target/arm/translate-sve.c             |  51 ++++++-
 tests/tcg/aarch64/test-826.c           |  50 +++++++
 util/osdep.c                           |  10 --
 hw/intc/Kconfig                        |   2 +-
 hw/intc/meson.build                    |   4 +-
 hw/misc/meson.build                    |   2 +
 qemu.nsi                               |   8 +-
 scripts/nsis.py                        |  17 ++-
 tests/tcg/aarch64/Makefile.target      |   4 +
 tests/tcg/configure.sh                 |   4 +
 28 files changed, 1084 insertions(+), 46 deletions(-)
 create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
 create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
 create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
 create mode 100644 hw/misc/xlnx-zynqmp-crf.c
 create mode 100644 tests/tcg/aarch64/test-826.c

From: Richard Henderson <richard.henderson@linaro.org>

For both ldnt1 and stnt1, the meaning of the Rn and Rm are different
from ld1 and st1: the vector and integer registers are reversed, and
the integer register 31 refers to XZR instead of SP.

Secondly, the 64-bit version of ldnt1 was being interpreted as
32-bit unpacked unscaled offset instead of 64-bit unscaled offset,
which discarded the upper 32 bits of the address coming from
the vector argument.

Thirdly, validate that the memory element size is in range for the
vector element size for ldnt1.  For ld1, we do this via independent
decode patterns, but for ldnt1 we need to do it manually.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220308031655.240710-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve.decode             |  5 ++-
 target/arm/translate-sve.c        | 51 +++++++++++++++++++++++++++++--
 tests/tcg/aarch64/test-826.c      | 50 ++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  4 +++
 tests/tcg/configure.sh            |  4 +++
 5 files changed, 109 insertions(+), 5 deletions(-)
 create mode 100644 tests/tcg/aarch64/test-826.c

diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -XXX,XX +XXX,XX @@ USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
 
 ### SVE2 Memory Gather Load Group
 
-# SVE2 64-bit gather non-temporal load
-#   (scalar plus unpacked 32-bit unscaled offsets)
+# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)
 LDNT1_zprz      1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \
-                &rprr_gather_load xs=0 esz=3 scale=0 ff=0
+                &rprr_gather_load xs=2 esz=3 scale=0 ff=0
 
 # SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)
 LDNT1_zprz      1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)
 
 static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)
 {
+    gen_helper_gvec_mem_scatter *fn = NULL;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (a->esz < a->msz + !a->u) {
+        return false;
+    }
     if (!dc_isar_feature(aa64_sve2, s)) {
         return false;
     }
-    return trans_LD1_zprz(s, a);
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    switch (a->esz) {
+    case MO_32:
+        fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];
+        break;
+    case MO_64:
+        fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];
+        break;
+    }
+    assert(fn != NULL);
+
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), a->msz, false, fn);
+    return true;
 }
 
 /* Indexed by [mte][be][xs][msz].  */
@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)
 
 static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)
 {
+    gen_helper_gvec_mem_scatter *fn;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (a->esz < a->msz) {
+        return false;
+    }
     if (!dc_isar_feature(aa64_sve2, s)) {
         return false;
     }
-    return trans_ST1_zprz(s, a);
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    switch (a->esz) {
+    case MO_32:
+        fn = scatter_store_fn32[mte][be][0][a->msz];
+        break;
+    case MO_64:
+        fn = scatter_store_fn64[mte][be][2][a->msz];
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), a->msz, true, fn);
+    return true;
 }
 
 /*
diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/test-826.c
@@ -XXX,XX +XXX,XX @@
+#include <sys/mman.h>
+#include <unistd.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <assert.h>
+
+static void *expected;
+
+void sigsegv(int sig, siginfo_t *info, void *vuc)
+{
+    ucontext_t *uc = vuc;
+
+    assert(info->si_addr == expected);
+    uc->uc_mcontext.pc += 4;
+}
+
+int main()
+{
+    struct sigaction sa = {
+        .sa_sigaction = sigsegv,
+        .sa_flags = SA_SIGINFO
+    };
+
+    void *page;
+    long ofs;
+
+    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
+        perror("sigaction");
+        return EXIT_FAILURE;
+    }
+
+    page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (page == MAP_FAILED) {
+        perror("mmap");
+        return EXIT_FAILURE;
+    }
+
+    ofs = 0x124;
+    expected = page + ofs;
+
+    asm("ptrue p0.d, vl1\n\t"
+        "dup z0.d, %0\n\t"
+        "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"
+        "dup z1.d, %1\n\t"
+        "ldnt1h {z0.d}, p0/z, [z1.d, %0]"
+        : : "r"(page), "r"(ofs) : "v0", "v1");
+
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls
 
 EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls
 endif
+endif
 
+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)
+AARCH64_TESTS += test-826
+test-826: CFLAGS+=-march=armv8.1-a+sve2
 endif
 
 TESTS += $(AARCH64_TESTS)
diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
index XXXXXXX..XXXXXXX 100755
--- a/tests/tcg/configure.sh
+++ b/tests/tcg/configure.sh
@@ -XXX,XX +XXX,XX @@ for target in $target_list; do
                              -march=armv8.1-a+sve -o $TMPE $TMPC; then
                   echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak
               fi
+              if do_compiler "$target_compiler" $target_compiler_cflags \
+                             -march=armv8.1-a+sve2 -o $TMPE $TMPC; then
+                  echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak
+              fi
               if do_compiler "$target_compiler" $target_compiler_cflags \
                              -march=armv8.3-a -o $TMPE $TMPC; then
                   echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When arm_is_el2_enabled was introduced, we missed
updating pauth_check_trap.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788
Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220315021205.342768-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/pauth_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
 
 static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)
 {
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         bool trap = !(hcr & HCR_API);
         if (el == 0) {
-- 
2.25.1

LPAE descriptors come in three forms:

* table descriptors, giving the address of the next level page table
 * page descriptors, which occur only at level 3 and describe the
   mapping of one page (which might be 4K, 16K or 64K)
 * block descriptors, which occur at higher page table levels, and
   describe the mapping of huge pages

QEMU's page-table-walk code treats block and page entries
identically, simply ORing in a number of bits from the input virtual
address that depends on the level of the page table that we stopped
at; we depend on the previous masking of descaddr with descaddrmask
to have already cleared out the low bits of the descriptor word.

This is not quite right: the address field in a block descriptor is
smaller, and so there are bits which are valid address bits in a page
descriptor or a table descriptor but which are not supposed to be
part of the address in a block descriptor, and descaddrmask does not
clear them.  We previously mostly got away with this because those
descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)
block descriptor bit 16 is defined to be the nT bit.  No emulated
QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might
see it when using KVM or hvf.

Explicitly zero out all the descaddr bits we're about to OR vaddr
bits into.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
             indexmask = indexmask_grainsize;
             continue;
         }
-        /* Block entry at level 1 or 2, or page entry at level 3.
+        /*
+         * Block entry at level 1 or 2, or page entry at level 3.
          * These are basically the same thing, although the number
-         * of bits we pull in from the vaddr varies.
+         * of bits we pull in from the vaddr varies. Note that although
+         * descaddrmask masks enough of the low bits of the descriptor
+         * to give a correct page or table address, the address field
+         * in a block descriptor is smaller; so we need to explicitly
+         * clear the lower bits here before ORing in the low vaddr bits.
          */
         page_size = (1ULL << ((stride * (4 - level)) + 3));
+        descaddr &= ~(page_size - 1);
         descaddr |= (address & (page_size - 1));
         /* Extract attributes from the descriptor */
         attrs = extract64(descriptor, 2, 10)
-- 
2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its
own class struct, but forgot to update the TypeInfo::class_size
accordingly.  This meant that not enough memory was allocated for the
class struct, and the initialization of xcdc->read in the class init
function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang
address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8
WRITE of size 8 at 0x61000000ab00 thread T0
    #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16
    #1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9
    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
    #3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)
    #4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5
    #5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5
    #6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24
    #7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35
    #8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5
    #9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5
    #10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)
allocated by thread T0 here:
    #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)
    #1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)
    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org
---
 hw/dma/xlnx_csu_dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(XlnxCSUDMA),
     .class_init    = xlnx_csu_dma_class_init,
+    .class_size    = sizeof(XlnxCSUDMAClass),
     .instance_init = xlnx_csu_dma_init,
     .interfaces = (InterfaceInfo[]) {
         { TYPE_STREAM_SINK },
-- 
2.25.1

In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().
Use g_autofree so we free it rather than leaking it.

(Detected with the clang leak sanitizer.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org
---
 hw/misc/npcm7xx_clk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_clk.c
+++ b/hw/misc/npcm7xx_clk.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)
     NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
 
     for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
-        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
-                g_strdup_printf("clock-in[%d]", i),
+        g_autofree char *s = g_strdup_printf("clock-in[%d]", i);
+        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,
                 npcm7xx_clk_update_sel_cb, sel, ClockUpdate);
     }
     sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
-- 
2.25.1

We currently list the emulators in the Windows installer's dialog
in an essentially random order (it's whatever glob.glob() returns
them to, which is filesystem-implementation-dependent). Add a
call to sorted() so they appear in alphabetical order.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org
---
 scripts/nsis.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py
index XXXXXXX..XXXXXXX 100644
--- a/scripts/nsis.py
+++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
         with open(
             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
         ) as nsh:
-            for exe in glob.glob(
+            for exe in sorted(glob.glob(
                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
-            ):
+            )):
                 exe = os.path.basename(exe)
                 arch = exe[12:-4]
                 nsh.write(
-- 
2.25.1

We use the nsis.py script to write out an installer script Section
for each emulator executable, so the exact set of Sections depends on
which executables were built.  However the part of qemu.nsi which
specifies mouse-over descriptions for each Section still has a
hard-coded and very outdated list (with just i386 and alpha).  This
causes two problems.  Firstly, if you build the installer for a
configuration where you didn't build the i386 binaries you get
warnings like this:
  warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)
  warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)
(this happens in our gitlab CI jobs, for instance).
Secondly, most of the emulators in the generated installer don't have
any mouseover text.

Make nsis.py generate a second output file which has the necessary
MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can
include that at the right point in qemu.nsi to set the mouse-over
text.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20220305105743.2384766-4-peter.maydell@linaro.org
---
 qemu.nsi        |  5 +----
 scripts/nsis.py | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/qemu.nsi b/qemu.nsi
index XXXXXXX..XXXXXXX 100644
--- a/qemu.nsi
+++ b/qemu.nsi
@@ -XXX,XX +XXX,XX @@ SectionEnd
 ; Descriptions (mouse-over).
 !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
+!include "${BINDIR}\system-mui-text.nsh"
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
 !ifdef DLLDIR
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
diff --git a/scripts/nsis.py b/scripts/nsis.py
index XXXXXXX..XXXXXXX 100644
--- a/scripts/nsis.py
+++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
         subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])
         with open(
             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
-        ) as nsh:
+        ) as nsh, open(
+            os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"
+        ) as muinsh:
             for exe in sorted(glob.glob(
                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
             )):
@@ -XXX,XX +XXX,XX @@ def main():
                         arch, exe
                     )
                 )
+                if arch.endswith('w'):
+                    desc = arch[:-1] + " emulation (GUI)."
+                else:
+                    desc = arch + " emulation."
+
+                muinsh.write(
+                    """
+                !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"
+                """.format(arch, desc))
 
         for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):
             signcode(exe)
-- 
2.25.1

From: Eric Auger <eric.auger@redhat.com>

CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3
specific files. So let's rename it into CONFIG_ARM_GICV3_TCG

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20220308182452.223473-2-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/Kconfig     | 2 +-
 hw/intc/meson.build | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config APIC
     select MSI_NONBROKEN
     select I8259
 
-config ARM_GIC_TCG
+config ARM_GICV3_TCG
     bool
     default y
     depends on ARM_GIC && TCG
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gicv3_common.c',
   'arm_gicv3_its_common.c',
 ))
-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
+softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(
   'arm_gicv3.c',
   'arm_gicv3_dist.c',
   'arm_gicv3_its.c',
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
 specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
 specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
+specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
 specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
 specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
-- 
2.25.1

From: Eric Auger <eric.auger@redhat.com>

In TCG mode, if gic-version=max we always select GICv3 even if
CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.
This also brings the benefit of fixing qos tests errors for tests
using gic-version=max with CONFIG_ARM_GICV3_TCG unset.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20220308182452.223473-3-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
         vms->gic_version = VIRT_GIC_VERSION_2;
         break;
     case VIRT_GIC_VERSION_MAX:
-        vms->gic_version = VIRT_GIC_VERSION_3;
+        if (module_object_class_by_name("arm-gicv3")) {
+            /* CONFIG_ARM_GICV3_TCG was set */
+            vms->gic_version = VIRT_GIC_VERSION_3;
+        } else {
+            vms->gic_version = VIRT_GIC_VERSION_2;
+        }
         break;
     case VIRT_GIC_VERSION_HOST:
         error_report("gic-version=host requires KVM");
-- 
2.25.1

Currently the CPU_LOG_INT logging misses some useful information
about loads from the vector table.  Add logging where we load vector
table entries.  This is particularly helpful for cases where the user
has accidentally not put a vector table in their image at all, which
can result in confusing guest crashes at startup.

Here's an example of the new logging for a case where
the vector table contains garbage:

Loaded reset SP 0x0 PC 0x0 from vector table
Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table
Taking exception 3 [Prefetch Abort] on CPU 0
...with CFSR.IACCVIOL
...BusFault with BFSR.STKERR
...taking pending nonsecure exception 3
...loading from element 3 of non-secure vector table at 0xc
...loaded new PC 0x20000558
----------------
IN:
0x20000558:  08000079  stmdaeq  r0, {r0, r3, r4, r5, r6}

(The double reset logging is the result of our long-standing
"CPUs all get reset twice" weirdness; it looks a bit ugly
but it'll go away if we ever fix that :-))

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220315204306.2797684-2-peter.maydell@linaro.org
---
 target/arm/cpu.c      | 5 +++++
 target/arm/m_helper.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
+#include "qemu/log.h"
 #include "qemu-common.h"
 #include "target/arm/idau.h"
 #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
             initial_pc = ldl_phys(s->as, vecbase + 4);
         }
 
+        qemu_log_mask(CPU_LOG_INT,
+                      "Loaded reset SP 0x%x PC 0x%x from vector table\n",
+                      initial_msp, initial_pc);
+
         env->regs[13] = initial_msp & 0xFFFFFFFC;
         env->regs[15] = initial_pc & ~1;
         env->thumb = initial_pc & 1;
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
     ARMMMUIdx mmu_idx;
     bool exc_secure;
 
+    qemu_log_mask(CPU_LOG_INT,
+                  "...loading from element %d of %s vector table at 0x%x\n",
+                  exc, targets_secure ? "secure" : "non-secure", addr);
+
     mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
         goto load_fail;
     }
     *pvec = vector_entry;
+    qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
     return true;
 
 load_fail:
-- 
2.25.1

For M-profile, the fault address is not always exposed to the guest
in a fault register (for instance the BFAR bus fault address register
is only updated for bus faults on data accesses, not instruction
accesses).  Currently we log the address only if we're putting it
into a particular guest-visible register.  Since we always have it,
log it generically, to make logs of i-side faults a bit clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          * Note that for M profile we don't have a guest facing FSR, but
          * the env->exception.fsr will be populated by the code that
          * raises the fault, in the A profile short-descriptor format.
+         *
+         * Log the exception.vaddress now regardless of subtype, because
+         * logging below only logs it when it goes into a guest visible
+         * register.
          */
+        qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
+                      (uint32_t)env->exception.vaddress);
         switch (env->exception.fsr & 0xf) {
         case M_FAKE_FSR_NSC_EXEC:
             /*
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add an unimplemented SERDES (Serializer/Deserializer) area.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h | 2 +-
 hw/arm/xlnx-zynqmp.c         | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
 
 struct XlnxZynqMPState {
     /*< private >*/
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define QSPI_DMA_ADDR       0xff0f0800
 #define NUM_QSPI_IRQ_LINES  2
 
+/* Serializer/Deserializer.  */
+#define SERDES_ADDR         0xfd400000
+#define SERDES_SIZE         0x20000
+
 #define DP_ADDR             0xfd4a0000
 #define DP_IRQ              113
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
         hwaddr size;
     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
         { .name = "apu", APU_ADDR, APU_SIZE },
+        { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
     };
     unsigned int nr;
 
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make the rvbar property settable after realize. This is done
in preparation to model the ZynqMP's runtime configurable rvbar.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  3 ++-
 target/arm/cpu.c    | 12 +++++++-----
 target/arm/helper.c | 10 +++++++---
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
             uint64_t vbar_el[4];
         };
         uint32_t mvbar; /* (monitor) vector base address register */
+        uint64_t rvbar; /* rvbar sampled from rvbar property at reset */
         struct { /* FCSE PID. */
             uint32_t fcseidr_ns;
             uint32_t fcseidr_s;
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
     uint32_t dcz_blocksize;
-    uint64_t rvbar;
+    uint64_t rvbar_prop; /* Property/input signals.  */
 
     /* Configurable aspects of GIC cpu interface (which is part of the CPU) */
     int gic_num_lrs; /* number of list registers */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         } else {
             env->pstate = PSTATE_MODE_EL1h;
         }
-        env->pc = cpu->rvbar;
+
+        /* Sample rvbar at reset.  */
+        env->cp15.rvbar = cpu->rvbar_prop;
+        env->pc = env->cp15.rvbar;
 #endif
     } else {
 #if defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_cbar_property =
 static Property arm_cpu_reset_hivecs_property =
             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
 
-static Property arm_cpu_rvbar_property =
-            DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);
-
 #ifndef CONFIG_USER_ONLY
 static Property arm_cpu_has_el2_property =
             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);
+        object_property_add_uint64_ptr(obj, "rvbar",
+                                       &cpu->rvbar_prop,
+                                       OBJ_PROP_FLAG_READWRITE);
     }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             ARMCPRegInfo rvbar = {
                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
-                .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
+                .access = PL1_R,
+                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
             };
             define_one_arm_cp_reg(cpu, &rvbar);
         }
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             ARMCPRegInfo rvbar = {
                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
-                .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
+                .access = PL2_R,
+                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
             };
             define_one_arm_cp_reg(cpu, &rvbar);
         }
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         ARMCPRegInfo el3_regs[] = {
             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
-              .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
+              .access = PL3_R,
+              .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
+            },
             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
               .access = PL3_RW,
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx ZynqMP CRF. At the moment this
is mostly a stub model.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-4-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++
 hw/misc/xlnx-zynqmp-crf.c         | 266 ++++++++++++++++++++++++++++++
 hw/misc/meson.build               |   1 +
 3 files changed, 478 insertions(+)
 create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
 create mode 100644 hw/misc/xlnx-zynqmp-crf.c

diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-zynqmp-crf.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the CRF - Clock Reset FPD.
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+#ifndef HW_MISC_XLNX_ZYNQMP_CRF_H
+#define HW_MISC_XLNX_ZYNQMP_CRF_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+
+#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPCRF, XLNX_ZYNQMP_CRF)
+
+REG32(ERR_CTRL, 0x0)
+    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
+REG32(IR_STATUS, 0x4)
+    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_MASK, 0x8)
+    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_ENABLE, 0xc)
+    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_DISABLE, 0x10)
+    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(CRF_WPROT, 0x1c)
+    FIELD(CRF_WPROT, ACTIVE, 0, 1)
+REG32(APLL_CTRL, 0x20)
+    FIELD(APLL_CTRL, POST_SRC, 24, 3)
+    FIELD(APLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(APLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(APLL_CTRL, DIV2, 16, 1)
+    FIELD(APLL_CTRL, FBDIV, 8, 7)
+    FIELD(APLL_CTRL, BYPASS, 3, 1)
+    FIELD(APLL_CTRL, RESET, 0, 1)
+REG32(APLL_CFG, 0x24)
+    FIELD(APLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(APLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(APLL_CFG, LFHF, 10, 2)
+    FIELD(APLL_CFG, CP, 5, 4)
+    FIELD(APLL_CFG, RES, 0, 4)
+REG32(APLL_FRAC_CFG, 0x28)
+    FIELD(APLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(APLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(APLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(APLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(APLL_FRAC_CFG, DATA, 0, 16)
+REG32(DPLL_CTRL, 0x2c)
+    FIELD(DPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(DPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(DPLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(DPLL_CTRL, DIV2, 16, 1)
+    FIELD(DPLL_CTRL, FBDIV, 8, 7)
+    FIELD(DPLL_CTRL, BYPASS, 3, 1)
+    FIELD(DPLL_CTRL, RESET, 0, 1)
+REG32(DPLL_CFG, 0x30)
+    FIELD(DPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(DPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(DPLL_CFG, LFHF, 10, 2)
+    FIELD(DPLL_CFG, CP, 5, 4)
+    FIELD(DPLL_CFG, RES, 0, 4)
+REG32(DPLL_FRAC_CFG, 0x34)
+    FIELD(DPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(DPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(DPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(DPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(DPLL_FRAC_CFG, DATA, 0, 16)
+REG32(VPLL_CTRL, 0x38)
+    FIELD(VPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(VPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(VPLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(VPLL_CTRL, DIV2, 16, 1)
+    FIELD(VPLL_CTRL, FBDIV, 8, 7)
+    FIELD(VPLL_CTRL, BYPASS, 3, 1)
+    FIELD(VPLL_CTRL, RESET, 0, 1)
+REG32(VPLL_CFG, 0x3c)
+    FIELD(VPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(VPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(VPLL_CFG, LFHF, 10, 2)
+    FIELD(VPLL_CFG, CP, 5, 4)
+    FIELD(VPLL_CFG, RES, 0, 4)
+REG32(VPLL_FRAC_CFG, 0x40)
+    FIELD(VPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(VPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(VPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(VPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(VPLL_FRAC_CFG, DATA, 0, 16)
+REG32(PLL_STATUS, 0x44)
+    FIELD(PLL_STATUS, VPLL_STABLE, 5, 1)
+    FIELD(PLL_STATUS, DPLL_STABLE, 4, 1)
+    FIELD(PLL_STATUS, APLL_STABLE, 3, 1)
+    FIELD(PLL_STATUS, VPLL_LOCK, 2, 1)
+    FIELD(PLL_STATUS, DPLL_LOCK, 1, 1)
+    FIELD(PLL_STATUS, APLL_LOCK, 0, 1)
+REG32(APLL_TO_LPD_CTRL, 0x48)
+    FIELD(APLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(DPLL_TO_LPD_CTRL, 0x4c)
+    FIELD(DPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(VPLL_TO_LPD_CTRL, 0x50)
+    FIELD(VPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(ACPU_CTRL, 0x60)
+    FIELD(ACPU_CTRL, CLKACT_HALF, 25, 1)
+    FIELD(ACPU_CTRL, CLKACT_FULL, 24, 1)
+    FIELD(ACPU_CTRL, DIVISOR0, 8, 6)
+    FIELD(ACPU_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TRACE_CTRL, 0x64)
+    FIELD(DBG_TRACE_CTRL, CLKACT, 24, 1)
+    FIELD(DBG_TRACE_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_TRACE_CTRL, SRCSEL, 0, 3)
+REG32(DBG_FPD_CTRL, 0x68)
+    FIELD(DBG_FPD_CTRL, CLKACT, 24, 1)
+    FIELD(DBG_FPD_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_FPD_CTRL, SRCSEL, 0, 3)
+REG32(DP_VIDEO_REF_CTRL, 0x70)
+    FIELD(DP_VIDEO_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_VIDEO_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_VIDEO_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_VIDEO_REF_CTRL, SRCSEL, 0, 3)
+REG32(DP_AUDIO_REF_CTRL, 0x74)
+    FIELD(DP_AUDIO_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_AUDIO_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_AUDIO_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_AUDIO_REF_CTRL, SRCSEL, 0, 3)
+REG32(DP_STC_REF_CTRL, 0x7c)
+    FIELD(DP_STC_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_STC_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_STC_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_STC_REF_CTRL, SRCSEL, 0, 3)
+REG32(DDR_CTRL, 0x80)
+    FIELD(DDR_CTRL, CLKACT, 24, 1)
+    FIELD(DDR_CTRL, DIVISOR0, 8, 6)
+    FIELD(DDR_CTRL, SRCSEL, 0, 3)
+REG32(GPU_REF_CTRL, 0x84)
+    FIELD(GPU_REF_CTRL, PP1_CLKACT, 26, 1)
+    FIELD(GPU_REF_CTRL, PP0_CLKACT, 25, 1)
+    FIELD(GPU_REF_CTRL, CLKACT, 24, 1)
+    FIELD(GPU_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(GPU_REF_CTRL, SRCSEL, 0, 3)
+REG32(SATA_REF_CTRL, 0xa0)
+    FIELD(SATA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(SATA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(SATA_REF_CTRL, SRCSEL, 0, 3)
+REG32(PCIE_REF_CTRL, 0xb4)
+    FIELD(PCIE_REF_CTRL, CLKACT, 24, 1)
+    FIELD(PCIE_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(PCIE_REF_CTRL, SRCSEL, 0, 3)
+REG32(GDMA_REF_CTRL, 0xb8)
+    FIELD(GDMA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(GDMA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(GDMA_REF_CTRL, SRCSEL, 0, 3)
+REG32(DPDMA_REF_CTRL, 0xbc)
+    FIELD(DPDMA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DPDMA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DPDMA_REF_CTRL, SRCSEL, 0, 3)
+REG32(TOPSW_MAIN_CTRL, 0xc0)
+    FIELD(TOPSW_MAIN_CTRL, CLKACT, 24, 1)
+    FIELD(TOPSW_MAIN_CTRL, DIVISOR0, 8, 6)
+    FIELD(TOPSW_MAIN_CTRL, SRCSEL, 0, 3)
+REG32(TOPSW_LSBUS_CTRL, 0xc4)
+    FIELD(TOPSW_LSBUS_CTRL, CLKACT, 24, 1)
+    FIELD(TOPSW_LSBUS_CTRL, DIVISOR0, 8, 6)
+    FIELD(TOPSW_LSBUS_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TSTMP_CTRL, 0xf8)
+    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
+REG32(RST_FPD_TOP, 0x100)
+    FIELD(RST_FPD_TOP, PCIE_CFG_RESET, 19, 1)
+    FIELD(RST_FPD_TOP, PCIE_BRIDGE_RESET, 18, 1)
+    FIELD(RST_FPD_TOP, PCIE_CTRL_RESET, 17, 1)
+    FIELD(RST_FPD_TOP, DP_RESET, 16, 1)
+    FIELD(RST_FPD_TOP, SWDT_RESET, 15, 1)
+    FIELD(RST_FPD_TOP, AFI_FM5_RESET, 12, 1)
+    FIELD(RST_FPD_TOP, AFI_FM4_RESET, 11, 1)
+    FIELD(RST_FPD_TOP, AFI_FM3_RESET, 10, 1)
+    FIELD(RST_FPD_TOP, AFI_FM2_RESET, 9, 1)
+    FIELD(RST_FPD_TOP, AFI_FM1_RESET, 8, 1)
+    FIELD(RST_FPD_TOP, AFI_FM0_RESET, 7, 1)
+    FIELD(RST_FPD_TOP, GDMA_RESET, 6, 1)
+    FIELD(RST_FPD_TOP, GPU_PP1_RESET, 5, 1)
+    FIELD(RST_FPD_TOP, GPU_PP0_RESET, 4, 1)
+    FIELD(RST_FPD_TOP, GPU_RESET, 3, 1)
+    FIELD(RST_FPD_TOP, GT_RESET, 2, 1)
+    FIELD(RST_FPD_TOP, SATA_RESET, 1, 1)
+REG32(RST_FPD_APU, 0x104)
+    FIELD(RST_FPD_APU, ACPU3_PWRON_RESET, 13, 1)
+    FIELD(RST_FPD_APU, ACPU2_PWRON_RESET, 12, 1)
+    FIELD(RST_FPD_APU, ACPU1_PWRON_RESET, 11, 1)
+    FIELD(RST_FPD_APU, ACPU0_PWRON_RESET, 10, 1)
+    FIELD(RST_FPD_APU, APU_L2_RESET, 8, 1)
+    FIELD(RST_FPD_APU, ACPU3_RESET, 3, 1)
+    FIELD(RST_FPD_APU, ACPU2_RESET, 2, 1)
+    FIELD(RST_FPD_APU, ACPU1_RESET, 1, 1)
+    FIELD(RST_FPD_APU, ACPU0_RESET, 0, 1)
+REG32(RST_DDR_SS, 0x108)
+    FIELD(RST_DDR_SS, DDR_RESET, 3, 1)
+    FIELD(RST_DDR_SS, APM_RESET, 2, 1)
+
+#define CRF_R_MAX (R_RST_DDR_SS + 1)
+
+struct XlnxZynqMPCRF {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    qemu_irq irq_ir;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[CRF_R_MAX];
+    RegisterInfo regs_info[CRF_R_MAX];
+};
+
+#endif
diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-zynqmp-crf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the CRF - Clock Reset FPD.
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "migration/vmstate.h"
+#include "hw/irq.h"
+#include "hw/misc/xlnx-zynqmp-crf.h"
+#include "target/arm/arm-powerctl.h"
+
+#ifndef XLNX_ZYNQMP_CRF_ERR_DEBUG
+#define XLNX_ZYNQMP_CRF_ERR_DEBUG 0
+#endif
+
+#define CRF_MAX_CPU    4
+
+static void ir_update_irq(XlnxZynqMPCRF *s)
+{
+    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
+    qemu_set_irq(s->irq_ir, pending);
+}
+
+static void ir_status_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    ir_update_irq(s);
+}
+
+static uint64_t ir_enable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] &= ~val;
+    ir_update_irq(s);
+    return 0;
+}
+
+static uint64_t ir_disable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] |= val;
+    ir_update_irq(s);
+    return 0;
+}
+
+static uint64_t rst_fpd_apu_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+    uint32_t val_old = s->regs[R_RST_FPD_APU];
+    unsigned int i;
+
+    for (i = 0; i < CRF_MAX_CPU; i++) {
+        uint32_t mask = (1 << (R_RST_FPD_APU_ACPU0_RESET_SHIFT + i));
+
+        if ((val ^ val_old) & mask) {
+            if (val & mask) {
+                arm_set_cpu_off(i);
+            } else {
+                arm_set_cpu_on_and_reset(i);
+            }
+        }
+    }
+    return val64;
+}
+
+static const RegisterAccessInfo crf_regs_info[] = {
+    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
+    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
+        .w1c = 0x1,
+        .post_write = ir_status_postw,
+    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
+        .pre_write = ir_enable_prew,
+    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
+        .pre_write = ir_disable_prew,
+    },{ .name = "CRF_WPROT",  .addr = A_CRF_WPROT,
+    },{ .name = "APLL_CTRL",  .addr = A_APLL_CTRL,
+        .reset = 0x12c09,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "APLL_CFG",  .addr = A_APLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "APLL_FRAC_CFG",  .addr = A_APLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "DPLL_CTRL",  .addr = A_DPLL_CTRL,
+        .reset = 0x2c09,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "DPLL_CFG",  .addr = A_DPLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "DPLL_FRAC_CFG",  .addr = A_DPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "VPLL_CTRL",  .addr = A_VPLL_CTRL,
+        .reset = 0x12809,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "VPLL_CFG",  .addr = A_VPLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "VPLL_FRAC_CFG",  .addr = A_VPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
+        .reset = 0x3f,
+        .rsvd = 0xc0,
+        .ro = 0x3f,
+    },{ .name = "APLL_TO_LPD_CTRL",  .addr = A_APLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "DPLL_TO_LPD_CTRL",  .addr = A_DPLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "VPLL_TO_LPD_CTRL",  .addr = A_VPLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "ACPU_CTRL",  .addr = A_ACPU_CTRL,
+        .reset = 0x3000400,
+        .rsvd = 0xfcffc0f8,
+    },{ .name = "DBG_TRACE_CTRL",  .addr = A_DBG_TRACE_CTRL,
+        .reset = 0x2500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DBG_FPD_CTRL",  .addr = A_DBG_FPD_CTRL,
+        .reset = 0x1002500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DP_VIDEO_REF_CTRL",  .addr = A_DP_VIDEO_REF_CTRL,
+        .reset = 0x1002300,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DP_AUDIO_REF_CTRL",  .addr = A_DP_AUDIO_REF_CTRL,
+        .reset = 0x1032300,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DP_STC_REF_CTRL",  .addr = A_DP_STC_REF_CTRL,
+        .reset = 0x1203200,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DDR_CTRL",  .addr = A_DDR_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "GPU_REF_CTRL",  .addr = A_GPU_REF_CTRL,
+        .reset = 0x1500,
+        .rsvd = 0xf8ffc0f8,
+    },{ .name = "SATA_REF_CTRL",  .addr = A_SATA_REF_CTRL,
+        .reset = 0x1001600,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "PCIE_REF_CTRL",  .addr = A_PCIE_REF_CTRL,
+        .reset = 0x1500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "GDMA_REF_CTRL",  .addr = A_GDMA_REF_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DPDMA_REF_CTRL",  .addr = A_DPDMA_REF_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "TOPSW_MAIN_CTRL",  .addr = A_TOPSW_MAIN_CTRL,
+        .reset = 0x1000400,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "TOPSW_LSBUS_CTRL",  .addr = A_TOPSW_LSBUS_CTRL,
+        .reset = 0x1000800,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
+        .reset = 0xa00,
+        .rsvd = 0xffffc0f8,
+    },
+    {   .name = "RST_FPD_TOP",  .addr = A_RST_FPD_TOP,
+        .reset = 0xf9ffe,
+        .rsvd = 0xf06001,
+    },{ .name = "RST_FPD_APU",  .addr = A_RST_FPD_APU,
+        .reset = 0x3d0f,
+        .rsvd = 0xc2f0,
+        .pre_write = rst_fpd_apu_prew,
+    },{ .name = "RST_DDR_SS",  .addr = A_RST_DDR_SS,
+        .reset = 0xf,
+        .rsvd = 0xf3,
+    }
+};
+
+static void crf_reset_enter(Object *obj, ResetType type)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
+static void crf_reset_hold(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    ir_update_irq(s);
+}
+
+static const MemoryRegionOps crf_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void crf_init(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), crf_regs_info,
+                              ARRAY_SIZE(crf_regs_info),
+                              s->regs_info, s->regs,
+                              &crf_ops,
+                              XLNX_ZYNQMP_CRF_ERR_DEBUG,
+                              CRF_R_MAX * 4);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_irq(sbd, &s->irq_ir);
+}
+
+static void crf_finalize(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_crf = {
+    .name = TYPE_XLNX_ZYNQMP_CRF,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCRF, CRF_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void crf_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_crf;
+    rc->phases.enter = crf_reset_enter;
+    rc->phases.hold = crf_reset_hold;
+}
+
+static const TypeInfo crf_info = {
+    .name              = TYPE_XLNX_ZYNQMP_CRF,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(XlnxZynqMPCRF),
+    .class_init        = crf_class_init,
+    .instance_init     = crf_init,
+    .instance_finalize = crf_finalize,
+};
+
+static void crf_register_types(void)
+{
+    type_register_static(&crf_info);
+}
+
+type_init(crf_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
+specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Connect the ZynqMP CRF - Clock Reset FPD device.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-5-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zynqmp.c         | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-zynqmp-efuse.h"
 #include "hw/or-irq.h"
+#include "hw/misc/xlnx-zynqmp-crf.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
     XlnxCSUDMA qspi_dma;
     qemu_or_irq qspi_irq_orgate;
+    XlnxZynqMPCRF crf;
 
     char *boot_cpu;
     ARMCPU *boot_cpu_ptr;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define QSPI_DMA_ADDR       0xff0f0800
 #define NUM_QSPI_IRQ_LINES  2
 
+#define CRF_ADDR            0xfd1a0000
+#define CRF_IRQ             120
+
 /* Serializer/Deserializer.  */
 #define SERDES_ADDR         0xfd400000
 #define SERDES_SIZE         0x20000
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
 }
 
+static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+
+    object_initialize_child(OBJECT(s), "crf", &s->crf, TYPE_XLNX_ZYNQMP_CRF);
+    sbd = SYS_BUS_DEVICE(&s->crf);
+
+    sysbus_realize(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, CRF_ADDR);
+    sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
+}
+
 static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
 {
     static const struct UnimpInfo {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     xlnx_zynqmp_create_bbram(s, gic_spi);
     xlnx_zynqmp_create_efuse(s, gic_spi);
+    xlnx_zynqmp_create_crf(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx ZynqMP APU Control.

Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 +++++++++
 hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++
 hw/misc/meson.build                    |   1 +
 3 files changed, 347 insertions(+)
 create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
 create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c

diff --git a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of ZynqMP APU Control.
+ *
+ * Copyright (c) 2013-2022 Xilinx Inc
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
+ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ *
+ */
+#ifndef HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
+#define HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "target/arm/cpu.h"
+
+#define TYPE_XLNX_ZYNQMP_APU_CTRL "xlnx.apu-ctrl"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPAPUCtrl, XLNX_ZYNQMP_APU_CTRL)
+
+REG32(APU_ERR_CTRL, 0x0)
+    FIELD(APU_ERR_CTRL, PSLVERR, 0, 1)
+REG32(ISR, 0x10)
+    FIELD(ISR, INV_APB, 0, 1)
+REG32(IMR, 0x14)
+    FIELD(IMR, INV_APB, 0, 1)
+REG32(IEN, 0x18)
+    FIELD(IEN, INV_APB, 0, 1)
+REG32(IDS, 0x1c)
+    FIELD(IDS, INV_APB, 0, 1)
+REG32(CONFIG_0, 0x20)
+    FIELD(CONFIG_0, CFGTE, 24, 4)
+    FIELD(CONFIG_0, CFGEND, 16, 4)
+    FIELD(CONFIG_0, VINITHI, 8, 4)
+    FIELD(CONFIG_0, AA64NAA32, 0, 4)
+REG32(CONFIG_1, 0x24)
+    FIELD(CONFIG_1, L2RSTDISABLE, 29, 1)
+    FIELD(CONFIG_1, L1RSTDISABLE, 28, 1)
+    FIELD(CONFIG_1, CP15DISABLE, 0, 4)
+REG32(RVBARADDR0L, 0x40)
+    FIELD(RVBARADDR0L, ADDR, 2, 30)
+REG32(RVBARADDR0H, 0x44)
+    FIELD(RVBARADDR0H, ADDR, 0, 8)
+REG32(RVBARADDR1L, 0x48)
+    FIELD(RVBARADDR1L, ADDR, 2, 30)
+REG32(RVBARADDR1H, 0x4c)
+    FIELD(RVBARADDR1H, ADDR, 0, 8)
+REG32(RVBARADDR2L, 0x50)
+    FIELD(RVBARADDR2L, ADDR, 2, 30)
+REG32(RVBARADDR2H, 0x54)
+    FIELD(RVBARADDR2H, ADDR, 0, 8)
+REG32(RVBARADDR3L, 0x58)
+    FIELD(RVBARADDR3L, ADDR, 2, 30)
+REG32(RVBARADDR3H, 0x5c)
+    FIELD(RVBARADDR3H, ADDR, 0, 8)
+REG32(ACE_CTRL, 0x60)
+    FIELD(ACE_CTRL, AWQOS, 16, 4)
+    FIELD(ACE_CTRL, ARQOS, 0, 4)
+REG32(SNOOP_CTRL, 0x80)
+    FIELD(SNOOP_CTRL, ACE_INACT, 4, 1)
+    FIELD(SNOOP_CTRL, ACP_INACT, 0, 1)
+REG32(PWRCTL, 0x90)
+    FIELD(PWRCTL, CLREXMONREQ, 17, 1)
+    FIELD(PWRCTL, L2FLUSHREQ, 16, 1)
+    FIELD(PWRCTL, CPUPWRDWNREQ, 0, 4)
+REG32(PWRSTAT, 0x94)
+    FIELD(PWRSTAT, CLREXMONACK, 17, 1)
+    FIELD(PWRSTAT, L2FLUSHDONE, 16, 1)
+    FIELD(PWRSTAT, DBGNOPWRDWN, 0, 4)
+
+#define APU_R_MAX ((R_PWRSTAT) + 1)
+
+#define APU_MAX_CPU    4
+
+struct XlnxZynqMPAPUCtrl {
+    SysBusDevice busdev;
+
+    ARMCPU *cpus[APU_MAX_CPU];
+    /* WFIs towards PMU. */
+    qemu_irq wfi_out[4];
+    /* CPU Power status towards INTC Redirect. */
+    qemu_irq cpu_power_status[4];
+    qemu_irq irq_imr;
+
+    uint8_t cpu_pwrdwn_req;
+    uint8_t cpu_in_wfi;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[APU_R_MAX];
+    RegisterInfo regs_info[APU_R_MAX];
+};
+
+#endif
diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the ZynqMP APU Control.
+ *
+ * Copyright (c) 2013-2022 Xilinx Inc
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
+ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+#include "hw/register.h"
+
+#include "qemu/bitops.h"
+#include "qapi/qmp/qerror.h"
+
+#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
+
+#ifndef XILINX_ZYNQMP_APU_ERR_DEBUG
+#define XILINX_ZYNQMP_APU_ERR_DEBUG 0
+#endif
+
+static void update_wfi_out(void *opaque)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
+    unsigned int i, wfi_pending;
+
+    wfi_pending = s->cpu_pwrdwn_req & s->cpu_in_wfi;
+    for (i = 0; i < APU_MAX_CPU; i++) {
+        qemu_set_irq(s->wfi_out[i], !!(wfi_pending & (1 << i)));
+    }
+}
+
+static void zynqmp_apu_rvbar_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    int i;
+
+    for (i = 0; i < APU_MAX_CPU; ++i) {
+        uint64_t rvbar = s->regs[R_RVBARADDR0L + 2 * i] +
+                         ((uint64_t)s->regs[R_RVBARADDR0H + 2 * i] << 32);
+        if (s->cpus[i]) {
+            object_property_set_int(OBJECT(s->cpus[i]), "rvbar", rvbar,
+                                    &error_abort);
+        }
+    }
+}
+
+static void zynqmp_apu_pwrctl_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    unsigned int i, new;
+
+    for (i = 0; i < APU_MAX_CPU; i++) {
+        new = val & (1 << i);
+        /* Check if CPU's CPUPWRDNREQ has changed. If yes, update GPIOs. */
+        if (new != (s->cpu_pwrdwn_req & (1 << i))) {
+            qemu_set_irq(s->cpu_power_status[i], !!new);
+        }
+        s->cpu_pwrdwn_req &= ~(1 << i);
+        s->cpu_pwrdwn_req |= new;
+    }
+    update_wfi_out(s);
+}
+
+static void imr_update_irq(XlnxZynqMPAPUCtrl *s)
+{
+    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
+    qemu_set_irq(s->irq_imr, pending);
+}
+
+static void isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    imr_update_irq(s);
+}
+
+static uint64_t ien_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] &= ~val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t ids_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] |= val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static const RegisterAccessInfo zynqmp_apu_regs_info[] = {
+#define RVBAR_REGDEF(n) \
+    {   .name = "RVBAR CPU " #n " Low",  .addr = A_RVBARADDR ## n ## L,    \
+            .reset = 0xffff0000ul,                                         \
+            .post_write = zynqmp_apu_rvbar_post_write,                     \
+    },{ .name = "RVBAR CPU " #n " High", .addr = A_RVBARADDR ## n ## H,    \
+            .post_write = zynqmp_apu_rvbar_post_write,                     \
+    }
+    {   .name = "ERR_CTRL",  .addr = A_APU_ERR_CTRL,
+    },{ .name = "ISR",  .addr = A_ISR,
+        .w1c = 0x1,
+        .post_write = isr_postw,
+    },{ .name = "IMR",  .addr = A_IMR,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IEN",  .addr = A_IEN,
+        .pre_write = ien_prew,
+    },{ .name = "IDS",  .addr = A_IDS,
+        .pre_write = ids_prew,
+    },{ .name = "CONFIG_0",  .addr = A_CONFIG_0,
+        .reset = 0xf0f,
+    },{ .name = "CONFIG_1",  .addr = A_CONFIG_1,
+    },
+    RVBAR_REGDEF(0),
+    RVBAR_REGDEF(1),
+    RVBAR_REGDEF(2),
+    RVBAR_REGDEF(3),
+    { .name = "ACE_CTRL",  .addr = A_ACE_CTRL,
+        .reset = 0xf000f,
+    },{ .name = "SNOOP_CTRL",  .addr = A_SNOOP_CTRL,
+    },{ .name = "PWRCTL",  .addr = A_PWRCTL,
+        .post_write = zynqmp_apu_pwrctl_post_write,
+    },{ .name = "PWRSTAT",  .addr = A_PWRSTAT,
+        .ro = 0x3000f,
+    }
+};
+
+static void zynqmp_apu_reset_enter(Object *obj, ResetType type)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    int i;
+
+    for (i = 0; i < APU_R_MAX; ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    s->cpu_pwrdwn_req = 0;
+    s->cpu_in_wfi = 0;
+}
+
+static void zynqmp_apu_reset_hold(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+
+    update_wfi_out(s);
+    imr_update_irq(s);
+}
+
+static const MemoryRegionOps zynqmp_apu_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static void zynqmp_apu_handle_wfi(void *opaque, int irq, int level)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
+
+    s->cpu_in_wfi = deposit32(s->cpu_in_wfi, irq, 1, level);
+    update_wfi_out(s);
+}
+
+static void zynqmp_apu_init(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    int i;
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), zynqmp_apu_regs_info,
+                              ARRAY_SIZE(zynqmp_apu_regs_info),
+                              s->regs_info, s->regs,
+                              &zynqmp_apu_ops,
+                              XILINX_ZYNQMP_APU_ERR_DEBUG,
+                              APU_R_MAX * 4);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->reg_array->mem);
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq_imr);
+
+    for (i = 0; i < APU_MAX_CPU; ++i) {
+        g_autofree gchar *prop_name = g_strdup_printf("cpu%d", i);
+        object_property_add_link(obj, prop_name, TYPE_ARM_CPU,
+                                 (Object **)&s->cpus[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    /* wfi_out is used to connect to PMU GPIs. */
+    qdev_init_gpio_out_named(DEVICE(obj), s->wfi_out, "wfi_out", 4);
+    /* CPU_POWER_STATUS is used to connect to INTC redirect. */
+    qdev_init_gpio_out_named(DEVICE(obj), s->cpu_power_status,
+                             "CPU_POWER_STATUS", 4);
+    /* wfi_in is used as input from CPUs as wfi request. */
+    qdev_init_gpio_in_named(DEVICE(obj), zynqmp_apu_handle_wfi, "wfi_in", 4);
+}
+
+static void zynqmp_apu_finalize(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_zynqmp_apu = {
+    .name = TYPE_XLNX_ZYNQMP_APU_CTRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPAPUCtrl, APU_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void zynqmp_apu_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_zynqmp_apu;
+
+    rc->phases.enter = zynqmp_apu_reset_enter;
+    rc->phases.hold = zynqmp_apu_reset_hold;
+}
+
+static const TypeInfo zynqmp_apu_info = {
+    .name              = TYPE_XLNX_ZYNQMP_APU_CTRL,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(XlnxZynqMPAPUCtrl),
+    .class_init        = zynqmp_apu_class_init,
+    .instance_init     = zynqmp_apu_init,
+    .instance_finalize = zynqmp_apu_finalize,
+};
+
+static void zynqmp_apu_register_types(void)
+{
+    type_register_static(&zynqmp_apu_info);
+}
+
+type_init(zynqmp_apu_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
+specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Connect the ZynqMP APU Control device.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-7-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  4 +++-
 hw/arm/xlnx-zynqmp.c         | 25 +++++++++++++++++++++++--
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-zynqmp-efuse.h"
 #include "hw/or-irq.h"
+#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
 #include "hw/misc/xlnx-zynqmp-crf.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
 
 struct XlnxZynqMPState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
     XlnxCSUDMA qspi_dma;
     qemu_or_irq qspi_irq_orgate;
+    XlnxZynqMPAPUCtrl apu_ctrl;
     XlnxZynqMPCRF crf;
 
     char *boot_cpu;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define DPDMA_IRQ           116
 
 #define APU_ADDR            0xfd5c0000
-#define APU_SIZE            0x100
+#define APU_IRQ             153
 
 #define IPI_ADDR            0xFF300000
 #define IPI_IRQ             64
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
 }
 
+static void xlnx_zynqmp_create_apu_ctrl(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+    int i;
+
+    object_initialize_child(OBJECT(s), "apu-ctrl", &s->apu_ctrl,
+                            TYPE_XLNX_ZYNQMP_APU_CTRL);
+    sbd = SYS_BUS_DEVICE(&s->apu_ctrl);
+
+    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+        g_autofree gchar *name = g_strdup_printf("cpu%d", i);
+
+        object_property_set_link(OBJECT(&s->apu_ctrl), name,
+                                 OBJECT(&s->apu_cpu[i]), &error_abort);
+    }
+
+    sysbus_realize(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, APU_ADDR);
+    sysbus_connect_irq(sbd, 0, gic[APU_IRQ]);
+}
+
 static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
 {
     SysBusDevice *sbd;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
         hwaddr base;
         hwaddr size;
     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
-        { .name = "apu", APU_ADDR, APU_SIZE },
         { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
     };
     unsigned int nr;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     xlnx_zynqmp_create_bbram(s, gic_spi);
     xlnx_zynqmp_create_efuse(s, gic_spi);
+    xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
     xlnx_zynqmp_create_crf(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

On older Solaris releases (before Solaris 11), we didn't get a
prototype for madvise, and so util/osdep.c provides its own prototype.
Some time between the public Solaris 11.4 release and Solaris 11.4.42
CBE, we started getting an madvise prototype that looks like this:

extern int madvise(void *, size_t, int);

which conflicts with the prototype in util/osdeps.c. Instead of always
declaring this prototype, check if we're missing the madvise()
prototype, and only declare it ourselves if the prototype is missing.
Move the prototype to include/qemu/osdep.h, the normal place to handle
platform-specific header quirks.

The 'missing_madvise_proto' meson check contains an obviously wrong
prototype for madvise. So if that code compiles and links, we must be
missing the actual prototype for madvise.

Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Message-id: 20220316035227.3702-2-adeason@sinenomine.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build          | 23 +++++++++++++++++++++--
 include/qemu/osdep.h |  8 ++++++++
 util/osdep.c         |  3 ---
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
   #error Not supported
   #endif
   }'''))
-config_host_data.set('CONFIG_MADVISE', cc.links(gnu_source_prefix + '''
+
+has_madvise = cc.links(gnu_source_prefix + '''
   #include <sys/types.h>
   #include <sys/mman.h>
   #include <stddef.h>
-  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }'''))
+  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }''')
+missing_madvise_proto = false
+if has_madvise
+  # Some platforms (illumos and Solaris before Solaris 11) provide madvise()
+  # but forget to prototype it. In this case, has_madvise will be true (the
+  # test program links despite a compile warning). To detect the
+  # missing-prototype case, we try again with a definitely-bogus prototype.
+  # This will only compile if the system headers don't provide the prototype;
+  # otherwise the conflicting prototypes will cause a compiler error.
+  missing_madvise_proto = cc.links(gnu_source_prefix + '''
+    #include <sys/types.h>
+    #include <sys/mman.h>
+    #include <stddef.h>
+    extern int madvise(int);
+    int main(void) { return madvise(0); }''')
+endif
+config_host_data.set('CONFIG_MADVISE', has_madvise)
+config_host_data.set('HAVE_MADVISE_WITHOUT_PROTOTYPE', missing_madvise_proto)
+
 config_host_data.set('CONFIG_MEMFD', cc.links(gnu_source_prefix + '''
   #include <sys/mman.h>
   int main(void) { return memfd_create("foo", MFD_ALLOW_SEALING); }'''))
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
 #define SIGIO SIGPOLL
 #endif
 
+#ifdef HAVE_MADVISE_WITHOUT_PROTOTYPE
+/*
+ * See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for discussion
+ * about Solaris missing the madvise() prototype.
+ */
+extern int madvise(char *, size_t, int);
+#endif
+
 #if defined(CONFIG_LINUX)
 #ifndef BUS_MCEERR_AR
 #define BUS_MCEERR_AR 4
diff --git a/util/osdep.c b/util/osdep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -XXX,XX +XXX,XX @@
 
 #ifdef CONFIG_SOLARIS
 #include <sys/statvfs.h>
-/* See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for
-   discussion about Solaris header problems */
-extern int madvise(char *, size_t, int);
 #endif
 
 #include "qemu-common.h"
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

On Solaris, 'sun' is #define'd to 1, which causes errors if a variable
is named 'sun'. Slightly change the name of the var for the Slot User
Number so we can build on Solaris.

Reviewed-by: Ani Sinha <ani@anisinha.ca>
Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20220316035227.3702-3-adeason@sinenomine.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
     Aml *bnum = aml_arg(4);
     Aml *func = aml_arg(2);
     Aml *rev = aml_arg(1);
-    Aml *sun = aml_arg(5);
+    Aml *sunum = aml_arg(5);
 
     method = aml_method("PDSM", 6, AML_SERIALIZED);
 
@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
     UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
     ifctx = aml_if(aml_equal(aml_arg(0), UUID));
     {
-        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sun), acpi_index));
+        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
         ifctx1 = aml_if(aml_equal(func, zero));
         {
             uint8_t byte_list[1];
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

The include for statvfs.h has not been needed since all statvfs calls
were removed in commit 4a1418e07bdc ("Unbreak large mem support by
removing kqemu").

The comment mentioning CONFIG_BSD hasn't made sense since an include
for config-host.h was removed in commit aafd75841001 ("util: Clean up
includes").

Remove this cruft.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Message-id: 20220316035227.3702-4-adeason@sinenomine.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/osdep.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/util/osdep.c b/util/osdep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-
-/* Needed early for CONFIG_BSD etc. */
-
-#ifdef CONFIG_SOLARIS
-#include <sys/statvfs.h>
-#endif
-
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/sockets.h"
-- 
2.25.1