Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[PULL 00/46] target-arm queue
-target-arm queue: Eric's SMMUv3 patchset, and an array
+The following changes since commit 7e7eb9f852a46b51a71ae9d82590b2e4d28827ee:
 of minor bugfixes and improvements from various others.
-thanks
+  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-01-28' into staging (2021-01-28 22:43:18 +0000)
 -- PMM
 The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:
   Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210129
-for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:
+for you to fetch changes up to 11749122e1a86866591306d43603d2795a3dea1a:
-  hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)
+  hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS (2021-01-29 10:47:29 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board
+ * Implement ID_PFR2
-   if the commandline includes "-machine iommu=smmuv3"
+ * Conditionalize DBGDIDR
- * target/arm: Implement v8M VLLDM and VLSTM
+ * rename xlnx-zcu102.canbusN properties
- * hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+ * provide powerdown/reset mechanism for secure firmware on 'virt' board
- * Some fixes to silence Coverity false-positives
+ * hw/misc: Fix arith overflow in NPCM7XX PWM module
- * arm: boot: set boot_info starting from first_cpu
+ * target/arm: Replace magic value by MMU_DATA_LOAD definition
-   (fixes a technical bug not visible in practice)
+ * configure: fix preadv errors on Catalina macOS with new XCode
- * hw/net/smc91c111: Convert away from old_mmio
+ * Various configure and other cleanups in preparation for iOS support
- * hw/usb/tusb6010: Convert away from old_mmio
+ * hvf: Add hypervisor entitlement to output binaries (needed for Big Sur)
- * hw/char/cmsdk-apb-uart.c: Accept more input after character read
+ * Implement pvpanic-pci device
- * target/arm: Make MPUIR write-ignored on OMAP, StrongARM
+ * Convert the CMSDK timer devices to the Clock framework
  * hw/arm/virt: Add linux,pci-domain property
 ----------------------------------------------------------------
-Eric Auger (11):
+Alexander Graf (1):
-      hw/arm/smmu-common: smmu base device and datatypes
+      hvf: Add hypervisor entitlement to output binaries
       hw/arm/smmu-common: IOMMU memory region and address space setup
       hw/arm/smmu-common: VMSAv8-64 page table walk
       hw/arm/smmuv3: Wired IRQ and GERROR helpers
       hw/arm/smmuv3: Queue helpers
       hw/arm/smmuv3: Implement MMIO write operations
       hw/arm/smmuv3: Event queue recording helper
       hw/arm/smmuv3: Implement translate callback
       hw/arm/smmuv3: Abort on vfio or vhost case
       target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
       hw/arm/virt: Introduce the iommu option
-Igor Mammedov (1):
+Hao Wu (1):
-      arm: boot: set boot_info starting from first_cpu
+      hw/misc: Fix arith overflow in NPCM7XX PWM module
-Jan Kiszka (1):
+Joelle van Dyne (7):
-      hw/arm/virt: Add linux,pci-domain property
+      configure: cross-compiling with empty cross_prefix
       osdep: build with non-working system() function
       darwin: remove redundant dependency declaration
       darwin: fix cross-compiling for Darwin
       configure: cross compile should use x86_64 cpu_family
       darwin: detect CoreAudio for build
       darwin: remove 64-bit build detection on 32-bit OS
-Mathew Maidment (1):
+Maxim Uvarov (3):
-      target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case
+      hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
       arm-virt: refactor gpios creation
       arm-virt: add secure pl061 for reset/power down
-Patrick Oppenlander (1):
+Mihai Carabas (4):
-      hw/char/cmsdk-apb-uart.c: Accept more input after character read
+      hw/misc/pvpanic: split-out generic and bus dependent code
       hw/misc/pvpanic: add PCI interface support
       pvpanic : update pvpanic spec document
       tests/qtest: add a test case for pvpanic-pci
-Peter Maydell (3):
+Paolo Bonzini (1):
-      hw/usb/tusb6010: Convert away from old_mmio
+      arm: rename xlnx-zcu102.canbusN properties
       hw/net/smc91c111: Convert away from old_mmio
       target/arm: Implement v8M VLLDM and VLSTM
-Prem Mallappa (3):
+Peter Maydell (26):
-      hw/arm/smmuv3: Skeleton
+      configure: Move preadv check to meson.build
-      hw/arm/virt: Add SMMUv3 to the virt board
+      ptimer: Add new ptimer_set_period_from_clock() function
-      hw/arm/virt-acpi-build: Add smmuv3 node in IORT table
+      clock: Add new clock_has_source() function
       tests: Add a simple test of the CMSDK APB timer
       tests: Add a simple test of the CMSDK APB watchdog
       tests: Add a simple test of the CMSDK APB dual timer
       hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
       hw/timer/cmsdk-apb-timer: Add Clock input
       hw/timer/cmsdk-apb-dualtimer: Add Clock input
       hw/watchdog/cmsdk-apb-watchdog: Add Clock input
       hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
       hw/arm/armsse: Wire up clocks
       hw/arm/mps2: Inline CMSDK_APB_TIMER creation
       hw/arm/mps2: Create and connect SYSCLK Clock
       hw/arm/mps2-tz: Create and connect ARMSSE Clocks
       hw/arm/musca: Create and connect ARMSSE Clocks
       hw/arm/stellaris: Convert SSYS to QOM device
       hw/arm/stellaris: Create Clock input for watchdog
       hw/timer/cmsdk-apb-timer: Convert to use Clock input
       hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
       hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
       tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
       hw/arm/armsse: Use Clock to set system_clock_scale
       arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
       arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
       hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS
 Philippe Mathieu-Daudé (1):
       target/arm: Replace magic value by MMU_DATA_LOAD definition
 Richard Henderson (2):
-      target/arm: Tidy conditions in handle_vec_simd_shri
+      target/arm: Implement ID_PFR2
-      target/arm: Tidy condition in disas_simd_two_reg_misc
+      target/arm: Conditionalize DBGDIDR
-Thomas Huth (1):
+ docs/devel/clocks.rst                    |  16 +++
-      hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+ docs/specs/pci-ids.txt                   |   1 +
  docs/specs/pvpanic.txt                   |  13 ++-
  docs/system/arm/virt.rst                 |   2 +
  configure                                |  78 ++++++++------
  meson.build                              |  34 ++++++-
  include/hw/arm/armsse.h                  |  14 ++-
  include/hw/arm/virt.h                    |   2 +
  include/hw/clock.h                       |  15 +++
  include/hw/misc/pvpanic.h                |  24 ++++-
  include/hw/pci/pci.h                     |   1 +
  include/hw/ptimer.h                      |  22 ++++
  include/hw/timer/cmsdk-apb-dualtimer.h   |   5 +-
  include/hw/timer/cmsdk-apb-timer.h       |  34 ++-----
  include/hw/watchdog/cmsdk-apb-watchdog.h |   5 +-
  include/qemu/osdep.h                     |  12 +++
  include/qemu/typedefs.h                  |   1 +
  target/arm/cpu.h                         |   1 +
  hw/arm/armsse.c                          |  48 ++++++---
  hw/arm/mps2-tz.c                         |  14 ++-
  hw/arm/mps2.c                            |  28 ++++-
  hw/arm/musca.c                           |  13 ++-
  hw/arm/stellaris.c                       | 170 +++++++++++++++++++++++--------
  hw/arm/virt.c                            | 111 ++++++++++++++++----
  hw/arm/xlnx-zcu102.c                     |   4 +-
  hw/core/ptimer.c                         |  34 +++++++
  hw/gpio/gpio_pwr.c                       |  70 +++++++++++++
  hw/misc/npcm7xx_pwm.c                    |  23 ++++-
  hw/misc/pvpanic-isa.c                    |  94 +++++++++++++++++
  hw/misc/pvpanic-pci.c                    |  94 +++++++++++++++++
  hw/misc/pvpanic.c                        |  85 ++--------------
  hw/timer/cmsdk-apb-dualtimer.c           |  53 +++++++---
  hw/timer/cmsdk-apb-timer.c               |  55 +++++-----
  hw/watchdog/cmsdk-apb-watchdog.c         |  29 ++++--
  target/arm/helper.c                      |  27 +++--
  target/arm/kvm64.c                       |   2 +
  tests/qtest/cmsdk-apb-dualtimer-test.c   | 130 +++++++++++++++++++++++
  tests/qtest/cmsdk-apb-timer-test.c       |  75 ++++++++++++++
  tests/qtest/cmsdk-apb-watchdog-test.c    | 131 ++++++++++++++++++++++++
  tests/qtest/npcm7xx_pwm-test.c           |   4 +-
  tests/qtest/pvpanic-pci-test.c           |  94 +++++++++++++++++
  tests/qtest/xlnx-can-test.c              |  30 +++---
  MAINTAINERS                              |   3 +
  accel/hvf/entitlements.plist             |   8 ++
  hw/arm/Kconfig                           |   1 +
  hw/gpio/Kconfig                          |   3 +
  hw/gpio/meson.build                      |   1 +
  hw/i386/Kconfig                          |   2 +-
  hw/misc/Kconfig                          |  12 ++-
  hw/misc/meson.build                      |   4 +-
  scripts/entitlement.sh                   |  13 +++
  tests/qtest/meson.build                  |   6 +-
 files changed, 1432 insertions(+), 319 deletions(-)
  create mode 100644 hw/gpio/gpio_pwr.c
  create mode 100644 hw/misc/pvpanic-isa.c
  create mode 100644 hw/misc/pvpanic-pci.c
  create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
  create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
  create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
  create mode 100644 tests/qtest/pvpanic-pci-test.c
  create mode 100644 accel/hvf/entitlements.plist
  create mode 100755 scripts/entitlement.sh
- hw/arm/Makefile.objs                |    1 +
- hw/arm/smmu-internal.h              |   99 +++
- hw/arm/smmuv3-internal.h            |  621 ++++++++++++++++++
- include/hw/acpi/acpi-defs.h         |   15 +
- include/hw/arm/smmu-common.h        |  145 +++++
- include/hw/arm/smmuv3.h             |   87 +++
- include/hw/arm/virt.h               |   10 +
- hw/arm/boot.c                       |    2 +-
- hw/arm/omap1.c                      |    8 +-
- hw/arm/omap2.c                      |    8 +-
- hw/arm/pxa2xx.c                     |   15 +-
- hw/arm/smmu-common.c                |  372 +++++++++++
- hw/arm/smmuv3.c                     | 1191 +++++++++++++++++++++++++++++++++++
- hw/arm/virt-acpi-build.c            |   55 +-
- hw/arm/virt.c                       |  101 ++-
- hw/char/cmsdk-apb-uart.c            |    1 +
- hw/net/smc91c111.c                  |   54 +-
- hw/usb/tusb6010.c                   |   40 +-
- target/arm/helper.c                 |    2 +-
- target/arm/kvm.c                    |   38 +-
- target/arm/translate-a64.c          |   12 +-
- target/arm/translate.c              |   17 +-
- default-configs/aarch64-softmmu.mak |    1 +
- hw/arm/trace-events                 |   37 ++
- target/arm/trace-events             |    3 +
-files changed, 2868 insertions(+), 67 deletions(-)
- create mode 100644 hw/arm/smmu-internal.h
- create mode 100644 hw/arm/smmuv3-internal.h
- create mode 100644 include/hw/arm/smmu-common.h
- create mode 100644 include/hw/arm/smmuv3.h
- create mode 100644 hw/arm/smmu-common.c
- create mode 100644 hw/arm/smmuv3.c

-[Qemu-devel] [PULL 07/24] target/arm: Tidy conditions in handle_vec_simd_shri
+[PULL 01/46] target/arm: Implement ID_PFR2
 From: Richard Henderson <richard.henderson@linaro.org>
-The (size > 3 && !is_q) condition is identical to the preceeding test
+This was defined at some point before ARMv8.4, and will
-of bit 3 in immh; eliminate it.  For the benefit of Coverity, assert
+shortly be used by new processor descriptions.
 that size is within the bounds we expect.
-Fixes: Coverity CID1385846
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Fixes: Coverity CID1385849
 Fixes: Coverity CID1385852
 Fixes: Coverity CID1385857
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20210120204400.1056582-1-richard.henderson@linaro.org
 Message-id: 20180501180455.11214-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 6 +-----
+ target/arm/cpu.h    | 1 +
-file changed, 1 insertion(+), 5 deletions(-)
+ target/arm/helper.c | 4 ++--
  target/arm/kvm64.c  | 2 ++
 files changed, 5 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/cpu.h
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-         unallocated_encoding(s);
+         uint32_t id_mmfr4;
-         return;
+         uint32_t id_pfr0;
-     }
+         uint32_t id_pfr1;
--
++        uint32_t id_pfr2;
--    if (size > 3 && !is_q) {
+         uint32_t mvfr0;
--        unallocated_encoding(s);
+         uint32_t mvfr1;
--        return;
+         uint32_t mvfr2;
--    }
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-+    tcg_debug_assert(size <= 3);
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
-     if (!fp_access_check(s)) {
++++ b/target/arm/helper.c
-         return;
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .access = PL1_R, .type = ARM_CP_CONST,
                .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
 -            { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
 +            { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
                .accessfn = access_aa64_tid3,
 -              .resetvalue = 0 },
 +              .resetvalue = cpu->isar.id_pfr2 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                                ARM64_SYS_REG(3, 0, 0, 1, 0));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
                                ARM64_SYS_REG(3, 0, 0, 1, 1));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
 +                              ARM64_SYS_REG(3, 0, 0, 3, 4));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                                ARM64_SYS_REG(3, 0, 0, 1, 2));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 08/24] target/arm: Tidy condition in disas_simd_two_reg_misc
+[PULL 02/46] target/arm: Conditionalize DBGDIDR
 From: Richard Henderson <richard.henderson@linaro.org>
-Path analysis shows that size == 3 && !is_q has been eliminated.
+Only define the register if it exists for the cpu.
-Fixes: Coverity CID1385853
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20210120031656.737646-1-richard.henderson@linaro.org
-Message-id: 20180501180455.11214-3-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 6 +++++-
+ target/arm/helper.c | 21 +++++++++++++++------
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 15 insertions(+), 6 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
-         /* All 64-bit element operations can be shared with scalar 2misc */
+      */
-         int pass;
+     int i;
+     int wrps, brps, ctx_cmps;
--        for (pass = 0; pass < (is_q ? 2 : 1); pass++) {
+-    ARMCPRegInfo dbgdidr = {
-+        /* Coverity claims (size == 3 && !is_q) has been eliminated
+-        .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
-+         * from all paths leading to here.
+-        .access = PL0_R, .accessfn = access_tda,
-+         */
+-        .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
-+        tcg_debug_assert(is_q);
+-    };
-+        for (pass = 0; pass < 2; pass++) {
++
-             TCGv_i64 tcg_op = tcg_temp_new_i64();
++    /*
-             TCGv_i64 tcg_res = tcg_temp_new_i64();
++     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
++     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
 +     * the register must not exist for this cpu.
 +     */
 +    if (cpu->isar.dbgdidr != 0) {
 +        ARMCPRegInfo dbgdidr = {
 +            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
 +            .opc1 = 0, .opc2 = 0,
 +            .access = PL0_R, .accessfn = access_tda,
 +            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
 +        };
 +        define_one_arm_cp_reg(cpu, &dbgdidr);
 +    }
      /* Note that all these register fields hold "number of Xs minus 1". */
      brps = arm_num_brps(cpu);
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
      assert(ctx_cmps <= brps);
 -    define_one_arm_cp_reg(cpu, &dbgdidr);
      define_arm_cp_regs(cpu, debug_cp_reginfo);
      if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 06/24] arm: boot: set boot_info starting from first_cpu
+[PULL 03/46] arm: rename xlnx-zcu102.canbusN properties
-From: Igor Mammedov <imammedo@redhat.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-Even though nothing is currently broken (since all boards
+The properties to attach a CANBUS object to the xlnx-zcu102 machine have
-use first_cpu as boot cpu), make sure that boot_info is set
+a period in them.  We want to use periods in properties for compound QAPI types,
-on all CPUs.
+and besides the "xlnx-zcu102." prefix is both unnecessary and different
-If some board would like support heterogenuos setup (i.e.
+from any other machine property name.  Remove it.
 init boot_info on subset of CPUs) in future, it should add
 a reasonable API to do it, instead of starting assigning
 boot_info from some CPU and till the end of present CPUs
 list.
-Ref:
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-"Message-ID: <CAFEAcA_NMWuA8WSs3cNeY6xX1kerO_uAcN_3=fK02BEhHJW86g@mail.gmail.com>"
+Message-id: 20210118162537.779542-1-pbonzini@redhat.com
+Reviewed-by: Vikram Garhwal <fnu.vikram@xilinx.com>
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1525176522-200354-5-git-send-email-imammedo@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/boot.c | 2 +-
+ hw/arm/xlnx-zcu102.c        |  4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+ tests/qtest/xlnx-can-test.c | 30 +++++++++++++++---------------
 files changed, 17 insertions(+), 17 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/boot.c
++++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
-     }
+     s->secure = false;
-     info->is_linux = is_linux;
+     /* Default to virt (EL2) being disabled */
+     s->virt = false;
--    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
+-    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
-+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
++    object_property_add_link(obj, "canbus0", TYPE_CAN_BUS,
-         ARM_CPU(cs)->env.boot_info = info;
+                              (Object **)&s->canbus[0],
-     }
+                              object_property_allow_set_link,
- }
+);
 -    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
 +    object_property_add_link(obj, "canbus1", TYPE_CAN_BUS,
                               (Object **)&s->canbus[1],
                               object_property_allow_set_link,
 );
 diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/xlnx-can-test.c
 +++ b/tests/qtest/xlnx-can-test.c
@@ -XXX,XX +XXX,XX @@ static void test_can_bus(void)
      uint8_t can_timestamp = 1;
      QTestState *qts = qtest_init("-machine xlnx-zcu102"
 -                " -object can-bus,id=canbus0"
 -                " -machine xlnx-zcu102.canbus0=canbus0"
 -                " -machine xlnx-zcu102.canbus1=canbus0"
 +                " -object can-bus,id=canbus"
 +                " -machine canbus0=canbus"
 +                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
      uint32_t status = 0;
      QTestState *qts = qtest_init("-machine xlnx-zcu102"
 -                " -object can-bus,id=canbus0"
 -                " -machine xlnx-zcu102.canbus0=canbus0"
 -                " -machine xlnx-zcu102.canbus1=canbus0"
 +                " -object can-bus,id=canbus"
 +                " -machine canbus0=canbus"
 +                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0 in loopback mode. */
@@ -XXX,XX +XXX,XX @@ static void test_can_filter(void)
      uint8_t can_timestamp = 1;
      QTestState *qts = qtest_init("-machine xlnx-zcu102"
 -                " -object can-bus,id=canbus0"
 -                " -machine xlnx-zcu102.canbus0=canbus0"
 -                " -machine xlnx-zcu102.canbus1=canbus0"
 +                " -object can-bus,id=canbus"
 +                " -machine canbus0=canbus"
 +                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_sleepmode(void)
      uint8_t can_timestamp = 1;
      QTestState *qts = qtest_init("-machine xlnx-zcu102"
 -                " -object can-bus,id=canbus0"
 -                " -machine xlnx-zcu102.canbus0=canbus0"
 -                " -machine xlnx-zcu102.canbus1=canbus0"
 +                " -object can-bus,id=canbus"
 +                " -machine canbus0=canbus"
 +                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0. */
@@ -XXX,XX +XXX,XX @@ static void test_can_snoopmode(void)
      uint8_t can_timestamp = 1;
      QTestState *qts = qtest_init("-machine xlnx-zcu102"
 -                " -object can-bus,id=canbus0"
 -                " -machine xlnx-zcu102.canbus0=canbus0"
 -                " -machine xlnx-zcu102.canbus1=canbus0"
 +                " -object can-bus,id=canbus"
 +                " -machine canbus0=canbus"
 +                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0. */
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 14/24] hw/arm/smmuv3: Skeleton
+[PULL 04/46] hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-This patch implements a skeleton for the smmuv3 device.
+Implement gpio-pwr driver to allow reboot and poweroff machine.
-Datatypes and register definitions are introduced. The MMIO
+This is simple driver with just 2 gpios lines. Current use case
-region, the interrupts and the queue are initialized.
+is to reboot and poweroff virt machine in secure mode. Secure
 pl066 gpio chip is needed for that.
-Only the MMIO read operation is implemented here.
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-5-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs     |   2 +-
+ hw/gpio/gpio_pwr.c  | 70 +++++++++++++++++++++++++++++++++++++++++++++
- hw/arm/smmuv3-internal.h | 142 +++++++++++++++
+ hw/gpio/Kconfig     |  3 ++
- include/hw/arm/smmuv3.h  |  87 ++++++++++
+ hw/gpio/meson.build |  1 +
- hw/arm/smmuv3.c          | 366 +++++++++++++++++++++++++++++++++++++++
+files changed, 74 insertions(+)
- hw/arm/trace-events      |   3 +
+ create mode 100644 hw/gpio/gpio_pwr.c
 files changed, 599 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/smmuv3-internal.h
  create mode 100644 include/hw/arm/smmuv3.h
  create mode 100644 hw/arm/smmuv3.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
  obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
  obj-$(CONFIG_IOTKIT) += iotkit.o
  obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
 -obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
 +obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/gpio/gpio_pwr.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ARM SMMUv3 support - Internal API
++ * GPIO qemu power controller
 + *
-+ * Copyright (C) 2014-2016 Broadcom Corporation
++ * Copyright (c) 2020 Linaro Limited
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Written by Prem Mallappa, Eric Auger
 + *
-+ * This program is free software; you can redistribute it and/or modify
++ * Author: Maxim Uvarov <maxim.uvarov@linaro.org>
 + * it under the terms of the GNU General Public License version 2 as
 + * published by the Free Software Foundation.
 + *
-+ * This program is distributed in the hope that it will be useful,
++ * Virtual gpio driver which can be used on top of pl061
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * to reboot and shutdown qemu virtual machine. One of use
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * case is gpio driver for secure world application (ARM
-+ * GNU General Public License for more details.
++ * Trusted Firmware.).
 + *
-+ * You should have received a copy of the GNU General Public License along
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
++ * See the COPYING file in the top-level directory.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
-+#ifndef HW_ARM_SMMU_V3_INTERNAL_H
-+#define HW_ARM_SMMU_V3_INTERNAL_H
-+
-+#include "hw/arm/smmu-common.h"
-+
-+/* MMIO Registers */
-+
-+REG32(IDR0,                0x0)
-+    FIELD(IDR0, S1P,         1 , 1)
-+    FIELD(IDR0, TTF,         2 , 2)
-+    FIELD(IDR0, COHACC,      4 , 1)
-+    FIELD(IDR0, ASID16,      12, 1)
-+    FIELD(IDR0, TTENDIAN,    21, 2)
-+    FIELD(IDR0, STALL_MODEL, 24, 2)
-+    FIELD(IDR0, TERM_MODEL,  26, 1)
-+    FIELD(IDR0, STLEVEL,     27, 2)
-+
-+REG32(IDR1,                0x4)
-+    FIELD(IDR1, SIDSIZE,      0 , 6)
-+    FIELD(IDR1, EVENTQS,      16, 5)
-+    FIELD(IDR1, CMDQS,        21, 5)
-+
-+#define SMMU_IDR1_SIDSIZE 16
-+#define SMMU_CMDQS   19
-+#define SMMU_EVENTQS 19
-+
-+REG32(IDR2,                0x8)
-+REG32(IDR3,                0xc)
-+REG32(IDR4,                0x10)
-+REG32(IDR5,                0x14)
-+     FIELD(IDR5, OAS,         0, 3);
-+     FIELD(IDR5, GRAN4K,      4, 1);
-+     FIELD(IDR5, GRAN16K,     5, 1);
-+     FIELD(IDR5, GRAN64K,     6, 1);
-+
-+#define SMMU_IDR5_OAS 4
-+
-+REG32(IIDR,                0x1c)
-+REG32(CR0,                 0x20)
-+    FIELD(CR0, SMMU_ENABLE,   0, 1)
-+    FIELD(CR0, EVENTQEN,      2, 1)
-+    FIELD(CR0, CMDQEN,        3, 1)
-+
-+REG32(CR0ACK,              0x24)
-+REG32(CR1,                 0x28)
-+REG32(CR2,                 0x2c)
-+REG32(STATUSR,             0x40)
-+REG32(IRQ_CTRL,            0x50)
-+    FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
-+    FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
-+    FIELD(IRQ_CTRL, EVENTQ_IRQEN,        2, 1)
-+
-+REG32(IRQ_CTRL_ACK,        0x54)
-+REG32(GERROR,              0x60)
-+    FIELD(GERROR, CMDQ_ERR,           0, 1)
-+    FIELD(GERROR, EVENTQ_ABT_ERR,     2, 1)
-+    FIELD(GERROR, PRIQ_ABT_ERR,       3, 1)
-+    FIELD(GERROR, MSI_CMDQ_ABT_ERR,   4, 1)
-+    FIELD(GERROR, MSI_EVENTQ_ABT_ERR, 5, 1)
-+    FIELD(GERROR, MSI_PRIQ_ABT_ERR,   6, 1)
-+    FIELD(GERROR, MSI_GERROR_ABT_ERR, 7, 1)
-+    FIELD(GERROR, MSI_SFM_ERR,        8, 1)
-+
-+REG32(GERRORN,             0x64)
-+
-+#define A_GERROR_IRQ_CFG0  0x68 /* 64b */
-+REG32(GERROR_IRQ_CFG1, 0x70)
-+REG32(GERROR_IRQ_CFG2, 0x74)
-+
-+#define A_STRTAB_BASE      0x80 /* 64b */
-+
-+#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
-+
-+REG32(STRTAB_BASE_CFG,     0x88)
-+    FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
-+    FIELD(STRTAB_BASE_CFG, SPLIT,    6 , 5)
-+    FIELD(STRTAB_BASE_CFG, LOG2SIZE, 0 , 6)
-+
-+#define A_CMDQ_BASE        0x90 /* 64b */
-+REG32(CMDQ_PROD,           0x98)
-+REG32(CMDQ_CONS,           0x9c)
-+    FIELD(CMDQ_CONS, ERR, 24, 7)
-+
-+#define A_EVENTQ_BASE      0xa0 /* 64b */
-+REG32(EVENTQ_PROD,         0xa8)
-+REG32(EVENTQ_CONS,         0xac)
-+
-+#define A_EVENTQ_IRQ_CFG0  0xb0 /* 64b */
-+REG32(EVENTQ_IRQ_CFG1,     0xb8)
-+REG32(EVENTQ_IRQ_CFG2,     0xbc)
-+
-+#define A_IDREGS           0xfd0
-+
-+static inline int smmu_enabled(SMMUv3State *s)
-+{
-+    return FIELD_EX32(s->cr[0], CR0, SMMU_ENABLE);
-+}
-+
-+/* Command Queue Entry */
-+typedef struct Cmd {
-+    uint32_t word[4];
-+} Cmd;
-+
-+/* Event Queue Entry */
-+typedef struct Evt  {
-+    uint32_t word[8];
-+} Evt;
-+
-+static inline uint32_t smmuv3_idreg(int regoffset)
-+{
-+    /*
-+     * Return the value of the Primecell/Corelink ID registers at the
-+     * specified offset from the first ID register.
-+     * These value indicate an ARM implementation of MMU600 p1
-+     */
-+    static const uint8_t smmuv3_ids[] = {
-+        0x04, 0, 0, 0, 0x84, 0xB4, 0xF0, 0x10, 0x0D, 0xF0, 0x05, 0xB1
-+    };
-+    return smmuv3_ids[regoffset / 4];
-+}
-+
-+#endif
-diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@
 +/*
-+ * Copyright (C) 2014-2016 Broadcom Corporation
++ * QEMU interface:
-+ * Copyright (c) 2017 Red Hat, Inc.
++ * two named input GPIO lines:
-+ * Written by Prem Mallappa, Eric Auger
++ *   'reset' : when asserted, trigger system reset
-+ *
++ *   'shutdown' : when asserted, trigger system shutdown
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 as
 + * published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_ARM_SMMUV3_H
 +#define HW_ARM_SMMUV3_H
 +
 +#include "hw/arm/smmu-common.h"
 +#include "hw/registerfields.h"
 +
 +#define TYPE_SMMUV3_IOMMU_MEMORY_REGION "smmuv3-iommu-memory-region"
 +
 +typedef struct SMMUQueue {
 +     uint64_t base; /* base register */
 +     uint32_t prod;
 +     uint32_t cons;
 +     uint8_t entry_size;
 +     uint8_t log2size;
 +} SMMUQueue;
 +
 +typedef struct SMMUv3State {
 +    SMMUState     smmu_state;
 +
 +    uint32_t features;
 +    uint8_t sid_size;
 +    uint8_t sid_split;
 +
 +    uint32_t idr[6];
 +    uint32_t iidr;
 +    uint32_t cr[3];
 +    uint32_t cr0ack;
 +    uint32_t statusr;
 +    uint32_t irq_ctrl;
 +    uint32_t gerror;
 +    uint32_t gerrorn;
 +    uint64_t gerror_irq_cfg0;
 +    uint32_t gerror_irq_cfg1;
 +    uint32_t gerror_irq_cfg2;
 +    uint64_t strtab_base;
 +    uint32_t strtab_base_cfg;
 +    uint64_t eventq_irq_cfg0;
 +    uint32_t eventq_irq_cfg1;
 +    uint32_t eventq_irq_cfg2;
 +
 +    SMMUQueue eventq, cmdq;
 +
 +    qemu_irq     irq[4];
 +} SMMUv3State;
 +
 +typedef enum {
 +    SMMU_IRQ_EVTQ,
 +    SMMU_IRQ_PRIQ,
 +    SMMU_IRQ_CMD_SYNC,
 +    SMMU_IRQ_GERROR,
 +} SMMUIrq;
 +
 +typedef struct {
 +    /*< private >*/
 +    SMMUBaseClass smmu_base_class;
 +    /*< public >*/
 +
 +    DeviceRealize parent_realize;
 +    DeviceReset   parent_reset;
 +} SMMUv3Class;
 +
 +#define TYPE_ARM_SMMUV3   "arm-smmuv3"
 +#define ARM_SMMUV3(obj) OBJECT_CHECK(SMMUv3State, (obj), TYPE_ARM_SMMUV3)
 +#define ARM_SMMUV3_CLASS(klass)                              \
 +    OBJECT_CLASS_CHECK(SMMUv3Class, (klass), TYPE_ARM_SMMUV3)
 +#define ARM_SMMUV3_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(SMMUv3Class, (obj), TYPE_ARM_SMMUV3)
 +
 +#endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Copyright (C) 2014-2016 Broadcom Corporation
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Written by Prem Mallappa, Eric Auger
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 as
 + * published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "hw/boards.h"
-+#include "sysemu/sysemu.h"
 +#include "hw/sysbus.h"
-+#include "hw/qdev-core.h"
++#include "sysemu/runstate.h"
 +#include "hw/pci/pci.h"
 +#include "exec/address-spaces.h"
 +#include "trace.h"
 +#include "qemu/log.h"
 +#include "qemu/error-report.h"
 +#include "qapi/error.h"
 +
-+#include "hw/arm/smmuv3.h"
++#define TYPE_GPIOPWR "gpio-pwr"
-+#include "smmuv3-internal.h"
++OBJECT_DECLARE_SIMPLE_TYPE(GPIO_PWR_State, GPIOPWR)
 +
-+static void smmuv3_init_regs(SMMUv3State *s)
++struct GPIO_PWR_State {
 +    SysBusDevice parent_obj;
 +};
 +
 +static void gpio_pwr_reset(void *opaque, int n, int level)
 +{
-+    /**
++    if (level) {
-+     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +     *       multi-level stream table
 +     */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
 +    /* terminated transaction will always be aborted/error returned */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
 +    /* 2-level stream table supported */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
 +
 +    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
 +    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
 +    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
 +
 +   /* 4K and 64K granule support */
 +    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
 +    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
 +    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
 +
 +    s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
 +    s->cmdq.prod = 0;
 +    s->cmdq.cons = 0;
 +    s->cmdq.entry_size = sizeof(struct Cmd);
 +    s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
 +    s->eventq.prod = 0;
 +    s->eventq.cons = 0;
 +    s->eventq.entry_size = sizeof(struct Evt);
 +
 +    s->features = 0;
 +    s->sid_split = 0;
 +}
 +
 +static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
 +                                   unsigned size, MemTxAttrs attrs)
 +{
 +    /* not yet implemented */
 +    return MEMTX_ERROR;
 +}
 +
 +static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
 +                               uint64_t *data, MemTxAttrs attrs)
 +{
 +    switch (offset) {
 +    case A_GERROR_IRQ_CFG0:
 +        *data = s->gerror_irq_cfg0;
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE:
 +        *data = s->strtab_base;
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE:
 +        *data = s->cmdq.base;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE:
 +        *data = s->eventq.base;
 +        return MEMTX_OK;
 +    default:
 +        *data = 0;
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
-+static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
++static void gpio_pwr_shutdown(void *opaque, int n, int level)
 +                              uint64_t *data, MemTxAttrs attrs)
 +{
-+    switch (offset) {
++    if (level) {
-+    case A_IDREGS ... A_IDREGS + 0x1f:
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +        *data = smmuv3_idreg(offset - A_IDREGS);
 +        return MEMTX_OK;
 +    case A_IDR0 ... A_IDR5:
 +        *data = s->idr[(offset - A_IDR0) / 4];
 +        return MEMTX_OK;
 +    case A_IIDR:
 +        *data = s->iidr;
 +        return MEMTX_OK;
 +    case A_CR0:
 +        *data = s->cr[0];
 +        return MEMTX_OK;
 +    case A_CR0ACK:
 +        *data = s->cr0ack;
 +        return MEMTX_OK;
 +    case A_CR1:
 +        *data = s->cr[1];
 +        return MEMTX_OK;
 +    case A_CR2:
 +        *data = s->cr[2];
 +        return MEMTX_OK;
 +    case A_STATUSR:
 +        *data = s->statusr;
 +        return MEMTX_OK;
 +    case A_IRQ_CTRL:
 +    case A_IRQ_CTRL_ACK:
 +        *data = s->irq_ctrl;
 +        return MEMTX_OK;
 +    case A_GERROR:
 +        *data = s->gerror;
 +        return MEMTX_OK;
 +    case A_GERRORN:
 +        *data = s->gerrorn;
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0: /* 64b */
 +        *data = extract64(s->gerror_irq_cfg0, 0, 32);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0 + 4:
 +        *data = extract64(s->gerror_irq_cfg0, 32, 32);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG1:
 +        *data = s->gerror_irq_cfg1;
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG2:
 +        *data = s->gerror_irq_cfg2;
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE: /* 64b */
 +        *data = extract64(s->strtab_base, 0, 32);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE + 4: /* 64b */
 +        *data = extract64(s->strtab_base, 32, 32);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE_CFG:
 +        *data = s->strtab_base_cfg;
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE: /* 64b */
 +        *data = extract64(s->cmdq.base, 0, 32);
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE + 4:
 +        *data = extract64(s->cmdq.base, 32, 32);
 +        return MEMTX_OK;
 +    case A_CMDQ_PROD:
 +        *data = s->cmdq.prod;
 +        return MEMTX_OK;
 +    case A_CMDQ_CONS:
 +        *data = s->cmdq.cons;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE: /* 64b */
 +        *data = extract64(s->eventq.base, 0, 32);
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE + 4: /* 64b */
 +        *data = extract64(s->eventq.base, 32, 32);
 +        return MEMTX_OK;
 +    case A_EVENTQ_PROD:
 +        *data = s->eventq.prod;
 +        return MEMTX_OK;
 +    case A_EVENTQ_CONS:
 +        *data = s->eventq.cons;
 +        return MEMTX_OK;
 +    default:
 +        *data = 0;
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
-+static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
++static void gpio_pwr_init(Object *obj)
 +                                  unsigned size, MemTxAttrs attrs)
 +{
-+    SMMUState *sys = opaque;
++    DeviceState *dev = DEVICE(obj);
 +    SMMUv3State *s = ARM_SMMUV3(sys);
 +    MemTxResult r;
 +
-+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
++    qdev_init_gpio_in_named(dev, gpio_pwr_reset, "reset", 1);
-+    offset &= ~0x10000;
++    qdev_init_gpio_in_named(dev, gpio_pwr_shutdown, "shutdown", 1);
 +
 +    switch (size) {
 +    case 8:
 +        r = smmu_readll(s, offset, data, attrs);
 +        break;
 +    case 4:
 +        r = smmu_readl(s, offset, data, attrs);
 +        break;
 +    default:
 +        r = MEMTX_ERROR;
 +        break;
 +    }
 +
 +    trace_smmuv3_read_mmio(offset, *data, size, r);
 +    return r;
 +}
 +
-+static const MemoryRegionOps smmu_mem_ops = {
++static const TypeInfo gpio_pwr_info = {
-+    .read_with_attrs = smmu_read_mmio,
++    .name          = TYPE_GPIOPWR,
-+    .write_with_attrs = smmu_write_mmio,
++    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++    .instance_size = sizeof(GPIO_PWR_State),
-+    .valid = {
++    .instance_init = gpio_pwr_init,
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    },
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    },
 +};
 +
-+static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
++static void gpio_pwr_register_types(void)
 +{
-+    int i;
++    type_register_static(&gpio_pwr_info);
 +
 +    for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
 +        sysbus_init_irq(dev, &s->irq[i]);
 +    }
 +}
 +
-+static void smmu_reset(DeviceState *dev)
++type_init(gpio_pwr_register_types)
-+{
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
-+    SMMUv3State *s = ARM_SMMUV3(dev);
+index XXXXXXX..XXXXXXX 100644
-+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
+--- a/hw/gpio/Kconfig
 +++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config PL061
  config GPIO_KEY
      bool
 +config GPIO_PWR
 +    bool
 +
-+    c->parent_reset(dev);
+ config SIFIVE_GPIO
-+
+     bool
-+    smmuv3_init_regs(s);
+diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 +}
 +
 +static void smmu_realize(DeviceState *d, Error **errp)
 +{
 +    SMMUState *sys = ARM_SMMU(d);
 +    SMMUv3State *s = ARM_SMMUV3(sys);
 +    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
 +    SysBusDevice *dev = SYS_BUS_DEVICE(d);
 +    Error *local_err = NULL;
 +
 +    c->parent_realize(d, &local_err);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +
 +    memory_region_init_io(&sys->iomem, OBJECT(s),
 +                          &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
 +
 +    sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
 +
 +    sysbus_init_mmio(dev, &sys->iomem);
 +
 +    smmu_init_irq(s, dev);
 +}
 +
 +static const VMStateDescription vmstate_smmuv3_queue = {
 +    .name = "smmuv3_queue",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT64(base, SMMUQueue),
 +        VMSTATE_UINT32(prod, SMMUQueue),
 +        VMSTATE_UINT32(cons, SMMUQueue),
 +        VMSTATE_UINT8(log2size, SMMUQueue),
 +    },
 +};
 +
 +static const VMStateDescription vmstate_smmuv3 = {
 +    .name = "smmuv3",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(features, SMMUv3State),
 +        VMSTATE_UINT8(sid_size, SMMUv3State),
 +        VMSTATE_UINT8(sid_split, SMMUv3State),
 +
 +        VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
 +        VMSTATE_UINT32(cr0ack, SMMUv3State),
 +        VMSTATE_UINT32(statusr, SMMUv3State),
 +        VMSTATE_UINT32(irq_ctrl, SMMUv3State),
 +        VMSTATE_UINT32(gerror, SMMUv3State),
 +        VMSTATE_UINT32(gerrorn, SMMUv3State),
 +        VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
 +        VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
 +        VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
 +        VMSTATE_UINT64(strtab_base, SMMUv3State),
 +        VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
 +        VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
 +        VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
 +        VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
 +
 +        VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
 +        VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
 +
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void smmuv3_instance_init(Object *obj)
 +{
 +    /* Nothing much to do here as of now */
 +}
 +
 +static void smmuv3_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_smmuv3;
 +    device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
 +    c->parent_realize = dc->realize;
 +    dc->realize = smmu_realize;
 +}
 +
 +static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
 +                                                  void *data)
 +{
 +}
 +
 +static const TypeInfo smmuv3_type_info = {
 +    .name          = TYPE_ARM_SMMUV3,
 +    .parent        = TYPE_ARM_SMMU,
 +    .instance_size = sizeof(SMMUv3State),
 +    .instance_init = smmuv3_instance_init,
 +    .class_size    = sizeof(SMMUv3Class),
 +    .class_init    = smmuv3_class_init,
 +};
 +
 +static const TypeInfo smmuv3_iommu_memory_region_info = {
 +    .parent = TYPE_IOMMU_MEMORY_REGION,
 +    .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
 +    .class_init = smmuv3_iommu_memory_region_class_init,
 +};
 +
 +static void smmuv3_register_types(void)
 +{
 +    type_register(&smmuv3_type_info);
 +    type_register(&smmuv3_iommu_memory_region_info);
 +}
 +
 +type_init(smmuv3_register_types)
 +
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
+--- a/hw/gpio/meson.build
-+++ b/hw/arm/trace-events
++++ b/hw/gpio/meson.build
-@@ -XXX,XX +XXX,XX @@ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr,
+@@ -XXX,XX +XXX,XX @@
- smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
+ softmmu_ss.add(when: 'CONFIG_E500', if_true: files('mpc8xxx.c'))
- smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
+ softmmu_ss.add(when: 'CONFIG_GPIO_KEY', if_true: files('gpio_key.c'))
- smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
++softmmu_ss.add(when: 'CONFIG_GPIO_PWR', if_true: files('gpio_pwr.c'))
-+
+ softmmu_ss.add(when: 'CONFIG_MAX7310', if_true: files('max7310.c'))
-+#hw/arm/smmuv3.c
+ softmmu_ss.add(when: 'CONFIG_PL061', if_true: files('pl061.c'))
-+smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+ softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_gpio.c'))
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 24/24] hw/arm/virt: Introduce the iommu option
+[PULL 05/46] arm-virt: refactor gpios creation
-From: Eric Auger <eric.auger@redhat.com>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-ARM virt machine now exposes a new "iommu" option.
+No functional change. Just refactor code to better
-The SMMUv3 IOMMU is instantiated using -machine virt,iommu=smmuv3.
+support secure and normal world gpios.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-15-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 36 ++++++++++++++++++++++++++++++++++++
+ hw/arm/virt.c | 57 ++++++++++++++++++++++++++++++++-------------------
-file changed, 36 insertions(+)
+file changed, 36 insertions(+), 21 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
      }
  }
-+static char *virt_get_iommu(Object *obj, Error **errp)
+-static void create_gpio(const VirtMachineState *vms)
 +static void create_gpio_keys(const VirtMachineState *vms,
 +                             DeviceState *pl061_dev,
 +                             uint32_t phandle)
 +{
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
++    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
 +                                        qdev_get_gpio_in(pl061_dev, 3));
 +
-+    switch (vms->iommu) {
++    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
-+    case VIRT_IOMMU_NONE:
++    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
-+        return g_strdup("none");
++    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
-+    case VIRT_IOMMU_SMMUV3:
++    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
-+        return g_strdup("smmuv3");
++
-+    default:
++    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
-+        g_assert_not_reached();
++    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
-+    }
++                            "label", "GPIO Key Poweroff");
 +    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
 +                          KEY_POWER);
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
 +                           "gpios", phandle, 3, 0);
 +}
 +
-+static void virt_set_iommu(Object *obj, const char *value, Error **errp)
++static void create_gpio_devices(const VirtMachineState *vms, int gpio,
-+{
++                                MemoryRegion *mem)
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
+ {
      char *nodename;
      DeviceState *pl061_dev;
 -    hwaddr base = vms->memmap[VIRT_GPIO].base;
 -    hwaddr size = vms->memmap[VIRT_GPIO].size;
 -    int irq = vms->irqmap[VIRT_GPIO];
 +    hwaddr base = vms->memmap[gpio].base;
 +    hwaddr size = vms->memmap[gpio].size;
 +    int irq = vms->irqmap[gpio];
      const char compat[] = "arm,pl061\0arm,primecell";
 +    SysBusDevice *s;
 -    pl061_dev = sysbus_create_simple("pl061", base,
 -                                     qdev_get_gpio_in(vms->gic, irq));
 +    pl061_dev = qdev_new("pl061");
 +    s = SYS_BUS_DEVICE(pl061_dev);
 +    sysbus_realize_and_unref(s, &error_fatal);
 +    memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(vms->gic, irq));
      uint32_t phandle = qemu_fdt_alloc_phandle(vms->fdt);
      nodename = g_strdup_printf("/pl061@%" PRIx64, base);
@@ -XXX,XX +XXX,XX @@ static void create_gpio(const VirtMachineState *vms)
      qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
      qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 -    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
 -                                        qdev_get_gpio_in(pl061_dev, 3));
 -    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
 -    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
 -
 -    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
 -    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
 -                            "label", "GPIO Key Poweroff");
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
 -                          KEY_POWER);
 -    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
 -                           "gpios", phandle, 3, 0);
      g_free(nodename);
 +
-+    if (!strcmp(value, "smmuv3")) {
++    /* Child gpio devices */
-+        vms->iommu = VIRT_IOMMU_SMMUV3;
++    create_gpio_keys(vms, pl061_dev, phandle);
-+    } else if (!strcmp(value, "none")) {
+ }
-+        vms->iommu = VIRT_IOMMU_NONE;
-+    } else {
+ static void create_virtio_devices(const VirtMachineState *vms)
-+        error_setg(errp, "Invalid iommu value");
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-+        error_append_hint(errp, "Valid values are none, smmuv3.\n");
+     if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
-+    }
+         vms->acpi_dev = create_acpi_ged(vms);
-+}
+     } else {
-+
+-        create_gpio(vms);
- static CpuInstanceProperties
++        create_gpio_devices(vms, VIRT_GPIO, sysmem);
  virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
  {
@@ -XXX,XX +XXX,XX @@ static void virt_2_12_instance_init(Object *obj)
                                          NULL);
      }
-+    /* Default disallows iommu instantiation */
+      /* connect powerdown request */
 +    vms->iommu = VIRT_IOMMU_NONE;
 +    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu, NULL);
 +    object_property_set_description(obj, "iommu",
 +                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3",
 +                                    NULL);
 +
      vms->memmap = a15memmap;
      vms->irqmap = a15irqmap;
  }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 22/24] hw/arm/virt: Add SMMUv3 to the virt board
+[PULL 06/46] arm-virt: add secure pl061 for reset/power down
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-Add code to instantiate an smmuv3 in virt machine. A new iommu
+Add secure pl061 for reset/power down machine from
-integer member is introduced in VirtMachineState to store the type
+the secure world (Arm Trusted Firmware). Connect it
-of the iommu in use.
+with gpio-pwr driver.
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: Added mention of the new device to the documentation]
 Message-id: 1524665762-31355-13-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h | 10 +++++++
+ docs/system/arm/virt.rst |  2 ++
- hw/arm/virt.c         | 64 ++++++++++++++++++++++++++++++++++++++++++-
+ include/hw/arm/virt.h    |  2 ++
-files changed, 73 insertions(+), 1 deletion(-)
+ hw/arm/virt.c            | 56 +++++++++++++++++++++++++++++++++++++++-
  hw/arm/Kconfig           |  1 +
 files changed, 60 insertions(+), 1 deletion(-)
+diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/virt.rst
++++ b/docs/system/arm/virt.rst
+@@ -XXX,XX +XXX,XX @@ The virt board supports:
+ - Secure-World-only devices if the CPU has TrustZone:
+   - A second PL011 UART
++  - A second PL061 GPIO controller, with GPIO lines for triggering
++    a system reset or system poweroff
+   - A secure flash memory
+   - 16MB of secure RAM
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
-@@ -XXX,XX +XXX,XX @@
- #define NUM_GICV2M_SPIS       64
- #define NUM_VIRTIO_TRANSPORTS 32
-+#define NUM_SMMU_IRQS          4
- #define ARCH_GICV3_MAINT_IRQ  9
 @@ -XXX,XX +XXX,XX @@ enum {
-     VIRT_GIC_V2M,
+     VIRT_GPIO,
-     VIRT_GIC_ITS,
+     VIRT_SECURE_UART,
      VIRT_GIC_REDIST,
 +    VIRT_SMMU,
      VIRT_UART,
      VIRT_MMIO,
      VIRT_RTC,
@@ -XXX,XX +XXX,XX @@ enum {
      VIRT_SECURE_MEM,
++    VIRT_SECURE_GPIO,
+     VIRT_PCDIMM_ACPI,
+     VIRT_ACPI_GED,
+     VIRT_NVDIMM_ACPI,
+@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+     bool kvm_no_adjvtime;
+     bool no_kvm_steal_time;
+     bool acpi_expose_flash;
++    bool no_secure_gpio;
  };
-+typedef enum VirtIOMMUType {
+ struct VirtMachineState {
 +    VIRT_IOMMU_NONE,
 +    VIRT_IOMMU_SMMUV3,
 +    VIRT_IOMMU_VIRTIO,
 +} VirtIOMMUType;
 +
  typedef struct MemMapEntry {
      hwaddr base;
      hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      bool its;
      bool virt;
      int32_t gic_version;
 +    VirtIOMMUType iommu;
      struct arm_boot_info bootinfo;
      const MemMapEntry *memmap;
      const int *irqmap;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint32_t clock_phandle;
      uint32_t gic_phandle;
      uint32_t msi_phandle;
 +    uint32_t iommu_phandle;
      int psci_conduit;
  } VirtMachineState;
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
- #include "hw/smbios/smbios.h"
+     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
- #include "qapi/visitor.h"
+     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
- #include "standard-headers/linux/input.h"
+     [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
-+#include "hw/arm/smmuv3.h"
++    [VIRT_SECURE_GPIO] =        { 0x090b0000, 0x00001000 },
  #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
      static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry a15memmap[] = {
      [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
      [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
      [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
 +    [VIRT_SMMU] =               { 0x09050000, 0x00020000 },
      [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
      /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
      [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
-@@ -XXX,XX +XXX,XX @@ static const int a15irqmap[] = {
+@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(const VirtMachineState *vms,
-     [VIRT_SECURE_UART] = 8,
+                            "gpios", phandle, 3, 0);
      [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
      [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
 +    [VIRT_SMMU] = 74,    /* ...to 74 + NUM_SMMU_IRQS - 1 */
      [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
  };
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(const VirtMachineState *vms,
 x7           /* PCI irq */);
  }
--static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
++#define SECURE_GPIO_POWEROFF 0
-+static void create_smmu(const VirtMachineState *vms, qemu_irq *pic,
++#define SECURE_GPIO_RESET    1
-+                        PCIBus *bus)
++
 +static void create_secure_gpio_pwr(const VirtMachineState *vms,
 +                                   DeviceState *pl061_dev,
 +                                   uint32_t phandle)
 +{
-+    char *node;
++    DeviceState *gpio_pwr_dev;
 +    const char compat[] = "arm,smmu-v3";
 +    int irq =  vms->irqmap[VIRT_SMMU];
 +    int i;
 +    hwaddr base = vms->memmap[VIRT_SMMU].base;
 +    hwaddr size = vms->memmap[VIRT_SMMU].size;
 +    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
 +    DeviceState *dev;
 +
-+    if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {
++    /* gpio-pwr */
-+        return;
++    gpio_pwr_dev = sysbus_create_simple("gpio-pwr", -1, NULL);
 +
 +    /* connect secure pl061 to gpio-pwr */
 +    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_RESET,
 +                          qdev_get_gpio_in_named(gpio_pwr_dev, "reset", 0));
 +    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_POWEROFF,
 +                          qdev_get_gpio_in_named(gpio_pwr_dev, "shutdown", 0));
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-poweroff");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "compatible",
 +                            "gpio-poweroff");
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-poweroff",
 +                           "gpios", phandle, SECURE_GPIO_POWEROFF, 0);
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "status", "disabled");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "secure-status",
 +                            "okay");
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-restart");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "compatible",
 +                            "gpio-restart");
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-restart",
 +                           "gpios", phandle, SECURE_GPIO_RESET, 0);
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "status", "disabled");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "secure-status",
 +                            "okay");
 +}
 +
  static void create_gpio_devices(const VirtMachineState *vms, int gpio,
                                  MemoryRegion *mem)
  {
@@ -XXX,XX +XXX,XX @@ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
      qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
      qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 +    if (gpio != VIRT_GPIO) {
 +        /* Mark as not usable by the normal world */
 +        qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
 +        qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
 +    }
      g_free(nodename);
      /* Child gpio devices */
 -    create_gpio_keys(vms, pl061_dev, phandle);
 +    if (gpio == VIRT_GPIO) {
 +        create_gpio_keys(vms, pl061_dev, phandle);
 +    } else {
 +        create_secure_gpio_pwr(vms, pl061_dev, phandle);
 +    }
  }
  static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
          create_gpio_devices(vms, VIRT_GPIO, sysmem);
      }
 +    if (vms->secure && !vmc->no_secure_gpio) {
 +        create_gpio_devices(vms, VIRT_SECURE_GPIO, secure_sysmem);
 +    }
 +
-+    dev = qdev_create(NULL, "arm-smmuv3");
+      /* connect powerdown request */
       vms->powerdown_notifier.notify = virt_powerdown_req;
       qemu_register_powerdown_notifier(&vms->powerdown_notifier);
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 0)
  static void virt_machine_5_2_options(MachineClass *mc)
  {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
-+    object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",
+     virt_machine_6_0_options(mc);
-+                             &error_abort);
+     compat_props_add(mc->compat_props, hw_compat_5_2, hw_compat_5_2_len);
-+    qdev_init_nofail(dev);
++    vmc->no_secure_gpio = true;
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 +    for (i = 0; i < NUM_SMMU_IRQS; i++) {
 +        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
 +    }
 +
 +    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
 +    qemu_fdt_add_subnode(vms->fdt, node);
 +    qemu_fdt_setprop(vms->fdt, node, "compatible", compat, sizeof(compat));
 +    qemu_fdt_setprop_sized_cells(vms->fdt, node, "reg", 2, base, 2, size);
 +
 +    qemu_fdt_setprop_cells(vms->fdt, node, "interrupts",
 +            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
 +            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
 +            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
 +            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
 +
 +    qemu_fdt_setprop(vms->fdt, node, "interrupt-names", irq_names,
 +                     sizeof(irq_names));
 +
 +    qemu_fdt_setprop_cell(vms->fdt, node, "clocks", vms->clock_phandle);
 +    qemu_fdt_setprop_string(vms->fdt, node, "clock-names", "apb_pclk");
 +    qemu_fdt_setprop(vms->fdt, node, "dma-coherent", NULL, 0);
 +
 +    qemu_fdt_setprop_cell(vms->fdt, node, "#iommu-cells", 1);
 +
 +    qemu_fdt_setprop_cell(vms->fdt, node, "phandle", vms->iommu_phandle);
 +    g_free(node);
 +}
 +
 +static void create_pcie(VirtMachineState *vms, qemu_irq *pic)
  {
      hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;
      hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
      qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);
      create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);
 +    if (vms->iommu) {
 +        vms->iommu_phandle = qemu_fdt_alloc_phandle(vms->fdt);
 +
 +        create_smmu(vms, pic, pci->bus);
 +
 +        qemu_fdt_setprop_cells(vms->fdt, nodename, "iommu-map",
 +                               0x0, vms->iommu_phandle, 0x0, 0x10000);
 +    }
 +
      g_free(nodename);
  }
+ DEFINE_VIRT_MACHINE(5, 2)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
      select PL011 # UART
      select PL031 # RTC
      select PL061 # GPIO
 +    select GPIO_PWR
      select PLATFORM_BUS
      select SMBIOS
      select VIRTIO_MMIO
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 09/24] hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+[PULL 07/46] hw/misc: Fix arith overflow in NPCM7XX PWM module
-From: Thomas Huth <thuth@redhat.com>
+From: Hao Wu <wuhaotsh@google.com>
-When running omap1/2 or pxa2xx based ARM machines with -nodefaults,
+Fix potential overflow problem when calculating pwm_duty.
-they bail out immediately complaining about a "missing SecureDigital
+. Ensure p->cmr and p->cnr to be from [0,65535], according to the
-device". That's not how the "default" devices in vl.c are meant to
+   hardware specification.
-work - it should be possible for a board to also start up without
+. Changed duty to uint32_t. However, since MAX_DUTY * (p->cmr+1)
-default devices. So let's turn the error message and exit() into
+   can excceed UINT32_MAX, we convert them to uint64_t in computation
-a warning instead.
+   and converted them back to uint32_t.
    (duty is guaranteed to be <= MAX_DUTY so it won't overflow.)
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+Fixes: CID 1442342
-Message-id: 1525326811-3233-1-git-send-email-thuth@redhat.com
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Doug Evans <dje@google.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210127011142.2122790-1-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/omap1.c  |  8 ++++----
+ hw/misc/npcm7xx_pwm.c          | 23 +++++++++++++++++++----
- hw/arm/omap2.c  |  8 ++++----
+ tests/qtest/npcm7xx_pwm-test.c |  4 ++--
- hw/arm/pxa2xx.c | 15 +++++++--------
+files changed, 21 insertions(+), 6 deletions(-)
 files changed, 15 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/omap1.c
+--- a/hw/misc/npcm7xx_pwm.c
-+++ b/hw/arm/omap1.c
++++ b/hw/misc/npcm7xx_pwm.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_PWM_PWDR3, 0x50);
- #include "hw/arm/soc_dma.h"
+ #define NPCM7XX_CH_INV              BIT(2)
- #include "sysemu/block-backend.h"
+ #define NPCM7XX_CH_MOD              BIT(3)
- #include "sysemu/blockdev.h"
-+#include "sysemu/qtest.h"
++#define NPCM7XX_MAX_CMR             65535
- #include "qemu/range.h"
++#define NPCM7XX_MAX_CNR             65535
- #include "hw/sysbus.h"
++
- #include "qemu/cutils.h"
+ /* Offset of each PWM channel's prescaler in the PPR register. */
-@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
+ static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
-                                 omap_findclk(s, "dpll3"));
+ /* Offset of each PWM channel's clock selector in the CSR register. */
+@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
-     dinfo = drive_get(IF_SD, 0, 0);
--    if (!dinfo) {
+ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
--        error_report("missing SecureDigital device");
+ {
--        exit(1);
+-    uint64_t duty;
-+    if (!dinfo && !qtest_enabled()) {
++    uint32_t duty;
-+        warn_report("missing SecureDigital device");
      if (p->running) {
          if (p->cnr == 0) {
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
          } else if (p->cmr >= p->cnr) {
              duty = NPCM7XX_PWM_MAX_DUTY;
          } else {
 -            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
 +            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
          }
      } else {
          duty = 0;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
      case A_NPCM7XX_PWM_CNR2:
      case A_NPCM7XX_PWM_CNR3:
          p = &s->pwm[npcm7xx_cnr_index(offset)];
 -        p->cnr = value;
 +        if (value > NPCM7XX_MAX_CNR) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid cnr value: %u", __func__, value);
 +            p->cnr = NPCM7XX_MAX_CNR;
 +        } else {
 +            p->cnr = value;
 +        }
          npcm7xx_pwm_update_output(p);
          break;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
      case A_NPCM7XX_PWM_CMR2:
      case A_NPCM7XX_PWM_CMR3:
          p = &s->pwm[npcm7xx_cmr_index(offset)];
 -        p->cmr = value;
 +        if (value > NPCM7XX_MAX_CMR) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid cmr value: %u", __func__, value);
 +            p->cmr = NPCM7XX_MAX_CMR;
 +        } else {
 +            p->cmr = value;
 +        }
          npcm7xx_pwm_update_output(p);
          break;
 diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/npcm7xx_pwm-test.c
 +++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
  static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
  {
 -    uint64_t duty;
 +    uint32_t duty;
      if (cnr == 0) {
          /* PWM is stopped. */
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
      } else if (cmr >= cnr) {
          duty = MAX_DUTY;
      } else {
 -        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
 +        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
      }
-     s->mmc = omap_mmc_init(0xfffb7800, system_memory,
--                           blk_by_legacy_dinfo(dinfo),
+     if (inverted) {
 +                           dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                             qdev_get_gpio_in(s->ih[1], OMAP_INT_OQN),
                             &s->drq[OMAP_DMA_MMC_TX],
                      omap_findclk(s, "mmc_ck"));
 diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap2.c
 +++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "sysemu/block-backend.h"
  #include "sysemu/blockdev.h"
 +#include "sysemu/qtest.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
  #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
                               s->drq[OMAP24XX_DMA_GPMC]);
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = omap2_mmc_init(omap_l4tao(s->l4, 9),
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->ih[0], OMAP_INT_24XX_MMC_IRQ),
                      &s->drq[OMAP24XX_DMA_MMC1_TX],
                      omap_findclk(s, "mmc_fclk"), omap_findclk(s, "mmc_iclk"));
 diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx.c
 +++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char-fe.h"
  #include "sysemu/block-backend.h"
  #include "sysemu/blockdev.h"
 +#include "sysemu/qtest.h"
  #include "qemu/cutils.h"
  static struct {
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
      s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                      qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                      qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
      s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                      qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                      qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 02/24] target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case
+[PULL 08/46] target/arm: Replace magic value by MMU_DATA_LOAD definition
-From: Mathew Maidment <mathew1800@gmail.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The duplication of id_tlbtr_reginfo was unintentionally added within
+cpu_get_phys_page_debug() uses 'DATA LOAD' MMU access type.
 af8114c6b8ead02f08b58e3c36895c1ea047 which should have been
 id_mpuir_reginfo.
-The effect was that for OMAP and StrongARM CPUs we would
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-incorrectly UNDEF writes to MPUIR rather than NOPing them.
+Message-id: 20210127232822.3530782-1-f4bug@amsat.org
 Signed-off-by: Mathew Maidment <mathew1800@gmail.com>
 Message-id: 20180501184933.37609-2-mathew1800@gmail.com
 [PMM: tweak commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
-                 r->access = PL1_RW;
+     *attrs = (MemTxAttrs) {};
-             }
--            id_tlbtr_reginfo.access = PL1_RW;
+-    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-+            id_mpuir_reginfo.access = PL1_RW;
++    ret = get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &phys_addr,
-             id_tlbtr_reginfo.access = PL1_RW;
+                         attrs, &prot, &page_size, &fi, &cacheattrs);
-         }
-         if (arm_feature(env, ARM_FEATURE_V8)) {
+     if (ret) {
 --
-.17.0
+.20.1

-New patch
+[PULL 09/46] configure: Move preadv check to meson.build
+Move the preadv availability check to meson.build.  This is what we
+want to be doing for host-OS-feature-checks anyway, but it also fixes
+a problem with building for macOS with the most recent XCode SDK on a
+Catalina host.
+On that configuration, 'preadv()' is provided as a weak symbol, so
+that programs can be built with optional support for it and make a
+runtime availability check to see whether the preadv() they have is a
+working one or one which they must not call because it will
+runtime-assert.  QEMU's configure test passes (unless you're building
+with --enable-werror) because the test program using preadv()
+compiles, but then QEMU crashes at runtime when preadv() is called,
+with errors like:
+  dyld: lazy symbol binding failed: Symbol not found: _preadv
+    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
+    Expected in: /usr/lib/libSystem.B.dylib
+  dyld: Symbol not found: _preadv
+    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
+    Expected in: /usr/lib/libSystem.B.dylib
+Meson's own function availability check has a special case for macOS
+which adds '-Wl,-no_weak_imports' to the compiler flags, which forces
+the test to require the real function, not the macOS-version-too-old
+stub.
+So this commit fixes the bug where macOS builds on Catalina currently
+require --disable-werror.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20210126155846.17109-1-peter.maydell@linaro.org
+---
+ configure   | 16 ----------------
+ meson.build |  4 +++-
+files changed, 3 insertions(+), 17 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ if compile_prog "" "" ; then
+   iovec=yes
+ fi
+-##########################################
+-# preadv probe
+-cat > $TMPC <<EOF
+-#include <sys/types.h>
+-#include <sys/uio.h>
+-#include <unistd.h>
+-int main(void) { return preadv(0, 0, 0, 0); }
+-EOF
+-preadv=no
+-if compile_prog "" "" ; then
+-  preadv=yes
+-fi
+-
+ ##########################################
+ # fdt probe
+@@ -XXX,XX +XXX,XX @@ fi
+ if test "$iovec" = "yes" ; then
+   echo "CONFIG_IOVEC=y" >> $config_host_mak
+ fi
+-if test "$preadv" = "yes" ; then
+-  echo "CONFIG_PREADV=y" >> $config_host_mak
+-fi
+ if test "$membarrier" = "yes" ; then
+   echo "CONFIG_MEMBARRIER=y" >> $config_host_mak
+ fi
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
+ config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
+ config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
++config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
++
+ ignored = ['CONFIG_QEMU_INTERP_PREFIX'] # actually per-target
+ arrays = ['CONFIG_AUDIO_DRIVERS', 'CONFIG_BDRV_RW_WHITELIST', 'CONFIG_BDRV_RO_WHITELIST']
+ strings = ['HOST_DSOSUF', 'CONFIG_IASL']
+@@ -XXX,XX +XXX,XX @@ summary_info += {'PIE':               get_option('b_pie')}
+ summary_info += {'static build':      config_host.has_key('CONFIG_STATIC')}
+ summary_info += {'malloc trim support': has_malloc_trim}
+ summary_info += {'membarrier':        config_host.has_key('CONFIG_MEMBARRIER')}
+-summary_info += {'preadv support':    config_host.has_key('CONFIG_PREADV')}
++summary_info += {'preadv support':    config_host_data.get('CONFIG_PREADV')}
+ summary_info += {'fdatasync':         config_host.has_key('CONFIG_FDATASYNC')}
+ summary_info += {'madvise':           config_host.has_key('CONFIG_MADVISE')}
+ summary_info += {'posix_madvise':     config_host.has_key('CONFIG_POSIX_MADVISE')}
+--
+.20.1

-New patch
+[PULL 10/46] configure: cross-compiling with empty cross_prefix
+From: Joelle van Dyne <j@getutm.app>
+The iOS toolchain does not use the host prefix naming convention. So we
+need to enable cross-compile options while allowing the PREFIX to be
+blank.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-3-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ cpu=""
+ iasl="iasl"
+ interp_prefix="/usr/gnemul/qemu-%M"
+ static="no"
++cross_compile="no"
+ cross_prefix=""
+ audio_drv_list=""
+ block_drv_rw_whitelist=""
+@@ -XXX,XX +XXX,XX @@ for opt do
+   optarg=$(expr "x$opt" : 'x[^=]*=\(.*\)')
+   case "$opt" in
+   --cross-prefix=*) cross_prefix="$optarg"
++                    cross_compile="yes"
+   ;;
+   --cc=*) CC="$optarg"
+   ;;
+@@ -XXX,XX +XXX,XX @@ $(echo Deprecated targets: $deprecated_targets_list | \
+   --target-list-exclude=LIST exclude a set of targets from the default target-list
+ Advanced options (experts only):
+-  --cross-prefix=PREFIX    use PREFIX for compile tools [$cross_prefix]
++  --cross-prefix=PREFIX    use PREFIX for compile tools, PREFIX can be blank [$cross_prefix]
+   --cc=CC                  use C compiler CC [$cc]
+   --iasl=IASL              use ACPI compiler IASL [$iasl]
+   --host-cc=CC             use C compiler CC [$host_cc] for code run at
+@@ -XXX,XX +XXX,XX @@ if has $sdl2_config; then
+ fi
+ echo "strip = [$(meson_quote $strip)]" >> $cross
+ echo "windres = [$(meson_quote $windres)]" >> $cross
+-if test -n "$cross_prefix"; then
++if test "$cross_compile" = "yes"; then
+     cross_arg="--cross-file config-meson.cross"
+     echo "[host_machine]" >> $cross
+     if test "$mingw32" = "yes" ; then
+--
+.20.1

-[Qemu-devel] [PULL 03/24] hw/char/cmsdk-apb-uart.c: Accept more input after character read
+[PULL 11/46] osdep: build with non-working system() function
-From: Patrick Oppenlander <patrick.oppenlander@gmail.com>
+From: Joelle van Dyne <j@getutm.app>
-The character frontend needs to be notified that the uart receive buffer
+Build without error on hosts without a working system(). If system()
-is empty and ready to handle another character.
+is called, return -1 with ENOSYS.
-Previously, the uart only worked correctly when receiving one character
+Signed-off-by: Joelle van Dyne <j@getutm.app>
-at a time.
+Message-id: 20210126012457.39046-6-j@getutm.app
 Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
 Message-id: CAEg67GkRTw=cXei3o9hvpxG_L4zSrNzR0bFyAgny+sSEUb_kPw@mail.gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/cmsdk-apb-uart.c | 1 +
+ meson.build          |  1 +
-file changed, 1 insertion(+)
+ include/qemu/osdep.h | 12 ++++++++++++
 files changed, 13 insertions(+)
-diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cmsdk-apb-uart.c
+--- a/meson.build
-+++ b/hw/char/cmsdk-apb-uart.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
-         r = s->rxbuf;
+ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
-         s->state &= ~R_STATE_RXFULL_MASK;
+ config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
-         cmsdk_apb_uart_update(s);
+ config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
-+        qemu_chr_fe_accept_input(&s->chr);
++config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
-         break;
-     case A_STATE:
+ config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
-         r = s->state;
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ static inline void qemu_thread_jit_write(void) {}
  static inline void qemu_thread_jit_execute(void) {}
  #endif
 +/**
 + * Platforms which do not support system() return ENOSYS
 + */
 +#ifndef HAVE_SYSTEM_FUNCTION
 +#define system platform_does_not_support_system
 +static inline int platform_does_not_support_system(const char *command)
 +{
 +    errno = ENOSYS;
 +    return -1;
 +}
 +#endif /* !HAVE_SYSTEM_FUNCTION */
 +
  #endif
 --
-.17.0
+.20.1

-New patch
+[PULL 12/46] darwin: remove redundant dependency declaration
+From: Joelle van Dyne <j@getutm.app>
+Meson will find CoreFoundation, IOKit, and Cocoa as needed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-7-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 1 -
+file changed, 1 deletion(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ Darwin)
+   fi
+   audio_drv_list="coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+-  QEMU_LDFLAGS="-framework CoreFoundation -framework IOKit $QEMU_LDFLAGS"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+   # won't work when we're compiling with gcc as a C compiler.
+   QEMU_CFLAGS="-DOS_OBJECT_USE_OBJC=0 $QEMU_CFLAGS"
+--
+.20.1

-New patch
+[PULL 13/46] darwin: fix cross-compiling for Darwin
+From: Joelle van Dyne <j@getutm.app>
+Add objc to the Meson cross file as well as detection of Darwin.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210126012457.39046-8-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ echo "cpp_link_args = [${LDFLAGS:+$(meson_quote $LDFLAGS)}]" >> $cross
+ echo "[binaries]" >> $cross
+ echo "c = [$(meson_quote $cc)]" >> $cross
+ test -n "$cxx" && echo "cpp = [$(meson_quote $cxx)]" >> $cross
++test -n "$objcc" && echo "objc = [$(meson_quote $objcc)]" >> $cross
+ echo "ar = [$(meson_quote $ar)]" >> $cross
+ echo "nm = [$(meson_quote $nm)]" >> $cross
+ echo "pkgconfig = [$(meson_quote $pkg_config_exe)]" >> $cross
+@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
+     if test "$linux" = "yes" ; then
+         echo "system = 'linux'" >> $cross
+     fi
++    if test "$darwin" = "yes" ; then
++        echo "system = 'darwin'" >> $cross
++    fi
+     case "$ARCH" in
+         i386|x86_64)
+             echo "cpu_family = 'x86'" >> $cross
+--
+.20.1

-New patch
+[PULL 14/46] configure: cross compile should use x86_64 cpu_family
+From: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-9-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 5 ++++-
+file changed, 4 insertions(+), 1 deletion(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
+         echo "system = 'darwin'" >> $cross
+     fi
+     case "$ARCH" in
+-        i386|x86_64)
++        i386)
+             echo "cpu_family = 'x86'" >> $cross
+             ;;
++        x86_64)
++            echo "cpu_family = 'x86_64'" >> $cross
++            ;;
+         ppc64le)
+             echo "cpu_family = 'ppc64'" >> $cross
+             ;;
+--
+.20.1

-New patch
+[PULL 15/46] darwin: detect CoreAudio for build
+From: Joelle van Dyne <j@getutm.app>
+On iOS there is no CoreAudio, so we should not assume Darwin always
+has it.
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210126012457.39046-11-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 35 +++++++++++++++++++++++++++++++++--
+file changed, 33 insertions(+), 2 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fdt="auto"
+ netmap="no"
+ sdl="auto"
+ sdl_image="auto"
++coreaudio="auto"
+ virtiofsd="auto"
+ virtfs="auto"
+ libudev="auto"
+@@ -XXX,XX +XXX,XX @@ Darwin)
+     QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
+     QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
+   fi
+-  audio_drv_list="coreaudio try-sdl"
++  audio_drv_list="try-coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+   # won't work when we're compiling with gcc as a C compiler.
+@@ -XXX,XX +XXX,XX @@ EOF
+   fi
+ fi
++##########################################
++# detect CoreAudio
++if test "$coreaudio" != "no" ; then
++  coreaudio_libs="-framework CoreAudio"
++  cat > $TMPC << EOF
++#include <CoreAudio/CoreAudio.h>
++int main(void)
++{
++  return (int)AudioGetCurrentHostTime();
++}
++EOF
++  if compile_prog "" "$coreaudio_libs" ; then
++    coreaudio=yes
++  else
++    coreaudio=no
++  fi
++fi
++
+ ##########################################
+ # Sound support libraries probe
+@@ -XXX,XX +XXX,XX @@ for drv in $audio_drv_list; do
+     fi
+     ;;
+-    coreaudio)
++    coreaudio | try-coreaudio)
++    if test "$coreaudio" = "no"; then
++      if test "$drv" = "try-coreaudio"; then
++        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio//')
++      else
++        error_exit "$drv check failed" \
++                "Make sure to have the $drv is available."
++      fi
++    else
+       coreaudio_libs="-framework CoreAudio"
++      if test "$drv" = "try-coreaudio"; then
++        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio/coreaudio/')
++      fi
++    fi
+     ;;
+     dsound)
+--
+.20.1

-New patch
+[PULL 16/46] darwin: remove 64-bit build detection on 32-bit OS
+From: Joelle van Dyne <j@getutm.app>
+A workaround added in early days of 64-bit OSX forced x86_64 if the
+host machine had 64-bit support. This creates issues when cross-
+compiling for ARM64. Additionally, the user can always use --cpu=* to
+manually set the host CPU and therefore this workaround should be
+removed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-12-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 11 -----------
+file changed, 11 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fi
+ # the correct CPU with the --cpu option.
+ case $targetos in
+ Darwin)
+-  # on Leopard most of the system is 32-bit, so we have to ask the kernel if we can
+-  # run 64-bit userspace code.
+-  # If the user didn't specify a CPU explicitly and the kernel says this is
+-  # 64 bit hw, then assume x86_64. Otherwise fall through to the usual detection code.
+-  if test -z "$cpu" && test "$(sysctl -n hw.optional.x86_64)" = "1"; then
+-    cpu="x86_64"
+-  fi
+   HOST_DSOSUF=".dylib"
+   ;;
+ SunOS)
+@@ -XXX,XX +XXX,XX @@ OpenBSD)
+ Darwin)
+   bsd="yes"
+   darwin="yes"
+-  if [ "$cpu" = "x86_64" ] ; then
+-    QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
+-    QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
+-  fi
+   audio_drv_list="try-coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+--
+.20.1

-New patch
+[PULL 17/46] hvf: Add hypervisor entitlement to output binaries
+From: Alexander Graf <agraf@csgraf.de>
+In macOS 11, QEMU only gets access to Hypervisor.framework if it has the
+respective entitlement. Add an entitlement template and automatically self
+sign and apply the entitlement in the build.
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Tested-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ meson.build                  | 29 +++++++++++++++++++++++++----
+ accel/hvf/entitlements.plist |  8 ++++++++
+ scripts/entitlement.sh       | 13 +++++++++++++
+files changed, 46 insertions(+), 4 deletions(-)
+ create mode 100644 accel/hvf/entitlements.plist
+ create mode 100755 scripts/entitlement.sh
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
+     }]
+   endif
+   foreach exe: execs
+-    emulators += {exe['name']:
+-         executable(exe['name'], exe['sources'],
+-               install: true,
++    exe_name = exe['name']
++    exe_sign = 'CONFIG_HVF' in config_target
++    if exe_sign
++      exe_name += '-unsigned'
++    endif
++
++    emulator = executable(exe_name, exe['sources'],
++               install: not exe_sign,
+                c_args: c_args,
+                dependencies: arch_deps + deps + exe['dependencies'],
+                objects: lib.extract_all_objects(recursive: true),
+@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
+                link_depends: [block_syms, qemu_syms] + exe.get('link_depends', []),
+                link_args: link_args,
+                gui_app: exe['gui'])
+-    }
++
++    if exe_sign
++      emulators += {exe['name'] : custom_target(exe['name'],
++                   install: true,
++                   install_dir: get_option('bindir'),
++                   depends: emulator,
++                   output: exe['name'],
++                   command: [
++                     meson.current_source_dir() / 'scripts/entitlement.sh',
++                     meson.current_build_dir() / exe_name,
++                     meson.current_build_dir() / exe['name'],
++                     meson.current_source_dir() / 'accel/hvf/entitlements.plist'
++                   ])
++      }
++    else
++      emulators += {exe['name']: emulator}
++    endif
+     if 'CONFIG_TRACE_SYSTEMTAP' in config_host
+       foreach stp: [
+diff --git a/accel/hvf/entitlements.plist b/accel/hvf/entitlements.plist
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/accel/hvf/entitlements.plist
+@@ -XXX,XX +XXX,XX @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
++<plist version="1.0">
++<dict>
++    <key>com.apple.security.hypervisor</key>
++    <true/>
++</dict>
++</plist>
+diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh
+new file mode 100755
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/scripts/entitlement.sh
+@@ -XXX,XX +XXX,XX @@
++#!/bin/sh -e
++#
++# Helper script for the build process to apply entitlements
++
++SRC="$1"
++DST="$2"
++ENTITLEMENT="$3"
++
++trap 'rm "$DST.tmp"' exit
++cp -af "$SRC" "$DST.tmp"
++codesign --entitlements "$ENTITLEMENT" --force -s - "$DST.tmp"
++mv "$DST.tmp" "$DST"
++trap '' exit
+--
+.20.1

-[Qemu-devel] [PULL 13/24] hw/arm/smmu-common: VMSAv8-64 page table walk
+[PULL 18/46] hw/misc/pvpanic: split-out generic and bus dependent code
-From: Eric Auger <eric.auger@redhat.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-This patch implements the page table walk for VMSAv8-64.
+To ease the PCI device addition in next patches, split the code as follows:
+- generic code (read/write/setup) is being kept in pvpanic.c
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+- ISA dependent code moved to pvpanic-isa.c
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
-Message-id: 1524665762-31355-4-git-send-email-eric.auger@redhat.com
+Also, rename:
 - ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
 - TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
 - MemoryRegion io -> mr.
 - pvpanic_ioport_* in pvpanic_*.
 Update the build system with the new files and config structure.
 Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmu-internal.h       |  99 ++++++++++++++++
+ include/hw/misc/pvpanic.h | 23 +++++++++-
- include/hw/arm/smmu-common.h |  14 +++
+ hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
- hw/arm/smmu-common.c         | 222 +++++++++++++++++++++++++++++++++++
+ hw/misc/pvpanic.c         | 85 +++--------------------------------
- hw/arm/trace-events          |   9 +-
+ hw/i386/Kconfig           |  2 +-
-files changed, 343 insertions(+), 1 deletion(-)
+ hw/misc/Kconfig           |  6 ++-
- create mode 100644 hw/arm/smmu-internal.h
+ hw/misc/meson.build       |  3 +-
+ tests/qtest/meson.build   |  2 +-
-diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
+files changed, 130 insertions(+), 85 deletions(-)
  create mode 100644 hw/misc/pvpanic-isa.c
 diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/pvpanic.h
 +++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
  #include "qom/object.h"
 -#define TYPE_PVPANIC "pvpanic"
 +#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
  #define PVPANIC_IOPORT_PROP "ioport"
 +/* The bit of supported pv event, TODO: include uapi header and remove this */
 +#define PVPANIC_F_PANICKED      0
 +#define PVPANIC_F_CRASHLOADED   1
 +
 +/* The pv event value */
 +#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
 +#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
 +
 +/*
 + * PVPanicState for any device type
 + */
 +typedef struct PVPanicState PVPanicState;
 +struct PVPanicState {
 +    MemoryRegion mr;
 +    uint8_t events;
 +};
 +
 +void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
 +
  static inline uint16_t pvpanic_port(void)
  {
 -    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
 +    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
      if (!o) {
          return 0;
      }
 diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/smmu-internal.h
++++ b/hw/misc/pvpanic-isa.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ARM SMMU support - Internal API
++ * QEMU simulated pvpanic device.
 + *
-+ * Copyright (c) 2017 Red Hat, Inc.
++ * Copyright Fujitsu, Corp. 2013
 + * Copyright (C) 2014-2016 Broadcom Corporation
 + * Written by Prem Mallappa, Eric Auger
 + *
-+ * This program is free software; you can redistribute it and/or modify
++ * Authors:
-+ * it under the terms of the GNU General Public License version 2 as
++ *     Wen Congyang <wency@cn.fujitsu.com>
-+ * published by the Free Software Foundation.
++ *     Hu Tao <hutao@cn.fujitsu.com>
 + *
-+ * This program is distributed in the hope that it will be useful,
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * See the COPYING file in the top-level directory.
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * General Public License for more details.
 + *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_ARM_SMMU_INTERNAL_H
++#include "qemu/osdep.h"
-+#define HW_ARM_SMMU_INTERNAL_H
++#include "qemu/log.h"
-+
++#include "qemu/module.h"
-+#define TBI0(tbi) ((tbi) & 0x1)
++#include "sysemu/runstate.h"
-+#define TBI1(tbi) ((tbi) & 0x2 >> 1)
++
-+
++#include "hw/nvram/fw_cfg.h"
-+/* PTE Manipulation */
++#include "hw/qdev-properties.h"
-+
++#include "hw/misc/pvpanic.h"
-+#define ARM_LPAE_PTE_TYPE_SHIFT         0
++#include "qom/object.h"
-+#define ARM_LPAE_PTE_TYPE_MASK          0x3
++#include "hw/isa/isa.h"
 +
-+#define ARM_LPAE_PTE_TYPE_BLOCK         1
++OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
 +#define ARM_LPAE_PTE_TYPE_TABLE         3
 +
 +#define ARM_LPAE_L3_PTE_TYPE_RESERVED   1
 +#define ARM_LPAE_L3_PTE_TYPE_PAGE       3
 +
 +#define ARM_LPAE_PTE_VALID              (1 << 0)
 +
 +#define PTE_ADDRESS(pte, shift) \
 +    (extract64(pte, shift, 47 - shift + 1) << shift)
 +
 +#define is_invalid_pte(pte) (!(pte & ARM_LPAE_PTE_VALID))
 +
 +#define is_reserved_pte(pte, level)                                      \
 +    ((level == 3) &&                                                     \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_RESERVED))
 +
 +#define is_block_pte(pte, level)                                         \
 +    ((level < 3) &&                                                      \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_BLOCK))
 +
 +#define is_table_pte(pte, level)                                        \
 +    ((level < 3) &&                                                     \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_TABLE))
 +
 +#define is_page_pte(pte, level)                                         \
 +    ((level == 3) &&                                                    \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_PAGE))
 +
 +/* access permissions */
 +
 +#define PTE_AP(pte) \
 +    (extract64(pte, 6, 2))
 +
 +#define PTE_APTABLE(pte) \
 +    (extract64(pte, 61, 2))
 +
 +/*
-+ * TODO: At the moment all transactions are considered as privileged (EL1)
++ * PVPanicISAState for ISA device and
-+ * as IOMMU translation callback does not pass user/priv attributes.
++ * use ioport.
 + */
-+#define is_permission_fault(ap, perm) \
++struct PVPanicISAState {
-+    (((perm) & IOMMU_WO) && ((ap) & 0x2))
++    ISADevice parent_obj;
 +
-+#define PTE_AP_TO_PERM(ap) \
++    uint16_t ioport;
-+    (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
++    PVPanicState pvpanic;
-+
++};
-+/* Level Indexing */
++
-+
++static void pvpanic_isa_initfn(Object *obj)
 +static inline int level_shift(int level, int granule_sz)
 +{
-+    return granule_sz + (3 - level) * (granule_sz - 3);
++    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
 +
 +    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
 +}
 +
-+static inline uint64_t level_page_mask(int level, int granule_sz)
++static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
 +{
-+    return ~(MAKE_64BIT_MASK(0, level_shift(level, granule_sz)));
++    ISADevice *d = ISA_DEVICE(dev);
 +    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
 +    PVPanicState *ps = &s->pvpanic;
 +    FWCfgState *fw_cfg = fw_cfg_find();
 +    uint16_t *pvpanic_port;
 +
 +    if (!fw_cfg) {
 +        return;
 +    }
 +
 +    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
 +    *pvpanic_port = cpu_to_le16(s->ioport);
 +    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
 +                    sizeof(*pvpanic_port));
 +
 +    isa_register_ioport(d, &ps->mr, s->ioport);
 +}
 +
-+static inline
++static Property pvpanic_isa_properties[] = {
-+uint64_t iova_level_offset(uint64_t iova, int inputsize,
++    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
-+                           int level, int gsz)
++    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
 +{
-+    return ((iova & MAKE_64BIT_MASK(0, inputsize)) >> level_shift(level, gsz)) &
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+            MAKE_64BIT_MASK(0, gsz - 3);
++
 +    dc->realize = pvpanic_isa_realizefn;
 +    device_class_set_props(dc, pvpanic_isa_properties);
 +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 +}
 +
-+#endif
++static TypeInfo pvpanic_isa_info = {
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
++    .name          = TYPE_PVPANIC_ISA_DEVICE,
-index XXXXXXX..XXXXXXX 100644
++    .parent        = TYPE_ISA_DEVICE,
---- a/include/hw/arm/smmu-common.h
++    .instance_size = sizeof(PVPanicISAState),
-+++ b/include/hw/arm/smmu-common.h
++    .instance_init = pvpanic_isa_initfn,
-@@ -XXX,XX +XXX,XX @@ static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
++    .class_init    = pvpanic_isa_class_init,
- {
++};
-     return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
++
 +static void pvpanic_register_types(void)
 +{
 +    type_register_static(&pvpanic_isa_info);
 +}
 +
 +type_init(pvpanic_register_types)
 diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/pvpanic.c
 +++ b/hw/misc/pvpanic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/misc/pvpanic.h"
  #include "qom/object.h"
 -/* The bit of supported pv event, TODO: include uapi header and remove this */
 -#define PVPANIC_F_PANICKED      0
 -#define PVPANIC_F_CRASHLOADED   1
 -
 -/* The pv event value */
 -#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
 -#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
 -
 -typedef struct PVPanicState PVPanicState;
 -DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
 -                         TYPE_PVPANIC)
 -
  static void handle_event(int event)
  {
      static bool logged;
@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
      }
  }
-+
-+/**
+-#include "hw/isa/isa.h"
-+ * smmu_ptw - Perform the page table walk for a given iova / access flags
+-
-+ * pair, according to @cfg translation config
+-struct PVPanicState {
-+ */
+-    ISADevice parent_obj;
-+int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
+-
-+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info);
+-    MemoryRegion io;
-+
+-    uint16_t ioport;
-+/**
+-    uint8_t events;
-+ * select_tt - compute which translation table shall be used according to
+-};
-+ * the input iova and translation config and return the TT specific info
+-
-+ */
+ /* return supported events on read */
-+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova);
+-static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
-+
++static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
- #endif  /* HW_ARM_SMMU_COMMON */
+ {
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
+     PVPanicState *pvp = opaque;
-index XXXXXXX..XXXXXXX 100644
+     return pvp->events;
---- a/hw/arm/smmu-common.c
+ }
-+++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@
+-static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
++static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
- #include "qemu/error-report.h"
+                                  unsigned size)
- #include "hw/arm/smmu-common.h"
+ {
-+#include "smmu-internal.h"
+     handle_event(val);
-+
+ }
-+/* VMSAv8-64 Translation */
-+
+ static const MemoryRegionOps pvpanic_ops = {
-+/**
+-    .read = pvpanic_ioport_read,
-+ * get_pte - Get the content of a page table entry located at
+-    .write = pvpanic_ioport_write,
-+ * @base_addr[@index]
++    .read = pvpanic_read,
-+ */
++    .write = pvpanic_write,
-+static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
+     .impl = {
-+                   SMMUPTWEventInfo *info)
+         .min_access_size = 1,
-+{
+         .max_access_size = 1,
-+    int ret;
+     },
-+    dma_addr_t addr = baseaddr + index * sizeof(*pte);
+ };
-+
-+    /* TODO: guarantee 64-bit single-copy atomicity */
+-static void pvpanic_isa_initfn(Object *obj)
-+    ret = dma_memory_read(&address_space_memory, addr,
++void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
-+                          (uint8_t *)pte, sizeof(*pte));
+ {
-+
+-    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
-+    if (ret != MEMTX_OK) {
+-
-+        info->type = SMMU_PTW_ERR_WALK_EABT;
+-    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
-+        info->addr = addr;
++    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
-+        return -EINVAL;
+ }
-+    }
+-
-+    trace_smmu_get_pte(baseaddr, index, addr, *pte);
+-static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
-+    return 0;
+-{
-+}
+-    ISADevice *d = ISA_DEVICE(dev);
-+
+-    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
-+/* VMSAv8-64 Translation Table Format Descriptor Decoding */
+-    FWCfgState *fw_cfg = fw_cfg_find();
-+
+-    uint16_t *pvpanic_port;
-+/**
+-
-+ * get_page_pte_address - returns the L3 descriptor output address,
+-    if (!fw_cfg) {
-+ * ie. the page frame
+-        return;
-+ * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
+-    }
-+ */
+-
-+static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
+-    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
-+{
+-    *pvpanic_port = cpu_to_le16(s->ioport);
-+    return PTE_ADDRESS(pte, granule_sz);
+-    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
-+}
+-                    sizeof(*pvpanic_port));
-+
+-
-+/**
+-    isa_register_ioport(d, &s->io, s->ioport);
-+ * get_table_pte_address - return table descriptor output address,
+-}
-+ * ie. address of next level table
+-
-+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+-static Property pvpanic_isa_properties[] = {
-+ */
+-    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
-+static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
+-    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-+{
+-    DEFINE_PROP_END_OF_LIST(),
-+    return PTE_ADDRESS(pte, granule_sz);
+-};
-+}
+-
-+
+-static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
-+/**
+-{
-+ * get_block_pte_address - return block descriptor output address and block size
+-    DeviceClass *dc = DEVICE_CLASS(klass);
-+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+-
-+ */
+-    dc->realize = pvpanic_isa_realizefn;
-+static inline hwaddr get_block_pte_address(uint64_t pte, int level,
+-    device_class_set_props(dc, pvpanic_isa_properties);
-+                                           int granule_sz, uint64_t *bsz)
+-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-+{
+-}
-+    int n = (granule_sz - 3) * (4 - level) + 3;
+-
-+
+-static TypeInfo pvpanic_isa_info = {
-+    *bsz = 1 << n;
+-    .name          = TYPE_PVPANIC,
-+    return PTE_ADDRESS(pte, n);
+-    .parent        = TYPE_ISA_DEVICE,
-+}
+-    .instance_size = sizeof(PVPanicState),
-+
+-    .instance_init = pvpanic_isa_initfn,
-+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
+-    .class_init    = pvpanic_isa_class_init,
-+{
+-};
-+    bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
+-
-+    uint8_t tbi_byte = tbi * 8;
+-static void pvpanic_register_types(void)
-+
+-{
-+    if (cfg->tt[0].tsz &&
+-    type_register_static(&pvpanic_isa_info);
-+        !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
+-}
-+        /* there is a ttbr0 region and we are in it (high bits all zero) */
+-
-+        return &cfg->tt[0];
+-type_init(pvpanic_register_types)
-+    } else if (cfg->tt[1].tsz &&
+diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-+           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
+index XXXXXXX..XXXXXXX 100644
-+        /* there is a ttbr1 region and we are in it (high bits all one) */
+--- a/hw/i386/Kconfig
-+        return &cfg->tt[1];
++++ b/hw/i386/Kconfig
-+    } else if (!cfg->tt[0].tsz) {
+@@ -XXX,XX +XXX,XX @@ config PC
-+        /* ttbr0 region is "everything not in the ttbr1 region" */
+     imply ISA_DEBUG
-+        return &cfg->tt[0];
+     imply PARALLEL
-+    } else if (!cfg->tt[1].tsz) {
+     imply PCI_DEVICES
-+        /* ttbr1 region is "everything not in the ttbr0 region" */
+-    imply PVPANIC
-+        return &cfg->tt[1];
++    imply PVPANIC_ISA
-+    }
+     imply QXL
-+    /* in the gap between the two regions, this is a Translation fault */
+     imply SEV
-+    return NULL;
+     imply SGA
-+}
+diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
-+
+index XXXXXXX..XXXXXXX 100644
-+/**
+--- a/hw/misc/Kconfig
-+ * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
++++ b/hw/misc/Kconfig
-+ * @cfg: translation config
+@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
-+ * @iova: iova to translate
+ config IOTKIT_SYSINFO
-+ * @perm: access type
+     bool
-+ * @tlbe: IOMMUTLBEntry (out)
-+ * @info: handle to an error info
+-config PVPANIC
-+ *
++config PVPANIC_COMMON
-+ * Return 0 on success, < 0 on error. In case of error, @info is filled
++    bool
-+ * and tlbe->perm is set to IOMMU_NONE.
++
-+ * Upon success, @tlbe is filled with translated_addr and entry
++config PVPANIC_ISA
-+ * permission rights.
+     bool
-+ */
+     depends on ISA_BUS
-+static int smmu_ptw_64(SMMUTransCfg *cfg,
++    select PVPANIC_COMMON
-+                       dma_addr_t iova, IOMMUAccessFlags perm,
-+                       IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+ config AUX
-+{
+     bool
-+    dma_addr_t baseaddr, indexmask;
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
-+    int stage = cfg->stage;
+index XXXXXXX..XXXXXXX 100644
-+    SMMUTransTableInfo *tt = select_tt(cfg, iova);
+--- a/hw/misc/meson.build
-+    uint8_t level, granule_sz, inputsize, stride;
++++ b/hw/misc/meson.build
-+
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
-+    if (!tt || tt->disabled) {
+ softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
-+        info->type = SMMU_PTW_ERR_TRANSLATION;
+ softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
-+        goto error;
+ softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
-+    }
++softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
-+
-+    granule_sz = tt->granule_sz;
+ # ARM devices
-+    stride = granule_sz - 3;
+ softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
-+    inputsize = 64 - tt->tsz;
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
-+    level = 4 - (inputsize - 4) / stride;
+ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
-+    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+ softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
-+    baseaddr = extract64(tt->ttb, 0, 48);
-+    baseaddr &= ~indexmask;
+-softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
-+
++softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
-+    tlbe->iova = iova;
+ softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
-+    tlbe->addr_mask = (1 << granule_sz) - 1;
+ softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
-+
+ softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
-+    while (level <= 3) {
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+index XXXXXXX..XXXXXXX 100644
-+        uint64_t mask = subpage_size - 1;
+--- a/tests/qtest/meson.build
-+        uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
++++ b/tests/qtest/meson.build
-+        uint64_t pte;
+@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
-+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+   (config_host.has_key('CONFIG_LINUX') and                                                  \
-+        uint8_t ap;
+    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
-+
+   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
-+        if (get_pte(baseaddr, offset, &pte, info)) {
+-  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
-+                goto error;
++  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
-+        }
+   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
-+        trace_smmu_ptw_level(level, iova, subpage_size,
+   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
-+                             baseaddr, offset, pte);
+   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
 +
 +        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            info->type = SMMU_PTW_ERR_TRANSLATION;
 +            goto error;
 +        }
 +
 +        if (is_page_pte(pte, level)) {
 +            uint64_t gpa = get_page_pte_address(pte, granule_sz);
 +
 +            ap = PTE_AP(pte);
 +            if (is_permission_fault(ap, perm)) {
 +                info->type = SMMU_PTW_ERR_PERMISSION;
 +                goto error;
 +            }
 +
 +            tlbe->translated_addr = gpa + (iova & mask);
 +            tlbe->perm = PTE_AP_TO_PERM(ap);
 +            trace_smmu_ptw_page_pte(stage, level, iova,
 +                                    baseaddr, pte_addr, pte, gpa);
 +            return 0;
 +        }
 +        if (is_block_pte(pte, level)) {
 +            uint64_t block_size;
 +            hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
 +                                               &block_size);
 +
 +            ap = PTE_AP(pte);
 +            if (is_permission_fault(ap, perm)) {
 +                info->type = SMMU_PTW_ERR_PERMISSION;
 +                goto error;
 +            }
 +
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, iova, gpa,
 +                                     block_size >> 20);
 +
 +            tlbe->translated_addr = gpa + (iova & mask);
 +            tlbe->perm = PTE_AP_TO_PERM(ap);
 +            return 0;
 +        }
 +
 +        /* table pte */
 +        ap = PTE_APTABLE(pte);
 +
 +        if (is_permission_fault(ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +        baseaddr = get_table_pte_address(pte, granule_sz);
 +        level++;
 +    }
 +
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    tlbe->perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
 +/**
 + * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
 + *
 + * @cfg: translation configuration
 + * @iova: iova to translate
 + * @perm: tentative access type
 + * @tlbe: returned entry
 + * @info: ptw event handle
 + *
 + * return 0 on success
 + */
 +inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
 +             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    if (!cfg->aa64) {
 +        /*
 +         * This code path is not entered as we check this while decoding
 +         * the configuration data in the derived SMMU model.
 +         */
 +        g_assert_not_reached();
 +    }
 +
 +    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
 +}
  /**
   * The bus number is used for lookup when SID based invalidation occurs.
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
  virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
  # hw/arm/smmu-common.c
 -smmu_add_mr(const char *name) "%s"
 \ No newline at end of file
 +smmu_add_mr(const char *name) "%s"
 +smmu_page_walk(int stage, uint64_t baseaddr, int first_level, uint64_t start, uint64_t end) "stage=%d, baseaddr=0x%"PRIx64", first level=%d, start=0x%"PRIx64", end=0x%"PRIx64
 +smmu_lookup_table(int level, uint64_t baseaddr, int granule_sz, uint64_t start, uint64_t end, int flags, uint64_t subpage_size) "level=%d baseaddr=0x%"PRIx64" granule=%d, start=0x%"PRIx64" end=0x%"PRIx64" flags=%d subpage_size=0x%"PRIx64
 +smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%lx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 +smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 +smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 +smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 +smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 11/24] hw/arm/smmu-common: smmu base device and datatypes
+[PULL 19/46] hw/misc/pvpanic: add PCI interface support
-From: Eric Auger <eric.auger@redhat.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-The patch introduces the smmu base device and class for the ARM
+Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
-smmu. Devices for specific versions will be derived from this
+where the PCI specific routines reside and update the build system with the new
-base device.
+files and config structure.
-We also introduce some important datatypes.
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-2-git-send-email-eric.auger@redhat.com
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                |   1 +
+ docs/specs/pci-ids.txt    |  1 +
- include/hw/arm/smmu-common.h        | 123 ++++++++++++++++++++++++++++
+ include/hw/misc/pvpanic.h |  1 +
- hw/arm/smmu-common.c                |  81 ++++++++++++++++++
+ include/hw/pci/pci.h      |  1 +
- default-configs/aarch64-softmmu.mak |   1 +
+ hw/misc/pvpanic-pci.c     | 94 +++++++++++++++++++++++++++++++++++++++
-files changed, 206 insertions(+)
+ hw/misc/Kconfig           |  6 +++
- create mode 100644 include/hw/arm/smmu-common.h
+ hw/misc/meson.build       |  1 +
- create mode 100644 hw/arm/smmu-common.c
+files changed, 104 insertions(+)
  create mode 100644 hw/misc/pvpanic-pci.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/docs/specs/pci-ids.txt
-+++ b/hw/arm/Makefile.objs
++++ b/docs/specs/pci-ids.txt
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
+@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
- obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
+b36:000d  PCI xhci usb host adapter
- obj-$(CONFIG_IOTKIT) += iotkit.o
+b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
- obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
+b36:0010  PCIe NVMe device (-device nvme)
-+obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
++1b36:0011  PCI PVPanic device (-device pvpanic-pci)
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
  All these devices are documented in docs/specs.
 diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/pvpanic.h
 +++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
  #include "qom/object.h"
  #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
 +#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
  #define PVPANIC_IOPORT_PROP "ioport"
 diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/pci/pci.h
 +++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
  #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
  #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
  #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
 +#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
  #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
  #define FMT_PCIBUS                      PRIx64
 diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/arm/smmu-common.h
++++ b/hw/misc/pvpanic-pci.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ARM SMMU Support
++ * QEMU simulated PCI pvpanic device.
 + *
-+ * Copyright (C) 2015-2016 Broadcom Corporation
++ * Copyright (C) 2020 Oracle
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Written by Prem Mallappa, Eric Auger
 + *
-+ * This program is free software; you can redistribute it and/or modify
++ * Authors:
-+ * it under the terms of the GNU General Public License version 2 as
++ *     Mihai Carabas <mihai.carabas@oracle.com>
 + * published by the Free Software Foundation.
 + *
-+ * This program is distributed in the hope that it will be useful,
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * See the COPYING file in the top-level directory.
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + */
 +
 +#ifndef HW_ARM_SMMU_COMMON_H
 +#define HW_ARM_SMMU_COMMON_H
 +
 +#include "hw/sysbus.h"
 +#include "hw/pci/pci.h"
 +
 +#define SMMU_PCI_BUS_MAX      256
 +#define SMMU_PCI_DEVFN_MAX    256
 +
 +#define SMMU_MAX_VA_BITS      48
 +
 +/*
 + * Page table walk error types
 + */
 +typedef enum {
 +    SMMU_PTW_ERR_NONE,
 +    SMMU_PTW_ERR_WALK_EABT,   /* Translation walk external abort */
 +    SMMU_PTW_ERR_TRANSLATION, /* Translation fault */
 +    SMMU_PTW_ERR_ADDR_SIZE,   /* Address Size fault */
 +    SMMU_PTW_ERR_ACCESS,      /* Access fault */
 +    SMMU_PTW_ERR_PERMISSION,  /* Permission fault */
 +} SMMUPTWEventType;
 +
 +typedef struct SMMUPTWEventInfo {
 +    SMMUPTWEventType type;
 +    dma_addr_t addr; /* fetched address that induced an abort, if any */
 +} SMMUPTWEventInfo;
 +
 +typedef struct SMMUTransTableInfo {
 +    bool disabled;             /* is the translation table disabled? */
 +    uint64_t ttb;              /* TT base address */
 +    uint8_t tsz;               /* input range, ie. 2^(64 -tsz)*/
 +    uint8_t granule_sz;        /* granule page shift */
 +} SMMUTransTableInfo;
 +
 +/*
 + * Generic structure populated by derived SMMU devices
 + * after decoding the configuration information and used as
 + * input to the page table walk
 + */
 +typedef struct SMMUTransCfg {
 +    int stage;                 /* translation stage */
 +    bool aa64;                 /* arch64 or aarch32 translation table */
 +    bool disabled;             /* smmu is disabled */
 +    bool bypassed;             /* translation is bypassed */
 +    bool aborted;              /* translation is aborted */
 +    uint64_t ttb;              /* TT base address */
 +    uint8_t oas;               /* output address width */
 +    uint8_t tbi;               /* Top Byte Ignore */
 +    uint16_t asid;
 +    SMMUTransTableInfo tt[2];
 +} SMMUTransCfg;
 +
 +typedef struct SMMUDevice {
 +    void               *smmu;
 +    PCIBus             *bus;
 +    int                devfn;
 +    IOMMUMemoryRegion  iommu;
 +    AddressSpace       as;
 +} SMMUDevice;
 +
 +typedef struct SMMUNotifierNode {
 +    SMMUDevice *sdev;
 +    QLIST_ENTRY(SMMUNotifierNode) next;
 +} SMMUNotifierNode;
 +
 +typedef struct SMMUPciBus {
 +    PCIBus       *bus;
 +    SMMUDevice   *pbdev[0]; /* Parent array is sparse, so dynamically alloc */
 +} SMMUPciBus;
 +
 +typedef struct SMMUState {
 +    /* <private> */
 +    SysBusDevice  dev;
 +    const char *mrtypename;
 +    MemoryRegion iomem;
 +
 +    GHashTable *smmu_pcibus_by_busptr;
 +    GHashTable *configs; /* cache for configuration data */
 +    GHashTable *iotlb;
 +    SMMUPciBus *smmu_pcibus_by_bus_num[SMMU_PCI_BUS_MAX];
 +    PCIBus *pci_bus;
 +    QLIST_HEAD(, SMMUNotifierNode) notifiers_list;
 +    uint8_t bus_num;
 +    PCIBus *primary_bus;
 +} SMMUState;
 +
 +typedef struct {
 +    /* <private> */
 +    SysBusDeviceClass parent_class;
 +
 +    /*< public >*/
 +
 +    DeviceRealize parent_realize;
 +
 +} SMMUBaseClass;
 +
 +#define TYPE_ARM_SMMU "arm-smmu"
 +#define ARM_SMMU(obj) OBJECT_CHECK(SMMUState, (obj), TYPE_ARM_SMMU)
 +#define ARM_SMMU_CLASS(klass)                                    \
 +    OBJECT_CLASS_CHECK(SMMUBaseClass, (klass), TYPE_ARM_SMMU)
 +#define ARM_SMMU_GET_CLASS(obj)                              \
 +    OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
 +
 +#endif  /* HW_ARM_SMMU_COMMON */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Copyright (C) 2014-2016 Broadcom Corporation
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Written by Prem Mallappa, Eric Auger
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 as
 + * published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * Author: Prem Mallappa <pmallapp@broadcom.com>
 + *
 + */
 +
 +#include "qemu/osdep.h"
-+#include "sysemu/sysemu.h"
++#include "qemu/log.h"
-+#include "exec/address-spaces.h"
++#include "qemu/module.h"
-+#include "trace.h"
++#include "sysemu/runstate.h"
-+#include "exec/target_page.h"
++
-+#include "qom/cpu.h"
++#include "hw/nvram/fw_cfg.h"
 +#include "hw/qdev-properties.h"
-+#include "qapi/error.h"
++#include "migration/vmstate.h"
 +#include "hw/misc/pvpanic.h"
 +#include "qom/object.h"
 +#include "hw/pci/pci.h"
 +
-+#include "qemu/error-report.h"
++OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
 +#include "hw/arm/smmu-common.h"
 +
-+static void smmu_base_realize(DeviceState *dev, Error **errp)
++/*
 + * PVPanicPCIState for PCI device
 + */
 +typedef struct PVPanicPCIState {
 +    PCIDevice dev;
 +    PVPanicState pvpanic;
 +} PVPanicPCIState;
 +
 +static const VMStateDescription vmstate_pvpanic_pci = {
 +    .name = "pvpanic-pci",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
 +{
-+    SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
++    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
-+    Error *local_err = NULL;
++    PVPanicState *ps = &s->pvpanic;
 +
-+    sbc->parent_realize(dev, &local_err);
++    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
-+    if (local_err) {
++
-+        error_propagate(errp, local_err);
++    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
 +        return;
 +    }
 +}
 +
-+static void smmu_base_reset(DeviceState *dev)
++static Property pvpanic_pci_properties[] = {
-+{
++    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
 +    /* will be filled later on */
 +}
 +
 +static Property smmu_dev_properties[] = {
 +    DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
 +    DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, "PCI", PCIBus *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
-+static void smmu_base_class_init(ObjectClass *klass, void *data)
++static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);
++    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
 +
-+    dc->props = smmu_dev_properties;
++    device_class_set_props(dc, pvpanic_pci_properties);
-+    device_class_set_parent_realize(dc, smmu_base_realize,
++
-+                                    &sbc->parent_realize);
++    pc->realize = pvpanic_pci_realizefn;
-+    dc->reset = smmu_base_reset;
++    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
 +    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
 +    pc->revision = 1;
 +    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
 +    dc->vmsd = &vmstate_pvpanic_pci;
 +
 +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 +}
 +
-+static const TypeInfo smmu_base_info = {
++static TypeInfo pvpanic_pci_info = {
-+    .name          = TYPE_ARM_SMMU,
++    .name          = TYPE_PVPANIC_PCI_DEVICE,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
++    .parent        = TYPE_PCI_DEVICE,
-+    .instance_size = sizeof(SMMUState),
++    .instance_size = sizeof(PVPanicPCIState),
-+    .class_data    = NULL,
++    .class_init    = pvpanic_pci_class_init,
-+    .class_size    = sizeof(SMMUBaseClass),
++    .interfaces = (InterfaceInfo[]) {
-+    .class_init    = smmu_base_class_init,
++        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-+    .abstract      = true,
++        { }
 +    }
 +};
 +
-+static void smmu_base_register_types(void)
++static void pvpanic_register_types(void)
 +{
-+    type_register_static(&smmu_base_info);
++    type_register_static(&pvpanic_pci_info);
 +}
 +
-+type_init(smmu_base_register_types)
++type_init(pvpanic_register_types);
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
  config PVPANIC_COMMON
      bool
 +config PVPANIC_PCI
 +    bool
 +    default y if PCI_DEVICES
 +    depends on PCI
 +    select PVPANIC_COMMON
 +
-diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
+ config PVPANIC_ISA
      bool
      depends on ISA_BUS
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/default-configs/aarch64-softmmu.mak
+--- a/hw/misc/meson.build
-+++ b/default-configs/aarch64-softmmu.mak
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
- CONFIG_DPCD=y
+ softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
- CONFIG_XLNX_ZYNQMP=y
- CONFIG_XLNX_ZYNQMP_ARM=y
+ softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
-+CONFIG_ARM_SMMUV3=y
++softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
  softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
  softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
  softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 01/24] hw/arm/virt: Add linux, pci-domain property
+[PULL 20/46] pvpanic : update pvpanic spec document
-From: Jan Kiszka <jan.kiszka@siemens.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-This allows to pin the host controller in the Linux PCI domain space.
+Add pvpanic PCI device support details in docs/specs/pvpanic.txt.
 Linux requires that property to be available consistently or not at all,
 in which case the domain number becomes unstable on additions/removals.
 Adding it here won't make a difference in practice for most setups as we
 only expose one controller.
-However, enabling Jailhouse on top may introduce another controller, and
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 that one would like to have stable address as well. So the property is
 needed for the first controller as well.
 Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
 Message-id: 3301c5bc-7b47-1b0e-8ce4-30435057a276@web.de
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 1 +
+ docs/specs/pvpanic.txt | 13 ++++++++++++-
-file changed, 1 insertion(+)
+file changed, 12 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/docs/specs/pvpanic.txt
-+++ b/hw/arm/virt.c
++++ b/docs/specs/pvpanic.txt
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@
-     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "pci");
+ PVPANIC DEVICE
-     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 3);
+ ==============
-     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 2);
-+    qemu_fdt_setprop_cell(vms->fdt, nodename, "linux,pci-domain", 0);
+-pvpanic device is a simulated ISA device, through which a guest panic
-     qemu_fdt_setprop_cells(vms->fdt, nodename, "bus-range", 0,
++pvpanic device is a simulated device, through which a guest panic
-                            nr_pcie_buses - 1);
+ event is sent to qemu, and a QMP event is generated. This allows
-     qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
+ management apps (e.g. libvirt) to be notified and respond to the event.
@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
  and/or polling for guest-panicked RunState, to learn when the pvpanic
  device has fired a panic event.
 +The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
 +PCI device.
 +
  ISA Interface
  -------------
@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
         the host should record it or report it, but should not affect
         the execution of the guest.
 +PCI Interface
 +-------------
 +
 +The PCI interface is similar to the ISA interface except that it uses an MMIO
 +address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
 +can enable a pvpanic device by adding '-device pvpanic-pci' to the command
 +line.
 +
  ACPI Interface
  --------------
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 19/24] hw/arm/smmuv3: Implement translate callback
+[PULL 21/46] tests/qtest: add a test case for pvpanic-pci
-From: Eric Auger <eric.auger@redhat.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-This patch implements the IOMMU Memory Region translate()
+Add a test case for pvpanic-pci device. The scenario is the same as pvpanic
-callback. Most of the code relates to the translation
+ISA device, but is using the PCI bus.
 configuration decoding and check (STE, CD).
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1524665762-31355-10-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 160 +++++++++++++++++
+ tests/qtest/pvpanic-pci-test.c | 94 ++++++++++++++++++++++++++++++++++
- hw/arm/smmuv3.c          | 358 +++++++++++++++++++++++++++++++++++++++
+ tests/qtest/meson.build        |  1 +
- hw/arm/trace-events      |   9 +
+files changed, 95 insertions(+)
-files changed, 527 insertions(+)
+ create mode 100644 tests/qtest/pvpanic-pci-test.c
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/hw/arm/smmuv3-internal.h
+index XXXXXXX..XXXXXXX
-+++ b/hw/arm/smmuv3-internal.h
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
++++ b/tests/qtest/pvpanic-pci-test.c
+@@ -XXX,XX +XXX,XX @@
- void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
++/*
++ * QTest testcase for PV Panic PCI device
-+/* Configuration Data */
++ *
 + * Copyright (C) 2020 Oracle
 + *
 + * Authors:
 + *     Mihai Carabas <mihai.carabas@oracle.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + */
 +
-+/* STE Level 1 Descriptor */
++#include "qemu/osdep.h"
-+typedef struct STEDesc {
++#include "libqos/libqtest.h"
-+    uint32_t word[2];
++#include "qapi/qmp/qdict.h"
-+} STEDesc;
++#include "libqos/pci.h"
 +#include "libqos/pci-pc.h"
 +#include "hw/pci/pci_regs.h"
 +
-+/* CD Level 1 Descriptor */
++static void test_panic_nopause(void)
-+typedef struct CDDesc {
++{
-+    uint32_t word[2];
++    uint8_t val;
-+} CDDesc;
++    QDict *response, *data;
 +    QTestState *qts;
 +    QPCIBus *pcibus;
 +    QPCIDevice *dev;
 +    QPCIBar bar;
 +
-+/* Stream Table Entry(STE) */
++    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=none");
-+typedef struct STE {
++    pcibus = qpci_new_pc(qts, NULL);
-+    uint32_t word[16];
++    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
-+} STE;
++    qpci_device_enable(dev);
 +    bar = qpci_iomap(dev, 0, NULL);
 +
-+/* Context Descriptor(CD) */
++    qpci_memread(dev, bar, 0, &val, sizeof(val));
-+typedef struct CD {
++    g_assert_cmpuint(val, ==, 3);
 +    uint32_t word[16];
 +} CD;
 +
-+/* STE fields */
++    val = 1;
 +    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
 +
-+#define STE_VALID(x)   extract32((x)->word[0], 0, 1)
++    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
 +    g_assert(qdict_haskey(response, "data"));
 +    data = qdict_get_qdict(response, "data");
 +    g_assert(qdict_haskey(data, "action"));
 +    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "run");
 +    qobject_unref(response);
 +
-+#define STE_CONFIG(x)  extract32((x)->word[0], 1, 3)
++    qtest_quit(qts);
 +#define STE_CFG_S1_ENABLED(config) (config & 0x1)
 +#define STE_CFG_S2_ENABLED(config) (config & 0x2)
 +#define STE_CFG_ABORT(config)      (!(config & 0x4))
 +#define STE_CFG_BYPASS(config)     (config == 0x4)
 +
 +#define STE_S1FMT(x)       extract32((x)->word[0], 4 , 2)
 +#define STE_S1CDMAX(x)     extract32((x)->word[1], 27, 5)
 +#define STE_S1STALLD(x)    extract32((x)->word[2], 27, 1)
 +#define STE_EATS(x)        extract32((x)->word[2], 28, 2)
 +#define STE_STRW(x)        extract32((x)->word[2], 30, 2)
 +#define STE_S2VMID(x)      extract32((x)->word[4], 0 , 16)
 +#define STE_S2T0SZ(x)      extract32((x)->word[5], 0 , 6)
 +#define STE_S2SL0(x)       extract32((x)->word[5], 6 , 2)
 +#define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 +#define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 +#define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
 +#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
 +#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
 +#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
 +#define STE_CTXPTR(x)                                           \
 +    ({                                                          \
 +        unsigned long addr;                                     \
 +        addr = (uint64_t)extract32((x)->word[1], 0, 16) << 32;  \
 +        addr |= (uint64_t)((x)->word[0] & 0xffffffc0);          \
 +        addr;                                                   \
 +    })
 +
 +#define STE_S2TTB(x)                                            \
 +    ({                                                          \
 +        unsigned long addr;                                     \
 +        addr = (uint64_t)extract32((x)->word[7], 0, 16) << 32;  \
 +        addr |= (uint64_t)((x)->word[6] & 0xfffffff0);          \
 +        addr;                                                   \
 +    })
 +
 +static inline int oas2bits(int oas_field)
 +{
 +    switch (oas_field) {
 +    case 0:
 +        return 32;
 +    case 1:
 +        return 36;
 +    case 2:
 +        return 40;
 +    case 3:
 +        return 42;
 +    case 4:
 +        return 44;
 +    case 5:
 +        return 48;
 +    }
 +    return -1;
 +}
 +
-+static inline int pa_range(STE *ste)
++static void test_panic(void)
 +{
-+    int oas_field = MIN(STE_S2PS(ste), SMMU_IDR5_OAS);
++    uint8_t val;
 +    QDict *response, *data;
 +    QTestState *qts;
 +    QPCIBus *pcibus;
 +    QPCIDevice *dev;
 +    QPCIBar bar;
 +
-+    if (!STE_S2AA64(ste)) {
++    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=pause");
-+        return 40;
++    pcibus = qpci_new_pc(qts, NULL);
-+    }
++    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
 +    qpci_device_enable(dev);
 +    bar = qpci_iomap(dev, 0, NULL);
 +
-+    return oas2bits(oas_field);
++    qpci_memread(dev, bar, 0, &val, sizeof(val));
 +    g_assert_cmpuint(val, ==, 3);
 +
 +    val = 1;
 +    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
 +
 +    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
 +    g_assert(qdict_haskey(response, "data"));
 +    data = qdict_get_qdict(response, "data");
 +    g_assert(qdict_haskey(data, "action"));
 +    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
 +    qobject_unref(response);
 +
 +    qtest_quit(qts);
 +}
 +
-+#define MAX_PA(ste) ((1 << pa_range(ste)) - 1)
++int main(int argc, char **argv)
 +
 +/* CD fields */
 +
 +#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
 +#define CD_ASID(x)    extract32((x)->word[1], 16, 16)
 +#define CD_TTB(x, sel)                                      \
 +    ({                                                      \
 +        uint64_t hi, lo;                                    \
 +        hi = extract32((x)->word[(sel) * 2 + 3], 0, 19);    \
 +        hi <<= 32;                                          \
 +        lo = (x)->word[(sel) * 2 + 2] & ~0xfULL;            \
 +        hi | lo;                                            \
 +    })
 +
 +#define CD_TSZ(x, sel)   extract32((x)->word[0], (16 * (sel)) + 0, 6)
 +#define CD_TG(x, sel)    extract32((x)->word[0], (16 * (sel)) + 6, 2)
 +#define CD_EPD(x, sel)   extract32((x)->word[0], (16 * (sel)) + 14, 1)
 +#define CD_ENDI(x)       extract32((x)->word[0], 15, 1)
 +#define CD_IPS(x)        extract32((x)->word[1], 0 , 3)
 +#define CD_TBI(x)        extract32((x)->word[1], 6 , 2)
 +#define CD_HD(x)         extract32((x)->word[1], 10 , 1)
 +#define CD_HA(x)         extract32((x)->word[1], 11 , 1)
 +#define CD_S(x)          extract32((x)->word[1], 12, 1)
 +#define CD_R(x)          extract32((x)->word[1], 13, 1)
 +#define CD_A(x)          extract32((x)->word[1], 14, 1)
 +#define CD_AARCH64(x)    extract32((x)->word[1], 9 , 1)
 +
 +#define CDM_VALID(x)    ((x)->word[0] & 0x1)
 +
 +static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd)
 +{
 +    return CD_VALID(cd);
 +}
 +
 +/**
 + * tg2granule - Decodes the CD translation granule size field according
 + * to the ttbr in use
 + * @bits: TG0/1 fields
 + * @ttbr: ttbr index in use
 + */
 +static inline int tg2granule(int bits, int ttbr)
 +{
 +    switch (bits) {
 +    case 0:
 +        return ttbr ? 0  : 12;
 +    case 1:
 +        return ttbr ? 14 : 16;
 +    case 2:
 +        return ttbr ? 12 : 14;
 +    case 3:
 +        return ttbr ? 16 :  0;
 +    default:
 +        return 0;
 +    }
 +}
 +
 +static inline uint64_t l1std_l2ptr(STEDesc *desc)
 +{
 +    uint64_t hi, lo;
 +
 +    hi = desc->word[1];
 +    lo = desc->word[0] & ~0x1fULL;
 +    return hi << 32 | lo;
 +}
 +
 +#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
      s->sid_split = 0;
  }
 +static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
 +                        SMMUEventInfo *event)
 +{
 +    int ret;
 +
-+    trace_smmuv3_get_ste(addr);
++    g_test_init(&argc, &argv, NULL);
-+    /* TODO: guarantee 64-bit single-copy atomicity */
++    qtest_add_func("/pvpanic-pci/panic", test_panic);
-+    ret = dma_memory_read(&address_space_memory, addr,
++    qtest_add_func("/pvpanic-pci/panic-nopause", test_panic_nopause);
 +                          (void *)buf, sizeof(*buf));
 +    if (ret != MEMTX_OK) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
 +        event->type = SMMU_EVT_F_STE_FETCH;
 +        event->u.f_ste_fetch.addr = addr;
 +        return -EINVAL;
 +    }
 +    return 0;
 +
-+}
++    ret = g_test_run();
 +
-+/* @ssid > 0 not supported yet */
-+static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
-+                       CD *buf, SMMUEventInfo *event)
-+{
-+    dma_addr_t addr = STE_CTXPTR(ste);
-+    int ret;
-+
-+    trace_smmuv3_get_cd(addr);
-+    /* TODO: guarantee 64-bit single-copy atomicity */
-+    ret = dma_memory_read(&address_space_memory, addr,
-+                           (void *)buf, sizeof(*buf));
-+    if (ret != MEMTX_OK) {
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
-+        event->type = SMMU_EVT_F_CD_FETCH;
-+        event->u.f_ste_fetch.addr = addr;
-+        return -EINVAL;
-+    }
-+    return 0;
-+}
-+
-+/* Returns <0 if the caller has no need to continue the translation */
-+static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
-+                      STE *ste, SMMUEventInfo *event)
-+{
-+    uint32_t config;
-+    int ret = -EINVAL;
-+
-+    if (!STE_VALID(ste)) {
-+        goto bad_ste;
-+    }
-+
-+    config = STE_CONFIG(ste);
-+
-+    if (STE_CFG_ABORT(config)) {
-+        cfg->aborted = true; /* abort but don't record any event */
-+        return ret;
-+    }
-+
-+    if (STE_CFG_BYPASS(config)) {
-+        cfg->bypassed = true;
-+        return ret;
-+    }
-+
-+    if (STE_CFG_S2_ENABLED(config)) {
-+        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-+        goto bad_ste;
-+    }
-+
-+    if (STE_S1CDMAX(ste) != 0) {
-+        qemu_log_mask(LOG_UNIMP,
-+                      "SMMUv3 does not support multiple context descriptors yet\n");
-+        goto bad_ste;
-+    }
-+
-+    if (STE_S1STALLD(ste)) {
-+        qemu_log_mask(LOG_UNIMP,
-+                      "SMMUv3 S1 stalling fault model not allowed yet\n");
-+        goto bad_ste;
-+    }
-+    return 0;
-+
-+bad_ste:
-+    event->type = SMMU_EVT_C_BAD_STE;
-+    return -EINVAL;
-+}
-+
-+/**
-+ * smmu_find_ste - Return the stream table entry associated
-+ * to the sid
-+ *
-+ * @s: smmuv3 handle
-+ * @sid: stream ID
-+ * @ste: returned stream table entry
-+ * @event: handle to an event info
-+ *
-+ * Supports linear and 2-level stream table
-+ * Return 0 on success, -EINVAL otherwise
-+ */
-+static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
-+                         SMMUEventInfo *event)
-+{
-+    dma_addr_t addr;
-+    int ret;
-+
-+    trace_smmuv3_find_ste(sid, s->features, s->sid_split);
-+    /* Check SID range */
-+    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
-+        event->type = SMMU_EVT_C_BAD_STREAMID;
-+        return -EINVAL;
-+    }
-+    if (s->features & SMMU_FEATURE_2LVL_STE) {
-+        int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
-+        dma_addr_t strtab_base, l1ptr, l2ptr;
-+        STEDesc l1std;
-+
-+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
-+        l1_ste_offset = sid >> s->sid_split;
-+        l2_ste_offset = sid & ((1 << s->sid_split) - 1);
-+        l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
-+        /* TODO: guarantee 64-bit single-copy atomicity */
-+        ret = dma_memory_read(&address_space_memory, l1ptr,
-+                              (uint8_t *)&l1std, sizeof(l1std));
-+        if (ret != MEMTX_OK) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
-+            event->type = SMMU_EVT_F_STE_FETCH;
-+            event->u.f_ste_fetch.addr = l1ptr;
-+            return -EINVAL;
-+        }
-+
-+        span = L1STD_SPAN(&l1std);
-+
-+        if (!span) {
-+            /* l2ptr is not valid */
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "invalid sid=%d (L1STD span=0)\n", sid);
-+            event->type = SMMU_EVT_C_BAD_STREAMID;
-+            return -EINVAL;
-+        }
-+        max_l2_ste = (1 << span) - 1;
-+        l2ptr = l1std_l2ptr(&l1std);
-+        trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
-+                                   l2ptr, l2_ste_offset, max_l2_ste);
-+        if (l2_ste_offset > max_l2_ste) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "l2_ste_offset=%d > max_l2_ste=%d\n",
-+                          l2_ste_offset, max_l2_ste);
-+            event->type = SMMU_EVT_C_BAD_STE;
-+            return -EINVAL;
-+        }
-+        addr = l2ptr + l2_ste_offset * sizeof(*ste);
-+    } else {
-+        addr = s->strtab_base + sid * sizeof(*ste);
-+    }
-+
-+    if (smmu_get_ste(s, addr, ste, event)) {
-+        return -EINVAL;
-+    }
-+
-+    return 0;
-+}
-+
-+static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
-+{
-+    int ret = -EINVAL;
-+    int i;
-+
-+    if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
-+        goto bad_cd;
-+    }
-+    if (!CD_A(cd)) {
-+        goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
-+    }
-+    if (CD_S(cd)) {
-+        goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
-+    }
-+    if (CD_HA(cd) || CD_HD(cd)) {
-+        goto bad_cd; /* HTTU = 0 */
-+    }
-+
-+    /* we support only those at the moment */
-+    cfg->aa64 = true;
-+    cfg->stage = 1;
-+
-+    cfg->oas = oas2bits(CD_IPS(cd));
-+    cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
-+    cfg->tbi = CD_TBI(cd);
-+    cfg->asid = CD_ASID(cd);
-+
-+    trace_smmuv3_decode_cd(cfg->oas);
-+
-+    /* decode data dependent on TT */
-+    for (i = 0; i <= 1; i++) {
-+        int tg, tsz;
-+        SMMUTransTableInfo *tt = &cfg->tt[i];
-+
-+        cfg->tt[i].disabled = CD_EPD(cd, i);
-+        if (cfg->tt[i].disabled) {
-+            continue;
-+        }
-+
-+        tsz = CD_TSZ(cd, i);
-+        if (tsz < 16 || tsz > 39) {
-+            goto bad_cd;
-+        }
-+
-+        tg = CD_TG(cd, i);
-+        tt->granule_sz = tg2granule(tg, i);
-+        if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
-+            goto bad_cd;
-+        }
-+
-+        tt->tsz = tsz;
-+        tt->ttb = CD_TTB(cd, i);
-+        if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
-+            goto bad_cd;
-+        }
-+        trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);
-+    }
-+
-+    event->record_trans_faults = CD_R(cd);
-+
-+    return 0;
-+
-+bad_cd:
-+    event->type = SMMU_EVT_C_BAD_CD;
 +    return ret;
 +}
-+
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 +/**
 + * smmuv3_decode_config - Prepare the translation configuration
 + * for the @mr iommu region
 + * @mr: iommu memory region the translation config must be prepared for
 + * @cfg: output translation configuration which is populated through
 + *       the different configuration decoding steps
 + * @event: must be zero'ed by the caller
 + *
 + * return < 0 if the translation needs to be aborted (@event is filled
 + * accordingly). Return 0 otherwise.
 + */
 +static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
 +                                SMMUEventInfo *event)
 +{
 +    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 +    uint32_t sid = smmu_get_sid(sdev);
 +    SMMUv3State *s = sdev->smmu;
 +    int ret = -EINVAL;
 +    STE ste;
 +    CD cd;
 +
 +    if (smmu_find_ste(s, sid, &ste, event)) {
 +        return ret;
 +    }
 +
 +    if (decode_ste(s, cfg, &ste, event)) {
 +        return ret;
 +    }
 +
 +    if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) {
 +        return ret;
 +    }
 +
 +    return decode_cd(cfg, &cd, event);
 +}
 +
 +static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
 +                                      IOMMUAccessFlags flag)
 +{
 +    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 +    SMMUv3State *s = sdev->smmu;
 +    uint32_t sid = smmu_get_sid(sdev);
 +    SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid};
 +    SMMUPTWEventInfo ptw_info = {};
 +    SMMUTransCfg cfg = {};
 +    IOMMUTLBEntry entry = {
 +        .target_as = &address_space_memory,
 +        .iova = addr,
 +        .translated_addr = addr,
 +        .addr_mask = ~(hwaddr)0,
 +        .perm = IOMMU_NONE,
 +    };
 +    int ret = 0;
 +
 +    if (!smmu_enabled(s)) {
 +        goto out;
 +    }
 +
 +    ret = smmuv3_decode_config(mr, &cfg, &event);
 +    if (ret) {
 +        goto out;
 +    }
 +
 +    if (cfg.aborted) {
 +        goto out;
 +    }
 +
 +    ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info);
 +    if (ret) {
 +        switch (ptw_info.type) {
 +        case SMMU_PTW_ERR_WALK_EABT:
 +            event.type = SMMU_EVT_F_WALK_EABT;
 +            event.u.f_walk_eabt.addr = addr;
 +            event.u.f_walk_eabt.rnw = flag & 0x1;
 +            event.u.f_walk_eabt.class = 0x1;
 +            event.u.f_walk_eabt.addr2 = ptw_info.addr;
 +            break;
 +        case SMMU_PTW_ERR_TRANSLATION:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_TRANSLATION;
 +                event.u.f_translation.addr = addr;
 +                event.u.f_translation.rnw = flag & 0x1;
 +            }
 +            break;
 +        case SMMU_PTW_ERR_ADDR_SIZE:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_ADDR_SIZE;
 +                event.u.f_addr_size.addr = addr;
 +                event.u.f_addr_size.rnw = flag & 0x1;
 +            }
 +            break;
 +        case SMMU_PTW_ERR_ACCESS:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_ACCESS;
 +                event.u.f_access.addr = addr;
 +                event.u.f_access.rnw = flag & 0x1;
 +            }
 +            break;
 +        case SMMU_PTW_ERR_PERMISSION:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_PERMISSION;
 +                event.u.f_permission.addr = addr;
 +                event.u.f_permission.rnw = flag & 0x1;
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +out:
 +    if (ret) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s translation failed for iova=0x%"PRIx64"(%d)\n",
 +                      mr->parent_obj.name, addr, ret);
 +        entry.perm = IOMMU_NONE;
 +        smmuv3_record_event(s, &event);
 +    } else if (!cfg.aborted) {
 +        entry.perm = flag;
 +        trace_smmuv3_translate(mr->parent_obj.name, sid, addr,
 +                               entry.translated_addr, entry.perm);
 +    }
 +
 +    return entry;
 +}
 +
  static int smmuv3_cmdq_consume(SMMUv3State *s)
  {
      SMMUCmdError cmd_error = SMMU_CERROR_NONE;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
  static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
                                                    void *data)
  {
 +    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 +
 +    imrc->translate = smmuv3_translate;
  }
  static const TypeInfo smmuv3_type_info = {
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
+--- a/tests/qtest/meson.build
-+++ b/hw/arm/trace-events
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx
+@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
- smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
- smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
- smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
+   (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
-+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
++  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
-+smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%lx l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
+   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
-+smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
+   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
-+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass iova:0x%"PRIx64" is_write=%d"
+   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
 +smmuv3_translate_in(uint16_t sid, int pci_bus_num, uint64_t strtab_base) "SID:0x%x bus:%d strtab_base:0x%"PRIx64
 +smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
 +smmuv3_translate(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
 +smmuv3_decode_cd(uint32_t oas) "oas=%d"
 +smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 16/24] hw/arm/smmuv3: Queue helpers
+[PULL 22/46] ptimer: Add new ptimer_set_period_from_clock() function
-From: Eric Auger <eric.auger@redhat.com>
+The ptimer API currently provides two methods for setting the period:
 ptimer_set_period(), which takes a period in nanoseconds, and
 ptimer_set_freq(), which takes a frequency in Hz.  Neither of these
 lines up nicely with the Clock API, because although both the Clock
 and the ptimer track the frequency using a representation of whole
 and fractional nanoseconds, conversion via either period-in-ns or
 frequency-in-Hz will introduce a rounding error.
-We introduce helpers to read/write into the command and event
+Add a new function ptimer_set_period_from_clock() which takes the
-circular queues.
+Clock object directly to avoid the rounding issues.  This includes a
 facility for the user to specify that there is a frequency divider
 between the Clock proper and the timer, as some timer devices like
 the CMSDK APB dualtimer need this.
-smmuv3_write_eventq and smmuv3_cmq_consume will become static
+To avoid having to drag in clock.h from ptimer.h we add the Clock
-in subsequent patches.
+type to typedefs.h.
-Invalidation commands are not yet dealt with. We do not cache
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-data that need to be invalidated. This will change with vhost
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-integration.
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-2-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-2-peter.maydell@linaro.org
 ---
  include/hw/ptimer.h     | 22 ++++++++++++++++++++++
  include/qemu/typedefs.h |  1 +
  hw/core/ptimer.c        | 34 ++++++++++++++++++++++++++++++++++
 files changed, 57 insertions(+)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-7-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3-internal.h | 163 +++++++++++++++++++++++++++++++++++++++
  hw/arm/smmuv3.c          | 136 ++++++++++++++++++++++++++++++++
  hw/arm/trace-events      |   5 ++
 files changed, 304 insertions(+)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/include/hw/ptimer.h
-+++ b/hw/arm/smmuv3-internal.h
++++ b/include/hw/ptimer.h
-@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+@@ -XXX,XX +XXX,XX @@ void ptimer_transaction_commit(ptimer_state *s);
- void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+  */
- void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
+ void ptimer_set_period(ptimer_state *s, int64_t period);
-+/* Queue Handling */
++/**
 + * ptimer_set_period_from_clock - Set counter increment from a Clock
 + * @s: ptimer to configure
 + * @clk: pointer to Clock object to take period from
 + * @divisor: value to scale the clock frequency down by
 + *
 + * If the ptimer is being driven from a Clock, this is the preferred
 + * way to tell the ptimer about the period, because it avoids any
 + * possible rounding errors that might happen if the internal
 + * representation of the Clock period was converted to either a period
 + * in ns or a frequency in Hz.
 + *
 + * If the ptimer should run at the same frequency as the clock,
 + * pass 1 as the @divisor; if the ptimer should run at half the
 + * frequency, pass 2, and so on.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block.
 + */
 +void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clock,
 +                                  unsigned int divisor);
 +
-+#define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
+ /**
-+#define WRAP_MASK(q)       (1 << (q)->log2size)
+  * ptimer_set_freq - Set counter frequency in Hz
-+#define INDEX_MASK(q)      (((1 << (q)->log2size)) - 1)
+  * @s: ptimer to configure
-+#define WRAP_INDEX_MASK(q) ((1 << ((q)->log2size + 1)) - 1)
+diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
-+
+index XXXXXXX..XXXXXXX 100644
-+#define Q_CONS(q) ((q)->cons & INDEX_MASK(q))
+--- a/include/qemu/typedefs.h
-+#define Q_PROD(q) ((q)->prod & INDEX_MASK(q))
++++ b/include/qemu/typedefs.h
-+
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockDriverState BlockDriverState;
-+#define Q_CONS_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_CONS(q))
+ typedef struct BusClass BusClass;
-+#define Q_PROD_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_PROD(q))
+ typedef struct BusState BusState;
-+
+ typedef struct Chardev Chardev;
-+#define Q_CONS_WRAP(q) (((q)->cons & WRAP_MASK(q)) >> (q)->log2size)
++typedef struct Clock Clock;
-+#define Q_PROD_WRAP(q) (((q)->prod & WRAP_MASK(q)) >> (q)->log2size)
+ typedef struct CompatProperty CompatProperty;
-+
+ typedef struct CoMutex CoMutex;
-+static inline bool smmuv3_q_full(SMMUQueue *q)
+ typedef struct CPUAddressSpace CPUAddressSpace;
-+{
+diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
-+    return ((q->cons ^ q->prod) & WRAP_INDEX_MASK(q)) == WRAP_MASK(q);
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/core/ptimer.c
-+
++++ b/hw/core/ptimer.c
-+static inline bool smmuv3_q_empty(SMMUQueue *q)
+@@ -XXX,XX +XXX,XX @@
-+{
+ #include "sysemu/qtest.h"
-+    return (q->cons & WRAP_INDEX_MASK(q)) == (q->prod & WRAP_INDEX_MASK(q));
+ #include "block/aio.h"
-+}
+ #include "sysemu/cpus.h"
-+
++#include "hw/clock.h"
-+static inline void queue_prod_incr(SMMUQueue *q)
-+{
+ #define DELTA_ADJUST     1
-+    q->prod = (q->prod + 1) & WRAP_INDEX_MASK(q);
+ #define DELTA_NO_ADJUST -1
-+}
+@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period)
-+
+     }
-+static inline void queue_cons_incr(SMMUQueue *q)
+ }
 +/* Set counter increment interval from a Clock */
 +void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clk,
 +                                  unsigned int divisor)
 +{
 +    /*
-+     * We have to use deposit for the CONS registers to preserve
++     * The raw clock period is a 64-bit value in units of 2^-32 ns;
-+     * the ERR field in the high bits.
++     * put another way it's a 32.32 fixed-point ns value. Our internal
 +     * representation of the period is 64.32 fixed point ns, so
 +     * the conversion is simple.
 +     */
-+    q->cons = deposit32(q->cons, 0, q->log2size + 1, q->cons + 1);
++    uint64_t raw_period = clock_get(clk);
-+}
++    uint64_t period_frac;
 +
-+static inline bool smmuv3_cmdq_enabled(SMMUv3State *s)
++    assert(s->in_transaction);
-+{
++    s->delta = ptimer_get_count(s);
-+    return FIELD_EX32(s->cr[0], CR0, CMDQEN);
++    s->period = extract64(raw_period, 32, 32);
-+}
++    period_frac = extract64(raw_period, 0, 32);
 +    /*
 +     * divisor specifies a possible frequency divisor between the
 +     * clock and the timer, so it is a multiplier on the period.
 +     * We do the multiply after splitting the raw period out into
 +     * period and frac to avoid having to do a 32*64->96 multiply.
 +     */
 +    s->period *= divisor;
 +    period_frac *= divisor;
 +    s->period += extract64(period_frac, 32, 32);
 +    s->period_frac = (uint32_t)period_frac;
 +
-+static inline bool smmuv3_eventq_enabled(SMMUv3State *s)
++    if (s->enabled) {
-+{
++        s->need_reload = true;
 +    return FIELD_EX32(s->cr[0], CR0, EVENTQEN);
 +}
 +
 +static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
 +{
 +    s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
 +}
 +
 +void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
 +
 +/* Commands */
 +
 +typedef enum SMMUCommandType {
 +    SMMU_CMD_NONE            = 0x00,
 +    SMMU_CMD_PREFETCH_CONFIG       ,
 +    SMMU_CMD_PREFETCH_ADDR,
 +    SMMU_CMD_CFGI_STE,
 +    SMMU_CMD_CFGI_STE_RANGE,
 +    SMMU_CMD_CFGI_CD,
 +    SMMU_CMD_CFGI_CD_ALL,
 +    SMMU_CMD_CFGI_ALL,
 +    SMMU_CMD_TLBI_NH_ALL     = 0x10,
 +    SMMU_CMD_TLBI_NH_ASID,
 +    SMMU_CMD_TLBI_NH_VA,
 +    SMMU_CMD_TLBI_NH_VAA,
 +    SMMU_CMD_TLBI_EL3_ALL    = 0x18,
 +    SMMU_CMD_TLBI_EL3_VA     = 0x1a,
 +    SMMU_CMD_TLBI_EL2_ALL    = 0x20,
 +    SMMU_CMD_TLBI_EL2_ASID,
 +    SMMU_CMD_TLBI_EL2_VA,
 +    SMMU_CMD_TLBI_EL2_VAA,
 +    SMMU_CMD_TLBI_S12_VMALL  = 0x28,
 +    SMMU_CMD_TLBI_S2_IPA     = 0x2a,
 +    SMMU_CMD_TLBI_NSNH_ALL   = 0x30,
 +    SMMU_CMD_ATC_INV         = 0x40,
 +    SMMU_CMD_PRI_RESP,
 +    SMMU_CMD_RESUME          = 0x44,
 +    SMMU_CMD_STALL_TERM,
 +    SMMU_CMD_SYNC,
 +} SMMUCommandType;
 +
 +static const char *cmd_stringify[] = {
 +    [SMMU_CMD_PREFETCH_CONFIG] = "SMMU_CMD_PREFETCH_CONFIG",
 +    [SMMU_CMD_PREFETCH_ADDR]   = "SMMU_CMD_PREFETCH_ADDR",
 +    [SMMU_CMD_CFGI_STE]        = "SMMU_CMD_CFGI_STE",
 +    [SMMU_CMD_CFGI_STE_RANGE]  = "SMMU_CMD_CFGI_STE_RANGE",
 +    [SMMU_CMD_CFGI_CD]         = "SMMU_CMD_CFGI_CD",
 +    [SMMU_CMD_CFGI_CD_ALL]     = "SMMU_CMD_CFGI_CD_ALL",
 +    [SMMU_CMD_CFGI_ALL]        = "SMMU_CMD_CFGI_ALL",
 +    [SMMU_CMD_TLBI_NH_ALL]     = "SMMU_CMD_TLBI_NH_ALL",
 +    [SMMU_CMD_TLBI_NH_ASID]    = "SMMU_CMD_TLBI_NH_ASID",
 +    [SMMU_CMD_TLBI_NH_VA]      = "SMMU_CMD_TLBI_NH_VA",
 +    [SMMU_CMD_TLBI_NH_VAA]     = "SMMU_CMD_TLBI_NH_VAA",
 +    [SMMU_CMD_TLBI_EL3_ALL]    = "SMMU_CMD_TLBI_EL3_ALL",
 +    [SMMU_CMD_TLBI_EL3_VA]     = "SMMU_CMD_TLBI_EL3_VA",
 +    [SMMU_CMD_TLBI_EL2_ALL]    = "SMMU_CMD_TLBI_EL2_ALL",
 +    [SMMU_CMD_TLBI_EL2_ASID]   = "SMMU_CMD_TLBI_EL2_ASID",
 +    [SMMU_CMD_TLBI_EL2_VA]     = "SMMU_CMD_TLBI_EL2_VA",
 +    [SMMU_CMD_TLBI_EL2_VAA]    = "SMMU_CMD_TLBI_EL2_VAA",
 +    [SMMU_CMD_TLBI_S12_VMALL]  = "SMMU_CMD_TLBI_S12_VMALL",
 +    [SMMU_CMD_TLBI_S2_IPA]     = "SMMU_CMD_TLBI_S2_IPA",
 +    [SMMU_CMD_TLBI_NSNH_ALL]   = "SMMU_CMD_TLBI_NSNH_ALL",
 +    [SMMU_CMD_ATC_INV]         = "SMMU_CMD_ATC_INV",
 +    [SMMU_CMD_PRI_RESP]        = "SMMU_CMD_PRI_RESP",
 +    [SMMU_CMD_RESUME]          = "SMMU_CMD_RESUME",
 +    [SMMU_CMD_STALL_TERM]      = "SMMU_CMD_STALL_TERM",
 +    [SMMU_CMD_SYNC]            = "SMMU_CMD_SYNC",
 +};
 +
 +static inline const char *smmu_cmd_string(SMMUCommandType type)
 +{
 +    if (type > SMMU_CMD_NONE && type < ARRAY_SIZE(cmd_stringify)) {
 +        return cmd_stringify[type] ? cmd_stringify[type] : "UNKNOWN";
 +    } else {
 +        return "INVALID";
 +    }
 +}
 +
-+/* CMDQ fields */
+ /* Set counter frequency in Hz.  */
-+
+ void ptimer_set_freq(ptimer_state *s, uint32_t freq)
 +typedef enum {
 +    SMMU_CERROR_NONE = 0,
 +    SMMU_CERROR_ILL,
 +    SMMU_CERROR_ABT,
 +    SMMU_CERROR_ATC_INV_SYNC,
 +} SMMUCmdError;
 +
 +enum { /* Command completion notification */
 +    CMD_SYNC_SIG_NONE,
 +    CMD_SYNC_SIG_IRQ,
 +    CMD_SYNC_SIG_SEV,
 +};
 +
 +#define CMD_TYPE(x)         extract32((x)->word[0], 0 , 8)
 +#define CMD_SSEC(x)         extract32((x)->word[0], 10, 1)
 +#define CMD_SSV(x)          extract32((x)->word[0], 11, 1)
 +#define CMD_RESUME_AC(x)    extract32((x)->word[0], 12, 1)
 +#define CMD_RESUME_AB(x)    extract32((x)->word[0], 13, 1)
 +#define CMD_SYNC_CS(x)      extract32((x)->word[0], 12, 2)
 +#define CMD_SSID(x)         extract32((x)->word[0], 12, 20)
 +#define CMD_SID(x)          ((x)->word[1])
 +#define CMD_VMID(x)         extract32((x)->word[1], 0 , 16)
 +#define CMD_ASID(x)         extract32((x)->word[1], 16, 16)
 +#define CMD_RESUME_STAG(x)  extract32((x)->word[2], 0 , 16)
 +#define CMD_RESP(x)         extract32((x)->word[2], 11, 2)
 +#define CMD_LEAF(x)         extract32((x)->word[2], 0 , 1)
 +#define CMD_STE_RANGE(x)    extract32((x)->word[2], 0 , 5)
 +#define CMD_ADDR(x) ({                                        \
 +            uint64_t high = (uint64_t)(x)->word[3];           \
 +            uint64_t low = extract32((x)->word[2], 12, 20);    \
 +            uint64_t addr = high << 32 | (low << 12);         \
 +            addr;                                             \
 +        })
 +
 +int smmuv3_cmdq_consume(SMMUv3State *s);
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
      trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
  }
 +static inline MemTxResult queue_read(SMMUQueue *q, void *data)
 +{
 +    dma_addr_t addr = Q_CONS_ENTRY(q);
 +
 +    return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
 +}
 +
 +static MemTxResult queue_write(SMMUQueue *q, void *data)
 +{
 +    dma_addr_t addr = Q_PROD_ENTRY(q);
 +    MemTxResult ret;
 +
 +    ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
 +    if (ret != MEMTX_OK) {
 +        return ret;
 +    }
 +
 +    queue_prod_incr(q);
 +    return MEMTX_OK;
 +}
 +
 +void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 +{
 +    SMMUQueue *q = &s->eventq;
 +
 +    if (!smmuv3_eventq_enabled(s)) {
 +        return;
 +    }
 +
 +    if (smmuv3_q_full(q)) {
 +        return;
 +    }
 +
 +    queue_write(q, evt);
 +
 +    if (smmuv3_q_empty(q)) {
 +        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 +    }
 +}
 +
  static void smmuv3_init_regs(SMMUv3State *s)
  {
-     /**
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
-     s->sid_split = 0;
- }
-+int smmuv3_cmdq_consume(SMMUv3State *s)
-+{
-+    SMMUCmdError cmd_error = SMMU_CERROR_NONE;
-+    SMMUQueue *q = &s->cmdq;
-+    SMMUCommandType type = 0;
-+
-+    if (!smmuv3_cmdq_enabled(s)) {
-+        return 0;
-+    }
-+    /*
-+     * some commands depend on register values, typically CR0. In case those
-+     * register values change while handling the command, spec says it
-+     * is UNPREDICTABLE whether the command is interpreted under the new
-+     * or old value.
-+     */
-+
-+    while (!smmuv3_q_empty(q)) {
-+        uint32_t pending = s->gerror ^ s->gerrorn;
-+        Cmd cmd;
-+
-+        trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
-+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
-+
-+        if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
-+            break;
-+        }
-+
-+        if (queue_read(q, &cmd) != MEMTX_OK) {
-+            cmd_error = SMMU_CERROR_ABT;
-+            break;
-+        }
-+
-+        type = CMD_TYPE(&cmd);
-+
-+        trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
-+
-+        switch (type) {
-+        case SMMU_CMD_SYNC:
-+            if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
-+                smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
-+            }
-+            break;
-+        case SMMU_CMD_PREFETCH_CONFIG:
-+        case SMMU_CMD_PREFETCH_ADDR:
-+        case SMMU_CMD_CFGI_STE:
-+        case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
-+        case SMMU_CMD_CFGI_CD:
-+        case SMMU_CMD_CFGI_CD_ALL:
-+        case SMMU_CMD_TLBI_NH_ALL:
-+        case SMMU_CMD_TLBI_NH_ASID:
-+        case SMMU_CMD_TLBI_NH_VA:
-+        case SMMU_CMD_TLBI_NH_VAA:
-+        case SMMU_CMD_TLBI_EL3_ALL:
-+        case SMMU_CMD_TLBI_EL3_VA:
-+        case SMMU_CMD_TLBI_EL2_ALL:
-+        case SMMU_CMD_TLBI_EL2_ASID:
-+        case SMMU_CMD_TLBI_EL2_VA:
-+        case SMMU_CMD_TLBI_EL2_VAA:
-+        case SMMU_CMD_TLBI_S12_VMALL:
-+        case SMMU_CMD_TLBI_S2_IPA:
-+        case SMMU_CMD_TLBI_NSNH_ALL:
-+        case SMMU_CMD_ATC_INV:
-+        case SMMU_CMD_PRI_RESP:
-+        case SMMU_CMD_RESUME:
-+        case SMMU_CMD_STALL_TERM:
-+            trace_smmuv3_unhandled_cmd(type);
-+            break;
-+        default:
-+            cmd_error = SMMU_CERROR_ILL;
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
-+            break;
-+        }
-+        if (cmd_error) {
-+            break;
-+        }
-+        /*
-+         * We only increment the cons index after the completion of
-+         * the command. We do that because the SYNC returns immediately
-+         * and does not check the completion of previous commands
-+         */
-+        queue_cons_incr(q);
-+    }
-+
-+    if (cmd_error) {
-+        trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
-+        smmu_write_cmdq_err(s, cmd_error);
-+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
-+    }
-+
-+    trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
-+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
-+
-+    return 0;
-+}
-+
- static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
-                                    unsigned size, MemTxAttrs attrs)
- {
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
-+++ b/hw/arm/trace-events
-@@ -XXX,XX +XXX,XX @@ smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
- smmuv3_trigger_irq(int irq) "irq=%d"
- smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
- smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
-+smmuv3_unhandled_cmd(uint32_t type) "Unhandled command type=%d"
-+smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod=%d cons=%d prod.wrap=%d cons.wrap=%d"
-+smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
-+smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
-+smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
 --
-.17.0
+.20.1

-New patch
+[PULL 23/46] clock: Add new clock_has_source() function
+Add a function for checking whether a clock has a source.  This is
+useful for devices which have input clocks that must be wired up by
+the board as it allows them to fail in realize rather than ploughing
+on with a zero-period clock.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-3-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-3-peter.maydell@linaro.org
+---
+ docs/devel/clocks.rst | 16 ++++++++++++++++
+ include/hw/clock.h    | 15 +++++++++++++++
+files changed, 31 insertions(+)
+diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/devel/clocks.rst
++++ b/docs/devel/clocks.rst
+@@ -XXX,XX +XXX,XX @@ object during device instance init. For example:
+     /* set initial value to 10ns / 100MHz */
+     clock_set_ns(clk, 10);
++To enforce that the clock is wired up by the board code, you can
++call ``clock_has_source()`` in your device's realize method:
++
++.. code-block:: c
++
++   if (!clock_has_source(s->clk)) {
++       error_setg(errp, "MyDevice: clk input must be connected");
++       return;
++   }
++
++Note that this only checks that the clock has been wired up; it is
++still possible that the output clock connected to it is disabled
++or has not yet been configured, in which case the period will be
++zero. You should use the clock callback to find out when the clock
++period changes.
++
+ Fetching clock frequency/period
+ -------------------------------
+diff --git a/include/hw/clock.h b/include/hw/clock.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/clock.h
++++ b/include/hw/clock.h
+@@ -XXX,XX +XXX,XX @@ void clock_clear_callback(Clock *clk);
+  */
+ void clock_set_source(Clock *clk, Clock *src);
++/**
++ * clock_has_source:
++ * @clk: the clock
++ *
++ * Returns true if the clock has a source clock connected to it.
++ * This is useful for devices which have input clocks which must
++ * be connected by the board/SoC code which creates them. The
++ * device code can use this to check in its realize method that
++ * the clock has been connected.
++ */
++static inline bool clock_has_source(const Clock *clk)
++{
++    return clk->source != NULL;
++}
++
+ /**
+  * clock_set:
+  * @clk: the clock to initialize.
+--
+.20.1

-New patch
+[PULL 24/46] tests: Add a simple test of the CMSDK APB timer
+Add a simple test of the CMSDK APB timer, since we're about to do
+some refactoring of how it is clocked.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-4-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-4-peter.maydell@linaro.org
+---
+ tests/qtest/cmsdk-apb-timer-test.c | 75 ++++++++++++++++++++++++++++++
+ MAINTAINERS                        |  1 +
+ tests/qtest/meson.build            |  1 +
+files changed, 77 insertions(+)
+ create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
+diff --git a/tests/qtest/cmsdk-apb-timer-test.c b/tests/qtest/cmsdk-apb-timer-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/cmsdk-apb-timer-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for the CMSDK APB timer device
++ *
++ * Copyright (c) 2021 Linaro Limited
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * for more details.
++ */
++
++#include "qemu/osdep.h"
++#include "libqtest-single.h"
++
++/* IoTKit/ARMSSE-200 timer0; driven at 25MHz in mps2-an385, so 40ns per tick */
++#define TIMER_BASE 0x40000000
++
++#define CTRL 0
++#define VALUE 4
++#define RELOAD 8
++#define INTSTATUS 0xc
++
++static void test_timer(void)
++{
++    g_assert_true(readl(TIMER_BASE + INTSTATUS) == 0);
++
++    /* Start timer: will fire after 40 * 1000 == 40000 ns */
++    writel(TIMER_BASE + RELOAD, 1000);
++    writel(TIMER_BASE + CTRL, 9);
++
++    /* Step to just past the 500th tick and check VALUE */
++    clock_step(40 * 500 + 1);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 500);
++
++    /* Just past the 1000th tick: timer should have fired */
++    clock_step(40 * 500);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 0);
++
++    /* VALUE reloads at the following tick */
++    clock_step(40);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 1000);
++
++    /* Check write-1-to-clear behaviour of INTSTATUS */
++    writel(TIMER_BASE + INTSTATUS, 0);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
++    writel(TIMER_BASE + INTSTATUS, 1);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
++
++    /* Turn off the timer */
++    writel(TIMER_BASE + CTRL, 0);
++}
++
++int main(int argc, char **argv)
++{
++    int r;
++
++    g_test_init(&argc, &argv, NULL);
++
++    qtest_start("-machine mps2-an385");
++
++    qtest_add_func("/cmsdk-apb-timer/timer", test_timer);
++
++    r = g_test_run();
++
++    qtest_end();
++
++    return r;
++}
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/pl031.h
+ F: include/hw/arm/primecell.h
+ F: hw/timer/cmsdk-apb-timer.c
+ F: include/hw/timer/cmsdk-apb-timer.h
++F: tests/qtest/cmsdk-apb-timer-test.c
+ F: hw/timer/cmsdk-apb-dualtimer.c
+ F: include/hw/timer/cmsdk-apb-dualtimer.h
+ F: hw/char/cmsdk-apb-uart.c
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
+    'npcm7xx_timer-test',
+    'npcm7xx_watchdog_timer-test']
+ qtests_arm = \
++  (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
+   ['arm-cpu-features',
+--
+.20.1

-New patch
+[PULL 25/46] tests: Add a simple test of the CMSDK APB watchdog
+Add a simple test of the CMSDK watchdog, since we're about to do some
+refactoring of how it is clocked.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-5-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-5-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+---
+ tests/qtest/cmsdk-apb-watchdog-test.c | 79 +++++++++++++++++++++++++++
+ MAINTAINERS                           |  1 +
+ tests/qtest/meson.build               |  1 +
+files changed, 81 insertions(+)
+ create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
+diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/cmsdk-apb-watchdog-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for the CMSDK APB watchdog device
++ *
++ * Copyright (c) 2021 Linaro Limited
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * for more details.
++ */
++
++#include "qemu/osdep.h"
++#include "libqtest-single.h"
++
++/*
++ * lm3s811evb watchdog; at board startup this runs at 200MHz / 16 == 12.5MHz,
++ * which is 80ns per tick.
++ */
++#define WDOG_BASE 0x40000000
++
++#define WDOGLOAD 0
++#define WDOGVALUE 4
++#define WDOGCONTROL 8
++#define WDOGINTCLR 0xc
++#define WDOGRIS 0x10
++#define WDOGMIS 0x14
++#define WDOGLOCK 0xc00
++
++static void test_watchdog(void)
++{
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++
++    writel(WDOG_BASE + WDOGCONTROL, 1);
++    writel(WDOG_BASE + WDOGLOAD, 1000);
++
++    /* Step to just past the 500th tick */
++    clock_step(500 * 80 + 1);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
++
++    /* Just past the 1000th tick: timer should have fired */
++    clock_step(500 * 80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
++
++    /* VALUE reloads at following tick */
++    clock_step(80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
++
++    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
++    clock_step(500 * 80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
++    writel(WDOG_BASE + WDOGINTCLR, 0);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++}
++
++int main(int argc, char **argv)
++{
++    int r;
++
++    g_test_init(&argc, &argv, NULL);
++
++    qtest_start("-machine lm3s811evb");
++
++    qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
++
++    r = g_test_run();
++
++    qtest_end();
++
++    return r;
++}
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: hw/char/cmsdk-apb-uart.c
+ F: include/hw/char/cmsdk-apb-uart.h
+ F: hw/watchdog/cmsdk-apb-watchdog.c
+ F: include/hw/watchdog/cmsdk-apb-watchdog.h
++F: tests/qtest/cmsdk-apb-watchdog-test.c
+ F: hw/misc/tz-ppc.c
+ F: include/hw/misc/tz-ppc.h
+ F: hw/misc/tz-mpc.c
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
+    'npcm7xx_watchdog_timer-test']
+ qtests_arm = \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
++  (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
+   ['arm-cpu-features',
+--
+.20.1

-[Qemu-devel] [PULL 12/24] hw/arm/smmu-common: IOMMU memory region and address space setup
+[PULL 26/46] tests: Add a simple test of the CMSDK APB dual timer
-From: Eric Auger <eric.auger@redhat.com>
+Add a simple test of the CMSDK dual timer, since we're about to do
 some refactoring of how it is clocked.
-We set up the infrastructure to enumerate all the PCI devices
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-attached to the SMMU and create an associated IOMMU memory
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-region and address space.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20210128114145.20536-6-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-6-peter.maydell@linaro.org
 ---
  tests/qtest/cmsdk-apb-dualtimer-test.c | 130 +++++++++++++++++++++++++
  MAINTAINERS                            |   1 +
  tests/qtest/meson.build                |   1 +
 files changed, 132 insertions(+)
  create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
-Those info are stored in SMMUDevice objects. The devices are
+diff --git a/tests/qtest/cmsdk-apb-dualtimer-test.c b/tests/qtest/cmsdk-apb-dualtimer-test.c
-grouped according to the PCIBus they belong to. A hash table
+new file mode 100644
-indexed by the PCIBus pointer is used. Also an array indexed by
+index XXXXXXX..XXXXXXX
-the bus number allows to find the list of SMMUDevices.
+--- /dev/null
++++ b/tests/qtest/cmsdk-apb-dualtimer-test.c
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+@@ -XXX,XX +XXX,XX @@
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
++/*
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
++ * QTest testcase for the CMSDK APB dualtimer device
-Message-id: 1524665762-31355-3-git-send-email-eric.auger@redhat.com
++ *
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++ * Copyright (c) 2021 Linaro Limited
----
++ *
- include/hw/arm/smmu-common.h |  8 +++++
++ * This program is free software; you can redistribute it and/or modify it
- hw/arm/smmu-common.c         | 69 ++++++++++++++++++++++++++++++++++++
++ * under the terms of the GNU General Public License as published by the
- hw/arm/trace-events          |  3 ++
++ * Free Software Foundation; either version 2 of the License, or
-files changed, 80 insertions(+)
++ * (at your option) any later version.
++ *
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
++ * This program is distributed in the hope that it will be useful, but WITHOUT
-index XXXXXXX..XXXXXXX 100644
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
---- a/include/hw/arm/smmu-common.h
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+++ b/include/hw/arm/smmu-common.h
++ * for more details.
-@@ -XXX,XX +XXX,XX @@ typedef struct {
++ */
  #define ARM_SMMU_GET_CLASS(obj)                              \
      OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
 +/* Return the SMMUPciBus handle associated to a PCI bus number */
 +SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num);
 +
-+/* Return the stream ID of an SMMU device */
++#include "qemu/osdep.h"
-+static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
++#include "libqtest-single.h"
 +
 +/* IoTKit/ARMSSE dualtimer; driven at 25MHz in mps2-an385, so 40ns per tick */
 +#define TIMER_BASE 0x40002000
 +
 +#define TIMER1LOAD 0
 +#define TIMER1VALUE 4
 +#define TIMER1CONTROL 8
 +#define TIMER1INTCLR 0xc
 +#define TIMER1RIS 0x10
 +#define TIMER1MIS 0x14
 +#define TIMER1BGLOAD 0x18
 +
 +#define TIMER2LOAD 0x20
 +#define TIMER2VALUE 0x24
 +#define TIMER2CONTROL 0x28
 +#define TIMER2INTCLR 0x2c
 +#define TIMER2RIS 0x30
 +#define TIMER2MIS 0x34
 +#define TIMER2BGLOAD 0x38
 +
 +#define CTRL_ENABLE (1 << 7)
 +#define CTRL_PERIODIC (1 << 6)
 +#define CTRL_INTEN (1 << 5)
 +#define CTRL_PRESCALE_1 (0 << 2)
 +#define CTRL_PRESCALE_16 (1 << 2)
 +#define CTRL_PRESCALE_256 (2 << 2)
 +#define CTRL_32BIT (1 << 1)
 +#define CTRL_ONESHOT (1 << 0)
 +
 +static void test_dualtimer(void)
 +{
-+    return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
++    g_assert_true(readl(TIMER_BASE + TIMER1RIS) == 0);
 +}
  #endif  /* HW_ARM_SMMU_COMMON */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "hw/arm/smmu-common.h"
 +/**
 + * The bus number is used for lookup when SID based invalidation occurs.
 + * In that case we lazily populate the SMMUPciBus array from the bus hash
 + * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
 + * numbers may not be always initialized yet.
 + */
 +SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
 +{
 +    SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
 +
-+    if (!smmu_pci_bus) {
++    /* Start timer: will fire after 40000 ns */
-+        GHashTableIter iter;
++    writel(TIMER_BASE + TIMER1LOAD, 1000);
 +    /* enable in free-running, wrapping, interrupt mode */
 +    writel(TIMER_BASE + TIMER1CONTROL, CTRL_ENABLE | CTRL_INTEN);
 +
-+        g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
++    /* Step to just past the 500th tick and check VALUE */
-+        while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
++    clock_step(500 * 40 + 1);
-+            if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
-+                s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 500);
-+                return smmu_pci_bus;
++
-+            }
++    /* Just past the 1000th tick: timer should have fired */
-+        }
++    clock_step(500 * 40);
-+    }
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 1);
-+    return smmu_pci_bus;
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0);
 +
 +    /*
 +     * We are in free-running wrapping 16-bit mode, so on the following
 +     * tick VALUE should have wrapped round to 0xffff.
 +     */
 +    clock_step(40);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0xffff);
 +
 +    /* Check that any write to INTCLR clears interrupt */
 +    writel(TIMER_BASE + TIMER1INTCLR, 1);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
 +
 +    /* Turn off the timer */
 +    writel(TIMER_BASE + TIMER1CONTROL, 0);
 +}
 +
-+static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
++static void test_prescale(void)
 +{
-+    SMMUState *s = opaque;
++    g_assert_true(readl(TIMER_BASE + TIMER2RIS) == 0);
 +    SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
 +    SMMUDevice *sdev;
 +
-+    if (!sbus) {
++    /* Start timer: will fire after 40 * 256 * 1000 == 1024000 ns */
-+        sbus = g_malloc0(sizeof(SMMUPciBus) +
++    writel(TIMER_BASE + TIMER2LOAD, 1000);
-+                         sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
++    /* enable in periodic, wrapping, interrupt mode, prescale 256 */
-+        sbus->bus = bus;
++    writel(TIMER_BASE + TIMER2CONTROL,
-+        g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
++           CTRL_ENABLE | CTRL_INTEN | CTRL_PERIODIC | CTRL_PRESCALE_256);
 +    }
 +
-+    sdev = sbus->pbdev[devfn];
++    /* Step to just past the 500th tick and check VALUE */
-+    if (!sdev) {
++    clock_step(40 * 256 * 501);
-+        char *name = g_strdup_printf("%s-%d-%d",
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
-+                                     s->mrtypename,
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 500);
 +                                     pci_bus_num(bus), devfn);
 +        sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
 +
-+        sdev->smmu = s;
++    /* Just past the 1000th tick: timer should have fired */
-+        sdev->bus = bus;
++    clock_step(40 * 256 * 500);
-+        sdev->devfn = devfn;
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 1);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 0);
 +
-+        memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
++    /* In periodic mode the tick VALUE now reloads */
-+                                 s->mrtypename,
++    clock_step(40 * 256);
-+                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 1000);
 +        address_space_init(&sdev->as,
 +                           MEMORY_REGION(&sdev->iommu), name);
 +        trace_smmu_add_mr(name);
 +        g_free(name);
 +    }
 +
-+    return &sdev->as;
++    /* Check that any write to INTCLR clears interrupt */
 +    writel(TIMER_BASE + TIMER2INTCLR, 1);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
 +
 +    /* Turn off the timer */
 +    writel(TIMER_BASE + TIMER2CONTROL, 0);
 +}
 +
- static void smmu_base_realize(DeviceState *dev, Error **errp)
++int main(int argc, char **argv)
- {
++{
-+    SMMUState *s = ARM_SMMU(dev);
++    int r;
      SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
      Error *local_err = NULL;
@@ -XXX,XX +XXX,XX @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, local_err);
          return;
      }
 +
-+    s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
++    g_test_init(&argc, &argv, NULL);
 +
-+    if (s->primary_bus) {
++    qtest_start("-machine mps2-an385");
-+        pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
++
-+    } else {
++    qtest_add_func("/cmsdk-apb-dualtimer/dualtimer", test_dualtimer);
-+        error_setg(errp, "SMMU is not attached to any PCI bus!");
++    qtest_add_func("/cmsdk-apb-dualtimer/prescale", test_prescale);
-+    }
++
- }
++    r = g_test_run();
++
- static void smmu_base_reset(DeviceState *dev)
++    qtest_end();
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
++
 +    return r;
 +}
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
+--- a/MAINTAINERS
-+++ b/hw/arm/trace-events
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ F: include/hw/timer/cmsdk-apb-timer.h
+ F: tests/qtest/cmsdk-apb-timer-test.c
- # hw/arm/virt-acpi-build.c
+ F: hw/timer/cmsdk-apb-dualtimer.c
- virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
+ F: include/hw/timer/cmsdk-apb-dualtimer.h
-+
++F: tests/qtest/cmsdk-apb-dualtimer-test.c
-+# hw/arm/smmu-common.c
+ F: hw/char/cmsdk-apb-uart.c
-+smmu_add_mr(const char *name) "%s"
+ F: include/hw/char/cmsdk-apb-uart.h
-\ No newline at end of file
+ F: hw/watchdog/cmsdk-apb-watchdog.c
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
     'npcm7xx_timer-test',
     'npcm7xx_watchdog_timer-test']
  qtests_arm = \
 +  (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
    (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
    (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
    (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
 --
-.17.0
+.20.1

-New patch
+[PULL 27/46] hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
+The state struct for the CMSDK APB timer device doesn't follow our
+usual naming convention of camelcase -- "CMSDK" and "APB" are both
+acronyms, but "TIMER" is not so should not be all-uppercase.
+Globally rename the struct to "CMSDKAPBTimer" (bringing it into line
+with CMSDKAPBWatchdog and CMSDKAPBDualTimer; CMSDKAPBUART remains
+as-is because "UART" is an acronym).
+Commit created with:
+ perl -p -i -e 's/CMSDKAPBTIMER/CMSDKAPBTimer/g' hw/timer/cmsdk-apb-timer.c include/hw/arm/armsse.h include/hw/timer/cmsdk-apb-timer.h
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-7-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-7-peter.maydell@linaro.org
+---
+ include/hw/arm/armsse.h            |  6 +++---
+ include/hw/timer/cmsdk-apb-timer.h |  4 ++--
+ hw/timer/cmsdk-apb-timer.c         | 28 ++++++++++++++--------------
+files changed, 19 insertions(+), 19 deletions(-)
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armsse.h
++++ b/include/hw/arm/armsse.h
+@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
+     TZPPC apb_ppc0;
+     TZPPC apb_ppc1;
+     TZMPC mpc[IOTS_NUM_MPC];
+-    CMSDKAPBTIMER timer0;
+-    CMSDKAPBTIMER timer1;
+-    CMSDKAPBTIMER s32ktimer;
++    CMSDKAPBTimer timer0;
++    CMSDKAPBTimer timer1;
++    CMSDKAPBTimer s32ktimer;
+     qemu_or_irq ppc_irq_orgate;
+     SplitIRQ sec_resp_splitter;
+     SplitIRQ ppc_irq_splitter[NUM_PPCS];
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/timer/cmsdk-apb-timer.h
++++ b/include/hw/timer/cmsdk-apb-timer.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qom/object.h"
+ #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
+-OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTIMER, CMSDK_APB_TIMER)
++OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
+-struct CMSDKAPBTIMER {
++struct CMSDKAPBTimer {
+     /*< private >*/
+     SysBusDevice parent_obj;
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/timer/cmsdk-apb-timer.c
++++ b/hw/timer/cmsdk-apb-timer.c
+@@ -XXX,XX +XXX,XX @@ static const int timer_id[] = {
+x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+ };
+-static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
++static void cmsdk_apb_timer_update(CMSDKAPBTimer *s)
+ {
+     qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
+ }
+ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
+ {
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
+     uint64_t r;
+     switch (offset) {
+@@ -XXX,XX +XXX,XX @@ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
+ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
+                                   unsigned size)
+ {
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
+     trace_cmsdk_apb_timer_write(offset, value, size);
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps cmsdk_apb_timer_ops = {
+ static void cmsdk_apb_timer_tick(void *opaque)
+ {
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
+     if (s->ctrl & R_CTRL_IRQEN_MASK) {
+         s->intstatus |= R_INTSTATUS_IRQ_MASK;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_tick(void *opaque)
+ static void cmsdk_apb_timer_reset(DeviceState *dev)
+ {
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
+     trace_cmsdk_apb_timer_reset();
+     s->ctrl = 0;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
+ static void cmsdk_apb_timer_init(Object *obj)
+ {
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(obj);
+     memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
+                           s, "cmsdk-apb-timer", 0x1000);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
+ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
+ {
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
+     if (s->pclk_frq == 0) {
+         error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
+     .version_id = 1,
+     .minimum_version_id = 1,
+     .fields = (VMStateField[]) {
+-        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
+-        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
+-        VMSTATE_UINT32(value, CMSDKAPBTIMER),
+-        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
+-        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
++        VMSTATE_PTIMER(timer, CMSDKAPBTimer),
++        VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
++        VMSTATE_UINT32(value, CMSDKAPBTimer),
++        VMSTATE_UINT32(reload, CMSDKAPBTimer),
++        VMSTATE_UINT32(intstatus, CMSDKAPBTimer),
+         VMSTATE_END_OF_LIST()
+     }
+ };
+ static Property cmsdk_apb_timer_properties[] = {
+-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
++    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
+ static const TypeInfo cmsdk_apb_timer_info = {
+     .name = TYPE_CMSDK_APB_TIMER,
+     .parent = TYPE_SYS_BUS_DEVICE,
+-    .instance_size = sizeof(CMSDKAPBTIMER),
++    .instance_size = sizeof(CMSDKAPBTimer),
+     .instance_init = cmsdk_apb_timer_init,
+     .class_init = cmsdk_apb_timer_class_init,
+ };
+--
+.20.1

-New patch
+[PULL 28/46] hw/timer/cmsdk-apb-timer: Add Clock input
+As the first step in converting the CMSDK_APB_TIMER device to the
+Clock framework, add a Clock input.  For the moment we do nothing
+with this clock; we will change the behaviour from using the pclk-frq
+property to using the Clock once all the users of this device have
+been converted to wire up the Clock.
+Since the device doesn't already have a doc comment for its "QEMU
+interface", we add one including the new Clock.
+This is a migration compatibility break for machines mps2-an505,
+mps2-an521, musca-a, musca-b1.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-8-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-8-peter.maydell@linaro.org
+---
+ include/hw/timer/cmsdk-apb-timer.h | 9 +++++++++
+ hw/timer/cmsdk-apb-timer.c         | 7 +++++--
+files changed, 14 insertions(+), 2 deletions(-)
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/timer/cmsdk-apb-timer.h
++++ b/include/hw/timer/cmsdk-apb-timer.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/qdev-properties.h"
+ #include "hw/sysbus.h"
+ #include "hw/ptimer.h"
++#include "hw/clock.h"
+ #include "qom/object.h"
+ #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
+ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
++/*
++ * QEMU interface:
++ *  + QOM property "pclk-frq": frequency at which the timer is clocked
++ *  + Clock input "pclk": clock for the timer
++ *  + sysbus MMIO region 0: the register bank
++ *  + sysbus IRQ 0: timer interrupt TIMERINT
++ */
+ struct CMSDKAPBTimer {
+     /*< private >*/
+     SysBusDevice parent_obj;
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
+     qemu_irq timerint;
+     uint32_t pclk_frq;
+     struct ptimer_state *timer;
++    Clock *pclk;
+     uint32_t ctrl;
+     uint32_t value;
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/timer/cmsdk-apb-timer.c
++++ b/hw/timer/cmsdk-apb-timer.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/irq.h"
+ #include "hw/registerfields.h"
++#include "hw/qdev-clock.h"
+ #include "hw/timer/cmsdk-apb-timer.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
+                           s, "cmsdk-apb-timer", 0x1000);
+     sysbus_init_mmio(sbd, &s->iomem);
+     sysbus_init_irq(sbd, &s->timerint);
++    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
+ }
+ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
+ static const VMStateDescription cmsdk_apb_timer_vmstate = {
+     .name = "cmsdk-apb-timer",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .fields = (VMStateField[]) {
+         VMSTATE_PTIMER(timer, CMSDKAPBTimer),
++        VMSTATE_CLOCK(pclk, CMSDKAPBTimer),
+         VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
+         VMSTATE_UINT32(value, CMSDKAPBTimer),
+         VMSTATE_UINT32(reload, CMSDKAPBTimer),
+--
+.20.1

-New patch
+[PULL 29/46] hw/timer/cmsdk-apb-dualtimer: Add Clock input
+As the first step in converting the CMSDK_APB_DUALTIMER device to the
+Clock framework, add a Clock input.  For the moment we do nothing
+with this clock; we will change the behaviour from using the pclk-frq
+property to using the Clock once all the users of this device have
+been converted to wire up the Clock.
+We take the opportunity to correct the name of the clock input to
+match the hardware -- the dual timer names the clock which drives the
+timers TIMCLK.  (It does also have a 'pclk' input, which is used only
+for the register and APB bus logic; on the SSE-200 these clocks are
+both connected together.)
+This is a migration compatibility break for machines mps2-an385,
+mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
+musca-b1.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-9-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-9-peter.maydell@linaro.org
+---
+ include/hw/timer/cmsdk-apb-dualtimer.h | 3 +++
+ hw/timer/cmsdk-apb-dualtimer.c         | 7 +++++--
+files changed, 8 insertions(+), 2 deletions(-)
+diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/timer/cmsdk-apb-dualtimer.h
++++ b/include/hw/timer/cmsdk-apb-dualtimer.h
+@@ -XXX,XX +XXX,XX @@
+  *
+  * QEMU interface:
+  *  + QOM property "pclk-frq": frequency at which the timer is clocked
++ *  + Clock input "TIMCLK": clock (for both timers)
+  *  + sysbus MMIO region 0: the register bank
+  *  + sysbus IRQ 0: combined timer interrupt TIMINTC
+  *  + sysbus IRO 1: timer block 1 interrupt TIMINT1
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/ptimer.h"
++#include "hw/clock.h"
+ #include "qom/object.h"
+ #define TYPE_CMSDK_APB_DUALTIMER "cmsdk-apb-dualtimer"
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
+     MemoryRegion iomem;
+     qemu_irq timerintc;
+     uint32_t pclk_frq;
++    Clock *timclk;
+     CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
+     uint32_t timeritcr;
+diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/timer/cmsdk-apb-dualtimer.c
++++ b/hw/timer/cmsdk-apb-dualtimer.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/irq.h"
+ #include "hw/qdev-properties.h"
+ #include "hw/registerfields.h"
++#include "hw/qdev-clock.h"
+ #include "hw/timer/cmsdk-apb-dualtimer.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
+     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
+         sysbus_init_irq(sbd, &s->timermod[i].timerint);
+     }
++    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
+ }
+ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_dualtimermod_vmstate = {
+ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
+     .name = "cmsdk-apb-dualtimer",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .fields = (VMStateField[]) {
++        VMSTATE_CLOCK(timclk, CMSDKAPBDualTimer),
+         VMSTATE_STRUCT_ARRAY(timermod, CMSDKAPBDualTimer,
+                              CMSDK_APB_DUALTIMER_NUM_MODULES,
+, cmsdk_dualtimermod_vmstate,
+--
+.20.1

-New patch
+[PULL 30/46] hw/watchdog/cmsdk-apb-watchdog: Add Clock input
+As the first step in converting the CMSDK_APB_TIMER device to the
+Clock framework, add a Clock input.  For the moment we do nothing
+with this clock; we will change the behaviour from using the
+wdogclk-frq property to using the Clock once all the users of this
+device have been converted to wire up the Clock.
+This is a migration compatibility break for machines mps2-an385,
+mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
+musca-b1, lm3s811evb, lm3s6965evb.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-10-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-10-peter.maydell@linaro.org
+---
+ include/hw/watchdog/cmsdk-apb-watchdog.h | 3 +++
+ hw/watchdog/cmsdk-apb-watchdog.c         | 7 +++++--
+files changed, 8 insertions(+), 2 deletions(-)
+diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
++++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
+@@ -XXX,XX +XXX,XX @@
+  *
+  * QEMU interface:
+  *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
++ *  + Clock input "WDOGCLK": clock for the watchdog's timer
+  *  + sysbus MMIO region 0: the register bank
+  *  + sysbus IRQ 0: watchdog interrupt
+  *
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/ptimer.h"
++#include "hw/clock.h"
+ #include "qom/object.h"
+ #define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
+     uint32_t wdogclk_frq;
+     bool is_luminary;
+     struct ptimer_state *timer;
++    Clock *wdogclk;
+     uint32_t control;
+     uint32_t intstatus;
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/watchdog/cmsdk-apb-watchdog.c
++++ b/hw/watchdog/cmsdk-apb-watchdog.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/irq.h"
+ #include "hw/qdev-properties.h"
+ #include "hw/registerfields.h"
++#include "hw/qdev-clock.h"
+ #include "hw/watchdog/cmsdk-apb-watchdog.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
+                           s, "cmsdk-apb-watchdog", 0x1000);
+     sysbus_init_mmio(sbd, &s->iomem);
+     sysbus_init_irq(sbd, &s->wdogint);
++    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
+     s->is_luminary = false;
+     s->id = cmsdk_apb_watchdog_id;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
+ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
+     .name = "cmsdk-apb-watchdog",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .fields = (VMStateField[]) {
++        VMSTATE_CLOCK(wdogclk, CMSDKAPBWatchdog),
+         VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
+         VMSTATE_UINT32(control, CMSDKAPBWatchdog),
+         VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
+--
+.20.1

-New patch
+[PULL 31/46] hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
+While we transition the ARMSSE code from integer properties
+specifying clock frequencies to Clock objects, we want to have the
+device provide both at once.  We want the final name of the main
+input Clock to be "MAINCLK", following the hardware name.
+Unfortunately creating an input Clock with a name X creates an
+under-the-hood QOM property X; for "MAINCLK" this clashes with the
+existing UINT32 property of that name.
+Rename the UINT32 property to MAINCLK_FRQ so it can coexist with the
+MAINCLK Clock; once the transition is complete MAINCLK_FRQ will be
+deleted.
+Commit created with:
+ perl -p -i -e 's/MAINCLK/MAINCLK_FRQ/g' hw/arm/{armsse,mps2-tz,musca}.c include/hw/arm/armsse.h
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-11-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-11-peter.maydell@linaro.org
+---
+ include/hw/arm/armsse.h | 2 +-
+ hw/arm/armsse.c         | 6 +++---
+ hw/arm/mps2-tz.c        | 2 +-
+ hw/arm/musca.c          | 2 +-
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armsse.h
++++ b/include/hw/arm/armsse.h
+@@ -XXX,XX +XXX,XX @@
+  * QEMU interface:
+  *  + QOM property "memory" is a MemoryRegion containing the devices provided
+  *    by the board model.
+- *  + QOM property "MAINCLK" is the frequency of the main system clock
++ *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
+  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
+  *    (In hardware, the SSE-200 permits the number of expansion interrupts
+  *    for the two CPUs to be configured separately, but we restrict it to
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
+     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                      MemoryRegion *),
+     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
+     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
+     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                      MemoryRegion *),
+     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
+     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+     }
+     if (!s->mainclk_frq) {
+-        error_setg(errp, "MAINCLK property was not set");
++        error_setg(errp, "MAINCLK_FRQ property was not set");
+         return;
+     }
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+     object_property_set_link(OBJECT(&mms->iotkit), "memory",
+                              OBJECT(system_memory), &error_abort);
+     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
+-    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
++    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
+     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
+     /*
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
+     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
+     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
+     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
+-    qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
++    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
+     /*
+      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+--
+.20.1

-New patch
+[PULL 32/46] hw/arm/armsse: Wire up clocks
+Create two input clocks on the ARMSSE devices, one for the normal
+MAINCLK, and one for the 32KHz S32KCLK, and wire these up to the
+appropriate devices.  The old property-based clock frequency setting
+will remain in place until conversion is complete.
+This is a migration compatibility break for machines mps2-an505,
+mps2-an521, musca-a, musca-b1.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-12-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-12-peter.maydell@linaro.org
+---
+ include/hw/arm/armsse.h |  6 ++++++
+ hw/arm/armsse.c         | 17 +++++++++++++++--
+files changed, 21 insertions(+), 2 deletions(-)
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armsse.h
++++ b/include/hw/arm/armsse.h
+@@ -XXX,XX +XXX,XX @@
+  *  per-CPU identity and control register blocks
+  *
+  * QEMU interface:
++ *  + Clock input "MAINCLK": clock for CPUs and most peripherals
++ *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
+  *  + QOM property "memory" is a MemoryRegion containing the devices provided
+  *    by the board model.
+  *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/misc/armsse-mhu.h"
+ #include "hw/misc/unimp.h"
+ #include "hw/or-irq.h"
++#include "hw/clock.h"
+ #include "hw/core/split-irq.h"
+ #include "hw/cpu/cluster.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
+     uint32_t nsccfg;
++    Clock *mainclk;
++    Clock *s32kclk;
++
+     /* Properties */
+     MemoryRegion *board_memory;
+     uint32_t exp_numirq;
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/armsse.h"
+ #include "hw/arm/boot.h"
+ #include "hw/irq.h"
++#include "hw/qdev-clock.h"
+ /* Format of the System Information block SYS_CONFIG register */
+ typedef enum SysConfigFormat {
+@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
+     assert(info->sram_banks <= MAX_SRAM_BANKS);
+     assert(info->num_cpus <= SSE_MAX_CPUS);
++    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
++    s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
++
+     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
+     for (i = 0; i < info->num_cpus; i++) {
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+      * map its upstream ends to the right place in the container.
+      */
+     qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
++    qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                              &error_abort);
+     qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
++    qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                              &error_abort);
+     qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
++    qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+      *   0x4002f000: S32K timer
+      */
+     qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
++    qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
+     qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
++    qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
+     qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
++    qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
+     qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
++    qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
+ static const VMStateDescription armsse_vmstate = {
+     .name = "iotkit",
+-    .version_id = 1,
+-    .minimum_version_id = 1,
++    .version_id = 2,
++    .minimum_version_id = 2,
+     .fields = (VMStateField[]) {
++        VMSTATE_CLOCK(mainclk, ARMSSE),
++        VMSTATE_CLOCK(s32kclk, ARMSSE),
+         VMSTATE_UINT32(nsccfg, ARMSSE),
+         VMSTATE_END_OF_LIST()
+     }
+--
+.20.1

-New patch
+[PULL 33/46] hw/arm/mps2: Inline CMSDK_APB_TIMER creation
+The old-style convenience function cmsdk_apb_timer_create() for
+creating CMSDK_APB_TIMER objects is used in only two places in
+mps2.c.  Most of the rest of the code in that file uses the new
+"initialize in place" coding style.
+We want to connect up a Clock object which should be done between the
+object creation and realization; rather than adding a Clock* argument
+to the convenience function, convert the timer creation code in
+mps2.c to the same style as is used already for the watchdog,
+dualtimer and other devices, and delete the now-unused convenience
+function.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-13-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-13-peter.maydell@linaro.org
+---
+ include/hw/timer/cmsdk-apb-timer.h | 21 ---------------------
+ hw/arm/mps2.c                      | 18 ++++++++++++++++--
+files changed, 16 insertions(+), 23 deletions(-)
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/timer/cmsdk-apb-timer.h
++++ b/include/hw/timer/cmsdk-apb-timer.h
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
+     uint32_t intstatus;
+ };
+-/**
+- * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
+- * @addr: location in system memory to map registers
+- * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
+- */
+-static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
+-                                                 qemu_irq timerint,
+-                                                 uint32_t pclk_frq)
+-{
+-    DeviceState *dev;
+-    SysBusDevice *s;
+-
+-    dev = qdev_new(TYPE_CMSDK_APB_TIMER);
+-    s = SYS_BUS_DEVICE(dev);
+-    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
+-    sysbus_realize_and_unref(s, &error_fatal);
+-    sysbus_mmio_map(s, 0, addr);
+-    sysbus_connect_irq(s, 0, timerint);
+-    return dev;
+-}
+-
+ #endif
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
+     /* CMSDK APB subsystem */
+     CMSDKAPBDualTimer dualtimer;
+     CMSDKAPBWatchdog watchdog;
++    CMSDKAPBTimer timer[2];
+ };
+ #define TYPE_MPS2_MACHINE "mps2"
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+     }
+     /* CMSDK APB subsystem */
+-    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
+-    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
++    for (i = 0; i < ARRAY_SIZE(mms->timer); i++) {
++        g_autofree char *name = g_strdup_printf("timer%d", i);
++        hwaddr base = 0x40000000 + i * 0x1000;
++        int irqno = 8 + i;
++        SysBusDevice *sbd;
++
++        object_initialize_child(OBJECT(mms), name, &mms->timer[i],
++                                TYPE_CMSDK_APB_TIMER);
++        sbd = SYS_BUS_DEVICE(&mms->timer[i]);
++        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
++        sysbus_realize_and_unref(sbd, &error_fatal);
++        sysbus_mmio_map(sbd, 0, base);
++        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
++    }
++
+     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
+                             TYPE_CMSDK_APB_DUALTIMER);
+     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
+--
+.20.1

-New patch
+[PULL 34/46] hw/arm/mps2: Create and connect SYSCLK Clock
+Create a fixed-frequency Clock object to be the SYSCLK, and wire it
+up to the devices that require it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-14-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-14-peter.maydell@linaro.org
+---
+ hw/arm/mps2.c | 9 +++++++++
+file changed, 9 insertions(+)
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/lan9118.h"
+ #include "net/net.h"
+ #include "hw/watchdog/cmsdk-apb-watchdog.h"
++#include "hw/qdev-clock.h"
+ #include "qom/object.h"
+ typedef enum MPS2FPGAType {
+@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
+     CMSDKAPBDualTimer dualtimer;
+     CMSDKAPBWatchdog watchdog;
+     CMSDKAPBTimer timer[2];
++    Clock *sysclk;
+ };
+ #define TYPE_MPS2_MACHINE "mps2"
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+         exit(EXIT_FAILURE);
+     }
++    /* This clock doesn't need migration because it is fixed-frequency */
++    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
++    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
++
+     /* The FPGA images have an odd combination of different RAMs,
+      * because in hardware they are different implementations and
+      * connected to different buses, giving varying performance/size
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+                                 TYPE_CMSDK_APB_TIMER);
+         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
+         qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
++        qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
+         sysbus_realize_and_unref(sbd, &error_fatal);
+         sysbus_mmio_map(sbd, 0, base);
+         sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
+                             TYPE_CMSDK_APB_DUALTIMER);
+     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
++    qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
+     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
+                        qdev_get_gpio_in(armv7m, 10));
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
+                             TYPE_CMSDK_APB_WATCHDOG);
+     qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
++    qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
+     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
+                        qdev_get_gpio_in_named(armv7m, "NMI", 0));
+--
+.20.1

-New patch
+[PULL 35/46] hw/arm/mps2-tz: Create and connect ARMSSE Clocks
+Create and connect the two clocks needed by the ARMSSE.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-15-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-15-peter.maydell@linaro.org
+---
+ hw/arm/mps2-tz.c | 13 +++++++++++++
+file changed, 13 insertions(+)
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/lan9118.h"
+ #include "net/net.h"
+ #include "hw/core/split-irq.h"
++#include "hw/qdev-clock.h"
+ #include "qom/object.h"
+ #define MPS2TZ_NUMIRQ 92
+@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
+     qemu_or_irq uart_irq_orgate;
+     DeviceState *lan9118;
+     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
++    Clock *sysclk;
++    Clock *s32kclk;
+ };
+ #define TYPE_MPS2TZ_MACHINE "mps2tz"
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
+ /* Main SYSCLK frequency in Hz */
+ #define SYSCLK_FRQ 20000000
++/* Slow 32Khz S32KCLK frequency in Hz */
++#define S32KCLK_FRQ (32 * 1000)
+ /* Create an alias of an entire original MemoryRegion @orig
+  * located at @base in the memory map.
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+         exit(EXIT_FAILURE);
+     }
++    /* These clocks don't need migration because they are fixed-frequency */
++    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
++    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
++    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
++    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
++
+     object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
+                             mmc->armsse_type);
+     iotkitdev = DEVICE(&mms->iotkit);
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+                              OBJECT(system_memory), &error_abort);
+     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
+     qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
++    qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
++    qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
+     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
+     /*
+--
+.20.1

-New patch
+[PULL 36/46] hw/arm/musca: Create and connect ARMSSE Clocks
+Create and connect the two clocks needed by the ARMSSE.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-16-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-16-peter.maydell@linaro.org
+---
+ hw/arm/musca.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/misc/tz-ppc.h"
+ #include "hw/misc/unimp.h"
+ #include "hw/rtc/pl031.h"
++#include "hw/qdev-clock.h"
+ #include "qom/object.h"
+ #define MUSCA_NUMIRQ_MAX 96
+@@ -XXX,XX +XXX,XX @@ struct MuscaMachineState {
+     UnimplementedDeviceState sdio;
+     UnimplementedDeviceState gpio;
+     UnimplementedDeviceState cryptoisland;
++    Clock *sysclk;
++    Clock *s32kclk;
+ };
+ #define TYPE_MUSCA_MACHINE "musca"
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
+  * don't model that in our SSE-200 model yet.
+  */
+ #define SYSCLK_FRQ 40000000
++/* Slow 32Khz S32KCLK frequency in Hz */
++#define S32KCLK_FRQ (32 * 1000)
+ static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
+ {
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
+         exit(1);
+     }
++    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
++    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
++    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
++    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
++
+     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
+                             TYPE_SSE200);
+     ssedev = DEVICE(&mms->sse);
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
+     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
+     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
+     qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
++    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
++    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
+     /*
+      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+--
+.20.1

-New patch
+[PULL 37/46] hw/arm/stellaris: Convert SSYS to QOM device
+Convert the SSYS code in the Stellaris boards (which encapsulates the
 system registers) to a proper QOM device.  This will provide us with
 somewhere to put the output Clock whose frequency depends on the
 setting of the PLL configuration registers.
 This is a migration compatibility break for lm3s811evb, lm3s6965evb.
 We use 3-phase reset here because the Clock will need to propagate
 its value in the hold phase.
 For the moment we reset the device during the board creation so that
 the system_clock_scale global gets set; this will be removed in a
 subsequent commit.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-17-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-17-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
  hw/arm/stellaris.c | 132 ++++++++++++++++++++++++++++++++++++---------
 file changed, 107 insertions(+), 25 deletions(-)
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
  /* System controller.  */
 -typedef struct {
 +#define TYPE_STELLARIS_SYS "stellaris-sys"
 +OBJECT_DECLARE_SIMPLE_TYPE(ssys_state, STELLARIS_SYS)
 +
 +struct ssys_state {
 +    SysBusDevice parent_obj;
 +
      MemoryRegion iomem;
      uint32_t pborctl;
      uint32_t ldopctl;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint32_t dcgc[3];
      uint32_t clkvclr;
      uint32_t ldoarst;
 +    qemu_irq irq;
 +    /* Properties (all read-only registers) */
      uint32_t user0;
      uint32_t user1;
 -    qemu_irq irq;
 -    stellaris_board_info *board;
 -} ssys_state;
 +    uint32_t did0;
 +    uint32_t did1;
 +    uint32_t dc0;
 +    uint32_t dc1;
 +    uint32_t dc2;
 +    uint32_t dc3;
 +    uint32_t dc4;
 +};
  static void ssys_update(ssys_state *s)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_fury[16] = {
  static int ssys_board_class(const ssys_state *s)
  {
 -    uint32_t did0 = s->board->did0;
 +    uint32_t did0 = s->did0;
      switch (did0 & DID0_VER_MASK) {
      case DID0_VER_0:
          return DID0_CLASS_SANDSTORM;
@@ -XXX,XX +XXX,XX @@ static uint64_t ssys_read(void *opaque, hwaddr offset,
      switch (offset) {
      case 0x000: /* DID0 */
 -        return s->board->did0;
 +        return s->did0;
      case 0x004: /* DID1 */
 -        return s->board->did1;
 +        return s->did1;
      case 0x008: /* DC0 */
 -        return s->board->dc0;
 +        return s->dc0;
      case 0x010: /* DC1 */
 -        return s->board->dc1;
 +        return s->dc1;
      case 0x014: /* DC2 */
 -        return s->board->dc2;
 +        return s->dc2;
      case 0x018: /* DC3 */
 -        return s->board->dc3;
 +        return s->dc3;
      case 0x01c: /* DC4 */
 -        return s->board->dc4;
 +        return s->dc4;
      case 0x030: /* PBORCTL */
          return s->pborctl;
      case 0x034: /* LDOPCTL */
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ssys_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 -static void ssys_reset(void *opaque)
 +static void stellaris_sys_reset_enter(Object *obj, ResetType type)
  {
 -    ssys_state *s = (ssys_state *)opaque;
 +    ssys_state *s = STELLARIS_SYS(obj);
      s->pborctl = 0x7ffd;
      s->rcc = 0x078e3ac0;
@@ -XXX,XX +XXX,XX @@ static void ssys_reset(void *opaque)
      s->rcgc[0] = 1;
      s->scgc[0] = 1;
      s->dcgc[0] = 1;
 +}
 +
 +static void stellaris_sys_reset_hold(Object *obj)
 +{
 +    ssys_state *s = STELLARIS_SYS(obj);
 +
      ssys_calculate_system_clock(s);
  }
 +static void stellaris_sys_reset_exit(Object *obj)
 +{
 +}
 +
  static int stellaris_sys_post_load(void *opaque, int version_id)
  {
      ssys_state *s = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
      }
  };
 +static Property stellaris_sys_properties[] = {
 +    DEFINE_PROP_UINT32("user0", ssys_state, user0, 0),
 +    DEFINE_PROP_UINT32("user1", ssys_state, user1, 0),
 +    DEFINE_PROP_UINT32("did0", ssys_state, did0, 0),
 +    DEFINE_PROP_UINT32("did1", ssys_state, did1, 0),
 +    DEFINE_PROP_UINT32("dc0", ssys_state, dc0, 0),
 +    DEFINE_PROP_UINT32("dc1", ssys_state, dc1, 0),
 +    DEFINE_PROP_UINT32("dc2", ssys_state, dc2, 0),
 +    DEFINE_PROP_UINT32("dc3", ssys_state, dc3, 0),
 +    DEFINE_PROP_UINT32("dc4", ssys_state, dc4, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static void stellaris_sys_instance_init(Object *obj)
 +{
 +    ssys_state *s = STELLARIS_SYS(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
 +
 +    memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
  static int stellaris_sys_init(uint32_t base, qemu_irq irq,
                                stellaris_board_info * board,
                                uint8_t *macaddr)
  {
 -    ssys_state *s;
 +    DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 -    s = g_new0(ssys_state, 1);
 -    s->irq = irq;
 -    s->board = board;
      /* Most devices come preprogrammed with a MAC address in the user data. */
 -    s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
 -    s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
 +    qdev_prop_set_uint32(dev, "user0",
 +                         macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16));
 +    qdev_prop_set_uint32(dev, "user1",
 +                         macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16));
 +    qdev_prop_set_uint32(dev, "did0", board->did0);
 +    qdev_prop_set_uint32(dev, "did1", board->did1);
 +    qdev_prop_set_uint32(dev, "dc0", board->dc0);
 +    qdev_prop_set_uint32(dev, "dc1", board->dc1);
 +    qdev_prop_set_uint32(dev, "dc2", board->dc2);
 +    qdev_prop_set_uint32(dev, "dc3", board->dc3);
 +    qdev_prop_set_uint32(dev, "dc4", board->dc4);
 +
 +    sysbus_realize_and_unref(sbd, &error_fatal);
 +    sysbus_mmio_map(sbd, 0, base);
 +    sysbus_connect_irq(sbd, 0, irq);
 +
 +    /*
 +     * Normally we should not be resetting devices like this during
 +     * board creation. For the moment we need to do so, because
 +     * system_clock_scale will only get set when the STELLARIS_SYS
 +     * device is reset, and we need its initial value to pass to
 +     * the watchdog device. This hack can be removed once the
 +     * watchdog has been converted to use a Clock input instead.
 +     */
 +    device_cold_reset(dev);
 -    memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
 -    memory_region_add_subregion(get_system_memory(), base, &s->iomem);
 -    ssys_reset(s);
 -    vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
      return 0;
  }
 -
  /* I2C controller.  */
  #define TYPE_STELLARIS_I2C "stellaris-i2c"
@@ -XXX,XX +XXX,XX @@ static const TypeInfo stellaris_adc_info = {
      .class_init    = stellaris_adc_class_init,
  };
 +static void stellaris_sys_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_stellaris_sys;
 +    rc->phases.enter = stellaris_sys_reset_enter;
 +    rc->phases.hold = stellaris_sys_reset_hold;
 +    rc->phases.exit = stellaris_sys_reset_exit;
 +    device_class_set_props(dc, stellaris_sys_properties);
 +}
 +
 +static const TypeInfo stellaris_sys_info = {
 +    .name = TYPE_STELLARIS_SYS,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(ssys_state),
 +    .instance_init = stellaris_sys_instance_init,
 +    .class_init = stellaris_sys_class_init,
 +};
 +
  static void stellaris_register_types(void)
  {
      type_register_static(&stellaris_i2c_info);
      type_register_static(&stellaris_gptm_info);
      type_register_static(&stellaris_adc_info);
 +    type_register_static(&stellaris_sys_info);
  }
  type_init(stellaris_register_types)
 --
 .20.1

-[Qemu-devel] [PULL 17/24] hw/arm/smmuv3: Implement MMIO write operations
+[PULL 38/46] hw/arm/stellaris: Create Clock input for watchdog
-From: Eric Auger <eric.auger@redhat.com>
+Create and connect the Clock input for the watchdog device on the
 Stellaris boards.  Because the Stellaris boards model the ability to
 change the clock rate by programming PLL registers, we have to create
 an output Clock on the ssys_state device and wire it up to the
 watchdog.
-Now we have relevant helpers for queue and irq
+Note that the old comment on ssys_calculate_system_clock() got the
-management, let's implement MMIO write operations.
+units wrong -- system_clock_scale is in nanoseconds, not
 milliseconds.  Improve the commentary to clarify how we are
 calculating the period.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-8-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-18-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-18-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- hw/arm/smmuv3-internal.h |   8 +-
+ hw/arm/stellaris.c | 43 +++++++++++++++++++++++++++++++------------
- hw/arm/smmuv3.c          | 170 +++++++++++++++++++++++++++++++++++++--
+file changed, 31 insertions(+), 12 deletions(-)
  hw/arm/trace-events      |   6 ++
 files changed, 174 insertions(+), 10 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/hw/arm/stellaris.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ REG32(CR0,                 0x20)
+@@ -XXX,XX +XXX,XX @@
-     FIELD(CR0, EVENTQEN,      2, 1)
+ #include "hw/watchdog/cmsdk-apb-watchdog.h"
-     FIELD(CR0, CMDQEN,        3, 1)
+ #include "migration/vmstate.h"
+ #include "hw/misc/unimp.h"
-+#define SMMU_CR0_RESERVED 0xFFFFFC20
++#include "hw/qdev-clock.h"
-+
+ #include "cpu.h"
- REG32(CR0ACK,              0x24)
+ #include "qom/object.h"
- REG32(CR1,                 0x28)
- REG32(CR2,                 0x2c)
+@@ -XXX,XX +XXX,XX @@ struct ssys_state {
-@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+     uint32_t clkvclr;
-     return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
+     uint32_t ldoarst;
      qemu_irq irq;
 +    Clock *sysclk;
      /* Properties (all read-only registers) */
      uint32_t user0;
      uint32_t user1;
@@ -XXX,XX +XXX,XX @@ static bool ssys_use_rcc2(ssys_state *s)
  }
--/* public until callers get introduced */
+ /*
--void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+- * Caculate the sys. clock period in ms.
--void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
++ * Calculate the system clock period. We only want to propagate
--
++ * this change to the rest of the system if we're not being called
- /* Queue Handling */
++ * from migration post-load.
  #define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
              addr;                                             \
          })
 -int smmuv3_cmdq_consume(SMMUv3State *s);
 +#define SMMU_FEATURE_2LVL_STE (1 << 0)
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
   * @irq: irq type
   * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
   */
--void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
+-static void ssys_calculate_system_clock(ssys_state *s)
-+static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
++static void ssys_calculate_system_clock(ssys_state *s, bool propagate_clock)
 +                               uint32_t gerror_mask)
  {
++    /*
-     bool pulse = false;
++     * SYSDIV field specifies divisor: 0 == /1, 1 == /2, etc.  Input
-@@ -XXX,XX +XXX,XX @@ void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
++     * clock is 200MHz, which is a period of 5 ns. Dividing the clock
 +     * frequency by X is the same as multiplying the period by X.
 +     */
      if (ssys_use_rcc2(s)) {
          system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
      } else {
          system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
      }
++    clock_set_ns(s->sysclk, system_clock_scale);
++    if (propagate_clock) {
++        clock_propagate(s->sysclk);
++    }
  }
--void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+ static void ssys_write(void *opaque, hwaddr offset,
-+static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
              s->int_status |= (1 << 6);
          }
          s->rcc = value;
 -        ssys_calculate_system_clock(s);
 +        ssys_calculate_system_clock(s, true);
          break;
      case 0x070: /* RCC2 */
          if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
              s->int_status |= (1 << 6);
          }
          s->rcc2 = value;
 -        ssys_calculate_system_clock(s);
 +        ssys_calculate_system_clock(s, true);
          break;
      case 0x100: /* RCGC0 */
          s->rcgc[0] = value;
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_reset_hold(Object *obj)
  {
-     uint32_t pending = s->gerror ^ s->gerrorn;
+     ssys_state *s = STELLARIS_SYS(obj);
-     uint32_t toggled = s->gerrorn ^ new_gerrorn;
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
+-    ssys_calculate_system_clock(s);
-     s->sid_split = 0;
++    /* OK to propagate clocks from the hold phase */
 +    ssys_calculate_system_clock(s, true);
  }
--int smmuv3_cmdq_consume(SMMUv3State *s)
+ static void stellaris_sys_reset_exit(Object *obj)
-+static int smmuv3_cmdq_consume(SMMUv3State *s)
+@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_post_load(void *opaque, int version_id)
  {
-     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
+     ssys_state *s = opaque;
-     SMMUQueue *q = &s->cmdq;
-@@ -XXX,XX +XXX,XX @@ int smmuv3_cmdq_consume(SMMUv3State *s)
+-    ssys_calculate_system_clock(s);
 +    ssys_calculate_system_clock(s, false);
      return 0;
  }
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
-+static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
+         VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
-+                               uint64_t data, MemTxAttrs attrs)
+         VMSTATE_UINT32(clkvclr, ssys_state),
-+{
+         VMSTATE_UINT32(ldoarst, ssys_state),
-+    switch (offset) {
++        /* No field for sysclk -- handled in post-load instead */
-+    case A_GERROR_IRQ_CFG0:
+         VMSTATE_END_OF_LIST()
-+        s->gerror_irq_cfg0 = data;
+     }
-+        return MEMTX_OK;
+ };
-+    case A_STRTAB_BASE:
+@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_instance_init(Object *obj)
-+        s->strtab_base = data;
+     memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
-+        return MEMTX_OK;
+     sysbus_init_mmio(sbd, &s->iomem);
-+    case A_CMDQ_BASE:
+     sysbus_init_irq(sbd, &s->irq);
-+        s->cmdq.base = data;
++    s->sysclk = qdev_init_clock_out(DEVICE(s), "SYSCLK");
-+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+ }
-+        if (s->cmdq.log2size > SMMU_CMDQS) {
-+            s->cmdq.log2size = SMMU_CMDQS;
+-static int stellaris_sys_init(uint32_t base, qemu_irq irq,
-+        }
+-                              stellaris_board_info * board,
-+        return MEMTX_OK;
+-                              uint8_t *macaddr)
-+    case A_EVENTQ_BASE:
++static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
-+        s->eventq.base = data;
++                                       stellaris_board_info *board,
-+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
++                                       uint8_t *macaddr)
 +        if (s->eventq.log2size > SMMU_EVENTQS) {
 +            s->eventq.log2size = SMMU_EVENTQS;
 +        }
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG0:
 +        s->eventq_irq_cfg0 = data;
 +        return MEMTX_OK;
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
 +static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
 +                               uint64_t data, MemTxAttrs attrs)
 +{
 +    switch (offset) {
 +    case A_CR0:
 +        s->cr[0] = data;
 +        s->cr0ack = data & ~SMMU_CR0_RESERVED;
 +        /* in case the command queue has been enabled */
 +        smmuv3_cmdq_consume(s);
 +        return MEMTX_OK;
 +    case A_CR1:
 +        s->cr[1] = data;
 +        return MEMTX_OK;
 +    case A_CR2:
 +        s->cr[2] = data;
 +        return MEMTX_OK;
 +    case A_IRQ_CTRL:
 +        s->irq_ctrl = data;
 +        return MEMTX_OK;
 +    case A_GERRORN:
 +        smmuv3_write_gerrorn(s, data);
 +        /*
 +         * By acknowledging the CMDQ_ERR, SW may notify cmds can
 +         * be processed again
 +         */
 +        smmuv3_cmdq_consume(s);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0: /* 64b */
 +        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0 + 4:
 +        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG1:
 +        s->gerror_irq_cfg1 = data;
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG2:
 +        s->gerror_irq_cfg2 = data;
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE: /* 64b */
 +        s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE + 4:
 +        s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE_CFG:
 +        s->strtab_base_cfg = data;
 +        if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
 +            s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
 +            s->features |= SMMU_FEATURE_2LVL_STE;
 +        }
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE: /* 64b */
 +        s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
 +        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
 +        if (s->cmdq.log2size > SMMU_CMDQS) {
 +            s->cmdq.log2size = SMMU_CMDQS;
 +        }
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE + 4: /* 64b */
 +        s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_CMDQ_PROD:
 +        s->cmdq.prod = data;
 +        smmuv3_cmdq_consume(s);
 +        return MEMTX_OK;
 +    case A_CMDQ_CONS:
 +        s->cmdq.cons = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE: /* 64b */
 +        s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
 +        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
 +        if (s->eventq.log2size > SMMU_EVENTQS) {
 +            s->eventq.log2size = SMMU_EVENTQS;
 +        }
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE + 4:
 +        s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_PROD:
 +        s->eventq.prod = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_CONS:
 +        s->eventq.cons = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG0: /* 64b */
 +        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG0 + 4:
 +        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG1:
 +        s->eventq_irq_cfg1 = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG2:
 +        s->eventq_irq_cfg2 = data;
 +        return MEMTX_OK;
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
  static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                     unsigned size, MemTxAttrs attrs)
  {
--    /* not yet implemented */
+     DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
--    return MEMTX_ERROR;
+     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-+    SMMUState *sys = opaque;
+@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
-+    SMMUv3State *s = ARM_SMMUV3(sys);
+      */
-+    MemTxResult r;
+     device_cold_reset(dev);
-+
-+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
+-    return 0;
-+    offset &= ~0x10000;
++    return dev;
 +
 +    switch (size) {
 +    case 8:
 +        r = smmu_writell(s, offset, data, attrs);
 +        break;
 +    case 4:
 +        r = smmu_writel(s, offset, data, attrs);
 +        break;
 +    default:
 +        r = MEMTX_ERROR;
 +        break;
 +    }
 +
 +    trace_smmuv3_write_mmio(offset, data, size, r);
 +    return r;
  }
- static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
+ /* I2C controller.  */
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-index XXXXXXX..XXXXXXX 100644
+     int flash_size;
---- a/hw/arm/trace-events
+     I2CBus *i2c;
-+++ b/hw/arm/trace-events
+     DeviceState *dev;
-@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t con
++    DeviceState *ssys_dev;
- smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
+     int i;
- smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
+     int j;
- smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
-+smmuv3_update(bool is_empty, uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "q empty:%d prod:%d cons:%d p.wrap:%d p.cons:%d"
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+smmuv3_update_check_cmd(int error) "cmdq not enabled or error :0x%x"
+         }
-+smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+     }
-+smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
-+smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+-    stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
-+smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+-                       board, nd_table[0].macaddr.a);
 +    ssys_dev = stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
 +                                  board, nd_table[0].macaddr.a);
      if (board->dc1 & (1 << 3)) { /* watchdog present */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          /* system_clock_scale is valid now */
          uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
          qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
 +        qdev_connect_clock_in(dev, "WDOGCLK",
 +                              qdev_get_clock_out(ssys_dev, "SYSCLK"));
          sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
          sysbus_mmio_map(SYS_BUS_DEVICE(dev),
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 23/24] hw/arm/virt-acpi-build: Add smmuv3 node in IORT table
+[PULL 39/46] hw/timer/cmsdk-apb-timer: Convert to use Clock input
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+Switch the CMSDK APB timer device over to using its Clock input; the
 pclk-frq property is now ignored.
-This patch builds the smmuv3 node in the ACPI IORT table.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-19-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-19-peter.maydell@linaro.org
 ---
  hw/timer/cmsdk-apb-timer.c | 18 ++++++++++++++----
 file changed, 14 insertions(+), 4 deletions(-)
-The RID space of the root complex, which spans 0x0-0x10000
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
 maps to streamid space 0x0-0x10000 in smmuv3, which in turn
 maps to deviceid space 0x0-0x10000 in the ITS group.
 The guest must feature the IOMMU probe deferral series
 (https://lkml.org/lkml/2017/4/10/214) which fixes streamid
 multiple lookup. This bug is not related to the SMMU emulation.
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
 Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/acpi/acpi-defs.h | 15 ++++++++++
  hw/arm/virt-acpi-build.c    | 55 ++++++++++++++++++++++++++++++++-----
 files changed, 63 insertions(+), 7 deletions(-)
 diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/acpi/acpi-defs.h
+--- a/hw/timer/cmsdk-apb-timer.c
-+++ b/include/hw/acpi/acpi-defs.h
++++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
- } QEMU_PACKED;
+     ptimer_transaction_commit(s->timer);
- typedef struct AcpiIortItsGroup AcpiIortItsGroup;
+ }
-+struct AcpiIortSmmu3 {
++static void cmsdk_apb_timer_clk_update(void *opaque)
-+    ACPI_IORT_NODE_HEADER_DEF
++{
-+    uint64_t base_address;
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 +    uint32_t flags;
 +    uint32_t reserved2;
 +    uint64_t vatos_address;
 +    uint32_t model;
 +    uint32_t event_gsiv;
 +    uint32_t pri_gsiv;
 +    uint32_t gerr_gsiv;
 +    uint32_t sync_gsiv;
 +    AcpiIortIdMapping id_mapping_array[0];
 +} QEMU_PACKED;
 +typedef struct AcpiIortSmmu3 AcpiIortSmmu3;
 +
- struct AcpiIortRC {
++    ptimer_transaction_begin(s->timer);
-     ACPI_IORT_NODE_HEADER_DEF
++    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
-     AcpiIortMemoryAccess memory_properties;
++    ptimer_transaction_commit(s->timer);
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
++}
-index XXXXXXX..XXXXXXX 100644
++
---- a/hw/arm/virt-acpi-build.c
+ static void cmsdk_apb_timer_init(Object *obj)
-+++ b/hw/arm/virt-acpi-build.c
+ {
-@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                            s, "cmsdk-apb-timer", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->timerint);
 -    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
 +    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk",
 +                                 cmsdk_apb_timer_clk_update, s);
  }
- static void
+ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 -build_iort(GArray *table_data, BIOSLinker *linker)
 +build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
  {
--    int iort_start = table_data->len;
+     CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
-+    int nb_nodes, iort_start = table_data->len;
-     AcpiIortIdMapping *idmap;
+-    if (s->pclk_frq == 0) {
-     AcpiIortItsGroup *its;
+-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
-     AcpiIortTable *iort;
++    if (!clock_has_source(s->pclk)) {
--    size_t node_size, iort_length;
++        error_setg(errp, "CMSDK APB timer: pclk clock must be connected");
-+    AcpiIortSmmu3 *smmu;
+         return;
 +    size_t node_size, iort_length, smmu_offset = 0;
      AcpiIortRC *rc;
      iort = acpi_data_push(table_data, sizeof(*iort));
 +    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
 +        nb_nodes = 3; /* RC, ITS, SMMUv3 */
 +    } else {
 +        nb_nodes = 2; /* RC, ITS */
 +    }
 +
      iort_length = sizeof(*iort);
 -    iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */
 +    iort->node_count = cpu_to_le32(nb_nodes);
      iort->node_offset = cpu_to_le32(sizeof(*iort));
      /* ITS group node */
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
      its->its_count = cpu_to_le32(1);
      its->identifiers[0] = 0; /* MADT translation_id */
 +    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
 +        int irq =  vms->irqmap[VIRT_SMMU];
 +
 +        /* SMMUv3 node */
 +        smmu_offset = iort->node_offset + node_size;
 +        node_size = sizeof(*smmu) + sizeof(*idmap);
 +        iort_length += node_size;
 +        smmu = acpi_data_push(table_data, node_size);
 +
 +        smmu->type = ACPI_IORT_NODE_SMMU_V3;
 +        smmu->length = cpu_to_le16(node_size);
 +        smmu->mapping_count = cpu_to_le32(1);
 +        smmu->mapping_offset = cpu_to_le32(sizeof(*smmu));
 +        smmu->base_address = cpu_to_le64(vms->memmap[VIRT_SMMU].base);
 +        smmu->event_gsiv = cpu_to_le32(irq);
 +        smmu->pri_gsiv = cpu_to_le32(irq + 1);
 +        smmu->gerr_gsiv = cpu_to_le32(irq + 2);
 +        smmu->sync_gsiv = cpu_to_le32(irq + 3);
 +
 +        /* Identity RID mapping covering the whole input RID range */
 +        idmap = &smmu->id_mapping_array[0];
 +        idmap->input_base = 0;
 +        idmap->id_count = cpu_to_le32(0xFFFF);
 +        idmap->output_base = 0;
 +        /* output IORT node is the ITS group node (the first node) */
 +        idmap->output_reference = cpu_to_le32(iort->node_offset);
 +    }
 +
      /* Root Complex Node */
      node_size = sizeof(*rc) + sizeof(*idmap);
      iort_length += node_size;
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
      idmap->input_base = 0;
      idmap->id_count = cpu_to_le32(0xFFFF);
      idmap->output_base = 0;
 -    /* output IORT node is the ITS group node (the first node) */
 -    idmap->output_reference = cpu_to_le32(iort->node_offset);
 +
 +    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
 +        /* output IORT node is the smmuv3 node */
 +        idmap->output_reference = cpu_to_le32(smmu_offset);
 +    } else {
 +        /* output IORT node is the ITS group node (the first node) */
 +        idmap->output_reference = cpu_to_le32(iort->node_offset);
 +    }
      iort->length = cpu_to_le32(iort_length);
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
      if (its_class_name() && !vmc->no_its) {
          acpi_add_table(table_offsets, tables_blob);
 -        build_iort(tables_blob, tables->linker);
 +        build_iort(tables_blob, tables->linker, vms);
      }
-     /* XSDT is pointed to by RSDP */
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
                             PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
      ptimer_transaction_begin(s->timer);
 -    ptimer_set_freq(s->timer, s->pclk_frq);
 +    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
      ptimer_transaction_commit(s->timer);
  }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 04/24] hw/usb/tusb6010: Convert away from old_mmio
+[PULL 40/46] hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
-Convert the tusb6010 device away from using the old_mmio field
+Switch the CMSDK APB dualtimer device over to using its Clock input;
-of MemoryRegionOps. This device is used only in the n800 and n810
+the pclk-frq property is now ignored.
 boards.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20180427173611.10281-2-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-20-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-20-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- hw/usb/tusb6010.c | 40 ++++++++++++++++++++++++++++++++++++----
+ hw/timer/cmsdk-apb-dualtimer.c | 42 ++++++++++++++++++++++++++++++----
-file changed, 36 insertions(+), 4 deletions(-)
+file changed, 37 insertions(+), 5 deletions(-)
-diff --git a/hw/usb/tusb6010.c b/hw/usb/tusb6010.c
+diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/usb/tusb6010.c
+--- a/hw/timer/cmsdk-apb-dualtimer.c
-+++ b/hw/usb/tusb6010.c
++++ b/hw/timer/cmsdk-apb-dualtimer.c
-@@ -XXX,XX +XXX,XX @@ static void tusb_async_writew(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_update(CMSDKAPBDualTimer *s)
-     }
+     qemu_set_irq(s->timerintc, timintc);
  }
-+static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)
++static int cmsdk_dualtimermod_divisor(CMSDKAPBDualTimerModule *m)
 +{
-+    switch (size) {
++    /* Return the divisor set by the current CONTROL.PRESCALE value */
 +    switch (FIELD_EX32(m->control, CONTROL, PRESCALE)) {
 +    case 0:
 +        return 1;
 +    case 1:
-+        return tusb_async_readb(opaque, addr);
++        return 16;
 +    case 2:
-+        return tusb_async_readh(opaque, addr);
++    case 3: /* UNDEFINED, we treat like 2 (and complained when it was set) */
-+    case 4:
++        return 256;
 +        return tusb_async_readw(opaque, addr);
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
-+static void tusb_async_writefn(void *opaque, hwaddr addr,
+ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
-+                               uint64_t value, unsigned size)
+                                              uint32_t newctrl)
  {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
          default:
              g_assert_not_reached();
          }
 -        ptimer_set_freq(m->timer, m->parent->pclk_frq / divisor);
 +        ptimer_set_period_from_clock(m->timer, m->parent->timclk, divisor);
      }
      if (changed & R_CONTROL_MODE_MASK) {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
       * limit must both be set to 0xffff, so we wrap at 16 bits.
       */
      ptimer_set_limit(m->timer, 0xffff, 1);
 -    ptimer_set_freq(m->timer, m->parent->pclk_frq);
 +    ptimer_set_period_from_clock(m->timer, m->parent->timclk,
 +                                 cmsdk_dualtimermod_divisor(m));
      ptimer_transaction_commit(m->timer);
  }
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
      s->timeritop = 0;
  }
 +static void cmsdk_apb_dualtimer_clk_update(void *opaque)
 +{
-+    switch (size) {
++    CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(opaque);
-+    case 1:
++    int i;
-+        tusb_async_writeb(opaque, addr, value);
++
-+        break;
++    for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
-+    case 2:
++        CMSDKAPBDualTimerModule *m = &s->timermod[i];
-+        tusb_async_writeh(opaque, addr, value);
++        ptimer_transaction_begin(m->timer);
-+        break;
++        ptimer_set_period_from_clock(m->timer, m->parent->timclk,
-+    case 4:
++                                     cmsdk_dualtimermod_divisor(m));
-+        tusb_async_writew(opaque, addr, value);
++        ptimer_transaction_commit(m->timer);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
- static const MemoryRegionOps tusb_async_ops = {
+ static void cmsdk_apb_dualtimer_init(Object *obj)
--    .old_mmio = {
+ {
--        .read = { tusb_async_readb, tusb_async_readh, tusb_async_readw, },
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
--        .write =  { tusb_async_writeb, tusb_async_writeh, tusb_async_writew, },
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
--    },
+     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
-+    .read = tusb_async_readfn,
+         sysbus_init_irq(sbd, &s->timermod[i].timerint);
-+    .write = tusb_async_writefn,
+     }
-+    .valid.min_access_size = 1,
+-    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
-+    .valid.max_access_size = 4,
++    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK",
-     .endianness = DEVICE_NATIVE_ENDIAN,
++                                   cmsdk_apb_dualtimer_clk_update, s);
- };
+ }
  static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
      CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(dev);
      int i;
 -    if (s->pclk_frq == 0) {
 -        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
 +    if (!clock_has_source(s->timclk)) {
 +        error_setg(errp, "CMSDK APB dualtimer: TIMCLK clock must be connected");
          return;
      }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 20/24] hw/arm/smmuv3: Abort on vfio or vhost case
+[PULL 41/46] hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
-From: Eric Auger <eric.auger@redhat.com>
+Switch the CMSDK APB watchdog device over to using its Clock input;
 the wdogclk_frq property is now ignored.
-At the moment, the SMMUv3 does not support notification on
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-TLB invalidation. So let's log an error as soon as such notifier
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-gets enabled.
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-21-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-21-peter.maydell@linaro.org
 ---
  hw/watchdog/cmsdk-apb-watchdog.c | 18 ++++++++++++++----
 file changed, 14 insertions(+), 4 deletions(-)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-11-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3.c | 11 +++++++++++
 file changed, 11 insertions(+)
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/hw/watchdog/cmsdk-apb-watchdog.c
-+++ b/hw/arm/smmuv3.c
++++ b/hw/watchdog/cmsdk-apb-watchdog.c
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
-     dc->realize = smmu_realize;
+     ptimer_transaction_commit(s->timer);
  }
-+static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
++static void cmsdk_apb_watchdog_clk_update(void *opaque)
 +                                       IOMMUNotifierFlag old,
 +                                       IOMMUNotifierFlag new)
 +{
-+    if (old == IOMMU_NOTIFIER_NONE) {
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
-+        warn_report("SMMUV3 does not support vhost/vfio integration yet: "
++
-+                    "devices of those types will not function properly");
++    ptimer_transaction_begin(s->timer);
-+    }
++    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
 +    ptimer_transaction_commit(s->timer);
 +}
 +
- static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
+ static void cmsdk_apb_watchdog_init(Object *obj)
                                                    void *data)
  {
-     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
-     imrc->translate = smmuv3_translate;
+                           s, "cmsdk-apb-watchdog", 0x1000);
-+    imrc->notify_flag_changed = smmuv3_notify_flag_changed;
+     sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->wdogint);
 -    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
 +    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK",
 +                                    cmsdk_apb_watchdog_clk_update, s);
      s->is_luminary = false;
      s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
  {
      CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
 -    if (s->wdogclk_frq == 0) {
 +    if (!clock_has_source(s->wdogclk)) {
          error_setg(errp,
 -                   "CMSDK APB watchdog: wdogclk-frq property must be set");
 +                   "CMSDK APB watchdog: WDOGCLK clock must be connected");
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
                             PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
      ptimer_transaction_begin(s->timer);
 -    ptimer_set_freq(s->timer, s->wdogclk_frq);
 +    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
      ptimer_transaction_commit(s->timer);
  }
- static const TypeInfo smmuv3_type_info = {
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 15/24] hw/arm/smmuv3: Wired IRQ and GERROR helpers
+[PULL 42/46] tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
-From: Eric Auger <eric.auger@redhat.com>
+Now that the CMSDK APB watchdog uses its Clock input, it will
 correctly respond when the system clock frequency is changed using
 the RCC register on in the Stellaris board system registers.  Test
 that when the RCC register is written it causes the watchdog timer to
 change speed.
-We introduce some helpers to handle wired IRQs and especially
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-GERROR interrupt. SMMU writes GERROR register on GERROR event
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-and SW acks GERROR interrupts by setting GERRORn.
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-22-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-22-peter.maydell@linaro.org
 ---
  tests/qtest/cmsdk-apb-watchdog-test.c | 52 +++++++++++++++++++++++++++
 file changed, 52 insertions(+)
-The Wired interrupts are edge sensitive hence the pulse usage.
+diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-6-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3-internal.h | 14 +++++++++
  hw/arm/smmuv3.c          | 64 ++++++++++++++++++++++++++++++++++++++++
  hw/arm/trace-events      |  3 ++
 files changed, 81 insertions(+)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/tests/qtest/cmsdk-apb-watchdog-test.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/tests/qtest/cmsdk-apb-watchdog-test.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t smmuv3_idreg(int regoffset)
+@@ -XXX,XX +XXX,XX @@
-     return smmuv3_ids[regoffset / 4];
+  */
  #include "qemu/osdep.h"
 +#include "qemu/bitops.h"
  #include "libqtest-single.h"
  /*
@@ -XXX,XX +XXX,XX @@
  #define WDOGMIS 0x14
  #define WDOGLOCK 0xc00
 +#define SSYS_BASE 0x400fe000
 +#define RCC 0x60
 +#define SYSDIV_SHIFT 23
 +#define SYSDIV_LENGTH 4
 +
  static void test_watchdog(void)
  {
      g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
@@ -XXX,XX +XXX,XX @@ static void test_watchdog(void)
      g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
  }
-+static inline bool smmuv3_eventq_irq_enabled(SMMUv3State *s)
++static void test_clock_change(void)
 +{
-+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, EVENTQ_IRQEN);
++    uint32_t rcc;
 +
 +    /*
 +     * Test that writing to the stellaris board's RCC register to
 +     * change the system clock frequency causes the watchdog
 +     * to change the speed it counts at.
 +     */
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 +
 +    writel(WDOG_BASE + WDOGCONTROL, 1);
 +    writel(WDOG_BASE + WDOGLOAD, 1000);
 +
 +    /* Step to just past the 500th tick */
 +    clock_step(80 * 500 + 1);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
 +
 +    /* Rewrite RCC.SYSDIV from 16 to 8, so the clock is now 40ns per tick */
 +    rcc = readl(SSYS_BASE + RCC);
 +    g_assert_cmpuint(extract32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH), ==, 0xf);
 +    rcc = deposit32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH, 7);
 +    writel(SSYS_BASE + RCC, rcc);
 +
 +    /* Just past the 1000th tick: timer should have fired */
 +    clock_step(40 * 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
 +
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
 +
 +    /* VALUE reloads at following tick */
 +    clock_step(41);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
 +
 +    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
 +    clock_step(40 * 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
 +    writel(WDOG_BASE + WDOGINTCLR, 0);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 +}
 +
-+static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+ int main(int argc, char **argv)
 +{
 +    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
 +}
 +
 +/* public until callers get introduced */
 +void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
 +void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/smmuv3.h"
  #include "smmuv3-internal.h"
 +/**
 + * smmuv3_trigger_irq - pulse @irq if enabled and update
 + * GERROR register in case of GERROR interrupt
 + *
 + * @irq: irq type
 + * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
 + */
 +void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
 +{
 +
 +    bool pulse = false;
 +
 +    switch (irq) {
 +    case SMMU_IRQ_EVTQ:
 +        pulse = smmuv3_eventq_irq_enabled(s);
 +        break;
 +    case SMMU_IRQ_PRIQ:
 +        qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
 +        break;
 +    case SMMU_IRQ_CMD_SYNC:
 +        pulse = true;
 +        break;
 +    case SMMU_IRQ_GERROR:
 +    {
 +        uint32_t pending = s->gerror ^ s->gerrorn;
 +        uint32_t new_gerrors = ~pending & gerror_mask;
 +
 +        if (!new_gerrors) {
 +            /* only toggle non pending errors */
 +            return;
 +        }
 +        s->gerror ^= new_gerrors;
 +        trace_smmuv3_write_gerror(new_gerrors, s->gerror);
 +
 +        pulse = smmuv3_gerror_irq_enabled(s);
 +        break;
 +    }
 +    }
 +    if (pulse) {
 +            trace_smmuv3_trigger_irq(irq);
 +            qemu_irq_pulse(s->irq[irq]);
 +    }
 +}
 +
 +void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
 +{
 +    uint32_t pending = s->gerror ^ s->gerrorn;
 +    uint32_t toggled = s->gerrorn ^ new_gerrorn;
 +
 +    if (toggled & ~pending) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "guest toggles non pending errors = 0x%x\n",
 +                      toggled & ~pending);
 +    }
 +
 +    /*
 +     * We do not raise any error in case guest toggles bits corresponding
 +     * to not active IRQs (CONSTRAINED UNPREDICTABLE)
 +     */
 +    s->gerrorn = new_gerrorn;
 +
 +    trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
 +}
 +
  static void smmuv3_init_regs(SMMUv3State *s)
  {
-     /**
+     int r;
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-index XXXXXXX..XXXXXXX 100644
+     qtest_start("-machine lm3s811evb");
---- a/hw/arm/trace-events
-+++ b/hw/arm/trace-events
+     qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
-@@ -XXX,XX +XXX,XX @@ smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "base
++    qtest_add_func("/cmsdk-apb-watchdog/watchdog_clock_change",
++                   test_clock_change);
- #hw/arm/smmuv3.c
- smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+     r = g_test_run();
-+smmuv3_trigger_irq(int irq) "irq=%d"
 +smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
 +smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 18/24] hw/arm/smmuv3: Event queue recording helper
+[PULL 43/46] hw/arm/armsse: Use Clock to set system_clock_scale
-From: Eric Auger <eric.auger@redhat.com>
+Use the MAINCLK Clock input to set the system_clock_scale variable
 rather than using the mainclk_frq property.
-Let's introduce a helper function aiming at recording an
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-event in the event queue.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20210128114145.20536-23-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-23-peter.maydell@linaro.org
 ---
  hw/arm/armsse.c | 24 +++++++++++++++++++-----
 file changed, 19 insertions(+), 5 deletions(-)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-9-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3-internal.h | 148 ++++++++++++++++++++++++++++++++++++++-
  hw/arm/smmuv3.c          | 108 ++++++++++++++++++++++++++--
  hw/arm/trace-events      |   1 +
 files changed, 249 insertions(+), 8 deletions(-)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/hw/arm/armsse.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
+@@ -XXX,XX +XXX,XX @@ static void armsse_forward_sec_resp_cfg(ARMSSE *s)
-     s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
+     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
  }
--void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
++static void armsse_mainclk_update(void *opaque)
 -
  /* Commands */
  typedef enum SMMUCommandType {
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
  #define SMMU_FEATURE_2LVL_STE (1 << 0)
 +/* Events */
 +
 +typedef enum SMMUEventType {
 +    SMMU_EVT_OK                 = 0x00,
 +    SMMU_EVT_F_UUT                    ,
 +    SMMU_EVT_C_BAD_STREAMID           ,
 +    SMMU_EVT_F_STE_FETCH              ,
 +    SMMU_EVT_C_BAD_STE                ,
 +    SMMU_EVT_F_BAD_ATS_TREQ           ,
 +    SMMU_EVT_F_STREAM_DISABLED        ,
 +    SMMU_EVT_F_TRANS_FORBIDDEN        ,
 +    SMMU_EVT_C_BAD_SUBSTREAMID        ,
 +    SMMU_EVT_F_CD_FETCH               ,
 +    SMMU_EVT_C_BAD_CD                 ,
 +    SMMU_EVT_F_WALK_EABT              ,
 +    SMMU_EVT_F_TRANSLATION      = 0x10,
 +    SMMU_EVT_F_ADDR_SIZE              ,
 +    SMMU_EVT_F_ACCESS                 ,
 +    SMMU_EVT_F_PERMISSION             ,
 +    SMMU_EVT_F_TLB_CONFLICT     = 0x20,
 +    SMMU_EVT_F_CFG_CONFLICT           ,
 +    SMMU_EVT_E_PAGE_REQ         = 0x24,
 +} SMMUEventType;
 +
 +static const char *event_stringify[] = {
 +    [SMMU_EVT_OK]                       = "SMMU_EVT_OK",
 +    [SMMU_EVT_F_UUT]                    = "SMMU_EVT_F_UUT",
 +    [SMMU_EVT_C_BAD_STREAMID]           = "SMMU_EVT_C_BAD_STREAMID",
 +    [SMMU_EVT_F_STE_FETCH]              = "SMMU_EVT_F_STE_FETCH",
 +    [SMMU_EVT_C_BAD_STE]                = "SMMU_EVT_C_BAD_STE",
 +    [SMMU_EVT_F_BAD_ATS_TREQ]           = "SMMU_EVT_F_BAD_ATS_TREQ",
 +    [SMMU_EVT_F_STREAM_DISABLED]        = "SMMU_EVT_F_STREAM_DISABLED",
 +    [SMMU_EVT_F_TRANS_FORBIDDEN]        = "SMMU_EVT_F_TRANS_FORBIDDEN",
 +    [SMMU_EVT_C_BAD_SUBSTREAMID]        = "SMMU_EVT_C_BAD_SUBSTREAMID",
 +    [SMMU_EVT_F_CD_FETCH]               = "SMMU_EVT_F_CD_FETCH",
 +    [SMMU_EVT_C_BAD_CD]                 = "SMMU_EVT_C_BAD_CD",
 +    [SMMU_EVT_F_WALK_EABT]              = "SMMU_EVT_F_WALK_EABT",
 +    [SMMU_EVT_F_TRANSLATION]            = "SMMU_EVT_F_TRANSLATION",
 +    [SMMU_EVT_F_ADDR_SIZE]              = "SMMU_EVT_F_ADDR_SIZE",
 +    [SMMU_EVT_F_ACCESS]                 = "SMMU_EVT_F_ACCESS",
 +    [SMMU_EVT_F_PERMISSION]             = "SMMU_EVT_F_PERMISSION",
 +    [SMMU_EVT_F_TLB_CONFLICT]           = "SMMU_EVT_F_TLB_CONFLICT",
 +    [SMMU_EVT_F_CFG_CONFLICT]           = "SMMU_EVT_F_CFG_CONFLICT",
 +    [SMMU_EVT_E_PAGE_REQ]               = "SMMU_EVT_E_PAGE_REQ",
 +};
 +
 +static inline const char *smmu_event_string(SMMUEventType type)
 +{
-+    if (type < ARRAY_SIZE(event_stringify)) {
++    ARMSSE *s = ARM_SSE(opaque);
-+        return event_stringify[type] ? event_stringify[type] : "UNKNOWN";
++    /*
-+    } else {
++     * Set system_clock_scale from our Clock input; this is what
-+        return "INVALID";
++     * controls the tick rate of the CPU SysTick timer.
-+    }
++     */
 +    system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
 +}
 +
-+/*  Encode an event record */
+ static void armsse_init(Object *obj)
 +typedef struct SMMUEventInfo {
 +    SMMUEventType type;
 +    uint32_t sid;
 +    bool recorded;
 +    bool record_trans_faults;
 +    union {
 +        struct {
 +            uint32_t ssid;
 +            bool ssv;
 +            dma_addr_t addr;
 +            bool rnw;
 +            bool pnu;
 +            bool ind;
 +       } f_uut;
 +       struct SSIDInfo {
 +            uint32_t ssid;
 +            bool ssv;
 +       } c_bad_streamid;
 +       struct SSIDAddrInfo {
 +            uint32_t ssid;
 +            bool ssv;
 +            dma_addr_t addr;
 +       } f_ste_fetch;
 +       struct SSIDInfo c_bad_ste;
 +       struct {
 +            dma_addr_t addr;
 +            bool rnw;
 +       } f_transl_forbidden;
 +       struct {
 +            uint32_t ssid;
 +       } c_bad_substream;
 +       struct SSIDAddrInfo f_cd_fetch;
 +       struct SSIDInfo c_bad_cd;
 +       struct FullInfo {
 +            bool stall;
 +            uint16_t stag;
 +            uint32_t ssid;
 +            bool ssv;
 +            bool s2;
 +            dma_addr_t addr;
 +            bool rnw;
 +            bool pnu;
 +            bool ind;
 +            uint8_t class;
 +            dma_addr_t addr2;
 +       } f_walk_eabt;
 +       struct FullInfo f_translation;
 +       struct FullInfo f_addr_size;
 +       struct FullInfo f_access;
 +       struct FullInfo f_permission;
 +       struct SSIDInfo f_cfg_conflict;
 +       /**
 +        * not supported yet:
 +        * F_BAD_ATS_TREQ
 +        * F_BAD_ATS_TREQ
 +        * F_TLB_CONFLICT
 +        * E_PAGE_REQUEST
 +        * IMPDEF_EVENTn
 +        */
 +    } u;
 +} SMMUEventInfo;
 +
 +/* EVTQ fields */
 +
 +#define EVT_Q_OVERFLOW        (1 << 31)
 +
 +#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
 +#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
 +#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
 +#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
 +#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
 +#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
 +#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
 +#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
 +#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
 +#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
 +#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
 +#define EVT_SET_ADDR(x, addr)                             \
 +    do {                                                  \
 +            (x)->word[5] = (uint32_t)(addr >> 32);        \
 +            (x)->word[4] = (uint32_t)(addr & 0xffffffff); \
 +    } while (0)
 +#define EVT_SET_ADDR2(x, addr)                            \
 +    do {                                                  \
 +            deposit32((x)->word[7], 3, 29, addr >> 16);   \
 +            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
 +    } while (0)
 +
 +void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult queue_write(SMMUQueue *q, void *data)
      return MEMTX_OK;
  }
 -void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 +static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
  {
-     SMMUQueue *q = &s->eventq;
+     ARMSSE *s = ARM_SSE(obj);
-+    MemTxResult r;
+@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
-+
+     assert(info->sram_banks <= MAX_SRAM_BANKS);
-+    if (!smmuv3_eventq_enabled(s)) {
+     assert(info->num_cpus <= SSE_MAX_CPUS);
-+        return MEMTX_ERROR;
-+    }
+-    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
-+
++    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
-+    if (smmuv3_q_full(q)) {
++                                    armsse_mainclk_update, s);
-+        return MEMTX_ERROR;
+     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
-+    }
-+
+     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
-+    r = queue_write(q, evt);
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
 +    if (r != MEMTX_OK) {
 +        return r;
 +    }
 +
 +    if (smmuv3_q_empty(q)) {
 +        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 +    }
 +    return MEMTX_OK;
 +}
 +
 +void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 +{
 +    Evt evt;
 +    MemTxResult r;
      if (!smmuv3_eventq_enabled(s)) {
          return;
      }
--    if (smmuv3_q_full(q)) {
+-    if (!s->mainclk_frq) {
-+    EVT_SET_TYPE(&evt, info->type);
+-        error_setg(errp, "MAINCLK_FRQ property was not set");
-+    EVT_SET_SID(&evt, info->sid);
+-        return;
-+
++    if (!clock_has_source(s->mainclk)) {
-+    switch (info->type) {
++        error_setg(errp, "MAINCLK clock was not connected");
-+    case SMMU_EVT_OK:
++    }
-         return;
++    if (!clock_has_source(s->s32kclk)) {
-+    case SMMU_EVT_F_UUT:
++        error_setg(errp, "S32KCLK clock was not connected");
 +        EVT_SET_SSID(&evt, info->u.f_uut.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_uut.ssv);
 +        EVT_SET_ADDR(&evt, info->u.f_uut.addr);
 +        EVT_SET_RNW(&evt,  info->u.f_uut.rnw);
 +        EVT_SET_PNU(&evt,  info->u.f_uut.pnu);
 +        EVT_SET_IND(&evt,  info->u.f_uut.ind);
 +        break;
 +    case SMMU_EVT_C_BAD_STREAMID:
 +        EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_streamid.ssv);
 +        break;
 +    case SMMU_EVT_F_STE_FETCH:
 +        EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
 +        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
 +        break;
 +    case SMMU_EVT_C_BAD_STE:
 +        EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_ste.ssv);
 +        break;
 +    case SMMU_EVT_F_STREAM_DISABLED:
 +        break;
 +    case SMMU_EVT_F_TRANS_FORBIDDEN:
 +        EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
 +        EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
 +        break;
 +    case SMMU_EVT_C_BAD_SUBSTREAMID:
 +        EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
 +        break;
 +    case SMMU_EVT_F_CD_FETCH:
 +        EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_cd_fetch.ssv);
 +        EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
 +        break;
 +    case SMMU_EVT_C_BAD_CD:
 +        EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_cd.ssv);
 +        break;
 +    case SMMU_EVT_F_WALK_EABT:
 +    case SMMU_EVT_F_TRANSLATION:
 +    case SMMU_EVT_F_ADDR_SIZE:
 +    case SMMU_EVT_F_ACCESS:
 +    case SMMU_EVT_F_PERMISSION:
 +        EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
 +        EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
 +        EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
 +        EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
 +        EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
 +        EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
 +        EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
 +        EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
 +        EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
 +        EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
 +        EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
 +        break;
 +    case SMMU_EVT_F_CFG_CONFLICT:
 +        EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_cfg_conflict.ssv);
 +        break;
 +    /* rest is not implemented */
 +    case SMMU_EVT_F_BAD_ATS_TREQ:
 +    case SMMU_EVT_F_TLB_CONFLICT:
 +    case SMMU_EVT_E_PAGE_REQ:
 +    default:
 +        g_assert_not_reached();
      }
--    queue_write(q, evt);
+     assert(info->num_cpus <= SSE_MAX_CPUS);
--
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
--    if (smmuv3_q_empty(q)) {
+      */
--        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
-+    trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
-+    r = smmuv3_write_eventq(s, &evt);
+-    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
-+    if (r != MEMTX_OK) {
++    /* Set initial system_clock_scale from MAINCLK */
-+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
++    armsse_mainclk_update(s);
      }
 +    info->recorded = true;
  }
- static void smmuv3_init_regs(SMMUv3State *s)
+ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
  smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
  smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
  smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 +smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 10/24] target/arm: Implement v8M VLLDM and VLSTM
+[PULL 44/46] arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
-For v8M the instructions VLLDM and VLSTM support lazy saving
+Remove all the code that sets frequency properties on the CMSDK
-and restoring of the secure floating-point registers. Even
+timer, dualtimer and watchdog devices and on the ARMSSE SoC device:
-if the floating point extension is not implemented, these
+these properties are unused now that the devices rely on their Clock
-instructions must act as NOPs in Secure state, so they can
+inputs instead.
 be used as part of the secure-to-nonsecure call sequence.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1768295
-Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180503105730.5958-1-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-24-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-24-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 17 ++++++++++++++++-
+ hw/arm/armsse.c    | 7 -------
-file changed, 16 insertions(+), 1 deletion(-)
+ hw/arm/mps2-tz.c   | 1 -
  hw/arm/mps2.c      | 3 ---
  hw/arm/musca.c     | 1 -
  hw/arm/stellaris.c | 3 ---
 files changed, 15 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/hw/arm/armsse.c
-+++ b/target/arm/translate.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-         /* Coprocessor.  */
+      * it to the appropriate PPC port; then we can realize the PPC and
-         if (arm_dc_feature(s, ARM_FEATURE_M)) {
+      * map its upstream ends to the right place in the container.
-             /* We don't currently implement M profile FP support,
+      */
--             * so this entire space should give a NOCP fault.
+-    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
-+             * so this entire space should give a NOCP fault, with
+     qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
-+             * the exception of the v8M VLLDM and VLSTM insns, which
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
-+             * must be NOPs in Secure state and UNDEF in Nonsecure state.
+         return;
-              */
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
+     object_property_set_link(OBJECT(&s->apb_ppc0), "port[0]", OBJECT(mr),
-+                (insn & 0xffa00f00) == 0xec200a00) {
+                              &error_abort);
-+                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
-+                 *  - VLLDM, VLSTM
+-    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
-+                 * We choose to UNDEF if the RAZ bits are non-zero.
+     qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
-+                 */
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
-+                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+         return;
-+                    goto illegal_op;
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+                }
+     object_property_set_link(OBJECT(&s->apb_ppc0), "port[1]", OBJECT(mr),
-+                /* Just NOP since FP support is not implemented */
+                              &error_abort);
-+                break;
-+            }
+-    qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
-+            /* All other insns: NOCP */
+     qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
-             gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
-                                default_exception_el(s));
+         return;
-             break;
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* Devices behind APB PPC1:
       *   0x4002f000: S32K timer
       */
 -    qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
      qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
                            qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 -    qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
      qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 -    qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                         armsse_get_common_irq_in(s, 1));
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 -    qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
          return;
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
      object_property_set_link(OBJECT(&mms->iotkit), "memory",
                               OBJECT(system_memory), &error_abort);
      qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
 -    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
      qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
      qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
          object_initialize_child(OBJECT(mms), name, &mms->timer[i],
                                  TYPE_CMSDK_APB_TIMER);
          sbd = SYS_BUS_DEVICE(&mms->timer[i]);
 -        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
          qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
          sysbus_realize_and_unref(sbd, &error_fatal);
          sysbus_mmio_map(sbd, 0, base);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                              TYPE_CMSDK_APB_DUALTIMER);
 -    qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
      qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
      sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      sysbus_mmio_map(SYS_BUS_DEVICE(&mms->dualtimer), 0, 0x40002000);
      object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                              TYPE_CMSDK_APB_WATCHDOG);
 -    qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
      qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
      sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
      qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
      qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
      qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
 -    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
      qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
      qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
      /*
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      if (board->dc1 & (1 << 3)) { /* watchdog present */
          dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
 -        /* system_clock_scale is valid now */
 -        uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
 -        qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
          qdev_connect_clock_in(dev, "WDOGCLK",
                                qdev_get_clock_out(ssys_dev, "SYSCLK"));
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 05/24] hw/net/smc91c111: Convert away from old_mmio
+[PULL 45/46] arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
-Convert the smc91c111 device away from using the old_mmio field of
+Now no users are setting the frq properties on the CMSDK timer,
-MemoryRegionOps. This device is used by several Arm board models.
+dualtimer, watchdog or ARMSSE SoC devices, we can remove the
 properties and the struct fields that back them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180427173611.10281-3-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-25-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-25-peter.maydell@linaro.org
 ---
- hw/net/smc91c111.c | 54 +++++++++++++++++++++-------------------------
+ include/hw/arm/armsse.h                  | 2 --
-file changed, 25 insertions(+), 29 deletions(-)
+ include/hw/timer/cmsdk-apb-dualtimer.h   | 2 --
  include/hw/timer/cmsdk-apb-timer.h       | 2 --
  include/hw/watchdog/cmsdk-apb-watchdog.h | 2 --
  hw/arm/armsse.c                          | 2 --
  hw/timer/cmsdk-apb-dualtimer.c           | 6 ------
  hw/timer/cmsdk-apb-timer.c               | 6 ------
  hw/watchdog/cmsdk-apb-watchdog.c         | 6 ------
 files changed, 28 deletions(-)
-diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/smc91c111.c
+--- a/include/hw/arm/armsse.h
-+++ b/hw/net/smc91c111.c
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
+@@ -XXX,XX +XXX,XX @@
-     return 0;
+  *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
   *  + QOM property "memory" is a MemoryRegion containing the devices provided
   *    by the board model.
 - *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
   *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
   *    (In hardware, the SSE-200 permits the number of expansion interrupts
   *    for the two CPUs to be configured separately, but we restrict it to
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
      /* Properties */
      MemoryRegion *board_memory;
      uint32_t exp_numirq;
 -    uint32_t mainclk_frq;
      uint32_t sram_addr_width;
      uint32_t init_svtor;
      bool cpu_fpu[SSE_MAX_CPUS];
 diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/cmsdk-apb-dualtimer.h
 +++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
   * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
   *
   * QEMU interface:
 - *  + QOM property "pclk-frq": frequency at which the timer is clocked
   *  + Clock input "TIMCLK": clock (for both timers)
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: combined timer interrupt TIMINTC
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq timerintc;
 -    uint32_t pclk_frq;
      Clock *timclk;
      CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
 diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/cmsdk-apb-timer.h
 +++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
  /*
   * QEMU interface:
 - *  + QOM property "pclk-frq": frequency at which the timer is clocked
   *  + Clock input "pclk": clock for the timer
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: timer interrupt TIMERINT
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq timerint;
 -    uint32_t pclk_frq;
      struct ptimer_state *timer;
      Clock *pclk;
 diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/watchdog/cmsdk-apb-watchdog.h
 +++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
   * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
   *
   * QEMU interface:
 - *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
   *  + Clock input "WDOGCLK": clock for the watchdog's timer
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: watchdog interrupt
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq wdogint;
 -    uint32_t wdogclk_frq;
      bool is_luminary;
      struct ptimer_state *timer;
      Clock *wdogclk;
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
      DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                       MemoryRegion *),
      DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 -    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
      DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
      DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
      DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
      DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                       MemoryRegion *),
      DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 -    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
      DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
      DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
      DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
 diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-dualtimer.c
 +++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
      }
  };
 -static Property cmsdk_apb_dualtimer_properties[] = {
 -    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBDualTimer, pclk_frq, 0),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
      dc->realize = cmsdk_apb_dualtimer_realize;
      dc->vmsd = &cmsdk_apb_dualtimer_vmstate;
      dc->reset = cmsdk_apb_dualtimer_reset;
 -    device_class_set_props(dc, cmsdk_apb_dualtimer_properties);
  }
--static void smc91c111_writew(void *opaque, hwaddr offset,
+ static const TypeInfo cmsdk_apb_dualtimer_info = {
--                             uint32_t value)
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
-+static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-timer.c
 +++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
      }
  };
 -static Property cmsdk_apb_timer_properties[] = {
 -    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
  {
--    smc91c111_writeb(opaque, offset, value & 0xff);
+     DeviceClass *dc = DEVICE_CLASS(klass);
--    smc91c111_writeb(opaque, offset + 1, value >> 8);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
-+    int i;
+     dc->realize = cmsdk_apb_timer_realize;
-+    uint32_t val = 0;
+     dc->vmsd = &cmsdk_apb_timer_vmstate;
-+
+     dc->reset = cmsdk_apb_timer_reset;
-+    for (i = 0; i < size; i++) {
+-    device_class_set_props(dc, cmsdk_apb_timer_properties);
 +        val |= smc91c111_readb(opaque, addr + i) << (i * 8);
 +    }
 +    return val;
  }
--static void smc91c111_writel(void *opaque, hwaddr offset,
+ static const TypeInfo cmsdk_apb_timer_info = {
--                             uint32_t value)
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
-+static void smc91c111_writefn(void *opaque, hwaddr addr,
+index XXXXXXX..XXXXXXX 100644
-+                               uint64_t value, unsigned size)
+--- a/hw/watchdog/cmsdk-apb-watchdog.c
 +++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
      }
  };
 -static Property cmsdk_apb_watchdog_properties[] = {
 -    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
  static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
  {
-+    int i = 0;
+     DeviceClass *dc = DEVICE_CLASS(klass);
-+
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
-     /* 32-bit writes to offset 0xc only actually write to the bank select
+     dc->realize = cmsdk_apb_watchdog_realize;
--       register (offset 0xe)  */
+     dc->vmsd = &cmsdk_apb_watchdog_vmstate;
--    if (offset != 0xc)
+     dc->reset = cmsdk_apb_watchdog_reset;
--        smc91c111_writew(opaque, offset, value & 0xffff);
+-    device_class_set_props(dc, cmsdk_apb_watchdog_properties);
 -    smc91c111_writew(opaque, offset + 2, value >> 16);
 -}
 +     * register (offset 0xe), so skip the first two bytes we would write.
 +     */
 +    if (addr == 0xc && size == 4) {
 +        i += 2;
 +    }
 -static uint32_t smc91c111_readw(void *opaque, hwaddr offset)
 -{
 -    uint32_t val;
 -    val = smc91c111_readb(opaque, offset);
 -    val |= smc91c111_readb(opaque, offset + 1) << 8;
 -    return val;
 -}
 -
 -static uint32_t smc91c111_readl(void *opaque, hwaddr offset)
 -{
 -    uint32_t val;
 -    val = smc91c111_readw(opaque, offset);
 -    val |= smc91c111_readw(opaque, offset + 2) << 16;
 -    return val;
 +    for (; i < size; i++) {
 +        smc91c111_writeb(opaque, addr + i,
 +                         extract32(value, i * 8, 8));
 +    }
  }
- static int smc91c111_can_receive_nc(NetClientState *nc)
+ static const TypeInfo cmsdk_apb_watchdog_info = {
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps smc91c111_mem_ops = {
      /* The special case for 32 bit writes to 0xc means we can't just
       * set .impl.min/max_access_size to 1, unfortunately
       */
 -    .old_mmio = {
 -        .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },
 -        .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },
 -    },
 +    .read = smc91c111_readfn,
 +    .write = smc91c111_writefn,
 +    .valid.min_access_size = 1,
 +    .valid.max_access_size = 4,
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 21/24] target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
+[PULL 46/46] hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS
-From: Eric Auger <eric.auger@redhat.com>
+Now that the watchdog device uses its Clock input rather than being
 passed the value of system_clock_scale at creation time, we can
 remove the hack where we reset the STELLARIS_SYS at board creation
 time to force it to set system_clock_scale.  Instead it will be reset
 at the usual point in startup and will inform the watchdog of the
 clock frequency at that point.
-In case the MSI is translated by an IOMMU we need to fixup the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-MSI route with the translated address.
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-26-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-26-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
  hw/arm/stellaris.c | 10 ----------
 file changed, 10 deletions(-)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 Signed-off-by: Bharat Bhushan <Bharat.Bhushan@nxp.com>
 Message-id: 1524665762-31355-12-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/kvm.c        | 38 +++++++++++++++++++++++++++++++++++++-
  target/arm/trace-events |  3 +++
 files changed, 40 insertions(+), 1 deletion(-)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
+--- a/hw/arm/stellaris.c
-+++ b/target/arm/kvm.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
- #include "sysemu/kvm.h"
+     sysbus_mmio_map(sbd, 0, base);
- #include "kvm_arm.h"
+     sysbus_connect_irq(sbd, 0, irq);
- #include "cpu.h"
-+#include "trace.h"
+-    /*
- #include "internals.h"
+-     * Normally we should not be resetting devices like this during
- #include "hw/arm/arm.h"
+-     * board creation. For the moment we need to do so, because
-+#include "hw/pci/pci.h"
+-     * system_clock_scale will only get set when the STELLARIS_SYS
- #include "exec/memattrs.h"
+-     * device is reset, and we need its initial value to pass to
- #include "exec/address-spaces.h"
+-     * the watchdog device. This hack can be removed once the
- #include "hw/boards.h"
+-     * watchdog has been converted to use a Clock input instead.
-@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
+-     */
- int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
+-    device_cold_reset(dev);
-                              uint64_t address, uint32_t data, PCIDevice *dev)
+-
- {
+     return dev;
 -    return 0;
 +    AddressSpace *as = pci_device_iommu_address_space(dev);
 +    hwaddr xlat, len, doorbell_gpa;
 +    MemoryRegionSection mrs;
 +    MemoryRegion *mr;
 +    int ret = 1;
 +
 +    if (as == &address_space_memory) {
 +        return 0;
 +    }
 +
 +    /* MSI doorbell address is translated by an IOMMU */
 +
 +    rcu_read_lock();
 +    mr = address_space_translate(as, address, &xlat, &len, true);
 +    if (!mr) {
 +        goto unlock;
 +    }
 +    mrs = memory_region_find(mr, xlat, 1);
 +    if (!mrs.mr) {
 +        goto unlock;
 +    }
 +
 +    doorbell_gpa = mrs.offset_within_address_space;
 +    memory_region_unref(mrs.mr);
 +
 +    route->u.msi.address_lo = doorbell_gpa;
 +    route->u.msi.address_hi = doorbell_gpa >> 32;
 +
 +    trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
 +
 +    ret = 0;
 +
 +unlock:
 +    rcu_read_unlock();
 +    return ret;
  }
- int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
-diff --git a/target/arm/trace-events b/target/arm/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/trace-events
-+++ b/target/arm/trace-events
-@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
- arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
- arm_gt_imask_toggle(int timer, int irqstate) "gt_ctl_write: timer %d IMASK toggle, new irqstate %d"
- arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
-+
-+# target/arm/kvm.c
-+kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
 --
-.17.0
+.20.1

target-arm queue: Eric's SMMUv3 patchset, and an array
of minor bugfixes and improvements from various others.

thanks
-- PMM

The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504

for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:

hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board
   if the commandline includes "-machine iommu=smmuv3"
 * target/arm: Implement v8M VLLDM and VLSTM
 * hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
 * Some fixes to silence Coverity false-positives
 * arm: boot: set boot_info starting from first_cpu
   (fixes a technical bug not visible in practice)
 * hw/net/smc91c111: Convert away from old_mmio
 * hw/usb/tusb6010: Convert away from old_mmio
 * hw/char/cmsdk-apb-uart.c: Accept more input after character read
 * target/arm: Make MPUIR write-ignored on OMAP, StrongARM
 * hw/arm/virt: Add linux,pci-domain property

----------------------------------------------------------------
Eric Auger (11):
      hw/arm/smmu-common: smmu base device and datatypes
      hw/arm/smmu-common: IOMMU memory region and address space setup
      hw/arm/smmu-common: VMSAv8-64 page table walk
      hw/arm/smmuv3: Wired IRQ and GERROR helpers
      hw/arm/smmuv3: Queue helpers
      hw/arm/smmuv3: Implement MMIO write operations
      hw/arm/smmuv3: Event queue recording helper
      hw/arm/smmuv3: Implement translate callback
      hw/arm/smmuv3: Abort on vfio or vhost case
      target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
      hw/arm/virt: Introduce the iommu option

Igor Mammedov (1):
      arm: boot: set boot_info starting from first_cpu

Jan Kiszka (1):
      hw/arm/virt: Add linux,pci-domain property

Mathew Maidment (1):
      target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case

Patrick Oppenlander (1):
      hw/char/cmsdk-apb-uart.c: Accept more input after character read

Peter Maydell (3):
      hw/usb/tusb6010: Convert away from old_mmio
      hw/net/smc91c111: Convert away from old_mmio
      target/arm: Implement v8M VLLDM and VLSTM

Prem Mallappa (3):
      hw/arm/smmuv3: Skeleton
      hw/arm/virt: Add SMMUv3 to the virt board
      hw/arm/virt-acpi-build: Add smmuv3 node in IORT table

Richard Henderson (2):
      target/arm: Tidy conditions in handle_vec_simd_shri
      target/arm: Tidy condition in disas_simd_two_reg_misc

Thomas Huth (1):
      hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

From: Jan Kiszka <jan.kiszka@siemens.com>

This allows to pin the host controller in the Linux PCI domain space.
Linux requires that property to be available consistently or not at all,
in which case the domain number becomes unstable on additions/removals.
Adding it here won't make a difference in practice for most setups as we
only expose one controller.

However, enabling Jailhouse on top may introduce another controller, and
that one would like to have stable address as well. So the property is
needed for the first controller as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 3301c5bc-7b47-1b0e-8ce4-30435057a276@web.de
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "pci");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 3);
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 2);
+    qemu_fdt_setprop_cell(vms->fdt, nodename, "linux,pci-domain", 0);
     qemu_fdt_setprop_cells(vms->fdt, nodename, "bus-range", 0,
                            nr_pcie_buses - 1);
     qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
-- 
2.17.0

From: Mathew Maidment <mathew1800@gmail.com>

The duplication of id_tlbtr_reginfo was unintentionally added within
3281af8114c6b8ead02f08b58e3c36895c1ea047 which should have been
id_mpuir_reginfo.

The effect was that for OMAP and StrongARM CPUs we would
incorrectly UNDEF writes to MPUIR rather than NOPing them.

Signed-off-by: Mathew Maidment <mathew1800@gmail.com>
Message-id: 20180501184933.37609-2-mathew1800@gmail.com
[PMM: tweak commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
                 r->access = PL1_RW;
             }
-            id_tlbtr_reginfo.access = PL1_RW;
+            id_mpuir_reginfo.access = PL1_RW;
             id_tlbtr_reginfo.access = PL1_RW;
         }
         if (arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.17.0

From: Patrick Oppenlander <patrick.oppenlander@gmail.com>

The character frontend needs to be notified that the uart receive buffer
is empty and ready to handle another character.

Previously, the uart only worked correctly when receiving one character
at a time.

Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
Message-id: CAEg67GkRTw=cXei3o9hvpxG_L4zSrNzR0bFyAgny+sSEUb_kPw@mail.gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cmsdk-apb-uart.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cmsdk-apb-uart.c
+++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@ static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
         r = s->rxbuf;
         s->state &= ~R_STATE_RXFULL_MASK;
         cmsdk_apb_uart_update(s);
+        qemu_chr_fe_accept_input(&s->chr);
         break;
     case A_STATE:
         r = s->state;
-- 
2.17.0

Convert the tusb6010 device away from using the old_mmio field
of MemoryRegionOps. This device is used only in the n800 and n810
boards.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180427173611.10281-2-peter.maydell@linaro.org
---
 hw/usb/tusb6010.c | 40 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/hw/usb/tusb6010.c b/hw/usb/tusb6010.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/tusb6010.c
+++ b/hw/usb/tusb6010.c
@@ -XXX,XX +XXX,XX @@ static void tusb_async_writew(void *opaque, hwaddr addr,
     }
 }
 
+static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)
+{
+    switch (size) {
+    case 1:
+        return tusb_async_readb(opaque, addr);
+    case 2:
+        return tusb_async_readh(opaque, addr);
+    case 4:
+        return tusb_async_readw(opaque, addr);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void tusb_async_writefn(void *opaque, hwaddr addr,
+                               uint64_t value, unsigned size)
+{
+    switch (size) {
+    case 1:
+        tusb_async_writeb(opaque, addr, value);
+        break;
+    case 2:
+        tusb_async_writeh(opaque, addr, value);
+        break;
+    case 4:
+        tusb_async_writew(opaque, addr, value);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static const MemoryRegionOps tusb_async_ops = {
-    .old_mmio = {
-        .read = { tusb_async_readb, tusb_async_readh, tusb_async_readw, },
-        .write =  { tusb_async_writeb, tusb_async_writeh, tusb_async_writew, },
-    },
+    .read = tusb_async_readfn,
+    .write = tusb_async_writefn,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.17.0

Convert the smc91c111 device away from using the old_mmio field of
MemoryRegionOps. This device is used by several Arm board models.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180427173611.10281-3-peter.maydell@linaro.org
---
 hw/net/smc91c111.c | 54 +++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -XXX,XX +XXX,XX @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
     return 0;
 }
 
-static void smc91c111_writew(void *opaque, hwaddr offset,
-                             uint32_t value)
+static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
 {
-    smc91c111_writeb(opaque, offset, value & 0xff);
-    smc91c111_writeb(opaque, offset + 1, value >> 8);
+    int i;
+    uint32_t val = 0;
+
+    for (i = 0; i < size; i++) {
+        val |= smc91c111_readb(opaque, addr + i) << (i * 8);
+    }
+    return val;
 }
 
-static void smc91c111_writel(void *opaque, hwaddr offset,
-                             uint32_t value)
+static void smc91c111_writefn(void *opaque, hwaddr addr,
+                               uint64_t value, unsigned size)
 {
+    int i = 0;
+
     /* 32-bit writes to offset 0xc only actually write to the bank select
-       register (offset 0xe)  */
-    if (offset != 0xc)
-        smc91c111_writew(opaque, offset, value & 0xffff);
-    smc91c111_writew(opaque, offset + 2, value >> 16);
-}
+     * register (offset 0xe), so skip the first two bytes we would write.
+     */
+    if (addr == 0xc && size == 4) {
+        i += 2;
+    }
 
-static uint32_t smc91c111_readw(void *opaque, hwaddr offset)
-{
-    uint32_t val;
-    val = smc91c111_readb(opaque, offset);
-    val |= smc91c111_readb(opaque, offset + 1) << 8;
-    return val;
-}
-
-static uint32_t smc91c111_readl(void *opaque, hwaddr offset)
-{
-    uint32_t val;
-    val = smc91c111_readw(opaque, offset);
-    val |= smc91c111_readw(opaque, offset + 2) << 16;
-    return val;
+    for (; i < size; i++) {
+        smc91c111_writeb(opaque, addr + i,
+                         extract32(value, i * 8, 8));
+    }
 }
 
 static int smc91c111_can_receive_nc(NetClientState *nc)
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps smc91c111_mem_ops = {
     /* The special case for 32 bit writes to 0xc means we can't just
      * set .impl.min/max_access_size to 1, unfortunately
      */
-    .old_mmio = {
-        .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },
-        .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },
-    },
+    .read = smc91c111_readfn,
+    .write = smc91c111_writefn,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

Even though nothing is currently broken (since all boards
use first_cpu as boot cpu), make sure that boot_info is set
on all CPUs.
If some board would like support heterogenuos setup (i.e.
init boot_info on subset of CPUs) in future, it should add
a reasonable API to do it, instead of starting assigning
boot_info from some CPU and till the end of present CPUs
list.

Ref:
"Message-ID: <CAFEAcA_NMWuA8WSs3cNeY6xX1kerO_uAcN_3=fK02BEhHJW86g@mail.gmail.com>"

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1525176522-200354-5-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     }
     info->is_linux = is_linux;
 
-    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
         ARM_CPU(cs)->env.boot_info = info;
     }
 }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The (size > 3 && !is_q) condition is identical to the preceeding test
of bit 3 in immh; eliminate it.  For the benefit of Coverity, assert
that size is within the bounds we expect.

Fixes: Coverity CID1385846
Fixes: Coverity CID1385849
Fixes: Coverity CID1385852
Fixes: Coverity CID1385857
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180501180455.11214-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
         unallocated_encoding(s);
         return;
     }
-
-    if (size > 3 && !is_q) {
-        unallocated_encoding(s);
-        return;
-    }
+    tcg_debug_assert(size <= 3);
 
     if (!fp_access_check(s)) {
         return;
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Path analysis shows that size == 3 && !is_q has been eliminated.

Fixes: Coverity CID1385853
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180501180455.11214-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
         /* All 64-bit element operations can be shared with scalar 2misc */
         int pass;
 
-        for (pass = 0; pass < (is_q ? 2 : 1); pass++) {
+        /* Coverity claims (size == 3 && !is_q) has been eliminated
+         * from all paths leading to here.
+         */
+        tcg_debug_assert(is_q);
+        for (pass = 0; pass < 2; pass++) {
             TCGv_i64 tcg_op = tcg_temp_new_i64();
             TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-- 
2.17.0

From: Thomas Huth <thuth@redhat.com>

When running omap1/2 or pxa2xx based ARM machines with -nodefaults,
they bail out immediately complaining about a "missing SecureDigital
device". That's not how the "default" devices in vl.c are meant to
work - it should be possible for a board to also start up without
default devices. So let's turn the error message and exit() into
a warning instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1525326811-3233-1-git-send-email-thuth@redhat.com
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/omap1.c  |  8 ++++----
 hw/arm/omap2.c  |  8 ++++----
 hw/arm/pxa2xx.c | 15 +++++++--------
 3 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/soc_dma.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "qemu/range.h"
 #include "hw/sysbus.h"
 #include "qemu/cutils.h"
@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
                                 omap_findclk(s, "dpll3"));
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = omap_mmc_init(0xfffb7800, system_memory,
-                           blk_by_legacy_dinfo(dinfo),
+                           dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                            qdev_get_gpio_in(s->ih[1], OMAP_INT_OQN),
                            &s->drq[OMAP_DMA_MMC_TX],
                     omap_findclk(s, "mmc_ck"));
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
                              s->drq[OMAP24XX_DMA_GPMC]);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = omap2_mmc_init(omap_l4tao(s->l4, 9),
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->ih[0], OMAP_INT_24XX_MMC_IRQ),
                     &s->drq[OMAP24XX_DMA_MMC1_TX],
                     omap_findclk(s, "mmc_fclk"), omap_findclk(s, "mmc_iclk"));
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "qemu/cutils.h"
 
 static struct {
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
-- 
2.17.0

For v8M the instructions VLLDM and VLSTM support lazy saving
and restoring of the secure floating-point registers. Even
if the floating point extension is not implemented, these
instructions must act as NOPs in Secure state, so they can
be used as part of the secure-to-nonsecure call sequence.

Fixes: https://bugs.launchpad.net/qemu/+bug/1768295
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180503105730.5958-1-peter.maydell@linaro.org
---
 target/arm/translate.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         /* Coprocessor.  */
         if (arm_dc_feature(s, ARM_FEATURE_M)) {
             /* We don't currently implement M profile FP support,
-             * so this entire space should give a NOCP fault.
+             * so this entire space should give a NOCP fault, with
+             * the exception of the v8M VLLDM and VLSTM insns, which
+             * must be NOPs in Secure state and UNDEF in Nonsecure state.
              */
+            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
+                (insn & 0xffa00f00) == 0xec200a00) {
+                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
+                 *  - VLLDM, VLSTM
+                 * We choose to UNDEF if the RAZ bits are non-zero.
+                 */
+                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+                    goto illegal_op;
+                }
+                /* Just NOP since FP support is not implemented */
+                break;
+            }
+            /* All other insns: NOCP */
             gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
                                default_exception_el(s));
             break;
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

The patch introduces the smmu base device and class for the ARM
smmu. Devices for specific versions will be derived from this
base device.

We also introduce some important datatypes.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                |   1 +
 include/hw/arm/smmu-common.h        | 123 ++++++++++++++++++++++++++++
 hw/arm/smmu-common.c                |  81 ++++++++++++++++++
 default-configs/aarch64-softmmu.mak |   1 +
 4 files changed, 206 insertions(+)
 create mode 100644 include/hw/arm/smmu-common.h
 create mode 100644 hw/arm/smmu-common.c

From: Eric Auger <eric.auger@redhat.com>

We set up the infrastructure to enumerate all the PCI devices
attached to the SMMU and create an associated IOMMU memory
region and address space.

Those info are stored in SMMUDevice objects. The devices are
grouped according to the PCIBus they belong to. A hash table
indexed by the PCIBus pointer is used. Also an array indexed by
the bus number allows to find the list of SMMUDevices.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  8 +++++
 hw/arm/smmu-common.c         | 69 ++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events          |  3 ++
 3 files changed, 80 insertions(+)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 #define ARM_SMMU_GET_CLASS(obj)                              \
     OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
 
+/* Return the SMMUPciBus handle associated to a PCI bus number */
+SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num);
+
+/* Return the stream ID of an SMMU device */
+static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
+{
+    return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
+}
 #endif  /* HW_ARM_SMMU_COMMON */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/arm/smmu-common.h"
 
+/**
+ * The bus number is used for lookup when SID based invalidation occurs.
+ * In that case we lazily populate the SMMUPciBus array from the bus hash
+ * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
+ * numbers may not be always initialized yet.
+ */
+SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
+{
+    SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
+
+    if (!smmu_pci_bus) {
+        GHashTableIter iter;
+
+        g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
+        while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
+            if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
+                s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
+                return smmu_pci_bus;
+            }
+        }
+    }
+    return smmu_pci_bus;
+}
+
+static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
+{
+    SMMUState *s = opaque;
+    SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
+    SMMUDevice *sdev;
+
+    if (!sbus) {
+        sbus = g_malloc0(sizeof(SMMUPciBus) +
+                         sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
+        sbus->bus = bus;
+        g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
+    }
+
+    sdev = sbus->pbdev[devfn];
+    if (!sdev) {
+        char *name = g_strdup_printf("%s-%d-%d",
+                                     s->mrtypename,
+                                     pci_bus_num(bus), devfn);
+        sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
+
+        sdev->smmu = s;
+        sdev->bus = bus;
+        sdev->devfn = devfn;
+
+        memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
+                                 s->mrtypename,
+                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
+        address_space_init(&sdev->as,
+                           MEMORY_REGION(&sdev->iommu), name);
+        trace_smmu_add_mr(name);
+        g_free(name);
+    }
+
+    return &sdev->as;
+}
+
 static void smmu_base_realize(DeviceState *dev, Error **errp)
 {
+    SMMUState *s = ARM_SMMU(dev);
     SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
     Error *local_err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, local_err);
         return;
     }
+
+    s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
+
+    if (s->primary_bus) {
+        pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
+    } else {
+        error_setg(errp, "SMMU is not attached to any PCI bus!");
+    }
 }
 
 static void smmu_base_reset(DeviceState *dev)
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
 
 # hw/arm/virt-acpi-build.c
 virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
+
+# hw/arm/smmu-common.c
+smmu_add_mr(const char *name) "%s"
\ No newline at end of file
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

This patch implements the page table walk for VMSAv8-64.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Message-id: 1524665762-31355-4-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  99 ++++++++++++++++
 include/hw/arm/smmu-common.h |  14 +++
 hw/arm/smmu-common.c         | 222 +++++++++++++++++++++++++++++++++++
 hw/arm/trace-events          |   9 +-
 4 files changed, 343 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/smmu-internal.h

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SMMU support - Internal API
+ *
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMU_INTERNAL_H
+#define HW_ARM_SMMU_INTERNAL_H
+
+#define TBI0(tbi) ((tbi) & 0x1)
+#define TBI1(tbi) ((tbi) & 0x2 >> 1)
+
+/* PTE Manipulation */
+
+#define ARM_LPAE_PTE_TYPE_SHIFT         0
+#define ARM_LPAE_PTE_TYPE_MASK          0x3
+
+#define ARM_LPAE_PTE_TYPE_BLOCK         1
+#define ARM_LPAE_PTE_TYPE_TABLE         3
+
+#define ARM_LPAE_L3_PTE_TYPE_RESERVED   1
+#define ARM_LPAE_L3_PTE_TYPE_PAGE       3
+
+#define ARM_LPAE_PTE_VALID              (1 << 0)
+
+#define PTE_ADDRESS(pte, shift) \
+    (extract64(pte, shift, 47 - shift + 1) << shift)
+
+#define is_invalid_pte(pte) (!(pte & ARM_LPAE_PTE_VALID))
+
+#define is_reserved_pte(pte, level)                                      \
+    ((level == 3) &&                                                     \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_RESERVED))
+
+#define is_block_pte(pte, level)                                         \
+    ((level < 3) &&                                                      \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_BLOCK))
+
+#define is_table_pte(pte, level)                                        \
+    ((level < 3) &&                                                     \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_TABLE))
+
+#define is_page_pte(pte, level)                                         \
+    ((level == 3) &&                                                    \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_PAGE))
+
+/* access permissions */
+
+#define PTE_AP(pte) \
+    (extract64(pte, 6, 2))
+
+#define PTE_APTABLE(pte) \
+    (extract64(pte, 61, 2))
+
+/*
+ * TODO: At the moment all transactions are considered as privileged (EL1)
+ * as IOMMU translation callback does not pass user/priv attributes.
+ */
+#define is_permission_fault(ap, perm) \
+    (((perm) & IOMMU_WO) && ((ap) & 0x2))
+
+#define PTE_AP_TO_PERM(ap) \
+    (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
+
+/* Level Indexing */
+
+static inline int level_shift(int level, int granule_sz)
+{
+    return granule_sz + (3 - level) * (granule_sz - 3);
+}
+
+static inline uint64_t level_page_mask(int level, int granule_sz)
+{
+    return ~(MAKE_64BIT_MASK(0, level_shift(level, granule_sz)));
+}
+
+static inline
+uint64_t iova_level_offset(uint64_t iova, int inputsize,
+                           int level, int gsz)
+{
+    return ((iova & MAKE_64BIT_MASK(0, inputsize)) >> level_shift(level, gsz)) &
+            MAKE_64BIT_MASK(0, gsz - 3);
+}
+
+#endif
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
 {
     return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
 }
+
+/**
+ * smmu_ptw - Perform the page table walk for a given iova / access flags
+ * pair, according to @cfg translation config
+ */
+int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info);
+
+/**
+ * select_tt - compute which translation table shall be used according to
+ * the input iova and translation config and return the TT specific info
+ */
+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova);
+
 #endif  /* HW_ARM_SMMU_COMMON */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/error-report.h"
 #include "hw/arm/smmu-common.h"
+#include "smmu-internal.h"
+
+/* VMSAv8-64 Translation */
+
+/**
+ * get_pte - Get the content of a page table entry located at
+ * @base_addr[@index]
+ */
+static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
+                   SMMUPTWEventInfo *info)
+{
+    int ret;
+    dma_addr_t addr = baseaddr + index * sizeof(*pte);
+
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                          (uint8_t *)pte, sizeof(*pte));
+
+    if (ret != MEMTX_OK) {
+        info->type = SMMU_PTW_ERR_WALK_EABT;
+        info->addr = addr;
+        return -EINVAL;
+    }
+    trace_smmu_get_pte(baseaddr, index, addr, *pte);
+    return 0;
+}
+
+/* VMSAv8-64 Translation Table Format Descriptor Decoding */
+
+/**
+ * get_page_pte_address - returns the L3 descriptor output address,
+ * ie. the page frame
+ * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
+ */
+static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
+{
+    return PTE_ADDRESS(pte, granule_sz);
+}
+
+/**
+ * get_table_pte_address - return table descriptor output address,
+ * ie. address of next level table
+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+ */
+static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
+{
+    return PTE_ADDRESS(pte, granule_sz);
+}
+
+/**
+ * get_block_pte_address - return block descriptor output address and block size
+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+ */
+static inline hwaddr get_block_pte_address(uint64_t pte, int level,
+                                           int granule_sz, uint64_t *bsz)
+{
+    int n = (granule_sz - 3) * (4 - level) + 3;
+
+    *bsz = 1 << n;
+    return PTE_ADDRESS(pte, n);
+}
+
+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
+{
+    bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
+    uint8_t tbi_byte = tbi * 8;
+
+    if (cfg->tt[0].tsz &&
+        !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
+        /* there is a ttbr0 region and we are in it (high bits all zero) */
+        return &cfg->tt[0];
+    } else if (cfg->tt[1].tsz &&
+           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
+        /* there is a ttbr1 region and we are in it (high bits all one) */
+        return &cfg->tt[1];
+    } else if (!cfg->tt[0].tsz) {
+        /* ttbr0 region is "everything not in the ttbr1 region" */
+        return &cfg->tt[0];
+    } else if (!cfg->tt[1].tsz) {
+        /* ttbr1 region is "everything not in the ttbr0 region" */
+        return &cfg->tt[1];
+    }
+    /* in the gap between the two regions, this is a Translation fault */
+    return NULL;
+}
+
+/**
+ * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * @cfg: translation config
+ * @iova: iova to translate
+ * @perm: access type
+ * @tlbe: IOMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64(SMMUTransCfg *cfg,
+                       dma_addr_t iova, IOMMUAccessFlags perm,
+                       IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    dma_addr_t baseaddr, indexmask;
+    int stage = cfg->stage;
+    SMMUTransTableInfo *tt = select_tt(cfg, iova);
+    uint8_t level, granule_sz, inputsize, stride;
+
+    if (!tt || tt->disabled) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    granule_sz = tt->granule_sz;
+    stride = granule_sz - 3;
+    inputsize = 64 - tt->tsz;
+    level = 4 - (inputsize - 4) / stride;
+    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    baseaddr = extract64(tt->ttb, 0, 48);
+    baseaddr &= ~indexmask;
+
+    tlbe->iova = iova;
+    tlbe->addr_mask = (1 << granule_sz) - 1;
+
+    while (level <= 3) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
+        uint64_t pte;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(level, iova, subpage_size,
+                             baseaddr, offset, pte);
+
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            info->type = SMMU_PTW_ERR_TRANSLATION;
+            goto error;
+        }
+
+        if (is_page_pte(pte, level)) {
+            uint64_t gpa = get_page_pte_address(pte, granule_sz);
+
+            ap = PTE_AP(pte);
+            if (is_permission_fault(ap, perm)) {
+                info->type = SMMU_PTW_ERR_PERMISSION;
+                goto error;
+            }
+
+            tlbe->translated_addr = gpa + (iova & mask);
+            tlbe->perm = PTE_AP_TO_PERM(ap);
+            trace_smmu_ptw_page_pte(stage, level, iova,
+                                    baseaddr, pte_addr, pte, gpa);
+            return 0;
+        }
+        if (is_block_pte(pte, level)) {
+            uint64_t block_size;
+            hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
+                                               &block_size);
+
+            ap = PTE_AP(pte);
+            if (is_permission_fault(ap, perm)) {
+                info->type = SMMU_PTW_ERR_PERMISSION;
+                goto error;
+            }
+
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, iova, gpa,
+                                     block_size >> 20);
+
+            tlbe->translated_addr = gpa + (iova & mask);
+            tlbe->perm = PTE_AP_TO_PERM(ap);
+            return 0;
+        }
+
+        /* table pte */
+        ap = PTE_APTABLE(pte);
+
+        if (is_permission_fault(ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+        baseaddr = get_table_pte_address(pte, granule_sz);
+        level++;
+    }
+
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    tlbe->perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
+/**
+ * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
+ *
+ * @cfg: translation configuration
+ * @iova: iova to translate
+ * @perm: tentative access type
+ * @tlbe: returned entry
+ * @info: ptw event handle
+ *
+ * return 0 on success
+ */
+inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    if (!cfg->aa64) {
+        /*
+         * This code path is not entered as we check this while decoding
+         * the configuration data in the derived SMMU model.
+         */
+        g_assert_not_reached();
+    }
+
+    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+}
 
 /**
  * The bus number is used for lookup when SID based invalidation occurs.
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
 virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # hw/arm/smmu-common.c
-smmu_add_mr(const char *name) "%s"
\ No newline at end of file
+smmu_add_mr(const char *name) "%s"
+smmu_page_walk(int stage, uint64_t baseaddr, int first_level, uint64_t start, uint64_t end) "stage=%d, baseaddr=0x%"PRIx64", first level=%d, start=0x%"PRIx64", end=0x%"PRIx64
+smmu_lookup_table(int level, uint64_t baseaddr, int granule_sz, uint64_t start, uint64_t end, int flags, uint64_t subpage_size) "level=%d baseaddr=0x%"PRIx64" granule=%d, start=0x%"PRIx64" end=0x%"PRIx64" flags=%d subpage_size=0x%"PRIx64
+smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%lx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
+smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
+smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
+smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch implements a skeleton for the smmuv3 device.
Datatypes and register definitions are introduced. The MMIO
region, the interrupts and the queue are initialized.

Only the MMIO read operation is implemented here.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-5-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs     |   2 +-
 hw/arm/smmuv3-internal.h | 142 +++++++++++++++
 include/hw/arm/smmuv3.h  |  87 ++++++++++
 hw/arm/smmuv3.c          | 366 +++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   3 +
 5 files changed, 599 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/smmuv3-internal.h
 create mode 100644 include/hw/arm/smmuv3.h
 create mode 100644 hw/arm/smmuv3.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
 obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
 obj-$(CONFIG_IOTKIT) += iotkit.o
 obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
-obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
+obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SMMUv3 support - Internal API
+ *
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMU_V3_INTERNAL_H
+#define HW_ARM_SMMU_V3_INTERNAL_H
+
+#include "hw/arm/smmu-common.h"
+
+/* MMIO Registers */
+
+REG32(IDR0,                0x0)
+    FIELD(IDR0, S1P,         1 , 1)
+    FIELD(IDR0, TTF,         2 , 2)
+    FIELD(IDR0, COHACC,      4 , 1)
+    FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, TTENDIAN,    21, 2)
+    FIELD(IDR0, STALL_MODEL, 24, 2)
+    FIELD(IDR0, TERM_MODEL,  26, 1)
+    FIELD(IDR0, STLEVEL,     27, 2)
+
+REG32(IDR1,                0x4)
+    FIELD(IDR1, SIDSIZE,      0 , 6)
+    FIELD(IDR1, EVENTQS,      16, 5)
+    FIELD(IDR1, CMDQS,        21, 5)
+
+#define SMMU_IDR1_SIDSIZE 16
+#define SMMU_CMDQS   19
+#define SMMU_EVENTQS 19
+
+REG32(IDR2,                0x8)
+REG32(IDR3,                0xc)
+REG32(IDR4,                0x10)
+REG32(IDR5,                0x14)
+     FIELD(IDR5, OAS,         0, 3);
+     FIELD(IDR5, GRAN4K,      4, 1);
+     FIELD(IDR5, GRAN16K,     5, 1);
+     FIELD(IDR5, GRAN64K,     6, 1);
+
+#define SMMU_IDR5_OAS 4
+
+REG32(IIDR,                0x1c)
+REG32(CR0,                 0x20)
+    FIELD(CR0, SMMU_ENABLE,   0, 1)
+    FIELD(CR0, EVENTQEN,      2, 1)
+    FIELD(CR0, CMDQEN,        3, 1)
+
+REG32(CR0ACK,              0x24)
+REG32(CR1,                 0x28)
+REG32(CR2,                 0x2c)
+REG32(STATUSR,             0x40)
+REG32(IRQ_CTRL,            0x50)
+    FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
+    FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
+    FIELD(IRQ_CTRL, EVENTQ_IRQEN,        2, 1)
+
+REG32(IRQ_CTRL_ACK,        0x54)
+REG32(GERROR,              0x60)
+    FIELD(GERROR, CMDQ_ERR,           0, 1)
+    FIELD(GERROR, EVENTQ_ABT_ERR,     2, 1)
+    FIELD(GERROR, PRIQ_ABT_ERR,       3, 1)
+    FIELD(GERROR, MSI_CMDQ_ABT_ERR,   4, 1)
+    FIELD(GERROR, MSI_EVENTQ_ABT_ERR, 5, 1)
+    FIELD(GERROR, MSI_PRIQ_ABT_ERR,   6, 1)
+    FIELD(GERROR, MSI_GERROR_ABT_ERR, 7, 1)
+    FIELD(GERROR, MSI_SFM_ERR,        8, 1)
+
+REG32(GERRORN,             0x64)
+
+#define A_GERROR_IRQ_CFG0  0x68 /* 64b */
+REG32(GERROR_IRQ_CFG1, 0x70)
+REG32(GERROR_IRQ_CFG2, 0x74)
+
+#define A_STRTAB_BASE      0x80 /* 64b */
+
+#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
+
+REG32(STRTAB_BASE_CFG,     0x88)
+    FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
+    FIELD(STRTAB_BASE_CFG, SPLIT,    6 , 5)
+    FIELD(STRTAB_BASE_CFG, LOG2SIZE, 0 , 6)
+
+#define A_CMDQ_BASE        0x90 /* 64b */
+REG32(CMDQ_PROD,           0x98)
+REG32(CMDQ_CONS,           0x9c)
+    FIELD(CMDQ_CONS, ERR, 24, 7)
+
+#define A_EVENTQ_BASE      0xa0 /* 64b */
+REG32(EVENTQ_PROD,         0xa8)
+REG32(EVENTQ_CONS,         0xac)
+
+#define A_EVENTQ_IRQ_CFG0  0xb0 /* 64b */
+REG32(EVENTQ_IRQ_CFG1,     0xb8)
+REG32(EVENTQ_IRQ_CFG2,     0xbc)
+
+#define A_IDREGS           0xfd0
+
+static inline int smmu_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, SMMU_ENABLE);
+}
+
+/* Command Queue Entry */
+typedef struct Cmd {
+    uint32_t word[4];
+} Cmd;
+
+/* Event Queue Entry */
+typedef struct Evt  {
+    uint32_t word[8];
+} Evt;
+
+static inline uint32_t smmuv3_idreg(int regoffset)
+{
+    /*
+     * Return the value of the Primecell/Corelink ID registers at the
+     * specified offset from the first ID register.
+     * These value indicate an ARM implementation of MMU600 p1
+     */
+    static const uint8_t smmuv3_ids[] = {
+        0x04, 0, 0, 0, 0x84, 0xB4, 0xF0, 0x10, 0x0D, 0xF0, 0x05, 0xB1
+    };
+    return smmuv3_ids[regoffset / 4];
+}
+
+#endif
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMUV3_H
+#define HW_ARM_SMMUV3_H
+
+#include "hw/arm/smmu-common.h"
+#include "hw/registerfields.h"
+
+#define TYPE_SMMUV3_IOMMU_MEMORY_REGION "smmuv3-iommu-memory-region"
+
+typedef struct SMMUQueue {
+     uint64_t base; /* base register */
+     uint32_t prod;
+     uint32_t cons;
+     uint8_t entry_size;
+     uint8_t log2size;
+} SMMUQueue;
+
+typedef struct SMMUv3State {
+    SMMUState     smmu_state;
+
+    uint32_t features;
+    uint8_t sid_size;
+    uint8_t sid_split;
+
+    uint32_t idr[6];
+    uint32_t iidr;
+    uint32_t cr[3];
+    uint32_t cr0ack;
+    uint32_t statusr;
+    uint32_t irq_ctrl;
+    uint32_t gerror;
+    uint32_t gerrorn;
+    uint64_t gerror_irq_cfg0;
+    uint32_t gerror_irq_cfg1;
+    uint32_t gerror_irq_cfg2;
+    uint64_t strtab_base;
+    uint32_t strtab_base_cfg;
+    uint64_t eventq_irq_cfg0;
+    uint32_t eventq_irq_cfg1;
+    uint32_t eventq_irq_cfg2;
+
+    SMMUQueue eventq, cmdq;
+
+    qemu_irq     irq[4];
+} SMMUv3State;
+
+typedef enum {
+    SMMU_IRQ_EVTQ,
+    SMMU_IRQ_PRIQ,
+    SMMU_IRQ_CMD_SYNC,
+    SMMU_IRQ_GERROR,
+} SMMUIrq;
+
+typedef struct {
+    /*< private >*/
+    SMMUBaseClass smmu_base_class;
+    /*< public >*/
+
+    DeviceRealize parent_realize;
+    DeviceReset   parent_reset;
+} SMMUv3Class;
+
+#define TYPE_ARM_SMMUV3   "arm-smmuv3"
+#define ARM_SMMUV3(obj) OBJECT_CHECK(SMMUv3State, (obj), TYPE_ARM_SMMUV3)
+#define ARM_SMMUV3_CLASS(klass)                              \
+    OBJECT_CLASS_CHECK(SMMUv3Class, (klass), TYPE_ARM_SMMUV3)
+#define ARM_SMMUV3_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(SMMUv3Class, (obj), TYPE_ARM_SMMUV3)
+
+#endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/boards.h"
+#include "sysemu/sysemu.h"
+#include "hw/sysbus.h"
+#include "hw/qdev-core.h"
+#include "hw/pci/pci.h"
+#include "exec/address-spaces.h"
+#include "trace.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include "hw/arm/smmuv3.h"
+#include "smmuv3-internal.h"
+
+static void smmuv3_init_regs(SMMUv3State *s)
+{
+    /**
+     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
+     *       multi-level stream table
+     */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
+    /* terminated transaction will always be aborted/error returned */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
+    /* 2-level stream table supported */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
+
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
+
+   /* 4K and 64K granule support */
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
+
+    s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
+    s->cmdq.prod = 0;
+    s->cmdq.cons = 0;
+    s->cmdq.entry_size = sizeof(struct Cmd);
+    s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
+    s->eventq.prod = 0;
+    s->eventq.cons = 0;
+    s->eventq.entry_size = sizeof(struct Evt);
+
+    s->features = 0;
+    s->sid_split = 0;
+}
+
+static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
+                                   unsigned size, MemTxAttrs attrs)
+{
+    /* not yet implemented */
+    return MEMTX_ERROR;
+}
+
+static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
+                               uint64_t *data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_GERROR_IRQ_CFG0:
+        *data = s->gerror_irq_cfg0;
+        return MEMTX_OK;
+    case A_STRTAB_BASE:
+        *data = s->strtab_base;
+        return MEMTX_OK;
+    case A_CMDQ_BASE:
+        *data = s->cmdq.base;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE:
+        *data = s->eventq.base;
+        return MEMTX_OK;
+    default:
+        *data = 0;
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
+                              uint64_t *data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_IDREGS ... A_IDREGS + 0x1f:
+        *data = smmuv3_idreg(offset - A_IDREGS);
+        return MEMTX_OK;
+    case A_IDR0 ... A_IDR5:
+        *data = s->idr[(offset - A_IDR0) / 4];
+        return MEMTX_OK;
+    case A_IIDR:
+        *data = s->iidr;
+        return MEMTX_OK;
+    case A_CR0:
+        *data = s->cr[0];
+        return MEMTX_OK;
+    case A_CR0ACK:
+        *data = s->cr0ack;
+        return MEMTX_OK;
+    case A_CR1:
+        *data = s->cr[1];
+        return MEMTX_OK;
+    case A_CR2:
+        *data = s->cr[2];
+        return MEMTX_OK;
+    case A_STATUSR:
+        *data = s->statusr;
+        return MEMTX_OK;
+    case A_IRQ_CTRL:
+    case A_IRQ_CTRL_ACK:
+        *data = s->irq_ctrl;
+        return MEMTX_OK;
+    case A_GERROR:
+        *data = s->gerror;
+        return MEMTX_OK;
+    case A_GERRORN:
+        *data = s->gerrorn;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0: /* 64b */
+        *data = extract64(s->gerror_irq_cfg0, 0, 32);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0 + 4:
+        *data = extract64(s->gerror_irq_cfg0, 32, 32);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG1:
+        *data = s->gerror_irq_cfg1;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG2:
+        *data = s->gerror_irq_cfg2;
+        return MEMTX_OK;
+    case A_STRTAB_BASE: /* 64b */
+        *data = extract64(s->strtab_base, 0, 32);
+        return MEMTX_OK;
+    case A_STRTAB_BASE + 4: /* 64b */
+        *data = extract64(s->strtab_base, 32, 32);
+        return MEMTX_OK;
+    case A_STRTAB_BASE_CFG:
+        *data = s->strtab_base_cfg;
+        return MEMTX_OK;
+    case A_CMDQ_BASE: /* 64b */
+        *data = extract64(s->cmdq.base, 0, 32);
+        return MEMTX_OK;
+    case A_CMDQ_BASE + 4:
+        *data = extract64(s->cmdq.base, 32, 32);
+        return MEMTX_OK;
+    case A_CMDQ_PROD:
+        *data = s->cmdq.prod;
+        return MEMTX_OK;
+    case A_CMDQ_CONS:
+        *data = s->cmdq.cons;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE: /* 64b */
+        *data = extract64(s->eventq.base, 0, 32);
+        return MEMTX_OK;
+    case A_EVENTQ_BASE + 4: /* 64b */
+        *data = extract64(s->eventq.base, 32, 32);
+        return MEMTX_OK;
+    case A_EVENTQ_PROD:
+        *data = s->eventq.prod;
+        return MEMTX_OK;
+    case A_EVENTQ_CONS:
+        *data = s->eventq.cons;
+        return MEMTX_OK;
+    default:
+        *data = 0;
+        qemu_log_mask(LOG_UNIMP,
+                      "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
+                                  unsigned size, MemTxAttrs attrs)
+{
+    SMMUState *sys = opaque;
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    MemTxResult r;
+
+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
+    offset &= ~0x10000;
+
+    switch (size) {
+    case 8:
+        r = smmu_readll(s, offset, data, attrs);
+        break;
+    case 4:
+        r = smmu_readl(s, offset, data, attrs);
+        break;
+    default:
+        r = MEMTX_ERROR;
+        break;
+    }
+
+    trace_smmuv3_read_mmio(offset, *data, size, r);
+    return r;
+}
+
+static const MemoryRegionOps smmu_mem_ops = {
+    .read_with_attrs = smmu_read_mmio,
+    .write_with_attrs = smmu_write_mmio,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+};
+
+static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
+        sysbus_init_irq(dev, &s->irq[i]);
+    }
+}
+
+static void smmu_reset(DeviceState *dev)
+{
+    SMMUv3State *s = ARM_SMMUV3(dev);
+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
+
+    c->parent_reset(dev);
+
+    smmuv3_init_regs(s);
+}
+
+static void smmu_realize(DeviceState *d, Error **errp)
+{
+    SMMUState *sys = ARM_SMMU(d);
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
+    SysBusDevice *dev = SYS_BUS_DEVICE(d);
+    Error *local_err = NULL;
+
+    c->parent_realize(d, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    memory_region_init_io(&sys->iomem, OBJECT(s),
+                          &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
+
+    sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
+
+    sysbus_init_mmio(dev, &sys->iomem);
+
+    smmu_init_irq(s, dev);
+}
+
+static const VMStateDescription vmstate_smmuv3_queue = {
+    .name = "smmuv3_queue",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64(base, SMMUQueue),
+        VMSTATE_UINT32(prod, SMMUQueue),
+        VMSTATE_UINT32(cons, SMMUQueue),
+        VMSTATE_UINT8(log2size, SMMUQueue),
+    },
+};
+
+static const VMStateDescription vmstate_smmuv3 = {
+    .name = "smmuv3",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(features, SMMUv3State),
+        VMSTATE_UINT8(sid_size, SMMUv3State),
+        VMSTATE_UINT8(sid_split, SMMUv3State),
+
+        VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
+        VMSTATE_UINT32(cr0ack, SMMUv3State),
+        VMSTATE_UINT32(statusr, SMMUv3State),
+        VMSTATE_UINT32(irq_ctrl, SMMUv3State),
+        VMSTATE_UINT32(gerror, SMMUv3State),
+        VMSTATE_UINT32(gerrorn, SMMUv3State),
+        VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
+        VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
+        VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
+        VMSTATE_UINT64(strtab_base, SMMUv3State),
+        VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
+        VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
+        VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
+        VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
+
+        VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
+        VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
+
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void smmuv3_instance_init(Object *obj)
+{
+    /* Nothing much to do here as of now */
+}
+
+static void smmuv3_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
+
+    dc->vmsd = &vmstate_smmuv3;
+    device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
+    c->parent_realize = dc->realize;
+    dc->realize = smmu_realize;
+}
+
+static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
+                                                  void *data)
+{
+}
+
+static const TypeInfo smmuv3_type_info = {
+    .name          = TYPE_ARM_SMMUV3,
+    .parent        = TYPE_ARM_SMMU,
+    .instance_size = sizeof(SMMUv3State),
+    .instance_init = smmuv3_instance_init,
+    .class_size    = sizeof(SMMUv3Class),
+    .class_init    = smmuv3_class_init,
+};
+
+static const TypeInfo smmuv3_iommu_memory_region_info = {
+    .parent = TYPE_IOMMU_MEMORY_REGION,
+    .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
+    .class_init = smmuv3_iommu_memory_region_class_init,
+};
+
+static void smmuv3_register_types(void)
+{
+    type_register(&smmuv3_type_info);
+    type_register(&smmuv3_iommu_memory_region_info);
+}
+
+type_init(smmuv3_register_types)
+
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr,
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
+
+#hw/arm/smmuv3.c
+smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

We introduce some helpers to handle wired IRQs and especially
GERROR interrupt. SMMU writes GERROR register on GERROR event
and SW acks GERROR interrupts by setting GERRORn.

The Wired interrupts are edge sensitive hence the pulse usage.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-6-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 14 +++++++++
 hw/arm/smmuv3.c          | 64 ++++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |  3 ++
 3 files changed, 81 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t smmuv3_idreg(int regoffset)
     return smmuv3_ids[regoffset / 4];
 }
 
+static inline bool smmuv3_eventq_irq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, EVENTQ_IRQEN);
+}
+
+static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
+}
+
+/* public until callers get introduced */
+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/smmuv3.h"
 #include "smmuv3-internal.h"
 
+/**
+ * smmuv3_trigger_irq - pulse @irq if enabled and update
+ * GERROR register in case of GERROR interrupt
+ *
+ * @irq: irq type
+ * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
+ */
+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
+{
+
+    bool pulse = false;
+
+    switch (irq) {
+    case SMMU_IRQ_EVTQ:
+        pulse = smmuv3_eventq_irq_enabled(s);
+        break;
+    case SMMU_IRQ_PRIQ:
+        qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
+        break;
+    case SMMU_IRQ_CMD_SYNC:
+        pulse = true;
+        break;
+    case SMMU_IRQ_GERROR:
+    {
+        uint32_t pending = s->gerror ^ s->gerrorn;
+        uint32_t new_gerrors = ~pending & gerror_mask;
+
+        if (!new_gerrors) {
+            /* only toggle non pending errors */
+            return;
+        }
+        s->gerror ^= new_gerrors;
+        trace_smmuv3_write_gerror(new_gerrors, s->gerror);
+
+        pulse = smmuv3_gerror_irq_enabled(s);
+        break;
+    }
+    }
+    if (pulse) {
+            trace_smmuv3_trigger_irq(irq);
+            qemu_irq_pulse(s->irq[irq]);
+    }
+}
+
+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+{
+    uint32_t pending = s->gerror ^ s->gerrorn;
+    uint32_t toggled = s->gerrorn ^ new_gerrorn;
+
+    if (toggled & ~pending) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "guest toggles non pending errors = 0x%x\n",
+                      toggled & ~pending);
+    }
+
+    /*
+     * We do not raise any error in case guest toggles bits corresponding
+     * to not active IRQs (CONSTRAINED UNPREDICTABLE)
+     */
+    s->gerrorn = new_gerrorn;
+
+    trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
+}
+
 static void smmuv3_init_regs(SMMUv3State *s)
 {
     /**
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "base
 
 #hw/arm/smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+smmuv3_trigger_irq(int irq) "irq=%d"
+smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
+smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

We introduce helpers to read/write into the command and event
circular queues.

smmuv3_write_eventq and smmuv3_cmq_consume will become static
in subsequent patches.

Invalidation commands are not yet dealt with. We do not cache
data that need to be invalidated. This will change with vhost
integration.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-7-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 163 +++++++++++++++++++++++++++++++++++++++
 hw/arm/smmuv3.c          | 136 ++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   5 ++
 3 files changed, 304 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
 void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
 void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
 
+/* Queue Handling */
+
+#define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
+#define WRAP_MASK(q)       (1 << (q)->log2size)
+#define INDEX_MASK(q)      (((1 << (q)->log2size)) - 1)
+#define WRAP_INDEX_MASK(q) ((1 << ((q)->log2size + 1)) - 1)
+
+#define Q_CONS(q) ((q)->cons & INDEX_MASK(q))
+#define Q_PROD(q) ((q)->prod & INDEX_MASK(q))
+
+#define Q_CONS_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_CONS(q))
+#define Q_PROD_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_PROD(q))
+
+#define Q_CONS_WRAP(q) (((q)->cons & WRAP_MASK(q)) >> (q)->log2size)
+#define Q_PROD_WRAP(q) (((q)->prod & WRAP_MASK(q)) >> (q)->log2size)
+
+static inline bool smmuv3_q_full(SMMUQueue *q)
+{
+    return ((q->cons ^ q->prod) & WRAP_INDEX_MASK(q)) == WRAP_MASK(q);
+}
+
+static inline bool smmuv3_q_empty(SMMUQueue *q)
+{
+    return (q->cons & WRAP_INDEX_MASK(q)) == (q->prod & WRAP_INDEX_MASK(q));
+}
+
+static inline void queue_prod_incr(SMMUQueue *q)
+{
+    q->prod = (q->prod + 1) & WRAP_INDEX_MASK(q);
+}
+
+static inline void queue_cons_incr(SMMUQueue *q)
+{
+    /*
+     * We have to use deposit for the CONS registers to preserve
+     * the ERR field in the high bits.
+     */
+    q->cons = deposit32(q->cons, 0, q->log2size + 1, q->cons + 1);
+}
+
+static inline bool smmuv3_cmdq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, CMDQEN);
+}
+
+static inline bool smmuv3_eventq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, EVENTQEN);
+}
+
+static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
+{
+    s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
+}
+
+void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
+
+/* Commands */
+
+typedef enum SMMUCommandType {
+    SMMU_CMD_NONE            = 0x00,
+    SMMU_CMD_PREFETCH_CONFIG       ,
+    SMMU_CMD_PREFETCH_ADDR,
+    SMMU_CMD_CFGI_STE,
+    SMMU_CMD_CFGI_STE_RANGE,
+    SMMU_CMD_CFGI_CD,
+    SMMU_CMD_CFGI_CD_ALL,
+    SMMU_CMD_CFGI_ALL,
+    SMMU_CMD_TLBI_NH_ALL     = 0x10,
+    SMMU_CMD_TLBI_NH_ASID,
+    SMMU_CMD_TLBI_NH_VA,
+    SMMU_CMD_TLBI_NH_VAA,
+    SMMU_CMD_TLBI_EL3_ALL    = 0x18,
+    SMMU_CMD_TLBI_EL3_VA     = 0x1a,
+    SMMU_CMD_TLBI_EL2_ALL    = 0x20,
+    SMMU_CMD_TLBI_EL2_ASID,
+    SMMU_CMD_TLBI_EL2_VA,
+    SMMU_CMD_TLBI_EL2_VAA,
+    SMMU_CMD_TLBI_S12_VMALL  = 0x28,
+    SMMU_CMD_TLBI_S2_IPA     = 0x2a,
+    SMMU_CMD_TLBI_NSNH_ALL   = 0x30,
+    SMMU_CMD_ATC_INV         = 0x40,
+    SMMU_CMD_PRI_RESP,
+    SMMU_CMD_RESUME          = 0x44,
+    SMMU_CMD_STALL_TERM,
+    SMMU_CMD_SYNC,
+} SMMUCommandType;
+
+static const char *cmd_stringify[] = {
+    [SMMU_CMD_PREFETCH_CONFIG] = "SMMU_CMD_PREFETCH_CONFIG",
+    [SMMU_CMD_PREFETCH_ADDR]   = "SMMU_CMD_PREFETCH_ADDR",
+    [SMMU_CMD_CFGI_STE]        = "SMMU_CMD_CFGI_STE",
+    [SMMU_CMD_CFGI_STE_RANGE]  = "SMMU_CMD_CFGI_STE_RANGE",
+    [SMMU_CMD_CFGI_CD]         = "SMMU_CMD_CFGI_CD",
+    [SMMU_CMD_CFGI_CD_ALL]     = "SMMU_CMD_CFGI_CD_ALL",
+    [SMMU_CMD_CFGI_ALL]        = "SMMU_CMD_CFGI_ALL",
+    [SMMU_CMD_TLBI_NH_ALL]     = "SMMU_CMD_TLBI_NH_ALL",
+    [SMMU_CMD_TLBI_NH_ASID]    = "SMMU_CMD_TLBI_NH_ASID",
+    [SMMU_CMD_TLBI_NH_VA]      = "SMMU_CMD_TLBI_NH_VA",
+    [SMMU_CMD_TLBI_NH_VAA]     = "SMMU_CMD_TLBI_NH_VAA",
+    [SMMU_CMD_TLBI_EL3_ALL]    = "SMMU_CMD_TLBI_EL3_ALL",
+    [SMMU_CMD_TLBI_EL3_VA]     = "SMMU_CMD_TLBI_EL3_VA",
+    [SMMU_CMD_TLBI_EL2_ALL]    = "SMMU_CMD_TLBI_EL2_ALL",
+    [SMMU_CMD_TLBI_EL2_ASID]   = "SMMU_CMD_TLBI_EL2_ASID",
+    [SMMU_CMD_TLBI_EL2_VA]     = "SMMU_CMD_TLBI_EL2_VA",
+    [SMMU_CMD_TLBI_EL2_VAA]    = "SMMU_CMD_TLBI_EL2_VAA",
+    [SMMU_CMD_TLBI_S12_VMALL]  = "SMMU_CMD_TLBI_S12_VMALL",
+    [SMMU_CMD_TLBI_S2_IPA]     = "SMMU_CMD_TLBI_S2_IPA",
+    [SMMU_CMD_TLBI_NSNH_ALL]   = "SMMU_CMD_TLBI_NSNH_ALL",
+    [SMMU_CMD_ATC_INV]         = "SMMU_CMD_ATC_INV",
+    [SMMU_CMD_PRI_RESP]        = "SMMU_CMD_PRI_RESP",
+    [SMMU_CMD_RESUME]          = "SMMU_CMD_RESUME",
+    [SMMU_CMD_STALL_TERM]      = "SMMU_CMD_STALL_TERM",
+    [SMMU_CMD_SYNC]            = "SMMU_CMD_SYNC",
+};
+
+static inline const char *smmu_cmd_string(SMMUCommandType type)
+{
+    if (type > SMMU_CMD_NONE && type < ARRAY_SIZE(cmd_stringify)) {
+        return cmd_stringify[type] ? cmd_stringify[type] : "UNKNOWN";
+    } else {
+        return "INVALID";
+    }
+}
+
+/* CMDQ fields */
+
+typedef enum {
+    SMMU_CERROR_NONE = 0,
+    SMMU_CERROR_ILL,
+    SMMU_CERROR_ABT,
+    SMMU_CERROR_ATC_INV_SYNC,
+} SMMUCmdError;
+
+enum { /* Command completion notification */
+    CMD_SYNC_SIG_NONE,
+    CMD_SYNC_SIG_IRQ,
+    CMD_SYNC_SIG_SEV,
+};
+
+#define CMD_TYPE(x)         extract32((x)->word[0], 0 , 8)
+#define CMD_SSEC(x)         extract32((x)->word[0], 10, 1)
+#define CMD_SSV(x)          extract32((x)->word[0], 11, 1)
+#define CMD_RESUME_AC(x)    extract32((x)->word[0], 12, 1)
+#define CMD_RESUME_AB(x)    extract32((x)->word[0], 13, 1)
+#define CMD_SYNC_CS(x)      extract32((x)->word[0], 12, 2)
+#define CMD_SSID(x)         extract32((x)->word[0], 12, 20)
+#define CMD_SID(x)          ((x)->word[1])
+#define CMD_VMID(x)         extract32((x)->word[1], 0 , 16)
+#define CMD_ASID(x)         extract32((x)->word[1], 16, 16)
+#define CMD_RESUME_STAG(x)  extract32((x)->word[2], 0 , 16)
+#define CMD_RESP(x)         extract32((x)->word[2], 11, 2)
+#define CMD_LEAF(x)         extract32((x)->word[2], 0 , 1)
+#define CMD_STE_RANGE(x)    extract32((x)->word[2], 0 , 5)
+#define CMD_ADDR(x) ({                                        \
+            uint64_t high = (uint64_t)(x)->word[3];           \
+            uint64_t low = extract32((x)->word[2], 12, 20);    \
+            uint64_t addr = high << 32 | (low << 12);         \
+            addr;                                             \
+        })
+
+int smmuv3_cmdq_consume(SMMUv3State *s);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
     trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
 }
 
+static inline MemTxResult queue_read(SMMUQueue *q, void *data)
+{
+    dma_addr_t addr = Q_CONS_ENTRY(q);
+
+    return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
+}
+
+static MemTxResult queue_write(SMMUQueue *q, void *data)
+{
+    dma_addr_t addr = Q_PROD_ENTRY(q);
+    MemTxResult ret;
+
+    ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
+    if (ret != MEMTX_OK) {
+        return ret;
+    }
+
+    queue_prod_incr(q);
+    return MEMTX_OK;
+}
+
+void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
+{
+    SMMUQueue *q = &s->eventq;
+
+    if (!smmuv3_eventq_enabled(s)) {
+        return;
+    }
+
+    if (smmuv3_q_full(q)) {
+        return;
+    }
+
+    queue_write(q, evt);
+
+    if (smmuv3_q_empty(q)) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    }
+}
+
 static void smmuv3_init_regs(SMMUv3State *s)
 {
     /**
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
+int smmuv3_cmdq_consume(SMMUv3State *s)
+{
+    SMMUCmdError cmd_error = SMMU_CERROR_NONE;
+    SMMUQueue *q = &s->cmdq;
+    SMMUCommandType type = 0;
+
+    if (!smmuv3_cmdq_enabled(s)) {
+        return 0;
+    }
+    /*
+     * some commands depend on register values, typically CR0. In case those
+     * register values change while handling the command, spec says it
+     * is UNPREDICTABLE whether the command is interpreted under the new
+     * or old value.
+     */
+
+    while (!smmuv3_q_empty(q)) {
+        uint32_t pending = s->gerror ^ s->gerrorn;
+        Cmd cmd;
+
+        trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
+
+        if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
+            break;
+        }
+
+        if (queue_read(q, &cmd) != MEMTX_OK) {
+            cmd_error = SMMU_CERROR_ABT;
+            break;
+        }
+
+        type = CMD_TYPE(&cmd);
+
+        trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
+
+        switch (type) {
+        case SMMU_CMD_SYNC:
+            if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
+                smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
+            }
+            break;
+        case SMMU_CMD_PREFETCH_CONFIG:
+        case SMMU_CMD_PREFETCH_ADDR:
+        case SMMU_CMD_CFGI_STE:
+        case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
+        case SMMU_CMD_CFGI_CD:
+        case SMMU_CMD_CFGI_CD_ALL:
+        case SMMU_CMD_TLBI_NH_ALL:
+        case SMMU_CMD_TLBI_NH_ASID:
+        case SMMU_CMD_TLBI_NH_VA:
+        case SMMU_CMD_TLBI_NH_VAA:
+        case SMMU_CMD_TLBI_EL3_ALL:
+        case SMMU_CMD_TLBI_EL3_VA:
+        case SMMU_CMD_TLBI_EL2_ALL:
+        case SMMU_CMD_TLBI_EL2_ASID:
+        case SMMU_CMD_TLBI_EL2_VA:
+        case SMMU_CMD_TLBI_EL2_VAA:
+        case SMMU_CMD_TLBI_S12_VMALL:
+        case SMMU_CMD_TLBI_S2_IPA:
+        case SMMU_CMD_TLBI_NSNH_ALL:
+        case SMMU_CMD_ATC_INV:
+        case SMMU_CMD_PRI_RESP:
+        case SMMU_CMD_RESUME:
+        case SMMU_CMD_STALL_TERM:
+            trace_smmuv3_unhandled_cmd(type);
+            break;
+        default:
+            cmd_error = SMMU_CERROR_ILL;
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            break;
+        }
+        if (cmd_error) {
+            break;
+        }
+        /*
+         * We only increment the cons index after the completion of
+         * the command. We do that because the SYNC returns immediately
+         * and does not check the completion of previous commands
+         */
+        queue_cons_incr(q);
+    }
+
+    if (cmd_error) {
+        trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
+        smmu_write_cmdq_err(s, cmd_error);
+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
+    }
+
+    trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
+
+    return 0;
+}
+
 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                    unsigned size, MemTxAttrs attrs)
 {
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
 smmuv3_trigger_irq(int irq) "irq=%d"
 smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
 smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
+smmuv3_unhandled_cmd(uint32_t type) "Unhandled command type=%d"
+smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod=%d cons=%d prod.wrap=%d cons.wrap=%d"
+smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
+smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
+smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

Now we have relevant helpers for queue and irq
management, let's implement MMIO write operations.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-8-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h |   8 +-
 hw/arm/smmuv3.c          | 170 +++++++++++++++++++++++++++++++++++++--
 hw/arm/trace-events      |   6 ++
 3 files changed, 174 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ REG32(CR0,                 0x20)
     FIELD(CR0, EVENTQEN,      2, 1)
     FIELD(CR0, CMDQEN,        3, 1)
 
+#define SMMU_CR0_RESERVED 0xFFFFFC20
+
 REG32(CR0ACK,              0x24)
 REG32(CR1,                 0x28)
 REG32(CR2,                 0x2c)
@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
     return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
 }
 
-/* public until callers get introduced */
-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
-
 /* Queue Handling */
 
 #define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
             addr;                                             \
         })
 
-int smmuv3_cmdq_consume(SMMUv3State *s);
+#define SMMU_FEATURE_2LVL_STE (1 << 0)
 
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  * @irq: irq type
  * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
  */
-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
+static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
+                               uint32_t gerror_mask)
 {
 
     bool pulse = false;
@@ -XXX,XX +XXX,XX @@ void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
     }
 }
 
-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
 {
     uint32_t pending = s->gerror ^ s->gerrorn;
     uint32_t toggled = s->gerrorn ^ new_gerrorn;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
-int smmuv3_cmdq_consume(SMMUv3State *s)
+static int smmuv3_cmdq_consume(SMMUv3State *s)
 {
     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
     SMMUQueue *q = &s->cmdq;
@@ -XXX,XX +XXX,XX @@ int smmuv3_cmdq_consume(SMMUv3State *s)
     return 0;
 }
 
+static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
+                               uint64_t data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_GERROR_IRQ_CFG0:
+        s->gerror_irq_cfg0 = data;
+        return MEMTX_OK;
+    case A_STRTAB_BASE:
+        s->strtab_base = data;
+        return MEMTX_OK;
+    case A_CMDQ_BASE:
+        s->cmdq.base = data;
+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+        if (s->cmdq.log2size > SMMU_CMDQS) {
+            s->cmdq.log2size = SMMU_CMDQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_BASE:
+        s->eventq.base = data;
+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
+        if (s->eventq.log2size > SMMU_EVENTQS) {
+            s->eventq.log2size = SMMU_EVENTQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0:
+        s->eventq_irq_cfg0 = data;
+        return MEMTX_OK;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
+                               uint64_t data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_CR0:
+        s->cr[0] = data;
+        s->cr0ack = data & ~SMMU_CR0_RESERVED;
+        /* in case the command queue has been enabled */
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_CR1:
+        s->cr[1] = data;
+        return MEMTX_OK;
+    case A_CR2:
+        s->cr[2] = data;
+        return MEMTX_OK;
+    case A_IRQ_CTRL:
+        s->irq_ctrl = data;
+        return MEMTX_OK;
+    case A_GERRORN:
+        smmuv3_write_gerrorn(s, data);
+        /*
+         * By acknowledging the CMDQ_ERR, SW may notify cmds can
+         * be processed again
+         */
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0: /* 64b */
+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0 + 4:
+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG1:
+        s->gerror_irq_cfg1 = data;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG2:
+        s->gerror_irq_cfg2 = data;
+        return MEMTX_OK;
+    case A_STRTAB_BASE: /* 64b */
+        s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
+        return MEMTX_OK;
+    case A_STRTAB_BASE + 4:
+        s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
+        return MEMTX_OK;
+    case A_STRTAB_BASE_CFG:
+        s->strtab_base_cfg = data;
+        if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
+            s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
+            s->features |= SMMU_FEATURE_2LVL_STE;
+        }
+        return MEMTX_OK;
+    case A_CMDQ_BASE: /* 64b */
+        s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+        if (s->cmdq.log2size > SMMU_CMDQS) {
+            s->cmdq.log2size = SMMU_CMDQS;
+        }
+        return MEMTX_OK;
+    case A_CMDQ_BASE + 4: /* 64b */
+        s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
+        return MEMTX_OK;
+    case A_CMDQ_PROD:
+        s->cmdq.prod = data;
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_CMDQ_CONS:
+        s->cmdq.cons = data;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE: /* 64b */
+        s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
+        if (s->eventq.log2size > SMMU_EVENTQS) {
+            s->eventq.log2size = SMMU_EVENTQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_BASE + 4:
+        s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_PROD:
+        s->eventq.prod = data;
+        return MEMTX_OK;
+    case A_EVENTQ_CONS:
+        s->eventq.cons = data;
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0: /* 64b */
+        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0 + 4:
+        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG1:
+        s->eventq_irq_cfg1 = data;
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG2:
+        s->eventq_irq_cfg2 = data;
+        return MEMTX_OK;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                    unsigned size, MemTxAttrs attrs)
 {
-    /* not yet implemented */
-    return MEMTX_ERROR;
+    SMMUState *sys = opaque;
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    MemTxResult r;
+
+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
+    offset &= ~0x10000;
+
+    switch (size) {
+    case 8:
+        r = smmu_writell(s, offset, data, attrs);
+        break;
+    case 4:
+        r = smmu_writel(s, offset, data, attrs);
+        break;
+    default:
+        r = MEMTX_ERROR;
+        break;
+    }
+
+    trace_smmuv3_write_mmio(offset, data, size, r);
+    return r;
 }
 
 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t con
 smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
 smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
 smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
+smmuv3_update(bool is_empty, uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "q empty:%d prod:%d cons:%d p.wrap:%d p.cons:%d"
+smmuv3_update_check_cmd(int error) "cmdq not enabled or error :0x%x"
+smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
+smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

Let's introduce a helper function aiming at recording an
event in the event queue.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-9-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 148 ++++++++++++++++++++++++++++++++++++++-
 hw/arm/smmuv3.c          | 108 ++++++++++++++++++++++++++--
 hw/arm/trace-events      |   1 +
 3 files changed, 249 insertions(+), 8 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
     s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
 }
 
-void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
-
 /* Commands */
 
 typedef enum SMMUCommandType {
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
 
 #define SMMU_FEATURE_2LVL_STE (1 << 0)
 
+/* Events */
+
+typedef enum SMMUEventType {
+    SMMU_EVT_OK                 = 0x00,
+    SMMU_EVT_F_UUT                    ,
+    SMMU_EVT_C_BAD_STREAMID           ,
+    SMMU_EVT_F_STE_FETCH              ,
+    SMMU_EVT_C_BAD_STE                ,
+    SMMU_EVT_F_BAD_ATS_TREQ           ,
+    SMMU_EVT_F_STREAM_DISABLED        ,
+    SMMU_EVT_F_TRANS_FORBIDDEN        ,
+    SMMU_EVT_C_BAD_SUBSTREAMID        ,
+    SMMU_EVT_F_CD_FETCH               ,
+    SMMU_EVT_C_BAD_CD                 ,
+    SMMU_EVT_F_WALK_EABT              ,
+    SMMU_EVT_F_TRANSLATION      = 0x10,
+    SMMU_EVT_F_ADDR_SIZE              ,
+    SMMU_EVT_F_ACCESS                 ,
+    SMMU_EVT_F_PERMISSION             ,
+    SMMU_EVT_F_TLB_CONFLICT     = 0x20,
+    SMMU_EVT_F_CFG_CONFLICT           ,
+    SMMU_EVT_E_PAGE_REQ         = 0x24,
+} SMMUEventType;
+
+static const char *event_stringify[] = {
+    [SMMU_EVT_OK]                       = "SMMU_EVT_OK",
+    [SMMU_EVT_F_UUT]                    = "SMMU_EVT_F_UUT",
+    [SMMU_EVT_C_BAD_STREAMID]           = "SMMU_EVT_C_BAD_STREAMID",
+    [SMMU_EVT_F_STE_FETCH]              = "SMMU_EVT_F_STE_FETCH",
+    [SMMU_EVT_C_BAD_STE]                = "SMMU_EVT_C_BAD_STE",
+    [SMMU_EVT_F_BAD_ATS_TREQ]           = "SMMU_EVT_F_BAD_ATS_TREQ",
+    [SMMU_EVT_F_STREAM_DISABLED]        = "SMMU_EVT_F_STREAM_DISABLED",
+    [SMMU_EVT_F_TRANS_FORBIDDEN]        = "SMMU_EVT_F_TRANS_FORBIDDEN",
+    [SMMU_EVT_C_BAD_SUBSTREAMID]        = "SMMU_EVT_C_BAD_SUBSTREAMID",
+    [SMMU_EVT_F_CD_FETCH]               = "SMMU_EVT_F_CD_FETCH",
+    [SMMU_EVT_C_BAD_CD]                 = "SMMU_EVT_C_BAD_CD",
+    [SMMU_EVT_F_WALK_EABT]              = "SMMU_EVT_F_WALK_EABT",
+    [SMMU_EVT_F_TRANSLATION]            = "SMMU_EVT_F_TRANSLATION",
+    [SMMU_EVT_F_ADDR_SIZE]              = "SMMU_EVT_F_ADDR_SIZE",
+    [SMMU_EVT_F_ACCESS]                 = "SMMU_EVT_F_ACCESS",
+    [SMMU_EVT_F_PERMISSION]             = "SMMU_EVT_F_PERMISSION",
+    [SMMU_EVT_F_TLB_CONFLICT]           = "SMMU_EVT_F_TLB_CONFLICT",
+    [SMMU_EVT_F_CFG_CONFLICT]           = "SMMU_EVT_F_CFG_CONFLICT",
+    [SMMU_EVT_E_PAGE_REQ]               = "SMMU_EVT_E_PAGE_REQ",
+};
+
+static inline const char *smmu_event_string(SMMUEventType type)
+{
+    if (type < ARRAY_SIZE(event_stringify)) {
+        return event_stringify[type] ? event_stringify[type] : "UNKNOWN";
+    } else {
+        return "INVALID";
+    }
+}
+
+/*  Encode an event record */
+typedef struct SMMUEventInfo {
+    SMMUEventType type;
+    uint32_t sid;
+    bool recorded;
+    bool record_trans_faults;
+    union {
+        struct {
+            uint32_t ssid;
+            bool ssv;
+            dma_addr_t addr;
+            bool rnw;
+            bool pnu;
+            bool ind;
+       } f_uut;
+       struct SSIDInfo {
+            uint32_t ssid;
+            bool ssv;
+       } c_bad_streamid;
+       struct SSIDAddrInfo {
+            uint32_t ssid;
+            bool ssv;
+            dma_addr_t addr;
+       } f_ste_fetch;
+       struct SSIDInfo c_bad_ste;
+       struct {
+            dma_addr_t addr;
+            bool rnw;
+       } f_transl_forbidden;
+       struct {
+            uint32_t ssid;
+       } c_bad_substream;
+       struct SSIDAddrInfo f_cd_fetch;
+       struct SSIDInfo c_bad_cd;
+       struct FullInfo {
+            bool stall;
+            uint16_t stag;
+            uint32_t ssid;
+            bool ssv;
+            bool s2;
+            dma_addr_t addr;
+            bool rnw;
+            bool pnu;
+            bool ind;
+            uint8_t class;
+            dma_addr_t addr2;
+       } f_walk_eabt;
+       struct FullInfo f_translation;
+       struct FullInfo f_addr_size;
+       struct FullInfo f_access;
+       struct FullInfo f_permission;
+       struct SSIDInfo f_cfg_conflict;
+       /**
+        * not supported yet:
+        * F_BAD_ATS_TREQ
+        * F_BAD_ATS_TREQ
+        * F_TLB_CONFLICT
+        * E_PAGE_REQUEST
+        * IMPDEF_EVENTn
+        */
+    } u;
+} SMMUEventInfo;
+
+/* EVTQ fields */
+
+#define EVT_Q_OVERFLOW        (1 << 31)
+
+#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
+#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
+#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
+#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
+#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
+#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
+#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
+#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
+#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
+#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
+#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
+#define EVT_SET_ADDR(x, addr)                             \
+    do {                                                  \
+            (x)->word[5] = (uint32_t)(addr >> 32);        \
+            (x)->word[4] = (uint32_t)(addr & 0xffffffff); \
+    } while (0)
+#define EVT_SET_ADDR2(x, addr)                            \
+    do {                                                  \
+            deposit32((x)->word[7], 3, 29, addr >> 16);   \
+            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
+    } while (0)
+
+void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult queue_write(SMMUQueue *q, void *data)
     return MEMTX_OK;
 }
 
-void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
+static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 {
     SMMUQueue *q = &s->eventq;
+    MemTxResult r;
+
+    if (!smmuv3_eventq_enabled(s)) {
+        return MEMTX_ERROR;
+    }
+
+    if (smmuv3_q_full(q)) {
+        return MEMTX_ERROR;
+    }
+
+    r = queue_write(q, evt);
+    if (r != MEMTX_OK) {
+        return r;
+    }
+
+    if (smmuv3_q_empty(q)) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    }
+    return MEMTX_OK;
+}
+
+void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
+{
+    Evt evt;
+    MemTxResult r;
 
     if (!smmuv3_eventq_enabled(s)) {
         return;
     }
 
-    if (smmuv3_q_full(q)) {
+    EVT_SET_TYPE(&evt, info->type);
+    EVT_SET_SID(&evt, info->sid);
+
+    switch (info->type) {
+    case SMMU_EVT_OK:
         return;
+    case SMMU_EVT_F_UUT:
+        EVT_SET_SSID(&evt, info->u.f_uut.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_uut.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_uut.addr);
+        EVT_SET_RNW(&evt,  info->u.f_uut.rnw);
+        EVT_SET_PNU(&evt,  info->u.f_uut.pnu);
+        EVT_SET_IND(&evt,  info->u.f_uut.ind);
+        break;
+    case SMMU_EVT_C_BAD_STREAMID:
+        EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_streamid.ssv);
+        break;
+    case SMMU_EVT_F_STE_FETCH:
+        EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
+        break;
+    case SMMU_EVT_C_BAD_STE:
+        EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_ste.ssv);
+        break;
+    case SMMU_EVT_F_STREAM_DISABLED:
+        break;
+    case SMMU_EVT_F_TRANS_FORBIDDEN:
+        EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
+        EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
+        break;
+    case SMMU_EVT_C_BAD_SUBSTREAMID:
+        EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
+        break;
+    case SMMU_EVT_F_CD_FETCH:
+        EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_cd_fetch.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
+        break;
+    case SMMU_EVT_C_BAD_CD:
+        EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_cd.ssv);
+        break;
+    case SMMU_EVT_F_WALK_EABT:
+    case SMMU_EVT_F_TRANSLATION:
+    case SMMU_EVT_F_ADDR_SIZE:
+    case SMMU_EVT_F_ACCESS:
+    case SMMU_EVT_F_PERMISSION:
+        EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
+        EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
+        EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
+        EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
+        EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
+        EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
+        EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
+        EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
+        EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
+        EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
+        EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
+        break;
+    case SMMU_EVT_F_CFG_CONFLICT:
+        EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_cfg_conflict.ssv);
+        break;
+    /* rest is not implemented */
+    case SMMU_EVT_F_BAD_ATS_TREQ:
+    case SMMU_EVT_F_TLB_CONFLICT:
+    case SMMU_EVT_E_PAGE_REQ:
+    default:
+        g_assert_not_reached();
     }
 
-    queue_write(q, evt);
-
-    if (smmuv3_q_empty(q)) {
-        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
+    r = smmuv3_write_eventq(s, &evt);
+    if (r != MEMTX_OK) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
     }
+    info->recorded = true;
 }
 
 static void smmuv3_init_regs(SMMUv3State *s)
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
 smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
 smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

This patch implements the IOMMU Memory Region translate()
callback. Most of the code relates to the translation
configuration decoding and check (STE, CD).

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Message-id: 1524665762-31355-10-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 160 +++++++++++++++++
 hw/arm/smmuv3.c          | 358 +++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   9 +
 3 files changed, 527 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
 
 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 
+/* Configuration Data */
+
+/* STE Level 1 Descriptor */
+typedef struct STEDesc {
+    uint32_t word[2];
+} STEDesc;
+
+/* CD Level 1 Descriptor */
+typedef struct CDDesc {
+    uint32_t word[2];
+} CDDesc;
+
+/* Stream Table Entry(STE) */
+typedef struct STE {
+    uint32_t word[16];
+} STE;
+
+/* Context Descriptor(CD) */
+typedef struct CD {
+    uint32_t word[16];
+} CD;
+
+/* STE fields */
+
+#define STE_VALID(x)   extract32((x)->word[0], 0, 1)
+
+#define STE_CONFIG(x)  extract32((x)->word[0], 1, 3)
+#define STE_CFG_S1_ENABLED(config) (config & 0x1)
+#define STE_CFG_S2_ENABLED(config) (config & 0x2)
+#define STE_CFG_ABORT(config)      (!(config & 0x4))
+#define STE_CFG_BYPASS(config)     (config == 0x4)
+
+#define STE_S1FMT(x)       extract32((x)->word[0], 4 , 2)
+#define STE_S1CDMAX(x)     extract32((x)->word[1], 27, 5)
+#define STE_S1STALLD(x)    extract32((x)->word[2], 27, 1)
+#define STE_EATS(x)        extract32((x)->word[2], 28, 2)
+#define STE_STRW(x)        extract32((x)->word[2], 30, 2)
+#define STE_S2VMID(x)      extract32((x)->word[4], 0 , 16)
+#define STE_S2T0SZ(x)      extract32((x)->word[5], 0 , 6)
+#define STE_S2SL0(x)       extract32((x)->word[5], 6 , 2)
+#define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
+#define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
+#define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_CTXPTR(x)                                           \
+    ({                                                          \
+        unsigned long addr;                                     \
+        addr = (uint64_t)extract32((x)->word[1], 0, 16) << 32;  \
+        addr |= (uint64_t)((x)->word[0] & 0xffffffc0);          \
+        addr;                                                   \
+    })
+
+#define STE_S2TTB(x)                                            \
+    ({                                                          \
+        unsigned long addr;                                     \
+        addr = (uint64_t)extract32((x)->word[7], 0, 16) << 32;  \
+        addr |= (uint64_t)((x)->word[6] & 0xfffffff0);          \
+        addr;                                                   \
+    })
+
+static inline int oas2bits(int oas_field)
+{
+    switch (oas_field) {
+    case 0:
+        return 32;
+    case 1:
+        return 36;
+    case 2:
+        return 40;
+    case 3:
+        return 42;
+    case 4:
+        return 44;
+    case 5:
+        return 48;
+    }
+    return -1;
+}
+
+static inline int pa_range(STE *ste)
+{
+    int oas_field = MIN(STE_S2PS(ste), SMMU_IDR5_OAS);
+
+    if (!STE_S2AA64(ste)) {
+        return 40;
+    }
+
+    return oas2bits(oas_field);
+}
+
+#define MAX_PA(ste) ((1 << pa_range(ste)) - 1)
+
+/* CD fields */
+
+#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
+#define CD_ASID(x)    extract32((x)->word[1], 16, 16)
+#define CD_TTB(x, sel)                                      \
+    ({                                                      \
+        uint64_t hi, lo;                                    \
+        hi = extract32((x)->word[(sel) * 2 + 3], 0, 19);    \
+        hi <<= 32;                                          \
+        lo = (x)->word[(sel) * 2 + 2] & ~0xfULL;            \
+        hi | lo;                                            \
+    })
+
+#define CD_TSZ(x, sel)   extract32((x)->word[0], (16 * (sel)) + 0, 6)
+#define CD_TG(x, sel)    extract32((x)->word[0], (16 * (sel)) + 6, 2)
+#define CD_EPD(x, sel)   extract32((x)->word[0], (16 * (sel)) + 14, 1)
+#define CD_ENDI(x)       extract32((x)->word[0], 15, 1)
+#define CD_IPS(x)        extract32((x)->word[1], 0 , 3)
+#define CD_TBI(x)        extract32((x)->word[1], 6 , 2)
+#define CD_HD(x)         extract32((x)->word[1], 10 , 1)
+#define CD_HA(x)         extract32((x)->word[1], 11 , 1)
+#define CD_S(x)          extract32((x)->word[1], 12, 1)
+#define CD_R(x)          extract32((x)->word[1], 13, 1)
+#define CD_A(x)          extract32((x)->word[1], 14, 1)
+#define CD_AARCH64(x)    extract32((x)->word[1], 9 , 1)
+
+#define CDM_VALID(x)    ((x)->word[0] & 0x1)
+
+static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd)
+{
+    return CD_VALID(cd);
+}
+
+/**
+ * tg2granule - Decodes the CD translation granule size field according
+ * to the ttbr in use
+ * @bits: TG0/1 fields
+ * @ttbr: ttbr index in use
+ */
+static inline int tg2granule(int bits, int ttbr)
+{
+    switch (bits) {
+    case 0:
+        return ttbr ? 0  : 12;
+    case 1:
+        return ttbr ? 14 : 16;
+    case 2:
+        return ttbr ? 12 : 14;
+    case 3:
+        return ttbr ? 16 :  0;
+    default:
+        return 0;
+    }
+}
+
+static inline uint64_t l1std_l2ptr(STEDesc *desc)
+{
+    uint64_t hi, lo;
+
+    hi = desc->word[1];
+    lo = desc->word[0] & ~0x1fULL;
+    return hi << 32 | lo;
+}
+
+#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
+static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
+                        SMMUEventInfo *event)
+{
+    int ret;
+
+    trace_smmuv3_get_ste(addr);
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                          (void *)buf, sizeof(*buf));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
+        event->type = SMMU_EVT_F_STE_FETCH;
+        event->u.f_ste_fetch.addr = addr;
+        return -EINVAL;
+    }
+    return 0;
+
+}
+
+/* @ssid > 0 not supported yet */
+static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
+                       CD *buf, SMMUEventInfo *event)
+{
+    dma_addr_t addr = STE_CTXPTR(ste);
+    int ret;
+
+    trace_smmuv3_get_cd(addr);
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                           (void *)buf, sizeof(*buf));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
+        event->type = SMMU_EVT_F_CD_FETCH;
+        event->u.f_ste_fetch.addr = addr;
+        return -EINVAL;
+    }
+    return 0;
+}
+
+/* Returns <0 if the caller has no need to continue the translation */
+static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
+                      STE *ste, SMMUEventInfo *event)
+{
+    uint32_t config;
+    int ret = -EINVAL;
+
+    if (!STE_VALID(ste)) {
+        goto bad_ste;
+    }
+
+    config = STE_CONFIG(ste);
+
+    if (STE_CFG_ABORT(config)) {
+        cfg->aborted = true; /* abort but don't record any event */
+        return ret;
+    }
+
+    if (STE_CFG_BYPASS(config)) {
+        cfg->bypassed = true;
+        return ret;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+        goto bad_ste;
+    }
+
+    if (STE_S1CDMAX(ste) != 0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 does not support multiple context descriptors yet\n");
+        goto bad_ste;
+    }
+
+    if (STE_S1STALLD(ste)) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 S1 stalling fault model not allowed yet\n");
+        goto bad_ste;
+    }
+    return 0;
+
+bad_ste:
+    event->type = SMMU_EVT_C_BAD_STE;
+    return -EINVAL;
+}
+
+/**
+ * smmu_find_ste - Return the stream table entry associated
+ * to the sid
+ *
+ * @s: smmuv3 handle
+ * @sid: stream ID
+ * @ste: returned stream table entry
+ * @event: handle to an event info
+ *
+ * Supports linear and 2-level stream table
+ * Return 0 on success, -EINVAL otherwise
+ */
+static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+                         SMMUEventInfo *event)
+{
+    dma_addr_t addr;
+    int ret;
+
+    trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+    /* Check SID range */
+    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
+        event->type = SMMU_EVT_C_BAD_STREAMID;
+        return -EINVAL;
+    }
+    if (s->features & SMMU_FEATURE_2LVL_STE) {
+        int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
+        dma_addr_t strtab_base, l1ptr, l2ptr;
+        STEDesc l1std;
+
+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
+        l1_ste_offset = sid >> s->sid_split;
+        l2_ste_offset = sid & ((1 << s->sid_split) - 1);
+        l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
+        /* TODO: guarantee 64-bit single-copy atomicity */
+        ret = dma_memory_read(&address_space_memory, l1ptr,
+                              (uint8_t *)&l1std, sizeof(l1std));
+        if (ret != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
+            event->type = SMMU_EVT_F_STE_FETCH;
+            event->u.f_ste_fetch.addr = l1ptr;
+            return -EINVAL;
+        }
+
+        span = L1STD_SPAN(&l1std);
+
+        if (!span) {
+            /* l2ptr is not valid */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "invalid sid=%d (L1STD span=0)\n", sid);
+            event->type = SMMU_EVT_C_BAD_STREAMID;
+            return -EINVAL;
+        }
+        max_l2_ste = (1 << span) - 1;
+        l2ptr = l1std_l2ptr(&l1std);
+        trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
+                                   l2ptr, l2_ste_offset, max_l2_ste);
+        if (l2_ste_offset > max_l2_ste) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "l2_ste_offset=%d > max_l2_ste=%d\n",
+                          l2_ste_offset, max_l2_ste);
+            event->type = SMMU_EVT_C_BAD_STE;
+            return -EINVAL;
+        }
+        addr = l2ptr + l2_ste_offset * sizeof(*ste);
+    } else {
+        addr = s->strtab_base + sid * sizeof(*ste);
+    }
+
+    if (smmu_get_ste(s, addr, ste, event)) {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
+{
+    int ret = -EINVAL;
+    int i;
+
+    if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
+        goto bad_cd;
+    }
+    if (!CD_A(cd)) {
+        goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
+    }
+    if (CD_S(cd)) {
+        goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
+    }
+    if (CD_HA(cd) || CD_HD(cd)) {
+        goto bad_cd; /* HTTU = 0 */
+    }
+
+    /* we support only those at the moment */
+    cfg->aa64 = true;
+    cfg->stage = 1;
+
+    cfg->oas = oas2bits(CD_IPS(cd));
+    cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
+    cfg->tbi = CD_TBI(cd);
+    cfg->asid = CD_ASID(cd);
+
+    trace_smmuv3_decode_cd(cfg->oas);
+
+    /* decode data dependent on TT */
+    for (i = 0; i <= 1; i++) {
+        int tg, tsz;
+        SMMUTransTableInfo *tt = &cfg->tt[i];
+
+        cfg->tt[i].disabled = CD_EPD(cd, i);
+        if (cfg->tt[i].disabled) {
+            continue;
+        }
+
+        tsz = CD_TSZ(cd, i);
+        if (tsz < 16 || tsz > 39) {
+            goto bad_cd;
+        }
+
+        tg = CD_TG(cd, i);
+        tt->granule_sz = tg2granule(tg, i);
+        if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
+            goto bad_cd;
+        }
+
+        tt->tsz = tsz;
+        tt->ttb = CD_TTB(cd, i);
+        if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
+            goto bad_cd;
+        }
+        trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);
+    }
+
+    event->record_trans_faults = CD_R(cd);
+
+    return 0;
+
+bad_cd:
+    event->type = SMMU_EVT_C_BAD_CD;
+    return ret;
+}
+
+/**
+ * smmuv3_decode_config - Prepare the translation configuration
+ * for the @mr iommu region
+ * @mr: iommu memory region the translation config must be prepared for
+ * @cfg: output translation configuration which is populated through
+ *       the different configuration decoding steps
+ * @event: must be zero'ed by the caller
+ *
+ * return < 0 if the translation needs to be aborted (@event is filled
+ * accordingly). Return 0 otherwise.
+ */
+static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
+                                SMMUEventInfo *event)
+{
+    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
+    uint32_t sid = smmu_get_sid(sdev);
+    SMMUv3State *s = sdev->smmu;
+    int ret = -EINVAL;
+    STE ste;
+    CD cd;
+
+    if (smmu_find_ste(s, sid, &ste, event)) {
+        return ret;
+    }
+
+    if (decode_ste(s, cfg, &ste, event)) {
+        return ret;
+    }
+
+    if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) {
+        return ret;
+    }
+
+    return decode_cd(cfg, &cd, event);
+}
+
+static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+                                      IOMMUAccessFlags flag)
+{
+    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
+    SMMUv3State *s = sdev->smmu;
+    uint32_t sid = smmu_get_sid(sdev);
+    SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid};
+    SMMUPTWEventInfo ptw_info = {};
+    SMMUTransCfg cfg = {};
+    IOMMUTLBEntry entry = {
+        .target_as = &address_space_memory,
+        .iova = addr,
+        .translated_addr = addr,
+        .addr_mask = ~(hwaddr)0,
+        .perm = IOMMU_NONE,
+    };
+    int ret = 0;
+
+    if (!smmu_enabled(s)) {
+        goto out;
+    }
+
+    ret = smmuv3_decode_config(mr, &cfg, &event);
+    if (ret) {
+        goto out;
+    }
+
+    if (cfg.aborted) {
+        goto out;
+    }
+
+    ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info);
+    if (ret) {
+        switch (ptw_info.type) {
+        case SMMU_PTW_ERR_WALK_EABT:
+            event.type = SMMU_EVT_F_WALK_EABT;
+            event.u.f_walk_eabt.addr = addr;
+            event.u.f_walk_eabt.rnw = flag & 0x1;
+            event.u.f_walk_eabt.class = 0x1;
+            event.u.f_walk_eabt.addr2 = ptw_info.addr;
+            break;
+        case SMMU_PTW_ERR_TRANSLATION:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_ADDR_SIZE:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_ADDR_SIZE;
+                event.u.f_addr_size.addr = addr;
+                event.u.f_addr_size.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_ACCESS:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_ACCESS;
+                event.u.f_access.addr = addr;
+                event.u.f_access.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_PERMISSION:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_PERMISSION;
+                event.u.f_permission.addr = addr;
+                event.u.f_permission.rnw = flag & 0x1;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    }
+out:
+    if (ret) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s translation failed for iova=0x%"PRIx64"(%d)\n",
+                      mr->parent_obj.name, addr, ret);
+        entry.perm = IOMMU_NONE;
+        smmuv3_record_event(s, &event);
+    } else if (!cfg.aborted) {
+        entry.perm = flag;
+        trace_smmuv3_translate(mr->parent_obj.name, sid, addr,
+                               entry.translated_addr, entry.perm);
+    }
+
+    return entry;
+}
+
 static int smmuv3_cmdq_consume(SMMUv3State *s)
 {
     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
                                                   void *data)
 {
+    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+    imrc->translate = smmuv3_translate;
 }
 
 static const TypeInfo smmuv3_type_info = {
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx
 smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
+smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%lx l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
+smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass iova:0x%"PRIx64" is_write=%d"
+smmuv3_translate_in(uint16_t sid, int pci_bus_num, uint64_t strtab_base) "SID:0x%x bus:%d strtab_base:0x%"PRIx64
+smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
+smmuv3_translate(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
+smmuv3_decode_cd(uint32_t oas) "oas=%d"
+smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

At the moment, the SMMUv3 does not support notification on
TLB invalidation. So let's log an error as soon as such notifier
gets enabled.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-11-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
     dc->realize = smmu_realize;
 }
 
+static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
+                                       IOMMUNotifierFlag old,
+                                       IOMMUNotifierFlag new)
+{
+    if (old == IOMMU_NOTIFIER_NONE) {
+        warn_report("SMMUV3 does not support vhost/vfio integration yet: "
+                    "devices of those types will not function properly");
+    }
+}
+
 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
                                                   void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
     imrc->translate = smmuv3_translate;
+    imrc->notify_flag_changed = smmuv3_notify_flag_changed;
 }
 
 static const TypeInfo smmuv3_type_info = {
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

In case the MSI is translated by an IOMMU we need to fixup the
MSI route with the translated address.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Bharat Bhushan <Bharat.Bhushan@nxp.com>
Message-id: 1524665762-31355-12-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c        | 38 +++++++++++++++++++++++++++++++++++++-
 target/arm/trace-events |  3 +++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "cpu.h"
+#include "trace.h"
 #include "internals.h"
 #include "hw/arm/arm.h"
+#include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
                              uint64_t address, uint32_t data, PCIDevice *dev)
 {
-    return 0;
+    AddressSpace *as = pci_device_iommu_address_space(dev);
+    hwaddr xlat, len, doorbell_gpa;
+    MemoryRegionSection mrs;
+    MemoryRegion *mr;
+    int ret = 1;
+
+    if (as == &address_space_memory) {
+        return 0;
+    }
+
+    /* MSI doorbell address is translated by an IOMMU */
+
+    rcu_read_lock();
+    mr = address_space_translate(as, address, &xlat, &len, true);
+    if (!mr) {
+        goto unlock;
+    }
+    mrs = memory_region_find(mr, xlat, 1);
+    if (!mrs.mr) {
+        goto unlock;
+    }
+
+    doorbell_gpa = mrs.offset_within_address_space;
+    memory_region_unref(mrs.mr);
+
+    route->u.msi.address_lo = doorbell_gpa;
+    route->u.msi.address_hi = doorbell_gpa >> 32;
+
+    trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
+
+    ret = 0;
+
+unlock:
+    rcu_read_unlock();
+    return ret;
 }
 
 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer, int irqstate) "gt_ctl_write: timer %d IMASK toggle, new irqstate %d"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+
+# target/arm/kvm.c
+kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

Add code to instantiate an smmuv3 in virt machine. A new iommu
integer member is introduced in VirtMachineState to store the type
of the iommu in use.

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 
 #define NUM_GICV2M_SPIS       64
 #define NUM_VIRTIO_TRANSPORTS 32
+#define NUM_SMMU_IRQS          4
 
 #define ARCH_GICV3_MAINT_IRQ  9
 
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_GIC_V2M,
     VIRT_GIC_ITS,
     VIRT_GIC_REDIST,
+    VIRT_SMMU,
     VIRT_UART,
     VIRT_MMIO,
     VIRT_RTC,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_SECURE_MEM,
 };
 
+typedef enum VirtIOMMUType {
+    VIRT_IOMMU_NONE,
+    VIRT_IOMMU_SMMUV3,
+    VIRT_IOMMU_VIRTIO,
+} VirtIOMMUType;
+
 typedef struct MemMapEntry {
     hwaddr base;
     hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     bool its;
     bool virt;
     int32_t gic_version;
+    VirtIOMMUType iommu;
     struct arm_boot_info bootinfo;
     const MemMapEntry *memmap;
     const int *irqmap;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t clock_phandle;
     uint32_t gic_phandle;
     uint32_t msi_phandle;
+    uint32_t iommu_phandle;
     int psci_conduit;
 } VirtMachineState;
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/smbios/smbios.h"
 #include "qapi/visitor.h"
 #include "standard-headers/linux/input.h"
+#include "hw/arm/smmuv3.h"
 
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry a15memmap[] = {
     [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
     [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
     [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
+    [VIRT_SMMU] =               { 0x09050000, 0x00020000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static const int a15irqmap[] = {
     [VIRT_SECURE_UART] = 8,
     [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
     [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
+    [VIRT_SMMU] = 74,    /* ...to 74 + NUM_SMMU_IRQS - 1 */
     [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
 };
 
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(const VirtMachineState *vms,
                            0x7           /* PCI irq */);
 }
 
-static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+static void create_smmu(const VirtMachineState *vms, qemu_irq *pic,
+                        PCIBus *bus)
+{
+    char *node;
+    const char compat[] = "arm,smmu-v3";
+    int irq =  vms->irqmap[VIRT_SMMU];
+    int i;
+    hwaddr base = vms->memmap[VIRT_SMMU].base;
+    hwaddr size = vms->memmap[VIRT_SMMU].size;
+    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
+    DeviceState *dev;
+
+    if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {
+        return;
+    }
+
+    dev = qdev_create(NULL, "arm-smmuv3");
+
+    object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",
+                             &error_abort);
+    qdev_init_nofail(dev);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+    for (i = 0; i < NUM_SMMU_IRQS; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+    }
+
+    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
+    qemu_fdt_add_subnode(vms->fdt, node);
+    qemu_fdt_setprop(vms->fdt, node, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(vms->fdt, node, "reg", 2, base, 2, size);
+
+    qemu_fdt_setprop_cells(vms->fdt, node, "interrupts",
+            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+
+    qemu_fdt_setprop(vms->fdt, node, "interrupt-names", irq_names,
+                     sizeof(irq_names));
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "clocks", vms->clock_phandle);
+    qemu_fdt_setprop_string(vms->fdt, node, "clock-names", "apb_pclk");
+    qemu_fdt_setprop(vms->fdt, node, "dma-coherent", NULL, 0);
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "#iommu-cells", 1);
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "phandle", vms->iommu_phandle);
+    g_free(node);
+}
+
+static void create_pcie(VirtMachineState *vms, qemu_irq *pic)
 {
     hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;
     hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);
     create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);
 
+    if (vms->iommu) {
+        vms->iommu_phandle = qemu_fdt_alloc_phandle(vms->fdt);
+
+        create_smmu(vms, pic, pci->bus);
+
+        qemu_fdt_setprop_cells(vms->fdt, nodename, "iommu-map",
+                               0x0, vms->iommu_phandle, 0x0, 0x10000);
+    }
+
     g_free(nodename);
 }
 
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch builds the smmuv3 node in the ACPI IORT table.

The RID space of the root complex, which spans 0x0-0x10000
maps to streamid space 0x0-0x10000 in smmuv3, which in turn
maps to deviceid space 0x0-0x10000 in the ITS group.

The guest must feature the IOMMU probe deferral series
(https://lkml.org/lkml/2017/4/10/214) which fixes streamid
multiple lookup. This bug is not related to the SMMU emulation.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/acpi/acpi-defs.h | 15 ++++++++++
 hw/arm/virt-acpi-build.c    | 55 ++++++++++++++++++++++++++++++++-----
 2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/acpi-defs.h
+++ b/include/hw/acpi/acpi-defs.h
@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {
 } QEMU_PACKED;
 typedef struct AcpiIortItsGroup AcpiIortItsGroup;
 
+struct AcpiIortSmmu3 {
+    ACPI_IORT_NODE_HEADER_DEF
+    uint64_t base_address;
+    uint32_t flags;
+    uint32_t reserved2;
+    uint64_t vatos_address;
+    uint32_t model;
+    uint32_t event_gsiv;
+    uint32_t pri_gsiv;
+    uint32_t gerr_gsiv;
+    uint32_t sync_gsiv;
+    AcpiIortIdMapping id_mapping_array[0];
+} QEMU_PACKED;
+typedef struct AcpiIortSmmu3 AcpiIortSmmu3;
+
 struct AcpiIortRC {
     ACPI_IORT_NODE_HEADER_DEF
     AcpiIortMemoryAccess memory_properties;
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)
 }
 
 static void
-build_iort(GArray *table_data, BIOSLinker *linker)
+build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
-    int iort_start = table_data->len;
+    int nb_nodes, iort_start = table_data->len;
     AcpiIortIdMapping *idmap;
     AcpiIortItsGroup *its;
     AcpiIortTable *iort;
-    size_t node_size, iort_length;
+    AcpiIortSmmu3 *smmu;
+    size_t node_size, iort_length, smmu_offset = 0;
     AcpiIortRC *rc;
 
     iort = acpi_data_push(table_data, sizeof(*iort));
 
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        nb_nodes = 3; /* RC, ITS, SMMUv3 */
+    } else {
+        nb_nodes = 2; /* RC, ITS */
+    }
+
     iort_length = sizeof(*iort);
-    iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */
+    iort->node_count = cpu_to_le32(nb_nodes);
     iort->node_offset = cpu_to_le32(sizeof(*iort));
 
     /* ITS group node */
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
     its->its_count = cpu_to_le32(1);
     its->identifiers[0] = 0; /* MADT translation_id */
 
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        int irq =  vms->irqmap[VIRT_SMMU];
+
+        /* SMMUv3 node */
+        smmu_offset = iort->node_offset + node_size;
+        node_size = sizeof(*smmu) + sizeof(*idmap);
+        iort_length += node_size;
+        smmu = acpi_data_push(table_data, node_size);
+
+        smmu->type = ACPI_IORT_NODE_SMMU_V3;
+        smmu->length = cpu_to_le16(node_size);
+        smmu->mapping_count = cpu_to_le32(1);
+        smmu->mapping_offset = cpu_to_le32(sizeof(*smmu));
+        smmu->base_address = cpu_to_le64(vms->memmap[VIRT_SMMU].base);
+        smmu->event_gsiv = cpu_to_le32(irq);
+        smmu->pri_gsiv = cpu_to_le32(irq + 1);
+        smmu->gerr_gsiv = cpu_to_le32(irq + 2);
+        smmu->sync_gsiv = cpu_to_le32(irq + 3);
+
+        /* Identity RID mapping covering the whole input RID range */
+        idmap = &smmu->id_mapping_array[0];
+        idmap->input_base = 0;
+        idmap->id_count = cpu_to_le32(0xFFFF);
+        idmap->output_base = 0;
+        /* output IORT node is the ITS group node (the first node) */
+        idmap->output_reference = cpu_to_le32(iort->node_offset);
+    }
+
     /* Root Complex Node */
     node_size = sizeof(*rc) + sizeof(*idmap);
     iort_length += node_size;
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
     idmap->input_base = 0;
     idmap->id_count = cpu_to_le32(0xFFFF);
     idmap->output_base = 0;
-    /* output IORT node is the ITS group node (the first node) */
-    idmap->output_reference = cpu_to_le32(iort->node_offset);
+
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        /* output IORT node is the smmuv3 node */
+        idmap->output_reference = cpu_to_le32(smmu_offset);
+    } else {
+        /* output IORT node is the ITS group node (the first node) */
+        idmap->output_reference = cpu_to_le32(iort->node_offset);
+    }
 
     iort->length = cpu_to_le32(iort_length);
 
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
 
     if (its_class_name() && !vmc->no_its) {
         acpi_add_table(table_offsets, tables_blob);
-        build_iort(tables_blob, tables->linker);
+        build_iort(tables_blob, tables->linker, vms);
     }
 
     /* XSDT is pointed to by RSDP */
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

ARM virt machine now exposes a new "iommu" option.
The SMMUv3 IOMMU is instantiated using -machine virt,iommu=smmuv3.

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
     }
 }
 
+static char *virt_get_iommu(Object *obj, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    switch (vms->iommu) {
+    case VIRT_IOMMU_NONE:
+        return g_strdup("none");
+    case VIRT_IOMMU_SMMUV3:
+        return g_strdup("smmuv3");
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void virt_set_iommu(Object *obj, const char *value, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    if (!strcmp(value, "smmuv3")) {
+        vms->iommu = VIRT_IOMMU_SMMUV3;
+    } else if (!strcmp(value, "none")) {
+        vms->iommu = VIRT_IOMMU_NONE;
+    } else {
+        error_setg(errp, "Invalid iommu value");
+        error_append_hint(errp, "Valid values are none, smmuv3.\n");
+    }
+}
+
 static CpuInstanceProperties
 virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
 {
@@ -XXX,XX +XXX,XX @@ static void virt_2_12_instance_init(Object *obj)
                                         NULL);
     }
 
+    /* Default disallows iommu instantiation */
+    vms->iommu = VIRT_IOMMU_NONE;
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu, NULL);
+    object_property_set_description(obj, "iommu",
+                                    "Set the IOMMU type. "
+                                    "Valid values are none and smmuv3",
+                                    NULL);
+
     vms->memmap = a15memmap;
     vms->irqmap = a15irqmap;
 }
-- 
2.17.0

The following changes since commit 7e7eb9f852a46b51a71ae9d82590b2e4d28827ee:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-01-28' into staging (2021-01-28 22:43:18 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210129

for you to fetch changes up to 11749122e1a86866591306d43603d2795a3dea1a:

hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS (2021-01-29 10:47:29 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement ID_PFR2
 * Conditionalize DBGDIDR
 * rename xlnx-zcu102.canbusN properties
 * provide powerdown/reset mechanism for secure firmware on 'virt' board
 * hw/misc: Fix arith overflow in NPCM7XX PWM module
 * target/arm: Replace magic value by MMU_DATA_LOAD definition
 * configure: fix preadv errors on Catalina macOS with new XCode
 * Various configure and other cleanups in preparation for iOS support
 * hvf: Add hypervisor entitlement to output binaries (needed for Big Sur)
 * Implement pvpanic-pci device
 * Convert the CMSDK timer devices to the Clock framework

----------------------------------------------------------------
Alexander Graf (1):
      hvf: Add hypervisor entitlement to output binaries

Hao Wu (1):
      hw/misc: Fix arith overflow in NPCM7XX PWM module

Joelle van Dyne (7):
      configure: cross-compiling with empty cross_prefix
      osdep: build with non-working system() function
      darwin: remove redundant dependency declaration
      darwin: fix cross-compiling for Darwin
      configure: cross compile should use x86_64 cpu_family
      darwin: detect CoreAudio for build
      darwin: remove 64-bit build detection on 32-bit OS

Maxim Uvarov (3):
      hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
      arm-virt: refactor gpios creation
      arm-virt: add secure pl061 for reset/power down

Mihai Carabas (4):
      hw/misc/pvpanic: split-out generic and bus dependent code
      hw/misc/pvpanic: add PCI interface support
      pvpanic : update pvpanic spec document
      tests/qtest: add a test case for pvpanic-pci

Paolo Bonzini (1):
      arm: rename xlnx-zcu102.canbusN properties

Peter Maydell (26):
      configure: Move preadv check to meson.build
      ptimer: Add new ptimer_set_period_from_clock() function
      clock: Add new clock_has_source() function
      tests: Add a simple test of the CMSDK APB timer
      tests: Add a simple test of the CMSDK APB watchdog
      tests: Add a simple test of the CMSDK APB dual timer
      hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
      hw/timer/cmsdk-apb-timer: Add Clock input
      hw/timer/cmsdk-apb-dualtimer: Add Clock input
      hw/watchdog/cmsdk-apb-watchdog: Add Clock input
      hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
      hw/arm/armsse: Wire up clocks
      hw/arm/mps2: Inline CMSDK_APB_TIMER creation
      hw/arm/mps2: Create and connect SYSCLK Clock
      hw/arm/mps2-tz: Create and connect ARMSSE Clocks
      hw/arm/musca: Create and connect ARMSSE Clocks
      hw/arm/stellaris: Convert SSYS to QOM device
      hw/arm/stellaris: Create Clock input for watchdog
      hw/timer/cmsdk-apb-timer: Convert to use Clock input
      hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
      hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
      tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
      hw/arm/armsse: Use Clock to set system_clock_scale
      arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
      arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
      hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS

Philippe Mathieu-Daudé (1):
      target/arm: Replace magic value by MMU_DATA_LOAD definition

Richard Henderson (2):
      target/arm: Implement ID_PFR2
      target/arm: Conditionalize DBGDIDR

docs/devel/clocks.rst                    |  16 +++
 docs/specs/pci-ids.txt                   |   1 +
 docs/specs/pvpanic.txt                   |  13 ++-
 docs/system/arm/virt.rst                 |   2 +
 configure                                |  78 ++++++++------
 meson.build                              |  34 ++++++-
 include/hw/arm/armsse.h                  |  14 ++-
 include/hw/arm/virt.h                    |   2 +
 include/hw/clock.h                       |  15 +++
 include/hw/misc/pvpanic.h                |  24 ++++-
 include/hw/pci/pci.h                     |   1 +
 include/hw/ptimer.h                      |  22 ++++
 include/hw/timer/cmsdk-apb-dualtimer.h   |   5 +-
 include/hw/timer/cmsdk-apb-timer.h       |  34 ++-----
 include/hw/watchdog/cmsdk-apb-watchdog.h |   5 +-
 include/qemu/osdep.h                     |  12 +++
 include/qemu/typedefs.h                  |   1 +
 target/arm/cpu.h                         |   1 +
 hw/arm/armsse.c                          |  48 ++++++---
 hw/arm/mps2-tz.c                         |  14 ++-
 hw/arm/mps2.c                            |  28 ++++-
 hw/arm/musca.c                           |  13 ++-
 hw/arm/stellaris.c                       | 170 +++++++++++++++++++++++--------
 hw/arm/virt.c                            | 111 ++++++++++++++++----
 hw/arm/xlnx-zcu102.c                     |   4 +-
 hw/core/ptimer.c                         |  34 +++++++
 hw/gpio/gpio_pwr.c                       |  70 +++++++++++++
 hw/misc/npcm7xx_pwm.c                    |  23 ++++-
 hw/misc/pvpanic-isa.c                    |  94 +++++++++++++++++
 hw/misc/pvpanic-pci.c                    |  94 +++++++++++++++++
 hw/misc/pvpanic.c                        |  85 ++--------------
 hw/timer/cmsdk-apb-dualtimer.c           |  53 +++++++---
 hw/timer/cmsdk-apb-timer.c               |  55 +++++-----
 hw/watchdog/cmsdk-apb-watchdog.c         |  29 ++++--
 target/arm/helper.c                      |  27 +++--
 target/arm/kvm64.c                       |   2 +
 tests/qtest/cmsdk-apb-dualtimer-test.c   | 130 +++++++++++++++++++++++
 tests/qtest/cmsdk-apb-timer-test.c       |  75 ++++++++++++++
 tests/qtest/cmsdk-apb-watchdog-test.c    | 131 ++++++++++++++++++++++++
 tests/qtest/npcm7xx_pwm-test.c           |   4 +-
 tests/qtest/pvpanic-pci-test.c           |  94 +++++++++++++++++
 tests/qtest/xlnx-can-test.c              |  30 +++---
 MAINTAINERS                              |   3 +
 accel/hvf/entitlements.plist             |   8 ++
 hw/arm/Kconfig                           |   1 +
 hw/gpio/Kconfig                          |   3 +
 hw/gpio/meson.build                      |   1 +
 hw/i386/Kconfig                          |   2 +-
 hw/misc/Kconfig                          |  12 ++-
 hw/misc/meson.build                      |   4 +-
 scripts/entitlement.sh                   |  13 +++
 tests/qtest/meson.build                  |   6 +-
 52 files changed, 1432 insertions(+), 319 deletions(-)
 create mode 100644 hw/gpio/gpio_pwr.c
 create mode 100644 hw/misc/pvpanic-isa.c
 create mode 100644 hw/misc/pvpanic-pci.c
 create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
 create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
 create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
 create mode 100644 tests/qtest/pvpanic-pci-test.c
 create mode 100644 accel/hvf/entitlements.plist
 create mode 100755 scripts/entitlement.sh

From: Richard Henderson <richard.henderson@linaro.org>

This was defined at some point before ARMv8.4, and will
shortly be used by new processor descriptions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210120204400.1056582-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 1 +
 target/arm/helper.c | 4 ++--
 target/arm/kvm64.c  | 2 ++
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint32_t id_mmfr4;
         uint32_t id_pfr0;
         uint32_t id_pfr1;
+        uint32_t id_pfr2;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
-            { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
+            { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = 0 },
+              .resetvalue = cpu->isar.id_pfr2 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 1, 0));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
                               ARM64_SYS_REG(3, 0, 0, 1, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
+                              ARM64_SYS_REG(3, 0, 0, 3, 4));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 2));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Only define the register if it exists for the cpu.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210120031656.737646-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
      */
     int i;
     int wrps, brps, ctx_cmps;
-    ARMCPRegInfo dbgdidr = {
-        .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
-        .access = PL0_R, .accessfn = access_tda,
-        .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
-    };
+
+    /*
+     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
+     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
+     * the register must not exist for this cpu.
+     */
+    if (cpu->isar.dbgdidr != 0) {
+        ARMCPRegInfo dbgdidr = {
+            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
+            .opc1 = 0, .opc2 = 0,
+            .access = PL0_R, .accessfn = access_tda,
+            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
+        };
+        define_one_arm_cp_reg(cpu, &dbgdidr);
+    }
 
     /* Note that all these register fields hold "number of Xs minus 1". */
     brps = arm_num_brps(cpu);
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
 
     assert(ctx_cmps <= brps);
 
-    define_one_arm_cp_reg(cpu, &dbgdidr);
     define_arm_cp_regs(cpu, debug_cp_reginfo);
 
     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
-- 
2.20.1

From: Paolo Bonzini <pbonzini@redhat.com>

The properties to attach a CANBUS object to the xlnx-zcu102 machine have
a period in them.  We want to use periods in properties for compound QAPI types,
and besides the "xlnx-zcu102." prefix is both unnecessary and different
from any other machine property name.  Remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20210118162537.779542-1-pbonzini@redhat.com
Reviewed-by: Vikram Garhwal <fnu.vikram@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c        |  4 ++--
 tests/qtest/xlnx-can-test.c | 30 +++++++++++++++---------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
     s->secure = false;
     /* Default to virt (EL2) being disabled */
     s->virt = false;
-    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
+    object_property_add_link(obj, "canbus0", TYPE_CAN_BUS,
                              (Object **)&s->canbus[0],
                              object_property_allow_set_link,
                              0);
 
-    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
+    object_property_add_link(obj, "canbus1", TYPE_CAN_BUS,
                              (Object **)&s->canbus[1],
                              object_property_allow_set_link,
                              0);
diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/xlnx-can-test.c
+++ b/tests/qtest/xlnx-can-test.c
@@ -XXX,XX +XXX,XX @@ static void test_can_bus(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
     uint32_t status = 0;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 in loopback mode. */
@@ -XXX,XX +XXX,XX @@ static void test_can_filter(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_sleepmode(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0. */
@@ -XXX,XX +XXX,XX @@ static void test_can_snoopmode(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0. */
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

Implement gpio-pwr driver to allow reboot and poweroff machine.
This is simple driver with just 2 gpios lines. Current use case
is to reboot and poweroff virt machine in secure mode. Secure
pl066 gpio chip is needed for that.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/gpio_pwr.c  | 70 +++++++++++++++++++++++++++++++++++++++++++++
 hw/gpio/Kconfig     |  3 ++
 hw/gpio/meson.build |  1 +
 3 files changed, 74 insertions(+)
 create mode 100644 hw/gpio/gpio_pwr.c

diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/gpio_pwr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * GPIO qemu power controller
+ *
+ * Copyright (c) 2020 Linaro Limited
+ *
+ * Author: Maxim Uvarov <maxim.uvarov@linaro.org>
+ *
+ * Virtual gpio driver which can be used on top of pl061
+ * to reboot and shutdown qemu virtual machine. One of use
+ * case is gpio driver for secure world application (ARM
+ * Trusted Firmware.).
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+/*
+ * QEMU interface:
+ * two named input GPIO lines:
+ *   'reset' : when asserted, trigger system reset
+ *   'shutdown' : when asserted, trigger system shutdown
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "sysemu/runstate.h"
+
+#define TYPE_GPIOPWR "gpio-pwr"
+OBJECT_DECLARE_SIMPLE_TYPE(GPIO_PWR_State, GPIOPWR)
+
+struct GPIO_PWR_State {
+    SysBusDevice parent_obj;
+};
+
+static void gpio_pwr_reset(void *opaque, int n, int level)
+{
+    if (level) {
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+    }
+}
+
+static void gpio_pwr_shutdown(void *opaque, int n, int level)
+{
+    if (level) {
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+    }
+}
+
+static void gpio_pwr_init(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+
+    qdev_init_gpio_in_named(dev, gpio_pwr_reset, "reset", 1);
+    qdev_init_gpio_in_named(dev, gpio_pwr_shutdown, "shutdown", 1);
+}
+
+static const TypeInfo gpio_pwr_info = {
+    .name          = TYPE_GPIOPWR,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(GPIO_PWR_State),
+    .instance_init = gpio_pwr_init,
+};
+
+static void gpio_pwr_register_types(void)
+{
+    type_register_static(&gpio_pwr_info);
+}
+
+type_init(gpio_pwr_register_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config PL061
 config GPIO_KEY
     bool
 
+config GPIO_PWR
+    bool
+
 config SIFIVE_GPIO
     bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@
 softmmu_ss.add(when: 'CONFIG_E500', if_true: files('mpc8xxx.c'))
 softmmu_ss.add(when: 'CONFIG_GPIO_KEY', if_true: files('gpio_key.c'))
+softmmu_ss.add(when: 'CONFIG_GPIO_PWR', if_true: files('gpio_pwr.c'))
 softmmu_ss.add(when: 'CONFIG_MAX7310', if_true: files('max7310.c'))
 softmmu_ss.add(when: 'CONFIG_PL061', if_true: files('pl061.c'))
 softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_gpio.c'))
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

No functional change. Just refactor code to better
support secure and normal world gpios.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 57 ++++++++++++++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 21 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
     }
 }
 
-static void create_gpio(const VirtMachineState *vms)
+static void create_gpio_keys(const VirtMachineState *vms,
+                             DeviceState *pl061_dev,
+                             uint32_t phandle)
+{
+    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
+                                        qdev_get_gpio_in(pl061_dev, 3));
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
+                            "label", "GPIO Key Poweroff");
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
+                          KEY_POWER);
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
+                           "gpios", phandle, 3, 0);
+}
+
+static void create_gpio_devices(const VirtMachineState *vms, int gpio,
+                                MemoryRegion *mem)
 {
     char *nodename;
     DeviceState *pl061_dev;
-    hwaddr base = vms->memmap[VIRT_GPIO].base;
-    hwaddr size = vms->memmap[VIRT_GPIO].size;
-    int irq = vms->irqmap[VIRT_GPIO];
+    hwaddr base = vms->memmap[gpio].base;
+    hwaddr size = vms->memmap[gpio].size;
+    int irq = vms->irqmap[gpio];
     const char compat[] = "arm,pl061\0arm,primecell";
+    SysBusDevice *s;
 
-    pl061_dev = sysbus_create_simple("pl061", base,
-                                     qdev_get_gpio_in(vms->gic, irq));
+    pl061_dev = qdev_new("pl061");
+    s = SYS_BUS_DEVICE(pl061_dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(vms->gic, irq));
 
     uint32_t phandle = qemu_fdt_alloc_phandle(vms->fdt);
     nodename = g_strdup_printf("/pl061@%" PRIx64, base);
@@ -XXX,XX +XXX,XX @@ static void create_gpio(const VirtMachineState *vms)
     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 
-    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
-                                        qdev_get_gpio_in(pl061_dev, 3));
-    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
-    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
-
-    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
-    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
-                            "label", "GPIO Key Poweroff");
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
-                          KEY_POWER);
-    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
-                           "gpios", phandle, 3, 0);
     g_free(nodename);
+
+    /* Child gpio devices */
+    create_gpio_keys(vms, pl061_dev, phandle);
 }
 
 static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
         vms->acpi_dev = create_acpi_ged(vms);
     } else {
-        create_gpio(vms);
+        create_gpio_devices(vms, VIRT_GPIO, sysmem);
     }
 
      /* connect powerdown request */
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

Add secure pl061 for reset/power down machine from
the secure world (Arm Trusted Firmware). Connect it
with gpio-pwr driver.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
[PMM: Added mention of the new device to the documentation]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst |  2 ++
 include/hw/arm/virt.h    |  2 ++
 hw/arm/virt.c            | 56 +++++++++++++++++++++++++++++++++++++++-
 hw/arm/Kconfig           |  1 +
 4 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ The virt board supports:
 - Secure-World-only devices if the CPU has TrustZone:
 
   - A second PL011 UART
+  - A second PL061 GPIO controller, with GPIO lines for triggering
+    a system reset or system poweroff
   - A secure flash memory
   - 16MB of secure RAM
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_GPIO,
     VIRT_SECURE_UART,
     VIRT_SECURE_MEM,
+    VIRT_SECURE_GPIO,
     VIRT_PCDIMM_ACPI,
     VIRT_ACPI_GED,
     VIRT_NVDIMM_ACPI,
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     bool kvm_no_adjvtime;
     bool no_kvm_steal_time;
     bool acpi_expose_flash;
+    bool no_secure_gpio;
 };
 
 struct VirtMachineState {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
     [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
+    [VIRT_SECURE_GPIO] =        { 0x090b0000, 0x00001000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(const VirtMachineState *vms,
                            "gpios", phandle, 3, 0);
 }
 
+#define SECURE_GPIO_POWEROFF 0
+#define SECURE_GPIO_RESET    1
+
+static void create_secure_gpio_pwr(const VirtMachineState *vms,
+                                   DeviceState *pl061_dev,
+                                   uint32_t phandle)
+{
+    DeviceState *gpio_pwr_dev;
+
+    /* gpio-pwr */
+    gpio_pwr_dev = sysbus_create_simple("gpio-pwr", -1, NULL);
+
+    /* connect secure pl061 to gpio-pwr */
+    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_RESET,
+                          qdev_get_gpio_in_named(gpio_pwr_dev, "reset", 0));
+    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_POWEROFF,
+                          qdev_get_gpio_in_named(gpio_pwr_dev, "shutdown", 0));
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-poweroff");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "compatible",
+                            "gpio-poweroff");
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-poweroff",
+                           "gpios", phandle, SECURE_GPIO_POWEROFF, 0);
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "status", "disabled");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "secure-status",
+                            "okay");
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-restart");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "compatible",
+                            "gpio-restart");
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-restart",
+                           "gpios", phandle, SECURE_GPIO_RESET, 0);
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "status", "disabled");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "secure-status",
+                            "okay");
+}
+
 static void create_gpio_devices(const VirtMachineState *vms, int gpio,
                                 MemoryRegion *mem)
 {
@@ -XXX,XX +XXX,XX @@ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 
+    if (gpio != VIRT_GPIO) {
+        /* Mark as not usable by the normal world */
+        qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
+        qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
+    }
     g_free(nodename);
 
     /* Child gpio devices */
-    create_gpio_keys(vms, pl061_dev, phandle);
+    if (gpio == VIRT_GPIO) {
+        create_gpio_keys(vms, pl061_dev, phandle);
+    } else {
+        create_secure_gpio_pwr(vms, pl061_dev, phandle);
+    }
 }
 
 static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         create_gpio_devices(vms, VIRT_GPIO, sysmem);
     }
 
+    if (vms->secure && !vmc->no_secure_gpio) {
+        create_gpio_devices(vms, VIRT_SECURE_GPIO, secure_sysmem);
+    }
+
      /* connect powerdown request */
      vms->powerdown_notifier.notify = virt_powerdown_req;
      qemu_register_powerdown_notifier(&vms->powerdown_notifier);
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 0)
 
 static void virt_machine_5_2_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_6_0_options(mc);
     compat_props_add(mc->compat_props, hw_compat_5_2, hw_compat_5_2_len);
+    vmc->no_secure_gpio = true;
 }
 DEFINE_VIRT_MACHINE(5, 2)
 
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
     select PL011 # UART
     select PL031 # RTC
     select PL061 # GPIO
+    select GPIO_PWR
     select PLATFORM_BUS
     select SMBIOS
     select VIRTIO_MMIO
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

Fix potential overflow problem when calculating pwm_duty.
1. Ensure p->cmr and p->cnr to be from [0,65535], according to the
   hardware specification.
2. Changed duty to uint32_t. However, since MAX_DUTY * (p->cmr+1)
   can excceed UINT32_MAX, we convert them to uint64_t in computation
   and converted them back to uint32_t.
   (duty is guaranteed to be <= MAX_DUTY so it won't overflow.)

Fixes: CID 1442342
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Doug Evans <dje@google.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210127011142.2122790-1-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/npcm7xx_pwm.c          | 23 +++++++++++++++++++----
 tests/qtest/npcm7xx_pwm-test.c |  4 ++--
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_PWM_PWDR3, 0x50);
 #define NPCM7XX_CH_INV              BIT(2)
 #define NPCM7XX_CH_MOD              BIT(3)
 
+#define NPCM7XX_MAX_CMR             65535
+#define NPCM7XX_MAX_CNR             65535
+
 /* Offset of each PWM channel's prescaler in the PPR register. */
 static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
 /* Offset of each PWM channel's clock selector in the CSR register. */
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
 
 static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
 {
-    uint64_t duty;
+    uint32_t duty;
 
     if (p->running) {
         if (p->cnr == 0) {
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
         } else if (p->cmr >= p->cnr) {
             duty = NPCM7XX_PWM_MAX_DUTY;
         } else {
-            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
+            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
         }
     } else {
         duty = 0;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
     case A_NPCM7XX_PWM_CNR2:
     case A_NPCM7XX_PWM_CNR3:
         p = &s->pwm[npcm7xx_cnr_index(offset)];
-        p->cnr = value;
+        if (value > NPCM7XX_MAX_CNR) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid cnr value: %u", __func__, value);
+            p->cnr = NPCM7XX_MAX_CNR;
+        } else {
+            p->cnr = value;
+        }
         npcm7xx_pwm_update_output(p);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
     case A_NPCM7XX_PWM_CMR2:
     case A_NPCM7XX_PWM_CMR3:
         p = &s->pwm[npcm7xx_cmr_index(offset)];
-        p->cmr = value;
+        if (value > NPCM7XX_MAX_CMR) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid cmr value: %u", __func__, value);
+            p->cmr = NPCM7XX_MAX_CMR;
+        } else {
+            p->cmr = value;
+        }
         npcm7xx_pwm_update_output(p);
         break;
 
diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_pwm-test.c
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
 
 static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
 {
-    uint64_t duty;
+    uint32_t duty;
 
     if (cnr == 0) {
         /* PWM is stopped. */
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
     } else if (cmr >= cnr) {
         duty = MAX_DUTY;
     } else {
-        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
+        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
     }
 
     if (inverted) {
-- 
2.20.1

Move the preadv availability check to meson.build.  This is what we
want to be doing for host-OS-feature-checks anyway, but it also fixes
a problem with building for macOS with the most recent XCode SDK on a
Catalina host.

On that configuration, 'preadv()' is provided as a weak symbol, so
that programs can be built with optional support for it and make a
runtime availability check to see whether the preadv() they have is a
working one or one which they must not call because it will
runtime-assert.  QEMU's configure test passes (unless you're building
with --enable-werror) because the test program using preadv()
compiles, but then QEMU crashes at runtime when preadv() is called,
with errors like:

dyld: lazy symbol binding failed: Symbol not found: _preadv
    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
    Expected in: /usr/lib/libSystem.B.dylib

dyld: Symbol not found: _preadv
    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
    Expected in: /usr/lib/libSystem.B.dylib

Meson's own function availability check has a special case for macOS
which adds '-Wl,-no_weak_imports' to the compiler flags, which forces
the test to require the real function, not the macOS-version-too-old
stub.

So this commit fixes the bug where macOS builds on Catalina currently
require --disable-werror.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20210126155846.17109-1-peter.maydell@linaro.org
---
 configure   | 16 ----------------
 meson.build |  4 +++-
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if compile_prog "" "" ; then
   iovec=yes
 fi
 
-##########################################
-# preadv probe
-cat > $TMPC <<EOF
-#include <sys/types.h>
-#include <sys/uio.h>
-#include <unistd.h>
-int main(void) { return preadv(0, 0, 0, 0); }
-EOF
-preadv=no
-if compile_prog "" "" ; then
-  preadv=yes
-fi
-
 ##########################################
 # fdt probe
 
@@ -XXX,XX +XXX,XX @@ fi
 if test "$iovec" = "yes" ; then
   echo "CONFIG_IOVEC=y" >> $config_host_mak
 fi
-if test "$preadv" = "yes" ; then
-  echo "CONFIG_PREADV=y" >> $config_host_mak
-fi
 if test "$membarrier" = "yes" ; then
   echo "CONFIG_MEMBARRIER=y" >> $config_host_mak
 fi
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
 config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
 config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
 
+config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
+
 ignored = ['CONFIG_QEMU_INTERP_PREFIX'] # actually per-target
 arrays = ['CONFIG_AUDIO_DRIVERS', 'CONFIG_BDRV_RW_WHITELIST', 'CONFIG_BDRV_RO_WHITELIST']
 strings = ['HOST_DSOSUF', 'CONFIG_IASL']
@@ -XXX,XX +XXX,XX @@ summary_info += {'PIE':               get_option('b_pie')}
 summary_info += {'static build':      config_host.has_key('CONFIG_STATIC')}
 summary_info += {'malloc trim support': has_malloc_trim}
 summary_info += {'membarrier':        config_host.has_key('CONFIG_MEMBARRIER')}
-summary_info += {'preadv support':    config_host.has_key('CONFIG_PREADV')}
+summary_info += {'preadv support':    config_host_data.get('CONFIG_PREADV')}
 summary_info += {'fdatasync':         config_host.has_key('CONFIG_FDATASYNC')}
 summary_info += {'madvise':           config_host.has_key('CONFIG_MADVISE')}
 summary_info += {'posix_madvise':     config_host.has_key('CONFIG_POSIX_MADVISE')}
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

The iOS toolchain does not use the host prefix naming convention. So we
need to enable cross-compile options while allowing the PREFIX to be
blank.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-3-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ cpu=""
 iasl="iasl"
 interp_prefix="/usr/gnemul/qemu-%M"
 static="no"
+cross_compile="no"
 cross_prefix=""
 audio_drv_list=""
 block_drv_rw_whitelist=""
@@ -XXX,XX +XXX,XX @@ for opt do
   optarg=$(expr "x$opt" : 'x[^=]*=$.*$')
   case "$opt" in
   --cross-prefix=*) cross_prefix="$optarg"
+                    cross_compile="yes"
   ;;
   --cc=*) CC="$optarg"
   ;;
@@ -XXX,XX +XXX,XX @@ $(echo Deprecated targets: $deprecated_targets_list | \
   --target-list-exclude=LIST exclude a set of targets from the default target-list
 
 Advanced options (experts only):
-  --cross-prefix=PREFIX    use PREFIX for compile tools [$cross_prefix]
+  --cross-prefix=PREFIX    use PREFIX for compile tools, PREFIX can be blank [$cross_prefix]
   --cc=CC                  use C compiler CC [$cc]
   --iasl=IASL              use ACPI compiler IASL [$iasl]
   --host-cc=CC             use C compiler CC [$host_cc] for code run at
@@ -XXX,XX +XXX,XX @@ if has $sdl2_config; then
 fi
 echo "strip = [$(meson_quote $strip)]" >> $cross
 echo "windres = [$(meson_quote $windres)]" >> $cross
-if test -n "$cross_prefix"; then
+if test "$cross_compile" = "yes"; then
     cross_arg="--cross-file config-meson.cross"
     echo "[host_machine]" >> $cross
     if test "$mingw32" = "yes" ; then
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

Build without error on hosts without a working system(). If system()
is called, return -1 with ENOSYS.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-6-j@getutm.app
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build          |  1 +
 include/qemu/osdep.h | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
 config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
 config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
 config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
+config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
 
 config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
 
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ static inline void qemu_thread_jit_write(void) {}
 static inline void qemu_thread_jit_execute(void) {}
 #endif
 
+/**
+ * Platforms which do not support system() return ENOSYS
+ */
+#ifndef HAVE_SYSTEM_FUNCTION
+#define system platform_does_not_support_system
+static inline int platform_does_not_support_system(const char *command)
+{
+    errno = ENOSYS;
+    return -1;
+}
+#endif /* !HAVE_SYSTEM_FUNCTION */
+
 #endif
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

Add objc to the Meson cross file as well as detection of Darwin.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210126012457.39046-8-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ echo "cpp_link_args = [${LDFLAGS:+$(meson_quote $LDFLAGS)}]" >> $cross
 echo "[binaries]" >> $cross
 echo "c = [$(meson_quote $cc)]" >> $cross
 test -n "$cxx" && echo "cpp = [$(meson_quote $cxx)]" >> $cross
+test -n "$objcc" && echo "objc = [$(meson_quote $objcc)]" >> $cross
 echo "ar = [$(meson_quote $ar)]" >> $cross
 echo "nm = [$(meson_quote $nm)]" >> $cross
 echo "pkgconfig = [$(meson_quote $pkg_config_exe)]" >> $cross
@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
     if test "$linux" = "yes" ; then
         echo "system = 'linux'" >> $cross
     fi
+    if test "$darwin" = "yes" ; then
+        echo "system = 'darwin'" >> $cross
+    fi
     case "$ARCH" in
         i386|x86_64)
             echo "cpu_family = 'x86'" >> $cross
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

On iOS there is no CoreAudio, so we should not assume Darwin always
has it.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210126012457.39046-11-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fdt="auto"
 netmap="no"
 sdl="auto"
 sdl_image="auto"
+coreaudio="auto"
 virtiofsd="auto"
 virtfs="auto"
 libudev="auto"
@@ -XXX,XX +XXX,XX @@ Darwin)
     QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
     QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
   fi
-  audio_drv_list="coreaudio try-sdl"
+  audio_drv_list="try-coreaudio try-sdl"
   audio_possible_drivers="coreaudio sdl"
   # Disable attempts to use ObjectiveC features in os/object.h since they
   # won't work when we're compiling with gcc as a C compiler.
@@ -XXX,XX +XXX,XX @@ EOF
   fi
 fi
 
+##########################################
+# detect CoreAudio
+if test "$coreaudio" != "no" ; then
+  coreaudio_libs="-framework CoreAudio"
+  cat > $TMPC << EOF
+#include <CoreAudio/CoreAudio.h>
+int main(void)
+{
+  return (int)AudioGetCurrentHostTime();
+}
+EOF
+  if compile_prog "" "$coreaudio_libs" ; then
+    coreaudio=yes
+  else
+    coreaudio=no
+  fi
+fi
+
 ##########################################
 # Sound support libraries probe
 
@@ -XXX,XX +XXX,XX @@ for drv in $audio_drv_list; do
     fi
     ;;
 
-    coreaudio)
+    coreaudio | try-coreaudio)
+    if test "$coreaudio" = "no"; then
+      if test "$drv" = "try-coreaudio"; then
+        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio//')
+      else
+        error_exit "$drv check failed" \
+                "Make sure to have the $drv is available."
+      fi
+    else
       coreaudio_libs="-framework CoreAudio"
+      if test "$drv" = "try-coreaudio"; then
+        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio/coreaudio/')
+      fi
+    fi
     ;;
 
     dsound)
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

A workaround added in early days of 64-bit OSX forced x86_64 if the
host machine had 64-bit support. This creates issues when cross-
compiling for ARM64. Additionally, the user can always use --cpu=* to
manually set the host CPU and therefore this workaround should be
removed.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-12-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 # the correct CPU with the --cpu option.
 case $targetos in
 Darwin)
-  # on Leopard most of the system is 32-bit, so we have to ask the kernel if we can
-  # run 64-bit userspace code.
-  # If the user didn't specify a CPU explicitly and the kernel says this is
-  # 64 bit hw, then assume x86_64. Otherwise fall through to the usual detection code.
-  if test -z "$cpu" && test "$(sysctl -n hw.optional.x86_64)" = "1"; then
-    cpu="x86_64"
-  fi
   HOST_DSOSUF=".dylib"
   ;;
 SunOS)
@@ -XXX,XX +XXX,XX @@ OpenBSD)
 Darwin)
   bsd="yes"
   darwin="yes"
-  if [ "$cpu" = "x86_64" ] ; then
-    QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
-    QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
-  fi
   audio_drv_list="try-coreaudio try-sdl"
   audio_possible_drivers="coreaudio sdl"
   # Disable attempts to use ObjectiveC features in os/object.h since they
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

In macOS 11, QEMU only gets access to Hypervisor.framework if it has the
respective entitlement. Add an entitlement template and automatically self
sign and apply the entitlement in the build.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Tested-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build                  | 29 +++++++++++++++++++++++++----
 accel/hvf/entitlements.plist |  8 ++++++++
 scripts/entitlement.sh       | 13 +++++++++++++
 3 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 accel/hvf/entitlements.plist
 create mode 100755 scripts/entitlement.sh

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
     }]
   endif
   foreach exe: execs
-    emulators += {exe['name']:
-         executable(exe['name'], exe['sources'],
-               install: true,
+    exe_name = exe['name']
+    exe_sign = 'CONFIG_HVF' in config_target
+    if exe_sign
+      exe_name += '-unsigned'
+    endif
+
+    emulator = executable(exe_name, exe['sources'],
+               install: not exe_sign,
                c_args: c_args,
                dependencies: arch_deps + deps + exe['dependencies'],
                objects: lib.extract_all_objects(recursive: true),
@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
                link_depends: [block_syms, qemu_syms] + exe.get('link_depends', []),
                link_args: link_args,
                gui_app: exe['gui'])
-    }
+
+    if exe_sign
+      emulators += {exe['name'] : custom_target(exe['name'],
+                   install: true,
+                   install_dir: get_option('bindir'),
+                   depends: emulator,
+                   output: exe['name'],
+                   command: [
+                     meson.current_source_dir() / 'scripts/entitlement.sh',
+                     meson.current_build_dir() / exe_name,
+                     meson.current_build_dir() / exe['name'],
+                     meson.current_source_dir() / 'accel/hvf/entitlements.plist'
+                   ])
+      }
+    else
+      emulators += {exe['name']: emulator}
+    endif
 
     if 'CONFIG_TRACE_SYSTEMTAP' in config_host
       foreach stp: [
diff --git a/accel/hvf/entitlements.plist b/accel/hvf/entitlements.plist
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/hvf/entitlements.plist
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.hypervisor</key>
+    <true/>
+</dict>
+</plist>
diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/scripts/entitlement.sh
@@ -XXX,XX +XXX,XX @@
+#!/bin/sh -e
+#
+# Helper script for the build process to apply entitlements
+
+SRC="$1"
+DST="$2"
+ENTITLEMENT="$3"
+
+trap 'rm "$DST.tmp"' exit
+cp -af "$SRC" "$DST.tmp"
+codesign --entitlements "$ENTITLEMENT" --force -s - "$DST.tmp"
+mv "$DST.tmp" "$DST"
+trap '' exit
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

To ease the PCI device addition in next patches, split the code as follows:
- generic code (read/write/setup) is being kept in pvpanic.c
- ISA dependent code moved to pvpanic-isa.c

Also, rename:
- ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
- TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
- MemoryRegion io -> mr.
- pvpanic_ioport_* in pvpanic_*.

Update the build system with the new files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/pvpanic.h | 23 +++++++++-
 hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
 hw/misc/pvpanic.c         | 85 +++--------------------------------
 hw/i386/Kconfig           |  2 +-
 hw/misc/Kconfig           |  6 ++-
 hw/misc/meson.build       |  3 +-
 tests/qtest/meson.build   |  2 +-
 7 files changed, 130 insertions(+), 85 deletions(-)
 create mode 100644 hw/misc/pvpanic-isa.c

diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qom/object.h"
 
-#define TYPE_PVPANIC "pvpanic"
+#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
+/* The bit of supported pv event, TODO: include uapi header and remove this */
+#define PVPANIC_F_PANICKED      0
+#define PVPANIC_F_CRASHLOADED   1
+
+/* The pv event value */
+#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
+#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
+
+/*
+ * PVPanicState for any device type
+ */
+typedef struct PVPanicState PVPanicState;
+struct PVPanicState {
+    MemoryRegion mr;
+    uint8_t events;
+};
+
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
+
 static inline uint16_t pvpanic_port(void)
 {
-    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
+    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
     if (!o) {
         return 0;
     }
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-isa.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated pvpanic device.
+ *
+ * Copyright Fujitsu, Corp. 2013
+ *
+ * Authors:
+ *     Wen Congyang <wency@cn.fujitsu.com>
+ *     Hu Tao <hutao@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/isa/isa.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
+
+/*
+ * PVPanicISAState for ISA device and
+ * use ioport.
+ */
+struct PVPanicISAState {
+    ISADevice parent_obj;
+
+    uint16_t ioport;
+    PVPanicState pvpanic;
+};
+
+static void pvpanic_isa_initfn(Object *obj)
+{
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
+}
+
+static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
+{
+    ISADevice *d = ISA_DEVICE(dev);
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+    FWCfgState *fw_cfg = fw_cfg_find();
+    uint16_t *pvpanic_port;
+
+    if (!fw_cfg) {
+        return;
+    }
+
+    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
+    *pvpanic_port = cpu_to_le16(s->ioport);
+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
+                    sizeof(*pvpanic_port));
+
+    isa_register_ioport(d, &ps->mr, s->ioport);
+}
+
+static Property pvpanic_isa_properties[] = {
+    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
+    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = pvpanic_isa_realizefn;
+    device_class_set_props(dc, pvpanic_isa_properties);
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_isa_info = {
+    .name          = TYPE_PVPANIC_ISA_DEVICE,
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(PVPanicISAState),
+    .instance_init = pvpanic_isa_initfn,
+    .class_init    = pvpanic_isa_class_init,
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_isa_info);
+}
+
+type_init(pvpanic_register_types)
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/pvpanic.h"
 #include "qom/object.h"
 
-/* The bit of supported pv event, TODO: include uapi header and remove this */
-#define PVPANIC_F_PANICKED      0
-#define PVPANIC_F_CRASHLOADED   1
-
-/* The pv event value */
-#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
-#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
-
-typedef struct PVPanicState PVPanicState;
-DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
-                         TYPE_PVPANIC)
-
 static void handle_event(int event)
 {
     static bool logged;
@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
     }
 }
 
-#include "hw/isa/isa.h"
-
-struct PVPanicState {
-    ISADevice parent_obj;
-
-    MemoryRegion io;
-    uint16_t ioport;
-    uint8_t events;
-};
-
 /* return supported events on read */
-static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
+static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
 {
     PVPanicState *pvp = opaque;
     return pvp->events;
 }
 
-static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
+static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
                                  unsigned size)
 {
     handle_event(val);
 }
 
 static const MemoryRegionOps pvpanic_ops = {
-    .read = pvpanic_ioport_read,
-    .write = pvpanic_ioport_write,
+    .read = pvpanic_read,
+    .write = pvpanic_write,
     .impl = {
         .min_access_size = 1,
         .max_access_size = 1,
     },
 };
 
-static void pvpanic_isa_initfn(Object *obj)
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
 {
-    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
-
-    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
+    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
 }
-
-static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
-{
-    ISADevice *d = ISA_DEVICE(dev);
-    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
-    FWCfgState *fw_cfg = fw_cfg_find();
-    uint16_t *pvpanic_port;
-
-    if (!fw_cfg) {
-        return;
-    }
-
-    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
-    *pvpanic_port = cpu_to_le16(s->ioport);
-    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
-                    sizeof(*pvpanic_port));
-
-    isa_register_ioport(d, &s->io, s->ioport);
-}
-
-static Property pvpanic_isa_properties[] = {
-    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
-    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = pvpanic_isa_realizefn;
-    device_class_set_props(dc, pvpanic_isa_properties);
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-}
-
-static TypeInfo pvpanic_isa_info = {
-    .name          = TYPE_PVPANIC,
-    .parent        = TYPE_ISA_DEVICE,
-    .instance_size = sizeof(PVPanicState),
-    .instance_init = pvpanic_isa_initfn,
-    .class_init    = pvpanic_isa_class_init,
-};
-
-static void pvpanic_register_types(void)
-{
-    type_register_static(&pvpanic_isa_info);
-}
-
-type_init(pvpanic_register_types)
diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -XXX,XX +XXX,XX @@ config PC
     imply ISA_DEBUG
     imply PARALLEL
     imply PCI_DEVICES
-    imply PVPANIC
+    imply PVPANIC_ISA
     imply QXL
     imply SEV
     imply SGA
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
 config IOTKIT_SYSINFO
     bool
 
-config PVPANIC
+config PVPANIC_COMMON
+    bool
+
+config PVPANIC_ISA
     bool
     depends on ISA_BUS
+    select PVPANIC_COMMON
 
 config AUX
     bool
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
 softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
 softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
 softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
 
 # ARM devices
 softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
 softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
-softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
   (config_host.has_key('CONFIG_LINUX') and                                                  \
    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
-  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
+  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
where the PCI specific routines reside and update the build system with the new
files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/specs/pci-ids.txt    |  1 +
 include/hw/misc/pvpanic.h |  1 +
 include/hw/pci/pci.h      |  1 +
 hw/misc/pvpanic-pci.c     | 94 +++++++++++++++++++++++++++++++++++++++
 hw/misc/Kconfig           |  6 +++
 hw/misc/meson.build       |  1 +
 6 files changed, 104 insertions(+)
 create mode 100644 hw/misc/pvpanic-pci.c

diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pci-ids.txt
+++ b/docs/specs/pci-ids.txt
@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
 1b36:000d  PCI xhci usb host adapter
 1b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
 1b36:0010  PCIe NVMe device (-device nvme)
+1b36:0011  PCI PVPanic device (-device pvpanic-pci)
 
 All these devices are documented in docs/specs.
 
diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
+#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
 #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
 #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
 #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
+#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
 #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
 
 #define FMT_PCIBUS                      PRIx64
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-pci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated PCI pvpanic device.
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/pci/pci.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
+
+/*
+ * PVPanicPCIState for PCI device
+ */
+typedef struct PVPanicPCIState {
+    PCIDevice dev;
+    PVPanicState pvpanic;
+} PVPanicPCIState;
+
+static const VMStateDescription vmstate_pvpanic_pci = {
+    .name = "pvpanic-pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
+{
+    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
+
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
+}
+
+static Property pvpanic_pci_properties[] = {
+    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, pvpanic_pci_properties);
+
+    pc->realize = pvpanic_pci_realizefn;
+    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
+    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
+    pc->revision = 1;
+    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
+    dc->vmsd = &vmstate_pvpanic_pci;
+
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_pci_info = {
+    .name          = TYPE_PVPANIC_PCI_DEVICE,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PVPanicPCIState),
+    .class_init    = pvpanic_pci_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { }
+    }
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_pci_info);
+}
+
+type_init(pvpanic_register_types);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
 config PVPANIC_COMMON
     bool
 
+config PVPANIC_PCI
+    bool
+    default y if PCI_DEVICES
+    depends on PCI
+    select PVPANIC_COMMON
+
 config PVPANIC_ISA
     bool
     depends on ISA_BUS
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
 softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add pvpanic PCI device support details in docs/specs/pvpanic.txt.

diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pvpanic.txt
+++ b/docs/specs/pvpanic.txt
@@ -XXX,XX +XXX,XX @@
 PVPANIC DEVICE
 ==============
 
-pvpanic device is a simulated ISA device, through which a guest panic
+pvpanic device is a simulated device, through which a guest panic
 event is sent to qemu, and a QMP event is generated. This allows
 management apps (e.g. libvirt) to be notified and respond to the event.
 
@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
 and/or polling for guest-panicked RunState, to learn when the pvpanic
 device has fired a panic event.
 
+The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
+PCI device.
+
 ISA Interface
 -------------
 
@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
        the host should record it or report it, but should not affect
        the execution of the guest.
 
+PCI Interface
+-------------
+
+The PCI interface is similar to the ISA interface except that it uses an MMIO
+address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
+can enable a pvpanic device by adding '-device pvpanic-pci' to the command
+line.
+
 ACPI Interface
 --------------
 
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add a test case for pvpanic-pci device. The scenario is the same as pvpanic
ISA device, but is using the PCI bus.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/pvpanic-pci-test.c | 94 ++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 2 files changed, 95 insertions(+)
 create mode 100644 tests/qtest/pvpanic-pci-test.c

diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/pvpanic-pci-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for PV Panic PCI device
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "libqos/libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "libqos/pci.h"
+#include "libqos/pci-pc.h"
+#include "hw/pci/pci_regs.h"
+
+static void test_panic_nopause(void)
+{
+    uint8_t val;
+    QDict *response, *data;
+    QTestState *qts;
+    QPCIBus *pcibus;
+    QPCIDevice *dev;
+    QPCIBar bar;
+
+    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=none");
+    pcibus = qpci_new_pc(qts, NULL);
+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
+    qpci_device_enable(dev);
+    bar = qpci_iomap(dev, 0, NULL);
+
+    qpci_memread(dev, bar, 0, &val, sizeof(val));
+    g_assert_cmpuint(val, ==, 3);
+
+    val = 1;
+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
+
+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
+    g_assert(qdict_haskey(response, "data"));
+    data = qdict_get_qdict(response, "data");
+    g_assert(qdict_haskey(data, "action"));
+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "run");
+    qobject_unref(response);
+
+    qtest_quit(qts);
+}
+
+static void test_panic(void)
+{
+    uint8_t val;
+    QDict *response, *data;
+    QTestState *qts;
+    QPCIBus *pcibus;
+    QPCIDevice *dev;
+    QPCIBar bar;
+
+    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=pause");
+    pcibus = qpci_new_pc(qts, NULL);
+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
+    qpci_device_enable(dev);
+    bar = qpci_iomap(dev, 0, NULL);
+
+    qpci_memread(dev, bar, 0, &val, sizeof(val));
+    g_assert_cmpuint(val, ==, 3);
+
+    val = 1;
+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
+
+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
+    g_assert(qdict_haskey(response, "data"));
+    data = qdict_get_qdict(response, "data");
+    g_assert(qdict_haskey(data, "action"));
+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
+    qobject_unref(response);
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/pvpanic-pci/panic", test_panic);
+    qtest_add_func("/pvpanic-pci/panic-nopause", test_panic_nopause);
+
+    ret = g_test_run();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
+  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
-- 
2.20.1

The ptimer API currently provides two methods for setting the period:
ptimer_set_period(), which takes a period in nanoseconds, and
ptimer_set_freq(), which takes a frequency in Hz.  Neither of these
lines up nicely with the Clock API, because although both the Clock
and the ptimer track the frequency using a representation of whole
and fractional nanoseconds, conversion via either period-in-ns or
frequency-in-Hz will introduce a rounding error.

Add a new function ptimer_set_period_from_clock() which takes the
Clock object directly to avoid the rounding issues.  This includes a
facility for the user to specify that there is a frequency divider
between the Clock proper and the timer, as some timer devices like
the CMSDK APB dualtimer need this.

To avoid having to drag in clock.h from ptimer.h we add the Clock
type to typedefs.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-2-peter.maydell@linaro.org
Message-id: 20210121190622.22000-2-peter.maydell@linaro.org
---
 include/hw/ptimer.h     | 22 ++++++++++++++++++++++
 include/qemu/typedefs.h |  1 +
 hw/core/ptimer.c        | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)

diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ptimer.h
+++ b/include/hw/ptimer.h
@@ -XXX,XX +XXX,XX @@ void ptimer_transaction_commit(ptimer_state *s);
  */
 void ptimer_set_period(ptimer_state *s, int64_t period);
 
+/**
+ * ptimer_set_period_from_clock - Set counter increment from a Clock
+ * @s: ptimer to configure
+ * @clk: pointer to Clock object to take period from
+ * @divisor: value to scale the clock frequency down by
+ *
+ * If the ptimer is being driven from a Clock, this is the preferred
+ * way to tell the ptimer about the period, because it avoids any
+ * possible rounding errors that might happen if the internal
+ * representation of the Clock period was converted to either a period
+ * in ns or a frequency in Hz.
+ *
+ * If the ptimer should run at the same frequency as the clock,
+ * pass 1 as the @divisor; if the ptimer should run at half the
+ * frequency, pass 2, and so on.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block.
+ */
+void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clock,
+                                  unsigned int divisor);
+
 /**
  * ptimer_set_freq - Set counter frequency in Hz
  * @s: ptimer to configure
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct BlockDriverState BlockDriverState;
 typedef struct BusClass BusClass;
 typedef struct BusState BusState;
 typedef struct Chardev Chardev;
+typedef struct Clock Clock;
 typedef struct CompatProperty CompatProperty;
 typedef struct CoMutex CoMutex;
 typedef struct CPUAddressSpace CPUAddressSpace;
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "block/aio.h"
 #include "sysemu/cpus.h"
+#include "hw/clock.h"
 
 #define DELTA_ADJUST     1
 #define DELTA_NO_ADJUST -1
@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period)
     }
 }
 
+/* Set counter increment interval from a Clock */
+void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clk,
+                                  unsigned int divisor)
+{
+    /*
+     * The raw clock period is a 64-bit value in units of 2^-32 ns;
+     * put another way it's a 32.32 fixed-point ns value. Our internal
+     * representation of the period is 64.32 fixed point ns, so
+     * the conversion is simple.
+     */
+    uint64_t raw_period = clock_get(clk);
+    uint64_t period_frac;
+
+    assert(s->in_transaction);
+    s->delta = ptimer_get_count(s);
+    s->period = extract64(raw_period, 32, 32);
+    period_frac = extract64(raw_period, 0, 32);
+    /*
+     * divisor specifies a possible frequency divisor between the
+     * clock and the timer, so it is a multiplier on the period.
+     * We do the multiply after splitting the raw period out into
+     * period and frac to avoid having to do a 32*64->96 multiply.
+     */
+    s->period *= divisor;
+    period_frac *= divisor;
+    s->period += extract64(period_frac, 32, 32);
+    s->period_frac = (uint32_t)period_frac;
+
+    if (s->enabled) {
+        s->need_reload = true;
+    }
+}
+
 /* Set counter frequency in Hz.  */
 void ptimer_set_freq(ptimer_state *s, uint32_t freq)
 {
-- 
2.20.1

Add a function for checking whether a clock has a source.  This is
useful for devices which have input clocks that must be wired up by
the board as it allows them to fail in realize rather than ploughing
on with a zero-period clock.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-3-peter.maydell@linaro.org
Message-id: 20210121190622.22000-3-peter.maydell@linaro.org
---
 docs/devel/clocks.rst | 16 ++++++++++++++++
 include/hw/clock.h    | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/clocks.rst
+++ b/docs/devel/clocks.rst
@@ -XXX,XX +XXX,XX @@ object during device instance init. For example:
     /* set initial value to 10ns / 100MHz */
     clock_set_ns(clk, 10);
 
+To enforce that the clock is wired up by the board code, you can
+call ``clock_has_source()`` in your device's realize method:
+
+.. code-block:: c
+
+   if (!clock_has_source(s->clk)) {
+       error_setg(errp, "MyDevice: clk input must be connected");
+       return;
+   }
+
+Note that this only checks that the clock has been wired up; it is
+still possible that the output clock connected to it is disabled
+or has not yet been configured, in which case the period will be
+zero. You should use the clock callback to find out when the clock
+period changes.
+
 Fetching clock frequency/period
 -------------------------------
 
diff --git a/include/hw/clock.h b/include/hw/clock.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/clock.h
+++ b/include/hw/clock.h
@@ -XXX,XX +XXX,XX @@ void clock_clear_callback(Clock *clk);
  */
 void clock_set_source(Clock *clk, Clock *src);
 
+/**
+ * clock_has_source:
+ * @clk: the clock
+ *
+ * Returns true if the clock has a source clock connected to it.
+ * This is useful for devices which have input clocks which must
+ * be connected by the board/SoC code which creates them. The
+ * device code can use this to check in its realize method that
+ * the clock has been connected.
+ */
+static inline bool clock_has_source(const Clock *clk)
+{
+    return clk->source != NULL;
+}
+
 /**
  * clock_set:
  * @clk: the clock to initialize.
-- 
2.20.1

Add a simple test of the CMSDK APB timer, since we're about to do
some refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-4-peter.maydell@linaro.org
Message-id: 20210121190622.22000-4-peter.maydell@linaro.org
---
 tests/qtest/cmsdk-apb-timer-test.c | 75 ++++++++++++++++++++++++++++++
 MAINTAINERS                        |  1 +
 tests/qtest/meson.build            |  1 +
 3 files changed, 77 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-timer-test.c

diff --git a/tests/qtest/cmsdk-apb-timer-test.c b/tests/qtest/cmsdk-apb-timer-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-timer-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB timer device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/* IoTKit/ARMSSE-200 timer0; driven at 25MHz in mps2-an385, so 40ns per tick */
+#define TIMER_BASE 0x40000000
+
+#define CTRL 0
+#define VALUE 4
+#define RELOAD 8
+#define INTSTATUS 0xc
+
+static void test_timer(void)
+{
+    g_assert_true(readl(TIMER_BASE + INTSTATUS) == 0);
+
+    /* Start timer: will fire after 40 * 1000 == 40000 ns */
+    writel(TIMER_BASE + RELOAD, 1000);
+    writel(TIMER_BASE + CTRL, 9);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(40 * 500 + 1);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 0);
+
+    /* VALUE reloads at the following tick */
+    clock_step(40);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 1000);
+
+    /* Check write-1-to-clear behaviour of INTSTATUS */
+    writel(TIMER_BASE + INTSTATUS, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
+    writel(TIMER_BASE + INTSTATUS, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + CTRL, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine mps2-an385");
+
+    qtest_add_func("/cmsdk-apb-timer/timer", test_timer);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/pl031.h
 F: include/hw/arm/primecell.h
 F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
+F: tests/qtest/cmsdk-apb-timer-test.c
 F: hw/timer/cmsdk-apb-dualtimer.c
 F: include/hw/timer/cmsdk-apb-dualtimer.h
 F: hw/char/cmsdk-apb-uart.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   ['arm-cpu-features',
-- 
2.20.1

Add a simple test of the CMSDK watchdog, since we're about to do some
refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-5-peter.maydell@linaro.org
Message-id: 20210121190622.22000-5-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 tests/qtest/cmsdk-apb-watchdog-test.c | 79 +++++++++++++++++++++++++++
 MAINTAINERS                           |  1 +
 tests/qtest/meson.build               |  1 +
 3 files changed, 81 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c

diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB watchdog device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/*
+ * lm3s811evb watchdog; at board startup this runs at 200MHz / 16 == 12.5MHz,
+ * which is 80ns per tick.
+ */
+#define WDOG_BASE 0x40000000
+
+#define WDOGLOAD 0
+#define WDOGVALUE 4
+#define WDOGCONTROL 8
+#define WDOGINTCLR 0xc
+#define WDOGRIS 0x10
+#define WDOGMIS 0x14
+#define WDOGLOCK 0xc00
+
+static void test_watchdog(void)
+{
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+
+    writel(WDOG_BASE + WDOGCONTROL, 1);
+    writel(WDOG_BASE + WDOGLOAD, 1000);
+
+    /* Step to just past the 500th tick */
+    clock_step(500 * 80 + 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(500 * 80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
+
+    /* VALUE reloads at following tick */
+    clock_step(80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+
+    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
+    clock_step(500 * 80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    writel(WDOG_BASE + WDOGINTCLR, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine lm3s811evb");
+
+    qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
 F: hw/watchdog/cmsdk-apb-watchdog.c
 F: include/hw/watchdog/cmsdk-apb-watchdog.h
+F: tests/qtest/cmsdk-apb-watchdog-test.c
 F: hw/misc/tz-ppc.c
 F: include/hw/misc/tz-ppc.h
 F: hw/misc/tz-mpc.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   ['arm-cpu-features',
-- 
2.20.1

Add a simple test of the CMSDK dual timer, since we're about to do
some refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20210128114145.20536-6-peter.maydell@linaro.org
Message-id: 20210121190622.22000-6-peter.maydell@linaro.org
---
 tests/qtest/cmsdk-apb-dualtimer-test.c | 130 +++++++++++++++++++++++++
 MAINTAINERS                            |   1 +
 tests/qtest/meson.build                |   1 +
 3 files changed, 132 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c

diff --git a/tests/qtest/cmsdk-apb-dualtimer-test.c b/tests/qtest/cmsdk-apb-dualtimer-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-dualtimer-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB dualtimer device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/* IoTKit/ARMSSE dualtimer; driven at 25MHz in mps2-an385, so 40ns per tick */
+#define TIMER_BASE 0x40002000
+
+#define TIMER1LOAD 0
+#define TIMER1VALUE 4
+#define TIMER1CONTROL 8
+#define TIMER1INTCLR 0xc
+#define TIMER1RIS 0x10
+#define TIMER1MIS 0x14
+#define TIMER1BGLOAD 0x18
+
+#define TIMER2LOAD 0x20
+#define TIMER2VALUE 0x24
+#define TIMER2CONTROL 0x28
+#define TIMER2INTCLR 0x2c
+#define TIMER2RIS 0x30
+#define TIMER2MIS 0x34
+#define TIMER2BGLOAD 0x38
+
+#define CTRL_ENABLE (1 << 7)
+#define CTRL_PERIODIC (1 << 6)
+#define CTRL_INTEN (1 << 5)
+#define CTRL_PRESCALE_1 (0 << 2)
+#define CTRL_PRESCALE_16 (1 << 2)
+#define CTRL_PRESCALE_256 (2 << 2)
+#define CTRL_32BIT (1 << 1)
+#define CTRL_ONESHOT (1 << 0)
+
+static void test_dualtimer(void)
+{
+    g_assert_true(readl(TIMER_BASE + TIMER1RIS) == 0);
+
+    /* Start timer: will fire after 40000 ns */
+    writel(TIMER_BASE + TIMER1LOAD, 1000);
+    /* enable in free-running, wrapping, interrupt mode */
+    writel(TIMER_BASE + TIMER1CONTROL, CTRL_ENABLE | CTRL_INTEN);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(500 * 40 + 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(500 * 40);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0);
+
+    /*
+     * We are in free-running wrapping 16-bit mode, so on the following
+     * tick VALUE should have wrapped round to 0xffff.
+     */
+    clock_step(40);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0xffff);
+
+    /* Check that any write to INTCLR clears interrupt */
+    writel(TIMER_BASE + TIMER1INTCLR, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + TIMER1CONTROL, 0);
+}
+
+static void test_prescale(void)
+{
+    g_assert_true(readl(TIMER_BASE + TIMER2RIS) == 0);
+
+    /* Start timer: will fire after 40 * 256 * 1000 == 1024000 ns */
+    writel(TIMER_BASE + TIMER2LOAD, 1000);
+    /* enable in periodic, wrapping, interrupt mode, prescale 256 */
+    writel(TIMER_BASE + TIMER2CONTROL,
+           CTRL_ENABLE | CTRL_INTEN | CTRL_PERIODIC | CTRL_PRESCALE_256);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(40 * 256 * 501);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 256 * 500);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 0);
+
+    /* In periodic mode the tick VALUE now reloads */
+    clock_step(40 * 256);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 1000);
+
+    /* Check that any write to INTCLR clears interrupt */
+    writel(TIMER_BASE + TIMER2INTCLR, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + TIMER2CONTROL, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine mps2-an385");
+
+    qtest_add_func("/cmsdk-apb-dualtimer/dualtimer", test_dualtimer);
+    qtest_add_func("/cmsdk-apb-dualtimer/prescale", test_prescale);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/timer/cmsdk-apb-timer.h
 F: tests/qtest/cmsdk-apb-timer-test.c
 F: hw/timer/cmsdk-apb-dualtimer.c
 F: include/hw/timer/cmsdk-apb-dualtimer.h
+F: tests/qtest/cmsdk-apb-dualtimer-test.c
 F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
 F: hw/watchdog/cmsdk-apb-watchdog.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
-- 
2.20.1

The state struct for the CMSDK APB timer device doesn't follow our
usual naming convention of camelcase -- "CMSDK" and "APB" are both
acronyms, but "TIMER" is not so should not be all-uppercase.
Globally rename the struct to "CMSDKAPBTimer" (bringing it into line
with CMSDKAPBWatchdog and CMSDKAPBDualTimer; CMSDKAPBUART remains
as-is because "UART" is an acronym).

Commit created with:
 perl -p -i -e 's/CMSDKAPBTIMER/CMSDKAPBTimer/g' hw/timer/cmsdk-apb-timer.c include/hw/arm/armsse.h include/hw/timer/cmsdk-apb-timer.h

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-7-peter.maydell@linaro.org
Message-id: 20210121190622.22000-7-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h            |  6 +++---
 include/hw/timer/cmsdk-apb-timer.h |  4 ++--
 hw/timer/cmsdk-apb-timer.c         | 28 ++++++++++++++--------------
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
     TZPPC apb_ppc0;
     TZPPC apb_ppc1;
     TZMPC mpc[IOTS_NUM_MPC];
-    CMSDKAPBTIMER timer0;
-    CMSDKAPBTIMER timer1;
-    CMSDKAPBTIMER s32ktimer;
+    CMSDKAPBTimer timer0;
+    CMSDKAPBTimer timer1;
+    CMSDKAPBTimer s32ktimer;
     qemu_or_irq ppc_irq_orgate;
     SplitIRQ sec_resp_splitter;
     SplitIRQ ppc_irq_splitter[NUM_PPCS];
diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
-OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTIMER, CMSDK_APB_TIMER)
+OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
-struct CMSDKAPBTIMER {
+struct CMSDKAPBTimer {
     /*< private >*/
     SysBusDevice parent_obj;
 
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const int timer_id[] = {
     0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 };
 
-static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
+static void cmsdk_apb_timer_update(CMSDKAPBTimer *s)
 {
     qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
 }
 
 static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
     uint64_t r;
 
     switch (offset) {
@@ -XXX,XX +XXX,XX @@ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
                                   unsigned size)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 
     trace_cmsdk_apb_timer_write(offset, value, size);
 
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps cmsdk_apb_timer_ops = {
 
 static void cmsdk_apb_timer_tick(void *opaque)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 
     if (s->ctrl & R_CTRL_IRQEN_MASK) {
         s->intstatus |= R_INTSTATUS_IRQ_MASK;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_tick(void *opaque)
 
 static void cmsdk_apb_timer_reset(DeviceState *dev)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
     trace_cmsdk_apb_timer_reset();
     s->ctrl = 0;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
 static void cmsdk_apb_timer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(obj);
 
     memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
                           s, "cmsdk-apb-timer", 0x1000);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
     if (s->pclk_frq == 0) {
         error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
-        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
-        VMSTATE_UINT32(value, CMSDKAPBTIMER),
-        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
-        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
+        VMSTATE_PTIMER(timer, CMSDKAPBTimer),
+        VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
+        VMSTATE_UINT32(value, CMSDKAPBTimer),
+        VMSTATE_UINT32(reload, CMSDKAPBTimer),
+        VMSTATE_UINT32(intstatus, CMSDKAPBTimer),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static Property cmsdk_apb_timer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
+    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
 static const TypeInfo cmsdk_apb_timer_info = {
     .name = TYPE_CMSDK_APB_TIMER,
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(CMSDKAPBTIMER),
+    .instance_size = sizeof(CMSDKAPBTimer),
     .instance_init = cmsdk_apb_timer_init,
     .class_init = cmsdk_apb_timer_class_init,
 };
-- 
2.20.1

As the first step in converting the CMSDK_APB_TIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the pclk-frq
property to using the Clock once all the users of this device have
been converted to wire up the Clock.

Since the device doesn't already have a doc comment for its "QEMU
interface", we add one including the new Clock.

This is a migration compatibility break for machines mps2-an505,
mps2-an521, musca-a, musca-b1.

diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
 OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
+/*
+ * QEMU interface:
+ *  + QOM property "pclk-frq": frequency at which the timer is clocked
+ *  + Clock input "pclk": clock for the timer
+ *  + sysbus MMIO region 0: the register bank
+ *  + sysbus IRQ 0: timer interrupt TIMERINT
+ */
 struct CMSDKAPBTimer {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     qemu_irq timerint;
     uint32_t pclk_frq;
     struct ptimer_state *timer;
+    Clock *pclk;
 
     uint32_t ctrl;
     uint32_t value;
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/irq.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/timer/cmsdk-apb-timer.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                           s, "cmsdk-apb-timer", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->timerint);
+    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
 }
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 
 static const VMStateDescription cmsdk_apb_timer_vmstate = {
     .name = "cmsdk-apb-timer",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_PTIMER(timer, CMSDKAPBTimer),
+        VMSTATE_CLOCK(pclk, CMSDKAPBTimer),
         VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
         VMSTATE_UINT32(value, CMSDKAPBTimer),
         VMSTATE_UINT32(reload, CMSDKAPBTimer),
-- 
2.20.1

As the first step in converting the CMSDK_APB_DUALTIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the pclk-frq
property to using the Clock once all the users of this device have
been converted to wire up the Clock.

We take the opportunity to correct the name of the clock input to
match the hardware -- the dual timer names the clock which drives the
timers TIMCLK.  (It does also have a 'pclk' input, which is used only
for the register and APB bus logic; on the SSE-200 these clocks are
both connected together.)

This is a migration compatibility break for machines mps2-an385,
mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
musca-b1.

diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-dualtimer.h
+++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
  *
  * QEMU interface:
  *  + QOM property "pclk-frq": frequency at which the timer is clocked
+ *  + Clock input "TIMCLK": clock (for both timers)
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: combined timer interrupt TIMINTC
  *  + sysbus IRO 1: timer block 1 interrupt TIMINT1
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_DUALTIMER "cmsdk-apb-dualtimer"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
     MemoryRegion iomem;
     qemu_irq timerintc;
     uint32_t pclk_frq;
+    Clock *timclk;
 
     CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
     uint32_t timeritcr;
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/timer/cmsdk-apb-dualtimer.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
         sysbus_init_irq(sbd, &s->timermod[i].timerint);
     }
+    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
 }
 
 static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_dualtimermod_vmstate = {
 
 static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
     .name = "cmsdk-apb-dualtimer",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(timclk, CMSDKAPBDualTimer),
         VMSTATE_STRUCT_ARRAY(timermod, CMSDKAPBDualTimer,
                              CMSDK_APB_DUALTIMER_NUM_MODULES,
                              1, cmsdk_dualtimermod_vmstate,
-- 
2.20.1

As the first step in converting the CMSDK_APB_TIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the
wdogclk-frq property to using the Clock once all the users of this
device have been converted to wire up the Clock.

This is a migration compatibility break for machines mps2-an385,
mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
musca-b1, lm3s811evb, lm3s6965evb.

diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
+++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
  *
  * QEMU interface:
  *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
+ *  + Clock input "WDOGCLK": clock for the watchdog's timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: watchdog interrupt
  *
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
     uint32_t wdogclk_frq;
     bool is_luminary;
     struct ptimer_state *timer;
+    Clock *wdogclk;
 
     uint32_t control;
     uint32_t intstatus;
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
                           s, "cmsdk-apb-watchdog", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->wdogint);
+    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
 
     s->is_luminary = false;
     s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
 
 static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
     .name = "cmsdk-apb-watchdog",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(wdogclk, CMSDKAPBWatchdog),
         VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
         VMSTATE_UINT32(control, CMSDKAPBWatchdog),
         VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
-- 
2.20.1

While we transition the ARMSSE code from integer properties
specifying clock frequencies to Clock objects, we want to have the
device provide both at once.  We want the final name of the main
input Clock to be "MAINCLK", following the hardware name.
Unfortunately creating an input Clock with a name X creates an
under-the-hood QOM property X; for "MAINCLK" this clashes with the
existing UINT32 property of that name.

Rename the UINT32 property to MAINCLK_FRQ so it can coexist with the
MAINCLK Clock; once the transition is complete MAINCLK_FRQ will be
deleted.

Commit created with:
 perl -p -i -e 's/MAINCLK/MAINCLK_FRQ/g' hw/arm/{armsse,mps2-tz,musca}.c include/hw/arm/armsse.h

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  * QEMU interface:
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
- *  + QOM property "MAINCLK" is the frequency of the main system clock
+ *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
  *    (In hardware, the SSE-200 permits the number of expansion interrupts
  *    for the two CPUs to be configured separately, but we restrict it to
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     }
 
     if (!s->mainclk_frq) {
-        error_setg(errp, "MAINCLK property was not set");
+        error_setg(errp, "MAINCLK_FRQ property was not set");
         return;
     }
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
     object_property_set_link(OBJECT(&mms->iotkit), "memory",
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
-    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
+    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 
     /*
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
-    qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
     /*
      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
-- 
2.20.1

Create two input clocks on the ARMSSE devices, one for the normal
MAINCLK, and one for the 32KHz S32KCLK, and wire these up to the
appropriate devices.  The old property-based clock frequency setting
will remain in place until conversion is complete.

This is a migration compatibility break for machines mps2-an505,
mps2-an521, musca-a, musca-b1.

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *  per-CPU identity and control register blocks
  *
  * QEMU interface:
+ *  + Clock input "MAINCLK": clock for CPUs and most peripherals
+ *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
  *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/armsse-mhu.h"
 #include "hw/misc/unimp.h"
 #include "hw/or-irq.h"
+#include "hw/clock.h"
 #include "hw/core/split-irq.h"
 #include "hw/cpu/cluster.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
 
     uint32_t nsccfg;
 
+    Clock *mainclk;
+    Clock *s32kclk;
+
     /* Properties */
     MemoryRegion *board_memory;
     uint32_t exp_numirq;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/armsse.h"
 #include "hw/arm/boot.h"
 #include "hw/irq.h"
+#include "hw/qdev-clock.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
     assert(info->sram_banks <= MAX_SRAM_BANKS);
     assert(info->num_cpus <= SSE_MAX_CPUS);
 
+    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
+    s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
+
     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
 
     for (i = 0; i < info->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      * map its upstream ends to the right place in the container.
      */
     qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                              &error_abort);
 
     qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                              &error_abort);
 
     qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      *   0x4002f000: S32K timer
      */
     qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
+    qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 
     qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
+    qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 
     qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 
     qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
 
 static const VMStateDescription armsse_vmstate = {
     .name = "iotkit",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(mainclk, ARMSSE),
+        VMSTATE_CLOCK(s32kclk, ARMSSE),
         VMSTATE_UINT32(nsccfg, ARMSSE),
         VMSTATE_END_OF_LIST()
     }
-- 
2.20.1

The old-style convenience function cmsdk_apb_timer_create() for
creating CMSDK_APB_TIMER objects is used in only two places in
mps2.c.  Most of the rest of the code in that file uses the new
"initialize in place" coding style.

We want to connect up a Clock object which should be done between the
object creation and realization; rather than adding a Clock* argument
to the convenience function, convert the timer creation code in
mps2.c to the same style as is used already for the watchdog,
dualtimer and other devices, and delete the now-unused convenience
function.

diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     uint32_t intstatus;
 };
 
-/**
- * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
- * @addr: location in system memory to map registers
- * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
- */
-static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
-                                                 qemu_irq timerint,
-                                                 uint32_t pclk_frq)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new(TYPE_CMSDK_APB_TIMER);
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, timerint);
-    return dev;
-}
-
 #endif
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
     /* CMSDK APB subsystem */
     CMSDKAPBDualTimer dualtimer;
     CMSDKAPBWatchdog watchdog;
+    CMSDKAPBTimer timer[2];
 };
 
 #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     }
 
     /* CMSDK APB subsystem */
-    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
-    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
+    for (i = 0; i < ARRAY_SIZE(mms->timer); i++) {
+        g_autofree char *name = g_strdup_printf("timer%d", i);
+        hwaddr base = 0x40000000 + i * 0x1000;
+        int irqno = 8 + i;
+        SysBusDevice *sbd;
+
+        object_initialize_child(OBJECT(mms), name, &mms->timer[i],
+                                TYPE_CMSDK_APB_TIMER);
+        sbd = SYS_BUS_DEVICE(&mms->timer[i]);
+        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
+        sysbus_realize_and_unref(sbd, &error_fatal);
+        sysbus_mmio_map(sbd, 0, base);
+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
+    }
+
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
-- 
2.20.1

Create a fixed-frequency Clock object to be the SYSCLK, and wire it
up to the devices that require it.

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "net/net.h"
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 typedef enum MPS2FPGAType {
@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
     CMSDKAPBDualTimer dualtimer;
     CMSDKAPBWatchdog watchdog;
     CMSDKAPBTimer timer[2];
+    Clock *sysclk;
 };
 
 #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
+    /* This clock doesn't need migration because it is fixed-frequency */
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+
     /* The FPGA images have an odd combination of different RAMs,
      * because in hardware they are different implementations and
      * connected to different buses, giving varying performance/size
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                 TYPE_CMSDK_APB_TIMER);
         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
         qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
+        qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
         sysbus_realize_and_unref(sbd, &error_fatal);
         sysbus_mmio_map(sbd, 0, base);
         sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
+    qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
                        qdev_get_gpio_in(armv7m, 10));
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                             TYPE_CMSDK_APB_WATCHDOG);
     qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
+    qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
                        qdev_get_gpio_in_named(armv7m, "NMI", 0));
-- 
2.20.1

Create and connect the two clocks needed by the ARMSSE.

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "net/net.h"
 #include "hw/core/split-irq.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 #define MPS2TZ_NUMIRQ 92
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
     qemu_or_irq uart_irq_orgate;
     DeviceState *lan9118;
     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
+    Clock *sysclk;
+    Clock *s32kclk;
 };
 
 #define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
 
 /* Main SYSCLK frequency in Hz */
 #define SYSCLK_FRQ 20000000
+/* Slow 32Khz S32KCLK frequency in Hz */
+#define S32KCLK_FRQ (32 * 1000)
 
 /* Create an alias of an entire original MemoryRegion @orig
  * located at @base in the memory map.
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
+    /* These clocks don't need migration because they are fixed-frequency */
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
+    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
+
     object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
                             mmc->armsse_type);
     iotkitdev = DEVICE(&mms->iotkit);
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
     qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
+    qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
+    qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 
     /*
-- 
2.20.1

Create and connect the two clocks needed by the ARMSSE.

diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/tz-ppc.h"
 #include "hw/misc/unimp.h"
 #include "hw/rtc/pl031.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 #define MUSCA_NUMIRQ_MAX 96
@@ -XXX,XX +XXX,XX @@ struct MuscaMachineState {
     UnimplementedDeviceState sdio;
     UnimplementedDeviceState gpio;
     UnimplementedDeviceState cryptoisland;
+    Clock *sysclk;
+    Clock *s32kclk;
 };
 
 #define TYPE_MUSCA_MACHINE "musca"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
  * don't model that in our SSE-200 model yet.
  */
 #define SYSCLK_FRQ 40000000
+/* Slow 32Khz S32KCLK frequency in Hz */
+#define S32KCLK_FRQ (32 * 1000)
 
 static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
 {
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
         exit(1);
     }
 
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
+    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
+
     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
                             TYPE_SSE200);
     ssedev = DEVICE(&mms->sse);
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
+    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
+    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
     /*
      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
-- 
2.20.1

Convert the SSYS code in the Stellaris boards (which encapsulates the
system registers) to a proper QOM device.  This will provide us with
somewhere to put the output Clock whose frequency depends on the
setting of the PLL configuration registers.

This is a migration compatibility break for lm3s811evb, lm3s6965evb.

We use 3-phase reset here because the Clock will need to propagate
its value in the hold phase.

For the moment we reset the device during the board creation so that
the system_clock_scale global gets set; this will be removed in a
subsequent commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-17-peter.maydell@linaro.org
Message-id: 20210121190622.22000-17-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 132 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 107 insertions(+), 25 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
 
 /* System controller.  */
 
-typedef struct {
+#define TYPE_STELLARIS_SYS "stellaris-sys"
+OBJECT_DECLARE_SIMPLE_TYPE(ssys_state, STELLARIS_SYS)
+
+struct ssys_state {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t pborctl;
     uint32_t ldopctl;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t dcgc[3];
     uint32_t clkvclr;
     uint32_t ldoarst;
+    qemu_irq irq;
+    /* Properties (all read-only registers) */
     uint32_t user0;
     uint32_t user1;
-    qemu_irq irq;
-    stellaris_board_info *board;
-} ssys_state;
+    uint32_t did0;
+    uint32_t did1;
+    uint32_t dc0;
+    uint32_t dc1;
+    uint32_t dc2;
+    uint32_t dc3;
+    uint32_t dc4;
+};
 
 static void ssys_update(ssys_state *s)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_fury[16] = {
 
 static int ssys_board_class(const ssys_state *s)
 {
-    uint32_t did0 = s->board->did0;
+    uint32_t did0 = s->did0;
     switch (did0 & DID0_VER_MASK) {
     case DID0_VER_0:
         return DID0_CLASS_SANDSTORM;
@@ -XXX,XX +XXX,XX @@ static uint64_t ssys_read(void *opaque, hwaddr offset,
 
     switch (offset) {
     case 0x000: /* DID0 */
-        return s->board->did0;
+        return s->did0;
     case 0x004: /* DID1 */
-        return s->board->did1;
+        return s->did1;
     case 0x008: /* DC0 */
-        return s->board->dc0;
+        return s->dc0;
     case 0x010: /* DC1 */
-        return s->board->dc1;
+        return s->dc1;
     case 0x014: /* DC2 */
-        return s->board->dc2;
+        return s->dc2;
     case 0x018: /* DC3 */
-        return s->board->dc3;
+        return s->dc3;
     case 0x01c: /* DC4 */
-        return s->board->dc4;
+        return s->dc4;
     case 0x030: /* PBORCTL */
         return s->pborctl;
     case 0x034: /* LDOPCTL */
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ssys_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void ssys_reset(void *opaque)
+static void stellaris_sys_reset_enter(Object *obj, ResetType type)
 {
-    ssys_state *s = (ssys_state *)opaque;
+    ssys_state *s = STELLARIS_SYS(obj);
 
     s->pborctl = 0x7ffd;
     s->rcc = 0x078e3ac0;
@@ -XXX,XX +XXX,XX @@ static void ssys_reset(void *opaque)
     s->rcgc[0] = 1;
     s->scgc[0] = 1;
     s->dcgc[0] = 1;
+}
+
+static void stellaris_sys_reset_hold(Object *obj)
+{
+    ssys_state *s = STELLARIS_SYS(obj);
+
     ssys_calculate_system_clock(s);
 }
 
+static void stellaris_sys_reset_exit(Object *obj)
+{
+}
+
 static int stellaris_sys_post_load(void *opaque, int version_id)
 {
     ssys_state *s = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
     }
 };
 
+static Property stellaris_sys_properties[] = {
+    DEFINE_PROP_UINT32("user0", ssys_state, user0, 0),
+    DEFINE_PROP_UINT32("user1", ssys_state, user1, 0),
+    DEFINE_PROP_UINT32("did0", ssys_state, did0, 0),
+    DEFINE_PROP_UINT32("did1", ssys_state, did1, 0),
+    DEFINE_PROP_UINT32("dc0", ssys_state, dc0, 0),
+    DEFINE_PROP_UINT32("dc1", ssys_state, dc1, 0),
+    DEFINE_PROP_UINT32("dc2", ssys_state, dc2, 0),
+    DEFINE_PROP_UINT32("dc3", ssys_state, dc3, 0),
+    DEFINE_PROP_UINT32("dc4", ssys_state, dc4, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void stellaris_sys_instance_init(Object *obj)
+{
+    ssys_state *s = STELLARIS_SYS(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
+
+    memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
 static int stellaris_sys_init(uint32_t base, qemu_irq irq,
                               stellaris_board_info * board,
                               uint8_t *macaddr)
 {
-    ssys_state *s;
+    DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    s = g_new0(ssys_state, 1);
-    s->irq = irq;
-    s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
-    s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
-    s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
+    qdev_prop_set_uint32(dev, "user0",
+                         macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16));
+    qdev_prop_set_uint32(dev, "user1",
+                         macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16));
+    qdev_prop_set_uint32(dev, "did0", board->did0);
+    qdev_prop_set_uint32(dev, "did1", board->did1);
+    qdev_prop_set_uint32(dev, "dc0", board->dc0);
+    qdev_prop_set_uint32(dev, "dc1", board->dc1);
+    qdev_prop_set_uint32(dev, "dc2", board->dc2);
+    qdev_prop_set_uint32(dev, "dc3", board->dc3);
+    qdev_prop_set_uint32(dev, "dc4", board->dc4);
+
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, base);
+    sysbus_connect_irq(sbd, 0, irq);
+
+    /*
+     * Normally we should not be resetting devices like this during
+     * board creation. For the moment we need to do so, because
+     * system_clock_scale will only get set when the STELLARIS_SYS
+     * device is reset, and we need its initial value to pass to
+     * the watchdog device. This hack can be removed once the
+     * watchdog has been converted to use a Clock input instead.
+     */
+    device_cold_reset(dev);
 
-    memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
-    memory_region_add_subregion(get_system_memory(), base, &s->iomem);
-    ssys_reset(s);
-    vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
     return 0;
 }
 
-
 /* I2C controller.  */
 
 #define TYPE_STELLARIS_I2C "stellaris-i2c"
@@ -XXX,XX +XXX,XX @@ static const TypeInfo stellaris_adc_info = {
     .class_init    = stellaris_adc_class_init,
 };
 
+static void stellaris_sys_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    dc->vmsd = &vmstate_stellaris_sys;
+    rc->phases.enter = stellaris_sys_reset_enter;
+    rc->phases.hold = stellaris_sys_reset_hold;
+    rc->phases.exit = stellaris_sys_reset_exit;
+    device_class_set_props(dc, stellaris_sys_properties);
+}
+
+static const TypeInfo stellaris_sys_info = {
+    .name = TYPE_STELLARIS_SYS,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(ssys_state),
+    .instance_init = stellaris_sys_instance_init,
+    .class_init = stellaris_sys_class_init,
+};
+
 static void stellaris_register_types(void)
 {
     type_register_static(&stellaris_i2c_info);
     type_register_static(&stellaris_gptm_info);
     type_register_static(&stellaris_adc_info);
+    type_register_static(&stellaris_sys_info);
 }
 
 type_init(stellaris_register_types)
-- 
2.20.1

Create and connect the Clock input for the watchdog device on the
Stellaris boards.  Because the Stellaris boards model the ability to
change the clock rate by programming PLL registers, we have to create
an output Clock on the ssys_state device and wire it up to the
watchdog.

Note that the old comment on ssys_calculate_system_clock() got the
units wrong -- system_clock_scale is in nanoseconds, not
milliseconds.  Improve the commentary to clarify how we are
calculating the period.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-18-peter.maydell@linaro.org
Message-id: 20210121190622.22000-18-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 43 +++++++++++++++++++++++++++++++------------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
 #include "migration/vmstate.h"
 #include "hw/misc/unimp.h"
+#include "hw/qdev-clock.h"
 #include "cpu.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct ssys_state {
     uint32_t clkvclr;
     uint32_t ldoarst;
     qemu_irq irq;
+    Clock *sysclk;
     /* Properties (all read-only registers) */
     uint32_t user0;
     uint32_t user1;
@@ -XXX,XX +XXX,XX @@ static bool ssys_use_rcc2(ssys_state *s)
 }
 
 /*
- * Caculate the sys. clock period in ms.
+ * Calculate the system clock period. We only want to propagate
+ * this change to the rest of the system if we're not being called
+ * from migration post-load.
  */
-static void ssys_calculate_system_clock(ssys_state *s)
+static void ssys_calculate_system_clock(ssys_state *s, bool propagate_clock)
 {
+    /*
+     * SYSDIV field specifies divisor: 0 == /1, 1 == /2, etc.  Input
+     * clock is 200MHz, which is a period of 5 ns. Dividing the clock
+     * frequency by X is the same as multiplying the period by X.
+     */
     if (ssys_use_rcc2(s)) {
         system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
     } else {
         system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
     }
+    clock_set_ns(s->sysclk, system_clock_scale);
+    if (propagate_clock) {
+        clock_propagate(s->sysclk);
+    }
 }
 
 static void ssys_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
             s->int_status |= (1 << 6);
         }
         s->rcc = value;
-        ssys_calculate_system_clock(s);
+        ssys_calculate_system_clock(s, true);
         break;
     case 0x070: /* RCC2 */
         if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
             s->int_status |= (1 << 6);
         }
         s->rcc2 = value;
-        ssys_calculate_system_clock(s);
+        ssys_calculate_system_clock(s, true);
         break;
     case 0x100: /* RCGC0 */
         s->rcgc[0] = value;
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_reset_hold(Object *obj)
 {
     ssys_state *s = STELLARIS_SYS(obj);
 
-    ssys_calculate_system_clock(s);
+    /* OK to propagate clocks from the hold phase */
+    ssys_calculate_system_clock(s, true);
 }
 
 static void stellaris_sys_reset_exit(Object *obj)
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_post_load(void *opaque, int version_id)
 {
     ssys_state *s = opaque;
 
-    ssys_calculate_system_clock(s);
+    ssys_calculate_system_clock(s, false);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
         VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
         VMSTATE_UINT32(clkvclr, ssys_state),
         VMSTATE_UINT32(ldoarst, ssys_state),
+        /* No field for sysclk -- handled in post-load instead */
         VMSTATE_END_OF_LIST()
     }
 };
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_instance_init(Object *obj)
     memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq);
+    s->sysclk = qdev_init_clock_out(DEVICE(s), "SYSCLK");
 }
 
-static int stellaris_sys_init(uint32_t base, qemu_irq irq,
-                              stellaris_board_info * board,
-                              uint8_t *macaddr)
+static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
+                                       stellaris_board_info *board,
+                                       uint8_t *macaddr)
 {
     DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
      */
     device_cold_reset(dev);
 
-    return 0;
+    return dev;
 }
 
 /* I2C controller.  */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     int flash_size;
     I2CBus *i2c;
     DeviceState *dev;
+    DeviceState *ssys_dev;
     int i;
     int j;
 
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
-                       board, nd_table[0].macaddr.a);
+    ssys_dev = stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
+                                  board, nd_table[0].macaddr.a);
 
 
     if (board->dc1 & (1 << 3)) { /* watchdog present */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         /* system_clock_scale is valid now */
         uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
         qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
+        qdev_connect_clock_in(dev, "WDOGCLK",
+                              qdev_get_clock_out(ssys_dev, "SYSCLK"));
 
         sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
         sysbus_mmio_map(SYS_BUS_DEVICE(dev),
-- 
2.20.1

Switch the CMSDK APB timer device over to using its Clock input; the
pclk-frq property is now ignored.

diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
     ptimer_transaction_commit(s->timer);
 }
 
+static void cmsdk_apb_timer_clk_update(void *opaque)
+{
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
+
+    ptimer_transaction_begin(s->timer);
+    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
+    ptimer_transaction_commit(s->timer);
+}
+
 static void cmsdk_apb_timer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                           s, "cmsdk-apb-timer", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->timerint);
-    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
+    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk",
+                                 cmsdk_apb_timer_clk_update, s);
 }
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
-    if (s->pclk_frq == 0) {
-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+    if (!clock_has_source(s->pclk)) {
+        error_setg(errp, "CMSDK APB timer: pclk clock must be connected");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     ptimer_transaction_begin(s->timer);
-    ptimer_set_freq(s->timer, s->pclk_frq);
+    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
     ptimer_transaction_commit(s->timer);
 }
 
-- 
2.20.1

Switch the CMSDK APB dualtimer device over to using its Clock input;
the pclk-frq property is now ignored.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-20-peter.maydell@linaro.org
Message-id: 20210121190622.22000-20-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/timer/cmsdk-apb-dualtimer.c | 42 ++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_update(CMSDKAPBDualTimer *s)
     qemu_set_irq(s->timerintc, timintc);
 }
 
+static int cmsdk_dualtimermod_divisor(CMSDKAPBDualTimerModule *m)
+{
+    /* Return the divisor set by the current CONTROL.PRESCALE value */
+    switch (FIELD_EX32(m->control, CONTROL, PRESCALE)) {
+    case 0:
+        return 1;
+    case 1:
+        return 16;
+    case 2:
+    case 3: /* UNDEFINED, we treat like 2 (and complained when it was set) */
+        return 256;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
                                              uint32_t newctrl)
 {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
         default:
             g_assert_not_reached();
         }
-        ptimer_set_freq(m->timer, m->parent->pclk_frq / divisor);
+        ptimer_set_period_from_clock(m->timer, m->parent->timclk, divisor);
     }
 
     if (changed & R_CONTROL_MODE_MASK) {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
      * limit must both be set to 0xffff, so we wrap at 16 bits.
      */
     ptimer_set_limit(m->timer, 0xffff, 1);
-    ptimer_set_freq(m->timer, m->parent->pclk_frq);
+    ptimer_set_period_from_clock(m->timer, m->parent->timclk,
+                                 cmsdk_dualtimermod_divisor(m));
     ptimer_transaction_commit(m->timer);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
     s->timeritop = 0;
 }
 
+static void cmsdk_apb_dualtimer_clk_update(void *opaque)
+{
+    CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(opaque);
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
+        CMSDKAPBDualTimerModule *m = &s->timermod[i];
+        ptimer_transaction_begin(m->timer);
+        ptimer_set_period_from_clock(m->timer, m->parent->timclk,
+                                     cmsdk_dualtimermod_divisor(m));
+        ptimer_transaction_commit(m->timer);
+    }
+}
+
 static void cmsdk_apb_dualtimer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
         sysbus_init_irq(sbd, &s->timermod[i].timerint);
     }
-    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
+    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK",
+                                   cmsdk_apb_dualtimer_clk_update, s);
 }
 
 static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
     CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(dev);
     int i;
 
-    if (s->pclk_frq == 0) {
-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+    if (!clock_has_source(s->timclk)) {
+        error_setg(errp, "CMSDK APB dualtimer: TIMCLK clock must be connected");
         return;
     }
 
-- 
2.20.1

Switch the CMSDK APB watchdog device over to using its Clock input;
the wdogclk_frq property is now ignored.

diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
     ptimer_transaction_commit(s->timer);
 }
 
+static void cmsdk_apb_watchdog_clk_update(void *opaque)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
+
+    ptimer_transaction_begin(s->timer);
+    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
+    ptimer_transaction_commit(s->timer);
+}
+
 static void cmsdk_apb_watchdog_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
                           s, "cmsdk-apb-watchdog", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->wdogint);
-    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
+    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK",
+                                    cmsdk_apb_watchdog_clk_update, s);
 
     s->is_luminary = false;
     s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
 
-    if (s->wdogclk_frq == 0) {
+    if (!clock_has_source(s->wdogclk)) {
         error_setg(errp,
-                   "CMSDK APB watchdog: wdogclk-frq property must be set");
+                   "CMSDK APB watchdog: WDOGCLK clock must be connected");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     ptimer_transaction_begin(s->timer);
-    ptimer_set_freq(s->timer, s->wdogclk_frq);
+    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
     ptimer_transaction_commit(s->timer);
 }
 
-- 
2.20.1

Now that the CMSDK APB watchdog uses its Clock input, it will
correctly respond when the system clock frequency is changed using
the RCC register on in the Stellaris board system registers.  Test
that when the RCC register is written it causes the watchdog timer to
change speed.

diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/cmsdk-apb-watchdog-test.c
+++ b/tests/qtest/cmsdk-apb-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "libqtest-single.h"
 
 /*
@@ -XXX,XX +XXX,XX @@
 #define WDOGMIS 0x14
 #define WDOGLOCK 0xc00
 
+#define SSYS_BASE 0x400fe000
+#define RCC 0x60
+#define SYSDIV_SHIFT 23
+#define SYSDIV_LENGTH 4
+
 static void test_watchdog(void)
 {
     g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
@@ -XXX,XX +XXX,XX @@ static void test_watchdog(void)
     g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 }
 
+static void test_clock_change(void)
+{
+    uint32_t rcc;
+
+    /*
+     * Test that writing to the stellaris board's RCC register to
+     * change the system clock frequency causes the watchdog
+     * to change the speed it counts at.
+     */
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+
+    writel(WDOG_BASE + WDOGCONTROL, 1);
+    writel(WDOG_BASE + WDOGLOAD, 1000);
+
+    /* Step to just past the 500th tick */
+    clock_step(80 * 500 + 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+
+    /* Rewrite RCC.SYSDIV from 16 to 8, so the clock is now 40ns per tick */
+    rcc = readl(SSYS_BASE + RCC);
+    g_assert_cmpuint(extract32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH), ==, 0xf);
+    rcc = deposit32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH, 7);
+    writel(SSYS_BASE + RCC, rcc);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
+
+    /* VALUE reloads at following tick */
+    clock_step(41);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+
+    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    writel(WDOG_BASE + WDOGINTCLR, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+}
+
 int main(int argc, char **argv)
 {
     int r;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_start("-machine lm3s811evb");
 
     qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
+    qtest_add_func("/cmsdk-apb-watchdog/watchdog_clock_change",
+                   test_clock_change);
 
     r = g_test_run();
 
-- 
2.20.1

Use the MAINCLK Clock input to set the system_clock_scale variable
rather than using the mainclk_frq property.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20210128114145.20536-23-peter.maydell@linaro.org
Message-id: 20210121190622.22000-23-peter.maydell@linaro.org
---
 hw/arm/armsse.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_forward_sec_resp_cfg(ARMSSE *s)
     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
 }
 
+static void armsse_mainclk_update(void *opaque)
+{
+    ARMSSE *s = ARM_SSE(opaque);
+    /*
+     * Set system_clock_scale from our Clock input; this is what
+     * controls the tick rate of the CPU SysTick timer.
+     */
+    system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
+}
+
 static void armsse_init(Object *obj)
 {
     ARMSSE *s = ARM_SSE(obj);
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
     assert(info->sram_banks <= MAX_SRAM_BANKS);
     assert(info->num_cpus <= SSE_MAX_CPUS);
 
-    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
+    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
+                                    armsse_mainclk_update, s);
     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
 
     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    if (!s->mainclk_frq) {
-        error_setg(errp, "MAINCLK_FRQ property was not set");
-        return;
+    if (!clock_has_source(s->mainclk)) {
+        error_setg(errp, "MAINCLK clock was not connected");
+    }
+    if (!clock_has_source(s->s32kclk)) {
+        error_setg(errp, "S32KCLK clock was not connected");
     }
 
     assert(info->num_cpus <= SSE_MAX_CPUS);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      */
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
 
-    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
+    /* Set initial system_clock_scale from MAINCLK */
+    armsse_mainclk_update(s);
 }
 
 static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
-- 
2.20.1

Remove all the code that sets frequency properties on the CMSDK
timer, dualtimer and watchdog devices and on the ARMSSE SoC device:
these properties are unused now that the devices rely on their Clock
inputs instead.

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      * it to the appropriate PPC port; then we can realize the PPC and
      * map its upstream ends to the right place in the container.
      */
-    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     object_property_set_link(OBJECT(&s->apb_ppc0), "port[0]", OBJECT(mr),
                              &error_abort);
 
-    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     object_property_set_link(OBJECT(&s->apb_ppc0), "port[1]", OBJECT(mr),
                              &error_abort);
 
-    qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* Devices behind APB PPC1:
      *   0x4002f000: S32K timer
      */
-    qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
     qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 
-    qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
     qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
 
     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 
-    qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                        armsse_get_common_irq_in(s, 1));
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 
-    qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
         return;
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
     object_property_set_link(OBJECT(&mms->iotkit), "memory",
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
-    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
     qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
     qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         object_initialize_child(OBJECT(mms), name, &mms->timer[i],
                                 TYPE_CMSDK_APB_TIMER);
         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
-        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
         qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
         sysbus_realize_and_unref(sbd, &error_fatal);
         sysbus_mmio_map(sbd, 0, base);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
 
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
-    qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
     qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     sysbus_mmio_map(SYS_BUS_DEVICE(&mms->dualtimer), 0, 0x40002000);
     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                             TYPE_CMSDK_APB_WATCHDOG);
-    qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
     qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
-    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
     qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
     qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
     /*
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     if (board->dc1 & (1 << 3)) { /* watchdog present */
         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
 
-        /* system_clock_scale is valid now */
-        uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
-        qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
         qdev_connect_clock_in(dev, "WDOGCLK",
                               qdev_get_clock_out(ssys_dev, "SYSCLK"));
 
-- 
2.20.1

Now no users are setting the frq properties on the CMSDK timer,
dualtimer, watchdog or ARMSSE SoC devices, we can remove the
properties and the struct fields that back them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-25-peter.maydell@linaro.org
Message-id: 20210121190622.22000-25-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h                  | 2 --
 include/hw/timer/cmsdk-apb-dualtimer.h   | 2 --
 include/hw/timer/cmsdk-apb-timer.h       | 2 --
 include/hw/watchdog/cmsdk-apb-watchdog.h | 2 --
 hw/arm/armsse.c                          | 2 --
 hw/timer/cmsdk-apb-dualtimer.c           | 6 ------
 hw/timer/cmsdk-apb-timer.c               | 6 ------
 hw/watchdog/cmsdk-apb-watchdog.c         | 6 ------
 8 files changed, 28 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
- *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
  *    (In hardware, the SSE-200 permits the number of expansion interrupts
  *    for the two CPUs to be configured separately, but we restrict it to
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
     /* Properties */
     MemoryRegion *board_memory;
     uint32_t exp_numirq;
-    uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
     bool cpu_fpu[SSE_MAX_CPUS];
diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-dualtimer.h
+++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
  * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
  *
  * QEMU interface:
- *  + QOM property "pclk-frq": frequency at which the timer is clocked
  *  + Clock input "TIMCLK": clock (for both timers)
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: combined timer interrupt TIMINTC
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq timerintc;
-    uint32_t pclk_frq;
     Clock *timclk;
 
     CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
 /*
  * QEMU interface:
- *  + QOM property "pclk-frq": frequency at which the timer is clocked
  *  + Clock input "pclk": clock for the timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: timer interrupt TIMERINT
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq timerint;
-    uint32_t pclk_frq;
     struct ptimer_state *timer;
     Clock *pclk;
 
diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
+++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
  * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
  *
  * QEMU interface:
- *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
  *  + Clock input "WDOGCLK": clock for the watchdog's timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: watchdog interrupt
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq wdogint;
-    uint32_t wdogclk_frq;
     bool is_luminary;
     struct ptimer_state *timer;
     Clock *wdogclk;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
     }
 };
 
-static Property cmsdk_apb_dualtimer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBDualTimer, pclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_dualtimer_realize;
     dc->vmsd = &cmsdk_apb_dualtimer_vmstate;
     dc->reset = cmsdk_apb_dualtimer_reset;
-    device_class_set_props(dc, cmsdk_apb_dualtimer_properties);
 }
 
 static const TypeInfo cmsdk_apb_dualtimer_info = {
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
     }
 };
 
-static Property cmsdk_apb_timer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_timer_realize;
     dc->vmsd = &cmsdk_apb_timer_vmstate;
     dc->reset = cmsdk_apb_timer_reset;
-    device_class_set_props(dc, cmsdk_apb_timer_properties);
 }
 
 static const TypeInfo cmsdk_apb_timer_info = {
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
     }
 };
 
-static Property cmsdk_apb_watchdog_properties[] = {
-    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_watchdog_realize;
     dc->vmsd = &cmsdk_apb_watchdog_vmstate;
     dc->reset = cmsdk_apb_watchdog_reset;
-    device_class_set_props(dc, cmsdk_apb_watchdog_properties);
 }
 
 static const TypeInfo cmsdk_apb_watchdog_info = {
-- 
2.20.1

Now that the watchdog device uses its Clock input rather than being
passed the value of system_clock_scale at creation time, we can
remove the hack where we reset the STELLARIS_SYS at board creation
time to force it to set system_clock_scale.  Instead it will be reset
at the usual point in startup and will inform the watchdog of the
clock frequency at that point.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-26-peter.maydell@linaro.org
Message-id: 20210121190622.22000-26-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
     sysbus_mmio_map(sbd, 0, base);
     sysbus_connect_irq(sbd, 0, irq);
 
-    /*
-     * Normally we should not be resetting devices like this during
-     * board creation. For the moment we need to do so, because
-     * system_clock_scale will only get set when the STELLARIS_SYS
-     * device is reset, and we need its initial value to pass to
-     * the watchdog device. This hack can be removed once the
-     * watchdog has been converted to use a Clock input instead.
-     */
-    device_cold_reset(dev);
-
     return dev;
 }
 
-- 
2.20.1