Series comparison

-[Qemu-devel] [PULL 00/21] target-arm queue
+[PULL 00/18] target-arm queue
-target-arm queue of various easier things that had piled
+Nothing very exciting this time around...
 up while I was on holiday.
-thanks
 -- PMM
-The following changes since commit 506e4a00de01e0b29fa83db5cbbc3d154253b4ea:
+The following changes since commit 37a712a0f969ca2df7f01182409a6c4825cebfb5:
-  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.1-20180925' into staging (2018-09-25 13:30:45 +0100)
+  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2020-10-01 12:23:19 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180925
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201001
-for you to fetch changes up to 4a87106b160a3e72152443065fb92f8a1313c23d:
+for you to fetch changes up to cdfaa57dcb53ba012439765a1462247dfda8595d:
-  target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode (2018-09-25 14:14:07 +0100)
+  hw/arm/raspi: Remove use of the 'version' value in the board code (2020-10-01 15:31:01 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
+ * Make isar_feature_aa32_fp16_arith() handle M-profile
- * hw/arm/exynos4210: fix Exynos4210 UART support
+ * Fix SVE splice
- * hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes
+ * Fix SVE LDR/STR
- * arm: Add BBC micro:bit machine
+ * Remove ignore_memory_transaction_failures on the raspi2
- * aspeed/i2c: Fix interrupt handling bugs
+ * raspi: Various cleanup/refactoring
  * hw/arm/smmu-common: Fix the name of the iommu memory regions
  * hw/arm/smmuv3: fix eventq recording and IRQ triggerring
  * hw/intc/arm_gic: Document QEMU interface
  * hw/intc/arm_gic: Drop GIC_BASE_IRQ macro
  * hw/net/pcnet-pci: Convert away from old_mmio accessors
  * hw/timer/cmsdk-apb-dualtimer: Add missing 'break' statements
  * aspeed/timer: fix compile breakage with clang 3.4.2
  * hw/arm/aspeed: change the FMC flash model of the AST2500 evb
  * hw/arm/aspeed: Minor code cleanups
  * target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode
 ----------------------------------------------------------------
-Bartlomiej Zolnierkiewicz (1):
+Peter Maydell (5):
-      hw/arm/exynos4210: fix Exynos4210 UART support
+      target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
       target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
       hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
       target/arm: Add ID register values for Cortex-M0
       target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile
-Cédric Le Goater (5):
+Philippe Mathieu-Daudé (11):
-      aspeed/i2c: interrupts should be cleared by software only
+      hw/arm/raspi: Define various blocks base addresses
-      aspeed/timer: fix compile breakage with clang 3.4.2
+      hw/arm/bcm2835: Add more unimplemented peripherals
-      hw/arm/aspeed: change the FMC flash model of the AST2500 evb
+      hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
-      hw/arm/aspeed: Add an Aspeed machine class
+      hw/arm/raspi: Display the board revision in the machine description
-      aspeed/smc: fix some alignment issues
+      hw/arm/raspi: Load the firmware on the first core
       hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
       hw/arm/raspi: Avoid using TypeInfo::class_data pointer
       hw/arm/raspi: Use more specific machine names
       hw/arm/raspi: Introduce RaspiProcessorId enum
       hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
       hw/arm/raspi: Remove use of the 'version' value in the board code
-Eric Auger (2):
+Richard Henderson (2):
-      hw/arm/smmu-common: Fix the name of the iommu memory regions
+      target/arm: Fix sve ldr/str
-      hw/arm/smmuv3: fix eventq recording and IRQ triggerring
+      target/arm: Fix SVE splice
-Guenter Roeck (2):
+ include/hw/arm/bcm2835_peripherals.h |   2 +
-      aspeed/i2c: Handle receive command in separate function
+ include/hw/arm/raspi_platform.h      |  51 ++++++++++--
-      aspeed/i2c: Fix receive done interrupt handling
+ target/arm/cpu.h                     |  50 +++++++++--
  hw/arm/bcm2835_peripherals.c         |   2 +
  hw/arm/raspi.c                       | 155 +++++++++++++++++++----------------
  hw/intc/armv7m_nvic.c                |  46 ++++++++++-
  target/arm/cpu.c                     |  21 +++--
  target/arm/cpu64.c                   |  12 +--
  target/arm/cpu_tcg.c                 |  60 ++++++++++----
  target/arm/helper.c                  |   9 +-
  target/arm/kvm64.c                   |   4 +
  target/arm/translate-sve.c           |   6 +-
 files changed, 286 insertions(+), 132 deletions(-)
-Joel Stanley (3):
-      MAINTAINERS: Add NRF51 entry
-      arm: Add Nordic Semiconductor nRF51 SoC
-      arm: Add BBC micro:bit machine
-Peter Maydell (6):
-      hw/intc/arm_gic: Document QEMU interface
-      hw/intc/arm_gic: Drop GIC_BASE_IRQ macro
-      hw/net/pcnet-pci: Convert away from old_mmio accessors
-      hw/net/pcnet-pci: Unify pcnet_ioport_read/write and pcnet_mmio_read/write
-      hw/timer/cmsdk-apb-dualtimer: Add missing 'break' statements
-      target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode
-Richard Henderson (1):
-      target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
-Shannon Zhao (1):
-      hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes
- hw/arm/Makefile.objs            |   1 +
- hw/arm/smmuv3-internal.h        |  26 ++---
- hw/intc/gic_internal.h          |   2 -
- include/hw/arm/aspeed.h         |  46 +++++++++
- include/hw/arm/nrf51_soc.h      |  41 ++++++++
- include/hw/intc/arm_gic.h       |  43 ++++++++
- include/hw/timer/aspeed_timer.h |   3 +-
- hw/arm/aspeed.c                 | 212 +++++++++++++---------------------------
- hw/arm/exynos4210.c             |   8 +-
- hw/arm/microbit.c               |  67 +++++++++++++
- hw/arm/nrf51_soc.c              | 133 +++++++++++++++++++++++++
- hw/arm/smmu-common.c            |   6 +-
- hw/arm/smmuv3.c                 |   2 +-
- hw/arm/virt-acpi-build.c        |  10 +-
- hw/i2c/aspeed_i2c.c             |  63 ++++++++----
- hw/intc/arm_gic.c               |  31 +++---
- hw/intc/arm_gic_common.c        |   1 -
- hw/net/pcnet-pci.c              |  98 ++-----------------
- hw/ssi/aspeed_smc.c             |   8 +-
- hw/timer/aspeed_timer.c         |   1 -
- hw/timer/cmsdk-apb-dualtimer.c  |   2 +
- target/arm/cpu.c                |  14 ++-
- target/arm/helper.c             |  45 +++++----
- MAINTAINERS                     |   8 ++
- default-configs/arm-softmmu.mak |   1 +
- hw/net/trace-events             |   6 --
-files changed, 542 insertions(+), 336 deletions(-)
- create mode 100644 include/hw/arm/aspeed.h
- create mode 100644 include/hw/arm/nrf51_soc.h
- create mode 100644 hw/arm/microbit.c
- create mode 100644 hw/arm/nrf51_soc.c

-[Qemu-devel] [PULL 01/21] target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
+[PULL 01/18] target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
-From: Richard Henderson <richard.henderson@linaro.org>
+The ARM_FEATURE_PXN bit indicates whether the CPU supports the PXN
 bit in short-descriptor translation table format descriptors.  This
 is indicated by ID_MMFR0.VMSA being at least 0b0100.  Replace the
 feature bit with an ID register check, in line with our preference
 for ID register checks over feature bits.
-Not only are the sve-related tb_flags fields unused when SVE is
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-disabled, but not all of the cpu registers are initialized properly
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-for computing same.  This can corrupt other fields by ORing in -1,
+Message-id: 20200910173855.4068-2-peter.maydell@linaro.org
-which might result in QEMU crashing.
+---
  target/arm/cpu.h    | 15 ++++++++++++++-
  target/arm/cpu.c    |  1 -
  target/arm/helper.c |  5 +++--
 files changed, 17 insertions(+), 4 deletions(-)
-This bug was not present in 3.0, but this patch is cc'd to
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-stable because adf92eab90e3f5f34c285 where the bug was
+index XXXXXXX..XXXXXXX 100644
-introduced was marked for stable.
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
-Fixes: adf92eab90e3f5f34c285
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, FHM, 8, 4)
-Cc: qemu-stable@nongnu.org (3.0.1)
+ FIELD(ID_ISAR6, SB, 12, 4)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+ FIELD(ID_ISAR6, SPECRES, 16, 4)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++FIELD(ID_MMFR0, VMSA, 0, 4)
----
++FIELD(ID_MMFR0, PMSA, 4, 4)
- target/arm/helper.c | 45 ++++++++++++++++++++++++---------------------
++FIELD(ID_MMFR0, OUTERSHR, 8, 4)
-file changed, 24 insertions(+), 21 deletions(-)
++FIELD(ID_MMFR0, SHARELVL, 12, 4)
++FIELD(ID_MMFR0, TCM, 16, 4)
 +FIELD(ID_MMFR0, AUXREG, 20, 4)
 +FIELD(ID_MMFR0, FCSE, 24, 4)
 +FIELD(ID_MMFR0, INNERSHR, 28, 4)
 +
  FIELD(ID_MMFR3, CMAINTVA, 0, 4)
  FIELD(ID_MMFR3, CMAINTSW, 4, 4)
  FIELD(ID_MMFR3, BPMAINT, 8, 4)
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */
      ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */
      ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
 -    ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
      ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
      ARM_FEATURE_V8,
      ARM_FEATURE_AARCH64, /* supports 64 bit mode */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
      return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 4;
  }
 +static inline bool isar_feature_aa32_pxn(const ARMISARegisters *id)
 +{
 +    return FIELD_EX32(id->id_mmfr0, ID_MMFR0, VMSA) >= 4;
 +}
 +
  static inline bool isar_feature_aa32_pan(const ARMISARegisters *id)
  {
      return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) != 0;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
 -        set_feature(env, ARM_FEATURE_PXN);
      }
      if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
          set_feature(env, ARM_FEATURE_CBAR);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
-     uint32_t flags;
+                              target_ulong *page_size, ARMMMUFaultInfo *fi)
+ {
-     if (is_a64(env)) {
+     CPUState *cs = env_cpu(env);
--        int sve_el = sve_exception_el(env);
++    ARMCPU *cpu = env_archcpu(env);
--        uint32_t zcr_len;
+     int level = 1;
--
+     uint32_t table;
-         *pc = env->pc;
+     uint32_t desc;
-         flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
-         /* Get control bits for tagged addresses */
+         goto do_fault;
-         flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+     }
-         flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+     type = (desc & 3);
--        flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
+-    if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
++    if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
--        /* If SVE is disabled, but FP is enabled,
+         /* Section translation fault, or attempt to use the encoding
--           then the effective len is 0.  */
+          * which is Reserved on implementations without PXN.
--        if (sve_el != 0 && fp_el == 0) {
+          */
--            zcr_len = 0;
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
--        } else {
+         pxn = desc & 1;
--            int current_el = arm_current_el(env);
+         ns = extract32(desc, 19, 1);
--            ARMCPU *cpu = arm_env_get_cpu(env);
+     } else {
-+        if (arm_feature(env, ARM_FEATURE_SVE)) {
+-        if (arm_feature(env, ARM_FEATURE_PXN)) {
-+            int sve_el = sve_exception_el(env);
++        if (cpu_isar_feature(aa32_pxn, cpu)) {
-+            uint32_t zcr_len;
+             pxn = (desc >> 2) & 1;
 -            zcr_len = cpu->sve_max_vq - 1;
 -            if (current_el <= 1) {
 -                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
 -            }
 -            if (current_el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
 -                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
 -            }
 -            if (current_el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
 -                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
 +            /* If SVE is disabled, but FP is enabled,
 +             * then the effective len is 0.
 +             */
 +            if (sve_el != 0 && fp_el == 0) {
 +                zcr_len = 0;
 +            } else {
 +                int current_el = arm_current_el(env);
 +                ARMCPU *cpu = arm_env_get_cpu(env);
 +
 +                zcr_len = cpu->sve_max_vq - 1;
 +                if (current_el <= 1) {
 +                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
 +                }
 +                if (current_el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
 +                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
 +                }
 +                if (current_el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
 +                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
 +                }
              }
 +            flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
 +            flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
          }
--        flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
+         ns = extract32(desc, 3, 1);
      } else {
          *pc = env->regs[15];
          flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 02/21] hw/arm/exynos4210: fix Exynos4210 UART support
+Deleted patch
-From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-commit 97274d0c05d4 ("hw/char/exynos4210_uart.c: Remove unneeded
-handling of NULL chardev") broke Exynos4210 support as it removed
-NULL 'Chardev *chr' handling from exynos4210_uart_create() and
-currently exynos4210_init() always passes NULL as 'Chardev *chr'
-argument to exynos4210_uart_create() calls. Fix it by adding
-missing serial_hd() calls to exynos4210_init().
-Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 9310418.Wg32kryeWE@amdc3058
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/exynos4210.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-     /*** UARTs ***/
-     exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
--                           EXYNOS4210_UART0_FIFO_SIZE, 0, NULL,
-+                           EXYNOS4210_UART0_FIFO_SIZE, 0, serial_hd(0),
-                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 0)]);
-     exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
--                           EXYNOS4210_UART1_FIFO_SIZE, 1, NULL,
-+                           EXYNOS4210_UART1_FIFO_SIZE, 1, serial_hd(1),
-                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 1)]);
-     exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
--                           EXYNOS4210_UART2_FIFO_SIZE, 2, NULL,
-+                           EXYNOS4210_UART2_FIFO_SIZE, 2, serial_hd(2),
-                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 2)]);
-     exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
--                           EXYNOS4210_UART3_FIFO_SIZE, 3, NULL,
-+                           EXYNOS4210_UART3_FIFO_SIZE, 3, serial_hd(3),
-                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 3)]);
-     /*** SD/MMC host controllers ***/
---
-.19.0

-[Qemu-devel] [PULL 21/21] target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode
+[PULL 02/18] target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
-The ARMv8 architecture defines that an AArch32 CPU starts
+Move the id_pfr0 and id_pfr1 fields into the ARMISARegisters
-in SVC mode, unless EL2 is the highest available EL, in
+sub-struct. We're going to want id_pfr1 for an isar_features
-which case it starts in Hyp mode. (In ARMv7 a CPU with EL2
+check, and moving both at the same time avoids an odd
-but not EL3 was not a valid configuration, but we don't
+inconsistency.
-specifically reject this if the user asks for one.)
 Changes other than the ones to cpu.h and kvm64.c made
 automatically with:
   perl -p -i -e 's/cpu->id_pfr/cpu->isar.id_pfr/' target/arm/*.c hw/intc/armv7m_nvic.c
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180823135047.16525-1-peter.maydell@linaro.org
+Message-id: 20200910173855.4068-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 14 ++++++++++++--
+ target/arm/cpu.h      |  4 ++--
-file changed, 12 insertions(+), 2 deletions(-)
+ hw/intc/armv7m_nvic.c |  4 ++--
+ target/arm/cpu.c      | 20 ++++++++++----------
  target/arm/cpu64.c    | 12 ++++++------
  target/arm/cpu_tcg.c  | 36 ++++++++++++++++++------------------
  target/arm/helper.c   |  4 ++--
  target/arm/kvm64.c    |  4 ++++
 files changed, 44 insertions(+), 40 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
          uint32_t id_mmfr2;
          uint32_t id_mmfr3;
          uint32_t id_mmfr4;
 +        uint32_t id_pfr0;
 +        uint32_t id_pfr1;
          uint32_t mvfr0;
          uint32_t mvfr1;
          uint32_t mvfr2;
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      uint32_t reset_fpsid;
      uint32_t ctr;
      uint32_t reset_sctlr;
 -    uint32_t id_pfr0;
 -    uint32_t id_pfr1;
      uint64_t pmceid0;
      uint64_t pmceid1;
      uint32_t id_afr0;
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                        "Aux Fault status registers unimplemented\n");
          return 0;
      case 0xd40: /* PFR0.  */
 -        return cpu->id_pfr0;
 +        return cpu->isar.id_pfr0;
      case 0xd44: /* PFR1.  */
 -        return cpu->id_pfr1;
 +        return cpu->isar.id_pfr1;
      case 0xd48: /* DFR0.  */
          return cpu->isar.id_dfr0;
      case 0xd4c: /* AFR0.  */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-         env->cp15.c15_cpar = 1;
+         /* Disable the security extension feature bits in the processor feature
           * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
           */
 -        cpu->id_pfr1 &= ~0xf0;
 +        cpu->isar.id_pfr1 &= ~0xf0;
          cpu->isar.id_aa64pfr0 &= ~0xf000;
      }
- #else
--    /* SVC mode with interrupts disabled.  */
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
--    env->uncached_cpsr = ARM_CPU_MODE_SVC;
+          * id_aa64pfr0_el1[11:8].
-+
+          */
-+    /*
+         cpu->isar.id_aa64pfr0 &= ~0xf00;
-+     * If the highest available EL is EL2, AArch32 will start in Hyp
+-        cpu->id_pfr1 &= ~0xf000;
-+     * mode; otherwise it starts in SVC. Note that if we start in
++        cpu->isar.id_pfr1 &= ~0xf000;
-+     * AArch64 then these values in the uncached_cpsr will be ignored.
+     }
-+     */
-+    if (arm_feature(env, ARM_FEATURE_EL2) &&
+ #ifndef CONFIG_USER_ONLY
-+        !arm_feature(env, ARM_FEATURE_EL3)) {
+@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
-+        env->uncached_cpsr = ARM_CPU_MODE_HYP;
+     cpu->isar.mvfr1 = 0x00011111;
-+    } else {
+     cpu->ctr = 0x82048004;
-+        env->uncached_cpsr = ARM_CPU_MODE_SVC;
+     cpu->reset_sctlr = 0x00c50078;
-+    }
+-    cpu->id_pfr0 = 0x1031;
-     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
+-    cpu->id_pfr1 = 0x11;
++    cpu->isar.id_pfr0 = 0x1031;
-     if (arm_feature(env, ARM_FEATURE_M)) {
++    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x400;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x31100003;
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x01111111;
      cpu->ctr = 0x80038003;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x1031;
 -    cpu->id_pfr1 = 0x11;
 +    cpu->isar.id_pfr0 = 0x1031;
 +    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x000;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x00100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x11111111;
      cpu->ctr = 0x84448003;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x00001131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00001131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x02010555;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x11111111;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x00001131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00001131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x02010555;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10201105;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x84448004; /* L1Ip = VIPT */
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10201105;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0x2;
      cpu->id_afr0 = 0x3;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0x2;
      cpu->id_afr0 = 0x3;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x11;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x33;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x11111111;
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0;
      cpu->id_afr0 = 0x2;
      cpu->isar.id_mmfr0 = 0x01100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
      cpu->midr = 0x410fc231;
      cpu->pmsav7_dregion = 8;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110021;
      cpu->isar.mvfr1 = 0x11000011;
      cpu->isar.mvfr2 = 0x00000000;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110221;
      cpu->isar.mvfr1 = 0x12000011;
      cpu->isar.mvfr2 = 0x00000040;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00100030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110021;
      cpu->isar.mvfr1 = 0x11000011;
      cpu->isar.mvfr2 = 0x00000040;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000210;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
      cpu->isar.id_dfr0 = 0x00200000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00101F40;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_PMSA);
      set_feature(&cpu->env, ARM_FEATURE_PMU);
      cpu->midr = 0x411fc153; /* r1p3 */
 -    cpu->id_pfr0 = 0x0131;
 -    cpu->id_pfr1 = 0x001;
 +    cpu->isar.id_pfr0 = 0x0131;
 +    cpu->isar.id_pfr1 = 0x001;
      cpu->isar.id_dfr0 = 0x010400;
      cpu->id_afr0 = 0x0;
      cpu->isar.id_mmfr0 = 0x0210030;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
  static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
      ARMCPU *cpu = env_archcpu(env);
 -    uint64_t pfr1 = cpu->id_pfr1;
 +    uint64_t pfr1 = cpu->isar.id_pfr1;
      if (env->gicv3state) {
          pfr1 |= 1 << 28;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
                .accessfn = access_aa32_tid3,
 -              .resetvalue = cpu->id_pfr0 },
 +              .resetvalue = cpu->isar.id_pfr0 },
              /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
               * the value of the GIC field until after we define these regs.
               */
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
           * than skipping the reads and leaving 0, as we must avoid
           * considering the values in every case.
           */
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
 +                              ARM64_SYS_REG(3, 0, 0, 1, 0));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
 +                              ARM64_SYS_REG(3, 0, 0, 1, 1));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                                ARM64_SYS_REG(3, 0, 0, 1, 2));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 13/21] hw/intc/arm_gic: Drop GIC_BASE_IRQ macro
+[PULL 03/18] hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
-The GIC_BASE_IRQ macro is a leftover from when we shared code
+M-profile CPUs only implement the ID registers as guest-visible if
-between the GICv2 and the v7M NVIC. Since the NVIC is now
+the CPU implements the Main Extension (all our current CPUs except
-split off, GIC_BASE_IRQ is always 0, and we can just delete it.
+the Cortex-M0 do).
 Currently we handle this by having the Cortex-M0 leave the ID
 register values in the ARMCPU struct as zero, but this conflicts with
 our design decision to make QEMU behaviour be keyed off ID register
 fields wherever possible.
 Explicitly code the ID registers in the NVIC to return 0 if the Main
 Extension is not implemented, so we can make the M0 model set the
 ARMCPU struct fields to obtain the correct behaviour without those
 values becoming guest-visible.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200910173855.4068-4-peter.maydell@linaro.org
 Message-id: 20180824161819.11085-1-peter.maydell@linaro.org
 ---
- hw/intc/gic_internal.h   |  2 --
+ hw/intc/armv7m_nvic.c | 42 ++++++++++++++++++++++++++++++++++++++++++
- hw/intc/arm_gic.c        | 31 ++++++++++++++-----------------
+file changed, 42 insertions(+)
  hw/intc/arm_gic_common.c |  1 -
 files changed, 14 insertions(+), 20 deletions(-)
-diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gic_internal.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/gic_internal.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+                       "Aux Fault status registers unimplemented\n");
- #define ALL_CPU_MASK ((unsigned)(((1 << GIC_NCPU) - 1)))
+         return 0;
+     case 0xd40: /* PFR0.  */
--#define GIC_BASE_IRQ 0
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
--
++            goto bad_offset;
- #define GIC_DIST_SET_ENABLED(irq, cm) (s->irq_state[irq].enabled |= (cm))
++        }
- #define GIC_DIST_CLEAR_ENABLED(irq, cm) (s->irq_state[irq].enabled &= ~(cm))
+         return cpu->isar.id_pfr0;
- #define GIC_DIST_TEST_ENABLED(irq, cm) ((s->irq_state[irq].enabled & (cm)) != 0)
+     case 0xd44: /* PFR1.  */
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-index XXXXXXX..XXXXXXX 100644
++            goto bad_offset;
---- a/hw/intc/arm_gic.c
++        }
-+++ b/hw/intc/arm_gic.c
+         return cpu->isar.id_pfr1;
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
+     case 0xd48: /* DFR0.  */
-             res = 0;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-             if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
++            goto bad_offset;
-                 /* Every byte offset holds 8 group status bits */
++        }
--                irq = (offset - 0x080) * 8 + GIC_BASE_IRQ;
+         return cpu->isar.id_dfr0;
-+                irq = (offset - 0x080) * 8;
+     case 0xd4c: /* AFR0.  */
-                 if (irq >= s->num_irq) {
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-                     goto bad_reg;
++            goto bad_offset;
-                 }
++        }
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
+         return cpu->id_afr0;
-             irq = (offset - 0x100) * 8;
+     case 0xd50: /* MMFR0.  */
-         else
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-             irq = (offset - 0x180) * 8;
++            goto bad_offset;
--        irq += GIC_BASE_IRQ;
++        }
-         if (irq >= s->num_irq)
+         return cpu->isar.id_mmfr0;
-             goto bad_reg;
+     case 0xd54: /* MMFR1.  */
-         res = 0;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
++            goto bad_offset;
-             irq = (offset - 0x200) * 8;
++        }
-         else
+         return cpu->isar.id_mmfr1;
-             irq = (offset - 0x280) * 8;
+     case 0xd58: /* MMFR2.  */
--        irq += GIC_BASE_IRQ;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-         if (irq >= s->num_irq)
++            goto bad_offset;
-             goto bad_reg;
++        }
-         res = 0;
+         return cpu->isar.id_mmfr2;
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
+     case 0xd5c: /* MMFR3.  */
-             goto bad_reg;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-         }
++            goto bad_offset;
++        }
--        irq += GIC_BASE_IRQ;
+         return cpu->isar.id_mmfr3;
-         if (irq >= s->num_irq)
+     case 0xd60: /* ISAR0.  */
-             goto bad_reg;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-         res = 0;
++            goto bad_offset;
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
++        }
-         }
+         return cpu->isar.id_isar0;
-     } else if (offset < 0x800) {
+     case 0xd64: /* ISAR1.  */
-         /* Interrupt Priority.  */
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
--        irq = (offset - 0x400) + GIC_BASE_IRQ;
++            goto bad_offset;
-+        irq = (offset - 0x400);
++        }
-         if (irq >= s->num_irq)
+         return cpu->isar.id_isar1;
-             goto bad_reg;
+     case 0xd68: /* ISAR2.  */
-         res = gic_dist_get_priority(s, cpu, irq, attrs);
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
++            goto bad_offset;
-             /* For uniprocessor GICs these RAZ/WI */
++        }
-             res = 0;
+         return cpu->isar.id_isar2;
-         } else {
+     case 0xd6c: /* ISAR3.  */
--            irq = (offset - 0x800) + GIC_BASE_IRQ;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-+            irq = (offset - 0x800);
++            goto bad_offset;
-             if (irq >= s->num_irq) {
++        }
-                 goto bad_reg;
+         return cpu->isar.id_isar3;
-             }
+     case 0xd70: /* ISAR4.  */
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-         }
++            goto bad_offset;
-     } else if (offset < 0xf00) {
++        }
-         /* Interrupt Configuration.  */
+         return cpu->isar.id_isar4;
--        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
+     case 0xd74: /* ISAR5.  */
-+        irq = (offset - 0xc00) * 4;
++        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-         if (irq >= s->num_irq)
++            goto bad_offset;
-             goto bad_reg;
++        }
-         res = 0;
+         return cpu->isar.id_isar5;
-@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
+     case 0xd78: /* CLIDR */
-              */
+         return cpu->clidr;
              if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
                  /* Every byte offset holds 8 group status bits */
 -                irq = (offset - 0x80) * 8 + GIC_BASE_IRQ;
 +                irq = (offset - 0x80) * 8;
                  if (irq >= s->num_irq) {
                      goto bad_reg;
                  }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0x180) {
          /* Interrupt Set Enable.  */
 -        irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x100) * 8;
          if (irq >= s->num_irq)
              goto bad_reg;
          if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0x200) {
          /* Interrupt Clear Enable.  */
 -        irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x180) * 8;
          if (irq >= s->num_irq)
              goto bad_reg;
          if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0x280) {
          /* Interrupt Set Pending.  */
 -        irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x200) * 8;
          if (irq >= s->num_irq)
              goto bad_reg;
          if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0x300) {
          /* Interrupt Clear Pending.  */
 -        irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x280) * 8;
          if (irq >= s->num_irq)
              goto bad_reg;
          if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
              goto bad_reg;
          }
 -        irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x300) * 8;
          if (irq >= s->num_irq) {
              goto bad_reg;
          }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
              goto bad_reg;
          }
 -        irq = (offset - 0x380) * 8 + GIC_BASE_IRQ;
 +        irq = (offset - 0x380) * 8;
          if (irq >= s->num_irq) {
              goto bad_reg;
          }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0x800) {
          /* Interrupt Priority.  */
 -        irq = (offset - 0x400) + GIC_BASE_IRQ;
 +        irq = (offset - 0x400);
          if (irq >= s->num_irq)
              goto bad_reg;
          gic_dist_set_priority(s, cpu, irq, value, attrs);
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
           * annoying exception of the 11MPCore's GIC.
           */
          if (s->num_cpu != 1 || s->revision == REV_11MPCORE) {
 -            irq = (offset - 0x800) + GIC_BASE_IRQ;
 +            irq = (offset - 0x800);
              if (irq >= s->num_irq) {
                  goto bad_reg;
              }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          }
      } else if (offset < 0xf00) {
          /* Interrupt Configuration.  */
 -        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
 +        irq = (offset - 0xc00) * 4;
          if (irq >= s->num_irq)
              goto bad_reg;
          if (irq < GIC_NR_SGIS)
 diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic_common.c
 +++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
                     s->num_cpu, GIC_NCPU);
          return;
      }
 -    s->num_irq += GIC_BASE_IRQ;
      if (s->num_irq > GIC_MAXIRQ) {
          error_setg(errp,
                     "requested %u interrupt lines exceeds GIC maximum %d",
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 12/21] hw/intc/arm_gic: Document QEMU interface
+[PULL 04/18] target/arm: Add ID register values for Cortex-M0
-The GICv2's QEMU interface (sysbus MMIO regions, IRQs,
+Give the Cortex-M0 ID register values corresponding to its
-etc) is now quite complicated with the addition of the
+implemented behaviour.  These will not be guest-visible but will be
-virtualization extensions. Add a comment in the header
+used to govern the behaviour of QEMU's emulation.  We use the same
-file which documents it.
+values that the Cortex-M3 does.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180823103818.31189-1-peter.maydell@linaro.org
+Message-id: 20200910173855.4068-5-peter.maydell@linaro.org
 ---
- include/hw/intc/arm_gic.h | 43 +++++++++++++++++++++++++++++++++++++++
+ target/arm/cpu_tcg.c | 24 ++++++++++++++++++++++++
-file changed, 43 insertions(+)
+file changed, 24 insertions(+)
-diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
+diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gic.h
+--- a/target/arm/cpu_tcg.c
-+++ b/include/hw/intc/arm_gic.h
++++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void cortex_m0_initfn(Object *obj)
-  * with this program; if not, see <http://www.gnu.org/licenses/>.
+     set_feature(&cpu->env, ARM_FEATURE_M);
-  */
+     cpu->midr = 0x410cc200;
 +/*
 + * QEMU interface:
 + *  + QOM property "num-cpu": number of CPUs to support
 + *  + QOM property "num-irq": number of IRQs (including both SPIs and PPIs)
 + *  + QOM property "revision": GIC version (1 or 2), or 0 for the 11MPCore GIC
 + *  + QOM property "has-security-extensions": set true if the GIC should
 + *    implement the security extensions
 + *  + QOM property "has-virtualization-extensions": set true if the GIC should
 + *    implement the virtualization extensions
 + *  + unnamed GPIO inputs: (where P is number of SPIs, i.e. num-irq - 32)
 + *    [0..P-1]  SPIs
 + *    [P..P+31] PPIs for CPU 0
 + *    [P+32..P+63] PPIs for CPU 1
 + *    ...
 + *  + sysbus IRQs: (in order; number will vary depending on number of cores)
 + *    - IRQ for CPU 0
 + *    - IRQ for CPU 1
 + *      ...
 + *    - FIQ for CPU 0
 + *    - FIQ for CPU 1
 + *      ...
 + *    - VIRQ for CPU 0 (exists even if virt extensions not present)
 + *    - VIRQ for CPU 1 (exists even if virt extensions not present)
 + *      ...
 + *    - VFIQ for CPU 0 (exists even if virt extensions not present)
 + *    - VFIQ for CPU 1 (exists even if virt extensions not present)
 + *      ...
 + *    - maintenance IRQ for CPU i/f 0 (only if virt extensions present)
 + *    - maintenance IRQ for CPU i/f 1 (only if virt extensions present)
 + *  + sysbus MMIO regions: (in order; numbers will vary depending on
 + *    whether virtualization extensions are present and on number of cores)
 + *    - distributor registers (GICD*)
 + *    - CPU interface for the accessing core (GICC*)
 + *    - virtual interface control registers (GICH*) (only if virt extns present)
 + *    - virtual CPU interface for the accessing core (GICV*) (only if virt)
 + *    - CPU 0 CPU interface registers
 + *    - CPU 1 CPU interface registers
 + *      ...
 + *    - CPU 0 virtual interface control registers (only if virt extns present)
 + *    - CPU 1 virtual interface control registers (only if virt extns present)
 + *      ...
 + */
 +
- #ifndef HW_ARM_GIC_H
++    /*
- #define HW_ARM_GIC_H
++     * These ID register values are not guest visible, because
++     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 +     * features, because QEMU generally controls its emulation
 +     * by looking at ID register fields. We use the same values as
 +     * for the M3.
 +     */
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
  }
  static void cortex_m3_initfn(Object *obj)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 08/21] aspeed/i2c: Handle receive command in separate function
+[PULL 05/18] target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile
-From: Guenter Roeck <linux@roeck-us.net>
+The M-profile definition of the MVFR1 ID register differs slightly
 from the A-profile one, and in particular the check for "does the CPU
 support fp16 arithmetic" is not the same.
-Receive command handling may have to be deferred if a previous receive
+We don't currently implement any M-profile CPUs with fp16 arithmetic,
-done interrupt was not yet acknowledged. Move receive command handling
+so this is not yet a visible bug, but correcting the logic now
-into a separate function to prepare for the necessary changes.
+disarms this beartrap for when we eventually do.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20180914063506.20815-3-clg@kaod.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200910173855.4068-6-peter.maydell@linaro.org
 ---
- hw/i2c/aspeed_i2c.c | 37 +++++++++++++++++++++----------------
+ target/arm/cpu.h | 31 ++++++++++++++++++++++++++-----
-file changed, 21 insertions(+), 16 deletions(-)
+file changed, 26 insertions(+), 5 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/target/arm/cpu.h
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
-     return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
+ FIELD(ID_MMFR4, CCIDX, 24, 4)
  FIELD(ID_MMFR4, EVT, 28, 4)
 +FIELD(ID_PFR1, PROGMOD, 0, 4)
 +FIELD(ID_PFR1, SECURITY, 4, 4)
 +FIELD(ID_PFR1, MPROGMOD, 8, 4)
 +FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
 +FIELD(ID_PFR1, GENTIMER, 16, 4)
 +FIELD(ID_PFR1, SEC_FRAC, 20, 4)
 +FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
 +FIELD(ID_PFR1, GIC, 28, 4)
 +
  FIELD(ID_AA64ISAR0, AES, 4, 4)
  FIELD(ID_AA64ISAR0, SHA1, 8, 4)
  FIELD(ID_AA64ISAR0, SHA2, 12, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(MVFR0, FPROUND, 28, 4)
  FIELD(MVFR1, FPFTZ, 0, 4)
  FIELD(MVFR1, FPDNAN, 4, 4)
 -FIELD(MVFR1, SIMDLS, 8, 4)
 -FIELD(MVFR1, SIMDINT, 12, 4)
 -FIELD(MVFR1, SIMDSP, 16, 4)
 -FIELD(MVFR1, SIMDHP, 20, 4)
 +FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
 +FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
 +FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
 +FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
 +FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
 +FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
  FIELD(MVFR1, FPHP, 24, 4)
  FIELD(MVFR1, SIMDFMAC, 28, 4)
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
      return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
  }
-+static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
++static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
 +{
-+    int ret;
++    return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
 +
 +    aspeed_i2c_set_state(bus, I2CD_MRXD);
 +    ret = i2c_recv(bus->bus);
 +    if (ret < 0) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
 +        ret = 0xff;
 +    } else {
 +        bus->intr_status |= I2CD_INTR_RX_DONE;
 +    }
 +    bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
 +    if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
 +        i2c_nack(bus->bus);
 +    }
 +    bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
 +    aspeed_i2c_set_state(bus, I2CD_MACTIVE);
 +}
 +
- /*
+ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
-  * The state machine needs some refinement. It is only used to track
+ {
-  * invalid STOP commands for the moment.
+-    return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
++    /* Sadly this is encoded differently for A-profile and M-profile */
-     }
++    if (isar_feature_aa32_mprofile(id)) {
++        return FIELD_EX32(id->mvfr1, MVFR1, FP16) > 0;
-     if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
++    } else {
--        int ret;
++        return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
--
++    }
--        aspeed_i2c_set_state(bus, I2CD_MRXD);
+ }
--        ret = i2c_recv(bus->bus);
--        if (ret < 0) {
+ static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
 -            qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
 -            ret = 0xff;
 -        } else {
 -            bus->intr_status |= I2CD_INTR_RX_DONE;
 -        }
 -        bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
 -        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
 -            i2c_nack(bus->bus);
 -        }
 -        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
 -        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
 +        aspeed_i2c_handle_rx_cmd(bus);
      }
      if (bus->cmd & I2CD_M_STOP_CMD) {
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 17/21] aspeed/timer: fix compile breakage with clang 3.4.2
+[PULL 06/18] target/arm: Fix sve ldr/str
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-In file included from /home/thuth/devel/qemu/hw/timer/aspeed_timer.c:16:
+The mte update missed a bit when producing clean addresses.
 /home/thuth/devel/qemu/include/hw/misc/aspeed_scu.h:37:3: error:
 redefinition of typedef 'AspeedSCUState' is a C11 feature
       [-Werror,-Wtypedef-redefinition]
 } AspeedSCUState;
   ^
 /home/thuth/devel/qemu/include/hw/timer/aspeed_timer.h:27:31: note:
 previous definition is here
 typedef struct AspeedSCUState AspeedSCUState;
-Reported-by: Thomas Huth <thuth@redhat.com>
+Fixes: b2aa8879b88
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200916014102.2446323-1-richard.henderson@linaro.org
 Message-id: 20180921161939.822-2-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/aspeed_timer.h | 3 +--
+ target/arm/translate-sve.c | 4 ++--
- hw/timer/aspeed_timer.c         | 1 -
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 1 insertion(+), 3 deletions(-)
-diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/aspeed_timer.h
+--- a/target/arm/translate-sve.c
-+++ b/include/hw/timer/aspeed_timer.h
++++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
- #define ASPEED_TIMER_H
+         for (i = 0; i < len_align; i += 8) {
+             tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEQ);
- #include "qemu/timer.h"
+             tcg_gen_st_i64(t0, cpu_env, vofs + i);
--
+-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
--typedef struct AspeedSCUState AspeedSCUState;
++            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
-+#include "hw/misc/aspeed_scu.h"
+         }
+         tcg_temp_free_i64(t0);
- #define ASPEED_TIMER(obj) \
+     } else {
-     OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER);
+@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+         for (i = 0; i < len_align; i += 8) {
-index XXXXXXX..XXXXXXX 100644
+             tcg_gen_ld_i64(t0, cpu_env, vofs + i);
---- a/hw/timer/aspeed_timer.c
+             tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEQ);
-+++ b/hw/timer/aspeed_timer.c
+-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
-@@ -XXX,XX +XXX,XX @@
++            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
- #include "qapi/error.h"
+         }
- #include "hw/sysbus.h"
+         tcg_temp_free_i64(t0);
- #include "hw/timer/aspeed_timer.h"
+     } else {
 -#include "hw/misc/aspeed_scu.h"
  #include "qemu-common.h"
  #include "qemu/bitops.h"
  #include "qemu/timer.h"
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 18/21] hw/arm/aspeed: change the FMC flash model of the AST2500 evb
+[PULL 07/18] target/arm: Fix SVE splice
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The AST2500 evb is shipped with a W25Q256 which has a non volatile bit
+While converting to gen_gvec_ool_zzzp, we lost passing
-to make the chip operate in 4 Byte address mode at power up. This
+a->esz as the data argument to the function.
 should be an interesting feature to model as it will exercise a bit
 more the SMC controllers and MMIO execution at boot time.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Fixes: 36cbb7a8e71
-Message-id: 20180921161939.822-3-clg@kaod.org
+Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200918000500.2690937-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed.c | 2 +-
+ target/arm/translate-sve.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/arm/translate-sve.c
-+++ b/hw/arm/aspeed.c
++++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
+@@ -XXX,XX +XXX,XX @@ static bool trans_SPLICE(DisasContext *s, arg_rprr_esz *a)
-     [AST2500_EVB]  = {
+ {
-         .soc_name  = "ast2500-a1",
+     if (sve_access_check(s)) {
-         .hw_strap1 = AST2500_EVB_HW_STRAP1,
+         gen_gvec_ool_zzzp(s, gen_helper_sve_splice,
--        .fmc_model = "n25q256a",
+-                          a->rd, a->rn, a->rm, a->pg, 0);
-+        .fmc_model = "w25q256",
++                          a->rd, a->rn, a->rm, a->pg, a->esz);
-         .spi_model = "mx25l25635e",
+     }
-         .num_cs    = 1,
+     return true;
-         .i2c_init  = ast2500_evb_i2c_init,
+ }
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 05/21] arm: Add Nordic Semiconductor nRF51 SoC
+[PULL 08/18] hw/arm/raspi: Define various blocks base addresses
-From: Joel Stanley <joel@jms.id.au>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The nRF51 is a Cortex-M0 microcontroller with an on-board radio module,
+The Raspberry firmware is closed-source. While running it, it
-plus other common ARM SoC peripherals.
+accesses various I/O registers. Logging these accesses as UNIMP
 (unimplemented) help to understand what the firmware is doing
 (ideally we want it able to boot a Linux kernel).
- http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf
+Document various blocks we might use later.
-This defines a basic model of the CPU and memory, with no peripherals
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-implemented at this stage.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+Message-id: 20200921034729.432931-2-f4bug@amsat.org
 Message-id: 20180831220920.27113-3-joel@jms.id.au
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: wrapped a few long lines]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs            |   1 +
+ include/hw/arm/raspi_platform.h | 51 +++++++++++++++++++++++++++------
- include/hw/arm/nrf51_soc.h      |  41 ++++++++++
+file changed, 43 insertions(+), 8 deletions(-)
  hw/arm/nrf51_soc.c              | 133 ++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   1 +
 files changed, 176 insertions(+)
  create mode 100644 include/hw/arm/nrf51_soc.h
  create mode 100644 hw/arm/nrf51_soc.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/include/hw/arm/raspi_platform.h
-+++ b/hw/arm/Makefile.objs
++++ b/include/hw/arm/raspi_platform.h
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IOTKIT) += iotkit.o
  obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
  obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
  obj-$(CONFIG_FSL_IMX6UL) += fsl-imx6ul.o mcimx6ul-evk.o
 +obj-$(CONFIG_NRF51_SOC) += nrf51_soc.o
 diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/nrf51_soc.h
 @@ -XXX,XX +XXX,XX @@
-+/*
+  * You should have received a copy of the GNU General Public License
-+ * Nordic Semiconductor nRF51  SoC
+  * along with this program; if not, write to the Free Software
   * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 + *
-+ * Copyright 2018 Joel Stanley <joel@jms.id.au>
++ * Various undocumented addresses and names come from Herman Hermitage's VC4
-+ *
++ * documentation:
-+ * This code is licensed under the GPL version 2 or later.  See
++ * https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
-+ * the COPYING file in the top-level directory.
+  */
-+ */
-+
+ #ifndef HW_ARM_RASPI_PLATFORM_H
-+#ifndef NRF51_SOC_H
+ #define HW_ARM_RASPI_PLATFORM_H
-+#define NRF51_SOC_H
-+
+ #define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
-+#include "hw/sysbus.h"
+-#define IC0_OFFSET              0x2000
-+#include "hw/arm/armv7m.h"
++#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
-+
++#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
-+#define TYPE_NRF51_SOC "nrf51-soc"
+ #define ST_OFFSET               0x3000   /* System Timer */
-+#define NRF51_SOC(obj) \
++#define TXP_OFFSET              0x4000   /* Transposer */
-+    OBJECT_CHECK(NRF51State, (obj), TYPE_NRF51_SOC)
++#define JPEG_OFFSET             0x5000
-+
+ #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
-+typedef struct NRF51State {
+ #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
-+    /*< private >*/
+-#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
-+    SysBusDevice parent_obj;
++#define ARBA_OFFSET             0x9000
-+
++#define BRDG_OFFSET             0xa000
-+    /*< public >*/
++#define ARM_OFFSET              0xB000   /* ARM control block */
-+    ARMv7MState cpu;
+ #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
-+
+ #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
-+    MemoryRegion iomem;
+-#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
-+    MemoryRegion sram;
++#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
-+    MemoryRegion flash;
+ #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
-+
+                                                       * Doorbells & Mailboxes */
-+    uint32_t sram_size;
+ #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
 +    uint32_t flash_size;
 +
 +    MemoryRegion *board_memory;
 +
 +    MemoryRegion container;
 +
 +} NRF51State;
 +
 +#endif
 +
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/nrf51_soc.c
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #define AVS_OFFSET              0x103000 /* Audio Video Standard */
-+ * Nordic Semiconductor nRF51 SoC
+ #define RNG_OFFSET              0x104000
-+ * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.1.pdf
+ #define GPIO_OFFSET             0x200000
-+ *
+-#define UART0_OFFSET            0x201000
-+ * Copyright 2018 Joel Stanley <joel@jms.id.au>
+-#define MMCI0_OFFSET            0x202000
-+ *
+-#define I2S_OFFSET              0x203000
-+ * This code is licensed under the GPL version 2 or later.  See
+-#define SPI0_OFFSET             0x204000
-+ * the COPYING file in the top-level directory.
++#define UART0_OFFSET            0x201000 /* PL011 */
-+ */
++#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
-+
++#define I2S_OFFSET              0x203000 /* PCM */
-+#include "qemu/osdep.h"
++#define SPI0_OFFSET             0x204000 /* SPI master */
-+#include "qapi/error.h"
+ #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
-+#include "qemu-common.h"
++#define PIXV0_OFFSET            0x206000
-+#include "hw/arm/arm.h"
++#define PIXV1_OFFSET            0x207000
-+#include "hw/sysbus.h"
++#define DPI_OFFSET              0x208000
-+#include "hw/boards.h"
++#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
-+#include "hw/devices.h"
++#define PWM_OFFSET              0x20c000
-+#include "hw/misc/unimp.h"
++#define PERM_OFFSET             0x20d000
-+#include "exec/address-spaces.h"
++#define TEC_OFFSET              0x20e000
-+#include "sysemu/sysemu.h"
+ #define OTP_OFFSET              0x20f000
-+#include "qemu/log.h"
++#define SLIM_OFFSET             0x210000 /* SLIMbus */
-+#include "cpu.h"
++#define CPG_OFFSET              0x211000
-+
+ #define THERMAL_OFFSET          0x212000
-+#include "hw/arm/nrf51_soc.h"
+-#define BSC_SL_OFFSET           0x214000 /* SPI slave */
-+
++#define AVSP_OFFSET             0x213000
-+#define IOMEM_BASE      0x40000000
++#define BSC_SL_OFFSET           0x214000 /* SPI slave (bootrom) */
-+#define IOMEM_SIZE      0x20000000
+ #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
-+
+ #define EMMC1_OFFSET            0x300000
-+#define FICR_BASE       0x10000000
++#define EMMC2_OFFSET            0x340000
-+#define FICR_SIZE       0x000000fc
++#define HVS_OFFSET              0x400000
-+
+ #define SMI_OFFSET              0x600000
-+#define FLASH_BASE      0x00000000
++#define DSI1_OFFSET             0x700000
-+#define SRAM_BASE       0x20000000
++#define UCAM_OFFSET             0x800000
-+
++#define CMI_OFFSET              0x802000
-+#define PRIVATE_BASE    0xF0000000
+ #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
-+#define PRIVATE_SIZE    0x10000000
+ #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
-+
++#define VECA_OFFSET             0x806000
-+/*
++#define PIXV2_OFFSET            0x807000
-+ * The size and base is for the NRF51822 part. If other parts
++#define HDMI_OFFSET             0x808000
-+ * are supported in the future, add a sub-class of NRF51SoC for
++#define HDCP_OFFSET             0x809000
-+ * the specific variants
++#define ARBR0_OFFSET            0x80a000
-+ */
+ #define DBUS_OFFSET             0x900000
-+#define NRF51822_FLASH_SIZE     (256 * 1024)
+ #define AVE0_OFFSET             0x910000
-+#define NRF51822_SRAM_SIZE      (16 * 1024)
+ #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
-+
++#define V3D_OFFSET              0xc00000
-+static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+ #define SDRAMC_OFFSET           0xe00000
-+{
++#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
-+    NRF51State *s = NRF51_SOC(dev_soc);
++#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
-+    Error *err = NULL;
++#define ARBR1_OFFSET            0xe04000
-+
+ #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
-+    if (!s->board_memory) {
++#define DCRC_OFFSET             0xe07000
-+        error_setg(errp, "memory property was not set");
++#define AXIP_OFFSET             0xe08000
-+        return;
-+    }
+ /* GPU interrupts */
-+
+ #define INTERRUPT_TIMER0               0
 +    object_property_set_link(OBJECT(&s->cpu), OBJECT(&s->container), "memory",
 +            &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -1);
 +
 +    memory_region_init_rom(&s->flash, OBJECT(s), "nrf51.flash", s->flash_size,
 +            &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(&s->container, FLASH_BASE, &s->flash);
 +
 +    memory_region_init_ram(&s->sram, NULL, "nrf51.sram", s->sram_size, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
 +
 +    create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
 +    create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
 +    create_unimplemented_device("nrf51_soc.private",
 +                                PRIVATE_BASE, PRIVATE_SIZE);
 +}
 +
 +static void nrf51_soc_init(Object *obj)
 +{
 +    NRF51State *s = NRF51_SOC(obj);
 +
 +    memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
 +
 +    sysbus_init_child_obj(OBJECT(s), "armv6m", OBJECT(&s->cpu), sizeof(s->cpu),
 +                          TYPE_ARMV7M);
 +    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
 +                         ARM_CPU_TYPE_NAME("cortex-m0"));
 +    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
 +}
 +
 +static Property nrf51_soc_properties[] = {
 +    DEFINE_PROP_LINK("memory", NRF51State, board_memory, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("sram-size", NRF51State, sram_size, NRF51822_SRAM_SIZE),
 +    DEFINE_PROP_UINT32("flash-size", NRF51State, flash_size,
 +                       NRF51822_FLASH_SIZE),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void nrf51_soc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = nrf51_soc_realize;
 +    dc->props = nrf51_soc_properties;
 +}
 +
 +static const TypeInfo nrf51_soc_info = {
 +    .name          = TYPE_NRF51_SOC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(NRF51State),
 +    .instance_init = nrf51_soc_init,
 +    .class_init    = nrf51_soc_class_init,
 +};
 +
 +static void nrf51_soc_types(void)
 +{
 +    type_register_static(&nrf51_soc_info);
 +}
 +type_init(nrf51_soc_types)
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_SYSCFG=y
  CONFIG_STM32F2XX_ADC=y
  CONFIG_STM32F2XX_SPI=y
  CONFIG_STM32F205_SOC=y
 +CONFIG_NRF51_SOC=y
  CONFIG_CMSDK_APB_TIMER=y
  CONFIG_CMSDK_APB_DUALTIMER=y
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 14/21] hw/net/pcnet-pci: Convert away from old_mmio accessors
+[PULL 09/18] hw/arm/bcm2835: Add more unimplemented peripherals
-Convert the pcnet-pci device away from using the old_mmio
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 MemoryRegionOps accessor functions.
-This commit is a no-behaviour-change API conversion.
+The bcm2835-v3d is used since Linux 4.7, see commit
-(Since PCNET_PNPMMIO_SIZE is 0x20, the old "addr & 0x10"
+ac67e0c39c ("ARM: bcm2835: Add VC4 to the device tree"),
-check and the new "addr < 0x10" check are exact opposites;
+and the bcm2835-txp since Linux 4.19, see commit
-the new code is phrased to be parallel with the
+b7dd29b401f5 ("ARM: dts: bcm283x: Add Transposer block").
 pcnet_io_read/write functions.)
-I have left a TODO comment marker because the similarity
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-between the MMIO and IO accessor behaviour is suspicious
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-and they could be combined, but this will be left to a
+Message-id: 20200921034729.432931-3-f4bug@amsat.org
 different patch.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/pcnet-pci.c  | 133 ++++++++++++++++++--------------------------
+ include/hw/arm/bcm2835_peripherals.h | 2 ++
- hw/net/trace-events |   8 +--
+ hw/arm/bcm2835_peripherals.c         | 2 ++
-files changed, 57 insertions(+), 84 deletions(-)
+files changed, 4 insertions(+)
-diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
+diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/pcnet-pci.c
+--- a/include/hw/arm/bcm2835_peripherals.h
-+++ b/hw/net/pcnet-pci.c
++++ b/include/hw/arm/bcm2835_peripherals.h
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pcnet_io_ops = {
+@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
-     .endianness = DEVICE_LITTLE_ENDIAN,
- };
+     BCM2835SystemTimerState systmr;
+     BCM2835MphiState mphi;
--static void pcnet_mmio_writeb(void *opaque, hwaddr addr, uint32_t val)
++    UnimplementedDeviceState txp;
-+/*
+     UnimplementedDeviceState armtmr;
-+ * TODO: should MMIO accesses to the addresses corresponding to the
+     UnimplementedDeviceState cprman;
-+ * APROM also honour the BCR_DWIO() setting? If so, then these functions
+     UnimplementedDeviceState a2w;
-+ * and pcnet_ioport_write/pcnet_ioport_read could be merged.
+@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
-+ * If not, then should pcnet_ioport_{read,write}{w,l} really check
+     UnimplementedDeviceState otp;
-+ * BCR_DWIO() for MMIO writes ?
+     UnimplementedDeviceState dbus;
-+ */
+     UnimplementedDeviceState ave0;
-+static void pcnet_mmio_write(void *opaque, hwaddr addr, uint64_t value,
++    UnimplementedDeviceState v3d;
-+                             unsigned size)
+     UnimplementedDeviceState bscsl;
- {
+     UnimplementedDeviceState smi;
-     PCNetState *d = opaque;
+     DWC2State dwc2;
+diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
--    trace_pcnet_mmio_writeb(opaque, addr, val);
+index XXXXXXX..XXXXXXX 100644
--    if (!(addr & 0x10))
+--- a/hw/arm/bcm2835_peripherals.c
--        pcnet_aprom_writeb(d, addr & 0x0f, val);
++++ b/hw/arm/bcm2835_peripherals.c
--}
+@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
-+    trace_pcnet_mmio_write(opaque, addr, size, val);
+         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
+                                INTERRUPT_USB));
--static uint32_t pcnet_mmio_readb(void *opaque, hwaddr addr)
--{
++    create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
--    PCNetState *d = opaque;
+     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
--    uint32_t val = -1;
+     create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
--
+     create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
--    if (!(addr & 0x10))
+@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
--        val = pcnet_aprom_readb(d, addr & 0x0f);
+     create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
--    trace_pcnet_mmio_readb(opaque, addr, val);
+     create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
--    return val;
+     create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
--}
++    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x1000);
--
+     create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 -static void pcnet_mmio_writew(void *opaque, hwaddr addr, uint32_t val)
 -{
 -    PCNetState *d = opaque;
 -
 -    trace_pcnet_mmio_writew(opaque, addr, val);
 -    if (addr & 0x10)
 -        pcnet_ioport_writew(d, addr & 0x0f, val);
 -    else {
 -        addr &= 0x0f;
 -        pcnet_aprom_writeb(d, addr, val & 0xff);
 -        pcnet_aprom_writeb(d, addr+1, (val & 0xff00) >> 8);
 +    if (addr < 0x10) {
 +        if (size == 1) {
 +            pcnet_aprom_writeb(d, addr, data);
 +        } else if ((addr & 1) == 0 && size == 2) {
 +            pcnet_aprom_writeb(d, addr, data & 0xff);
 +            pcnet_aprom_writeb(d, addr + 1, data >> 8);
 +        } else if ((addr & 3) == 0 && size == 4) {
 +            pcnet_aprom_writeb(d, addr, data & 0xff);
 +            pcnet_aprom_writeb(d, addr + 1, (data >> 8) & 0xff);
 +            pcnet_aprom_writeb(d, addr + 2, (data >> 16) & 0xff);
 +            pcnet_aprom_writeb(d, addr + 3, data >> 24);
 +        }
 +    } else {
 +        if (size == 2) {
 +            pcnet_ioport_writew(d, addr, data);
 +        } else if (size == 4) {
 +            pcnet_ioport_writel(d, addr, data);
 +        }
      }
  }
--static uint32_t pcnet_mmio_readw(void *opaque, hwaddr addr)
--{
--    PCNetState *d = opaque;
--    uint32_t val = -1;
--
--    if (addr & 0x10)
--        val = pcnet_ioport_readw(d, addr & 0x0f);
--    else {
--        addr &= 0x0f;
--        val = pcnet_aprom_readb(d, addr+1);
--        val <<= 8;
--        val |= pcnet_aprom_readb(d, addr);
--    }
--    trace_pcnet_mmio_readw(opaque, addr, val);
--    return val;
--}
--
--static void pcnet_mmio_writel(void *opaque, hwaddr addr, uint32_t val)
-+static uint64_t pcnet_mmio_read(void *opque, hwaddr addr, unsigned size)
- {
-     PCNetState *d = opaque;
--    trace_pcnet_mmio_writel(opaque, addr, val);
--    if (addr & 0x10)
--        pcnet_ioport_writel(d, addr & 0x0f, val);
--    else {
--        addr &= 0x0f;
--        pcnet_aprom_writeb(d, addr, val & 0xff);
--        pcnet_aprom_writeb(d, addr+1, (val & 0xff00) >> 8);
--        pcnet_aprom_writeb(d, addr+2, (val & 0xff0000) >> 16);
--        pcnet_aprom_writeb(d, addr+3, (val & 0xff000000) >> 24);
--    }
--}
-+    trace_pcnet_ioport_read(opaque, addr, size);
--static uint32_t pcnet_mmio_readl(void *opaque, hwaddr addr)
--{
--    PCNetState *d = opaque;
--    uint32_t val;
--
--    if (addr & 0x10)
--        val = pcnet_ioport_readl(d, addr & 0x0f);
--    else {
--        addr &= 0x0f;
--        val = pcnet_aprom_readb(d, addr+3);
--        val <<= 8;
--        val |= pcnet_aprom_readb(d, addr+2);
--        val <<= 8;
--        val |= pcnet_aprom_readb(d, addr+1);
--        val <<= 8;
--        val |= pcnet_aprom_readb(d, addr);
-+    if (addr < 0x10) {
-+        if (size == 1) {
-+            return pcnet_aprom_readb(d, addr);
-+        } else if ((addr & 1) == 0 && size == 2) {
-+            return pcnet_aprom_readb(d, addr) |
-+                   (pcnet_aprom_readb(d, addr + 1) << 8);
-+        } else if ((addr & 3) == 0 && size == 4) {
-+            return pcnet_aprom_readb(d, addr) |
-+                   (pcnet_aprom_readb(d, addr + 1) << 8) |
-+                   (pcnet_aprom_readb(d, addr + 2) << 16) |
-+                   (pcnet_aprom_readb(d, addr + 3) << 24);
-+        }
-+    } else {
-+        if (size == 2) {
-+            return pcnet_ioport_readw(d, addr);
-+        } else if (size == 4) {
-+            return pcnet_ioport_readl(d, addr);
-+        }
-     }
--    trace_pcnet_mmio_readl(opaque, addr, val);
--    return val;
-+    return ((uint64_t)1 << (size * 8)) - 1;
- }
- static const VMStateDescription vmstate_pci_pcnet = {
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pci_pcnet = {
- /* PCI interface */
- static const MemoryRegionOps pcnet_mmio_ops = {
--    .old_mmio = {
--        .read = { pcnet_mmio_readb, pcnet_mmio_readw, pcnet_mmio_readl },
--        .write = { pcnet_mmio_writeb, pcnet_mmio_writew, pcnet_mmio_writel },
--    },
-+    .read = pcnet_mmio_read,
-+    .write = pcnet_mmio_write,
-+    .valid.min_access_size = 1,
-+    .valid.max_access_size = 4,
-+    .impl.min_access_size = 1,
-+    .impl.max_access_size = 4,
-     .endianness = DEVICE_LITTLE_ENDIAN,
- };
-diff --git a/hw/net/trace-events b/hw/net/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/trace-events
-+++ b/hw/net/trace-events
-@@ -XXX,XX +XXX,XX @@ pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x
- pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
- pcnet_ioport_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
- pcnet_ioport_write(void *opaque, uint64_t addr, uint64_t data, unsigned size) "opaque=%p addr=0x%"PRIx64" data=0x%"PRIx64" size=%d"
--pcnet_mmio_writeb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
--pcnet_mmio_writew(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
--pcnet_mmio_writel(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
--pcnet_mmio_readb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
--pcnet_mmio_readw(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
--pcnet_mmio_readl(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-+pcnet_mmio_write(void *opaque, uint64_t addr, uint32_t val, unsigned size) "opaque=%p addr=0x%"PRIx64" val=0x%x size=%d"
-+pcnet_mmio_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
- # hw/net/net_rx_pkt.c
- net_rx_pkt_parsed(bool ip4, bool ip6, bool udp, bool tcp, size_t l3o, size_t l4o, size_t l5o) "RX packet parsed: ip4: %d, ip6: %d, udp: %d, tcp: %d, l3 offset: %zu, l4 offset: %zu, l5 offset: %zu"
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 15/21] hw/net/pcnet-pci: Unify pcnet_ioport_read/write and pcnet_mmio_read/write
+[PULL 10/18] hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
-The only difference between our implementation of the pcnet ioport
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 accessors and the mmio accessors is that the former check BCR_DWIO to
 see what access widths are permitted for addresses in the aprom range
 (0x0..0xf). In fact our failure to do this in the mmio accessors
 is a bug (one which was fixed for the ioport accessors in
 commit 7ba79741970 in 2011).
-The data sheet for the Am79C970A does not describe the DWIO
+Commit 1c3db49d39 added the raspi3, which uses the same peripherals
-bit as only applying for I/O space mapped I/O resources and
+than the raspi2 (but with different ARM cores). The raspi3 was
-not memory mapped I/O resources, and our MMIO accessors already
+introduced without the ignore_memory_transaction_failures flag.
-honour DWIO for accesses in the 0x10..0x1f range (since the
+Almost 2 years later, the machine is usable running U-Boot and
-pcnet_ioport_{read,write}{w,l} functions check it).
+Linux.
+In commit 00cbd5bd74 we mapped a lot of unimplemented devices,
-The data sheet for the later but compatible Am79C976 is clearer:
+commit d442d95f added thermal block and commit 0e5bbd7406 the
-it states specifically "DWIO mode applies to both I/O- and
+system timer.
-memory-mapped acceses." This seems to be reasonable evidence
+As we are happy with the raspi3, let's remove this flag on the
-in favour of interpretating the Am79C970A spec as being the same.
+raspi2.
 (NB: Linux's pcnet driver only supports I/O accesses, so the
 MMIO access part of this device is probably untested anyway.)
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200921034729.432931-4-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/pcnet-pci.c  | 67 ++-------------------------------------------
+ hw/arm/raspi.c | 3 ---
- hw/net/trace-events |  2 --
+file changed, 3 deletions(-)
 files changed, 2 insertions(+), 67 deletions(-)
-diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/pcnet-pci.c
+--- a/hw/arm/raspi.c
-+++ b/hw/net/pcnet-pci.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pcnet_io_ops = {
+@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
-     .endianness = DEVICE_LITTLE_ENDIAN,
+     mc->default_cpus = mc->min_cpus = mc->max_cpus = cores_count(board_rev);
      mc->default_ram_size = board_ram_size(board_rev);
      mc->default_ram_id = "ram";
 -    if (board_version(board_rev) == 2) {
 -        mc->ignore_memory_transaction_failures = true;
 -    }
  };
--/*
+ static const TypeInfo raspi_machine_types[] = {
 - * TODO: should MMIO accesses to the addresses corresponding to the
 - * APROM also honour the BCR_DWIO() setting? If so, then these functions
 - * and pcnet_ioport_write/pcnet_ioport_read could be merged.
 - * If not, then should pcnet_ioport_{read,write}{w,l} really check
 - * BCR_DWIO() for MMIO writes ?
 - */
 -static void pcnet_mmio_write(void *opaque, hwaddr addr, uint64_t value,
 -                             unsigned size)
 -{
 -    PCNetState *d = opaque;
 -
 -    trace_pcnet_mmio_write(opaque, addr, size, val);
 -
 -    if (addr < 0x10) {
 -        if (size == 1) {
 -            pcnet_aprom_writeb(d, addr, data);
 -        } else if ((addr & 1) == 0 && size == 2) {
 -            pcnet_aprom_writeb(d, addr, data & 0xff);
 -            pcnet_aprom_writeb(d, addr + 1, data >> 8);
 -        } else if ((addr & 3) == 0 && size == 4) {
 -            pcnet_aprom_writeb(d, addr, data & 0xff);
 -            pcnet_aprom_writeb(d, addr + 1, (data >> 8) & 0xff);
 -            pcnet_aprom_writeb(d, addr + 2, (data >> 16) & 0xff);
 -            pcnet_aprom_writeb(d, addr + 3, data >> 24);
 -        }
 -    } else {
 -        if (size == 2) {
 -            pcnet_ioport_writew(d, addr, data);
 -        } else if (size == 4) {
 -            pcnet_ioport_writel(d, addr, data);
 -        }
 -    }
 -}
 -
 -static uint64_t pcnet_mmio_read(void *opque, hwaddr addr, unsigned size)
 -{
 -    PCNetState *d = opaque;
 -
 -    trace_pcnet_ioport_read(opaque, addr, size);
 -
 -    if (addr < 0x10) {
 -        if (size == 1) {
 -            return pcnet_aprom_readb(d, addr);
 -        } else if ((addr & 1) == 0 && size == 2) {
 -            return pcnet_aprom_readb(d, addr) |
 -                   (pcnet_aprom_readb(d, addr + 1) << 8);
 -        } else if ((addr & 3) == 0 && size == 4) {
 -            return pcnet_aprom_readb(d, addr) |
 -                   (pcnet_aprom_readb(d, addr + 1) << 8) |
 -                   (pcnet_aprom_readb(d, addr + 2) << 16) |
 -                   (pcnet_aprom_readb(d, addr + 3) << 24);
 -        }
 -    } else {
 -        if (size == 2) {
 -            return pcnet_ioport_readw(d, addr);
 -        } else if (size == 4) {
 -            return pcnet_ioport_readl(d, addr);
 -        }
 -    }
 -    return ((uint64_t)1 << (size * 8)) - 1;
 -}
 -
  static const VMStateDescription vmstate_pci_pcnet = {
      .name = "pcnet",
      .version_id = 3,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pci_pcnet = {
  /* PCI interface */
  static const MemoryRegionOps pcnet_mmio_ops = {
 -    .read = pcnet_mmio_read,
 -    .write = pcnet_mmio_write,
 +    .read = pcnet_ioport_read,
 +    .write = pcnet_ioport_write,
      .valid.min_access_size = 1,
      .valid.max_access_size = 4,
      .impl.min_access_size = 1,
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x
  pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
  pcnet_ioport_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
  pcnet_ioport_write(void *opaque, uint64_t addr, uint64_t data, unsigned size) "opaque=%p addr=0x%"PRIx64" data=0x%"PRIx64" size=%d"
 -pcnet_mmio_write(void *opaque, uint64_t addr, uint32_t val, unsigned size) "opaque=%p addr=0x%"PRIx64" val=0x%x size=%d"
 -pcnet_mmio_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
  # hw/net/net_rx_pkt.c
  net_rx_pkt_parsed(bool ip4, bool ip6, bool udp, bool tcp, size_t l3o, size_t l4o, size_t l5o) "RX packet parsed: ip4: %d, ip6: %d, udp: %d, tcp: %d, l3 offset: %zu, l4 offset: %zu, l5 offset: %zu"
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 11/21] hw/arm/smmuv3: fix eventq recording and IRQ triggerring
+[PULL 11/18] hw/arm/raspi: Display the board revision in the machine description
-From: Eric Auger <eric.auger@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The event queue management is broken today. Event records
+Display the board revision in the machine description.
 are not properly written as EVT_SET_* macro was not updating
 the actual event record. Also the event queue interrupt
 is not correctly triggered.
-Fixes: bb981004eaf4 ("hw/arm/smmuv3: Event queue recording helper")
+Before:
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20180921070138.10114-3-eric.auger@redhat.com
+  $ qemu-system-aarch64 -M help | fgrep raspi
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+  raspi2               Raspberry Pi 2B
   raspi3               Raspberry Pi 3B
 After:
   raspi2               Raspberry Pi 2B (revision 1.1)
   raspi3               Raspberry Pi 3B (revision 1.2)
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-2-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 26 +++++++++++++-------------
+ hw/arm/raspi.c | 4 +++-
- hw/arm/smmuv3.c          |  2 +-
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 14 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/hw/arm/raspi.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
+@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
+     uint32_t board_rev = (uint32_t)(uintptr_t)data;
- #define EVT_Q_OVERFLOW        (1 << 31)
+     rmc->board_rev = board_rev;
--#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
+-    mc->desc = g_strdup_printf("Raspberry Pi %s", board_type(board_rev));
--#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
++    mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
--#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
++                               board_type(board_rev),
--#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
++                               FIELD_EX32(board_rev, REV_CODE, REVISION));
--#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
+     mc->init = raspi_machine_init;
--#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
+     mc->block_default_type = IF_SD;
--#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
+     mc->no_parallel = 1;
 -#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
 -#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
 -#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
 -#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
 +#define EVT_SET_TYPE(x, v)  ((x)->word[0] = deposit32((x)->word[0], 0 , 8 , v))
 +#define EVT_SET_SSV(x, v)   ((x)->word[0] = deposit32((x)->word[0], 11, 1 , v))
 +#define EVT_SET_SSID(x, v)  ((x)->word[0] = deposit32((x)->word[0], 12, 20, v))
 +#define EVT_SET_SID(x, v)   ((x)->word[1] = v)
 +#define EVT_SET_STAG(x, v)  ((x)->word[2] = deposit32((x)->word[2], 0 , 16, v))
 +#define EVT_SET_STALL(x, v) ((x)->word[2] = deposit32((x)->word[2], 31, 1 , v))
 +#define EVT_SET_PNU(x, v)   ((x)->word[3] = deposit32((x)->word[3], 1 , 1 , v))
 +#define EVT_SET_IND(x, v)   ((x)->word[3] = deposit32((x)->word[3], 2 , 1 , v))
 +#define EVT_SET_RNW(x, v)   ((x)->word[3] = deposit32((x)->word[3], 3 , 1 , v))
 +#define EVT_SET_S2(x, v)    ((x)->word[3] = deposit32((x)->word[3], 7 , 1 , v))
 +#define EVT_SET_CLASS(x, v) ((x)->word[3] = deposit32((x)->word[3], 8 , 2 , v))
  #define EVT_SET_ADDR(x, addr)                             \
      do {                                                  \
              (x)->word[5] = (uint32_t)(addr >> 32);        \
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
      } while (0)
  #define EVT_SET_ADDR2(x, addr)                            \
      do {                                                  \
 -            deposit32((x)->word[7], 3, 29, addr >> 16);   \
 -            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
 +            (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16);   \
 +            (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
      } while (0)
  void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
          return r;
      }
 -    if (smmuv3_q_empty(q)) {
 +    if (!smmuv3_q_empty(q)) {
          smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
      }
      return MEMTX_OK;
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 03/21] hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes
+[PULL 12/18] hw/arm/raspi: Load the firmware on the first core
-From: Shannon Zhao <shannon.zhaosl@gmail.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Like commit 16b4226(hw/acpi-build: Add a check for memory-less NUMA node
+The 'first_cpu' is more a QEMU accelerator-related concept
-), it also needs to check memory length for NUMA nodes on ARM.
+than a variable the machine requires to use.
 Since the machine is aware of its CPUs, directly use the
 first one to load the firmware.
-Signed-off-by: Shannon Zhao <shannon.zhaosl@gmail.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180911112643.19296-1-shenglong.zsl@alibaba-inc.com
+Message-id: 20200924111808.77168-3-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 10 ++++++----
+ hw/arm/raspi.c | 3 ++-
-file changed, 6 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/hw/arm/raspi.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
-     mem_base = vms->memmap[VIRT_MEM].base;
+ static void setup_boot(MachineState *machine, int version, size_t ram_size)
-     for (i = 0; i < nb_numa_nodes; ++i) {
+ {
--        numamem = acpi_data_push(table_data, sizeof(*numamem));
++    RaspiMachineState *s = RASPI_MACHINE(machine);
--        build_srat_memory(numamem, mem_base, numa_info[i].node_mem, i,
+     static struct arm_boot_info binfo;
--                          MEM_AFFINITY_ENABLED);
+     int r;
--        mem_base += numa_info[i].node_mem;
-+        if (numa_info[i].node_mem > 0) {
+@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
-+            numamem = acpi_data_push(table_data, sizeof(*numamem));
+         binfo.firmware_loaded = true;
 +            build_srat_memory(numamem, mem_base, numa_info[i].node_mem, i,
 +                              MEM_AFFINITY_ENABLED);
 +            mem_base += numa_info[i].node_mem;
 +        }
      }
-     build_header(linker, table_data, (void *)(table_data->data + srat_start),
+-    arm_load_kernel(ARM_CPU(first_cpu), machine, &binfo);
 +    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
  }
  static void raspi_machine_init(MachineState *machine)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 04/21] MAINTAINERS: Add NRF51 entry
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-This contains the NRF51, and the machine that uses it, the BBC
-micro:bit.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20180831220920.27113-2-joel@jms.id.au
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS | 8 ++++++++
-file changed, 8 insertions(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: include/hw/*/*aspeed*
- F: hw/net/ftgmac100.c
- F: include/hw/net/ftgmac100.h
-+NRF51
-+M: Joel Stanley <joel@jms.id.au>
-+L: qemu-arm@nongnu.org
-+S: Maintained
-+F: hw/arm/nrf51_soc.c
-+F: hw/arm/microbit.c
-+F: include/hw/arm/nrf51_soc.h
-+
- CRIS Machines
- -------------
- Axis Dev88
---
-.19.0

-[Qemu-devel] [PULL 09/21] aspeed/i2c: Fix receive done interrupt handling
+[PULL 13/18] hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
-From: Guenter Roeck <linux@roeck-us.net>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The AST2500 datasheet says:
+The arm_boot_info structure belong to the machine,
 move it to RaspiMachineState.
-I2CD10 Interrupt Status Register
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-       bit 2 Receive Done Interrupt status
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-             S/W needs to clear this status bit to allow next data receiving
+Message-id: 20200924111808.77168-4-f4bug@amsat.org
 The Rx interrupt done interrupt status bit needs to be cleared
 explicitly before the next byte can be received, and must therefore
 not be auto-cleared. Also, receiving the next byte must be delayed
 until the bit has been cleared.
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20180914063506.20815-4-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i2c/aspeed_i2c.c | 10 +++++++++-
+ hw/arm/raspi.c | 30 +++++++++++++++---------------
-file changed, 9 insertions(+), 1 deletion(-)
+file changed, 15 insertions(+), 15 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/hw/arm/raspi.c
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ struct RaspiMachineState {
-         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+     MachineState parent_obj;
      /*< public >*/
      BCM283XState soc;
 +    struct arm_boot_info binfo;
  };
  typedef struct RaspiMachineState RaspiMachineState;
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
  static void setup_boot(MachineState *machine, int version, size_t ram_size)
  {
      RaspiMachineState *s = RASPI_MACHINE(machine);
 -    static struct arm_boot_info binfo;
      int r;
 -    binfo.board_id = MACH_TYPE_BCM2708;
 -    binfo.ram_size = ram_size;
 -    binfo.nb_cpus = machine->smp.cpus;
 +    s->binfo.board_id = MACH_TYPE_BCM2708;
 +    s->binfo.ram_size = ram_size;
 +    s->binfo.nb_cpus = machine->smp.cpus;
      if (version <= 2) {
          /* The rpi1 and 2 require some custom setup code to run in Secure
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
           * firmware for some cache maintenance operations.
           * The rpi3 doesn't need this.
           */
 -        binfo.board_setup_addr = BOARDSETUP_ADDR;
 -        binfo.write_board_setup = write_board_setup;
 -        binfo.secure_board_setup = true;
 -        binfo.secure_boot = true;
 +        s->binfo.board_setup_addr = BOARDSETUP_ADDR;
 +        s->binfo.write_board_setup = write_board_setup;
 +        s->binfo.secure_board_setup = true;
 +        s->binfo.secure_boot = true;
      }
--    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
+     /* Pi2 and Pi3 requires SMP setup */
-+    if ((bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) &&
+     if (version >= 2) {
-+        !(bus->intr_status & I2CD_INTR_RX_DONE)) {
+-        binfo.smp_loader_start = SMPBOOT_ADDR;
-         aspeed_i2c_handle_rx_cmd(bus);
++        s->binfo.smp_loader_start = SMPBOOT_ADDR;
          if (version == 2) {
 -            binfo.write_secondary_boot = write_smpboot;
 +            s->binfo.write_secondary_boot = write_smpboot;
          } else {
 -            binfo.write_secondary_boot = write_smpboot64;
 +            s->binfo.write_secondary_boot = write_smpboot64;
          }
 -        binfo.secondary_cpu_reset_hook = reset_secondary;
 +        s->binfo.secondary_cpu_reset_hook = reset_secondary;
      }
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
+     /* If the user specified a "firmware" image (e.g. UEFI), we bypass
-                                  uint64_t value, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
- {
+             exit(1);
      AspeedI2CBus *bus = opaque;
 +    bool handle_rx;
      switch (offset) {
      case I2CD_FUN_CTRL_REG:
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
          bus->intr_ctrl = value & 0x7FFF;
          break;
      case I2CD_INTR_STS_REG:
 +        handle_rx = (bus->intr_status & I2CD_INTR_RX_DONE) &&
 +                (value & I2CD_INTR_RX_DONE);
          bus->intr_status &= ~(value & 0x7FFF);
          if (!bus->intr_status) {
              bus->controller->intr_status &= ~(1 << bus->id);
              qemu_irq_lower(bus->controller->irq);
          }
-+        if (handle_rx && (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST))) {
-+            aspeed_i2c_handle_rx_cmd(bus);
+-        binfo.entry = firmware_addr;
-+            aspeed_i2c_bus_raise_interrupt(bus);
+-        binfo.firmware_loaded = true;
-+        }
++        s->binfo.entry = firmware_addr;
-         break;
++        s->binfo.firmware_loaded = true;
-     case I2CD_DEV_ADDR_REG:
+     }
-         qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
 -    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
 +    arm_load_kernel(&s->soc.cpu[0].core, machine, &s->binfo);
  }
  static void raspi_machine_init(MachineState *machine)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 06/21] arm: Add BBC micro:bit machine
+[PULL 14/18] hw/arm/raspi: Avoid using TypeInfo::class_data pointer
-From: Joel Stanley <joel@jms.id.au>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-This adds the base for a machine model of the BBC micro:bit:
+Using class_data pointer to create a MachineClass is not
 the recommended way anymore. The correct way is to open-code
 the MachineClass::fields in the class_init() method.
-  https://en.wikipedia.org/wiki/Micro_Bit
+We can not use TYPE_RASPI_MACHINE::class_base_init() because
 it is called *before* each machine class_init(), therefore the
 board_rev field is not populated. We have to manually call
 raspi_machine_class_common_init() for each machine.
-This is a system with a nRF51 SoC containing the main processor, with
+This partly reverts commit a03bde3674e.
 various peripherals on board.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Suggested-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180831220920.27113-4-joel@jms.id.au
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-5-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs |  2 +-
+ hw/arm/raspi.c | 34 ++++++++++++++++++++++++----------
- hw/arm/microbit.c    | 67 ++++++++++++++++++++++++++++++++++++++++++++
+file changed, 24 insertions(+), 10 deletions(-)
 files changed, 68 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/microbit.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/hw/arm/raspi.c
-+++ b/hw/arm/Makefile.objs
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IOTKIT) += iotkit.o
+@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
- obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
+     setup_boot(machine, version, machine->ram_size - vcram_size);
- obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
+ }
- obj-$(CONFIG_FSL_IMX6UL) += fsl-imx6ul.o mcimx6ul-evk.o
--obj-$(CONFIG_NRF51_SOC) += nrf51_soc.o
+-static void raspi_machine_class_init(ObjectClass *oc, void *data)
-+obj-$(CONFIG_NRF51_SOC) += nrf51_soc.o microbit.o
++static void raspi_machine_class_common_init(MachineClass *mc,
-diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
++                                            uint32_t board_rev)
-new file mode 100644
+ {
-index XXXXXXX..XXXXXXX
+-    MachineClass *mc = MACHINE_CLASS(oc);
---- /dev/null
+-    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-+++ b/hw/arm/microbit.c
+-    uint32_t board_rev = (uint32_t)(uintptr_t)data;
-@@ -XXX,XX +XXX,XX @@
+-
-+/*
+-    rmc->board_rev = board_rev;
-+ * BBC micro:bit machine
+     mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
-+ * http://tech.microbit.org/hardware/
+                                board_type(board_rev),
-+ *
+                                FIELD_EX32(board_rev, REV_CODE, REVISION));
-+ * Copyright 2018 Joel Stanley <joel@jms.id.au>
+@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
-+ *
+     mc->default_ram_id = "ram";
-+ * This code is licensed under the GPL version 2 or later.  See
+ };
-+ * the COPYING file in the top-level directory.
-+ */
++static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "hw/boards.h"
 +#include "hw/arm/arm.h"
 +#include "exec/address-spaces.h"
 +
 +#include "hw/arm/nrf51_soc.h"
 +
 +typedef struct {
 +    MachineState parent;
 +
 +    NRF51State nrf51;
 +} MicrobitMachineState;
 +
 +#define TYPE_MICROBIT_MACHINE MACHINE_TYPE_NAME("microbit")
 +
 +#define MICROBIT_MACHINE(obj) \
 +    OBJECT_CHECK(MicrobitMachineState, obj, TYPE_MICROBIT_MACHINE)
 +
 +static void microbit_init(MachineState *machine)
 +{
 +    MicrobitMachineState *s = MICROBIT_MACHINE(machine);
 +    MemoryRegion *system_memory = get_system_memory();
 +    Object *soc = OBJECT(&s->nrf51);
 +
 +    sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
 +                          TYPE_NRF51_SOC);
 +    object_property_set_link(soc, OBJECT(system_memory), "memory",
 +                             &error_fatal);
 +    object_property_set_bool(soc, true, "realized", &error_fatal);
 +
 +    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +                       NRF51_SOC(soc)->flash_size);
 +}
 +
 +static void microbit_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
++    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 +
-+    mc->desc = "BBC micro:bit";
++    rmc->board_rev = 0xa21041;
-+    mc->init = microbit_init;
++    raspi_machine_class_common_init(mc, rmc->board_rev);
 +    mc->max_cpus = 1;
 +}
 +
 +static const TypeInfo microbit_info = {
 +    .name = TYPE_MICROBIT_MACHINE,
 +    .parent = TYPE_MACHINE,
 +    .instance_size = sizeof(MicrobitMachineState),
 +    .class_init = microbit_machine_class_init,
 +};
 +
-+static void microbit_machine_init(void)
++#ifdef TARGET_AARCH64
 +static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
 +{
-+    type_register_static(&microbit_info);
++    MachineClass *mc = MACHINE_CLASS(oc);
-+}
++    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 +
-+type_init(microbit_machine_init);
++    rmc->board_rev = 0xa02082;
 +    raspi_machine_class_common_init(mc, rmc->board_rev);
 +};
 +#endif /* TARGET_AARCH64 */
 +
  static const TypeInfo raspi_machine_types[] = {
      {
          .name           = MACHINE_TYPE_NAME("raspi2"),
          .parent         = TYPE_RASPI_MACHINE,
 -        .class_init     = raspi_machine_class_init,
 -        .class_data     = (void *)0xa21041,
 +        .class_init     = raspi2b_machine_class_init,
  #ifdef TARGET_AARCH64
      }, {
          .name           = MACHINE_TYPE_NAME("raspi3"),
          .parent         = TYPE_RASPI_MACHINE,
 -        .class_init     = raspi_machine_class_init,
 -        .class_data     = (void *)0xa02082,
 +        .class_init     = raspi3b_machine_class_init,
  #endif
      }, {
          .name           = TYPE_RASPI_MACHINE,
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 10/21] hw/arm/smmu-common: Fix the name of the iommu memory regions
+[PULL 15/18] hw/arm/raspi: Use more specific machine names
-From: Eric Auger <eric.auger@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-At the point smmu_find_add_as() gets called, the bus number might
+Now that we can instantiate different machines based on their
-not be computed. Let's change the name of IOMMU memory region and
+board_rev register value, we can have various raspi2 and raspi3.
 just use the devfn and an incrementing index.
-The name only is used for debug.
+In commit fc78a990ec103 we corrected the machine description.
 Correct the machine names too. For backward compatibility, add
 an alias to the previous generic name.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20180921070138.10114-2-eric.auger@redhat.com
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200924111808.77168-6-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmu-common.c | 6 +++---
+ hw/arm/raspi.c | 6 ++++--
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmu-common.c
+--- a/hw/arm/raspi.c
-+++ b/hw/arm/smmu-common.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
+@@ -XXX,XX +XXX,XX @@ static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
-     SMMUState *s = opaque;
+     MachineClass *mc = MACHINE_CLASS(oc);
-     SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
+     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-     SMMUDevice *sdev;
-+    static uint index;
++    mc->alias = "raspi2";
+     rmc->board_rev = 0xa21041;
-     if (!sbus) {
+     raspi_machine_class_common_init(mc, rmc->board_rev);
-         sbus = g_malloc0(sizeof(SMMUPciBus) +
+ };
-@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
+@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
+     MachineClass *mc = MACHINE_CLASS(oc);
-     sdev = sbus->pbdev[devfn];
+     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-     if (!sdev) {
--        char *name = g_strdup_printf("%s-%d-%d",
++    mc->alias = "raspi3";
--                                     s->mrtypename,
+     rmc->board_rev = 0xa02082;
--                                     pci_bus_num(bus), devfn);
+     raspi_machine_class_common_init(mc, rmc->board_rev);
-+        char *name = g_strdup_printf("%s-%d-%d", s->mrtypename, devfn, index++);
+ };
-+
+@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
-         sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
+ static const TypeInfo raspi_machine_types[] = {
-         sdev->smmu = s;
+     {
 -        .name           = MACHINE_TYPE_NAME("raspi2"),
 +        .name           = MACHINE_TYPE_NAME("raspi2b"),
          .parent         = TYPE_RASPI_MACHINE,
          .class_init     = raspi2b_machine_class_init,
  #ifdef TARGET_AARCH64
      }, {
 -        .name           = MACHINE_TYPE_NAME("raspi3"),
 +        .name           = MACHINE_TYPE_NAME("raspi3b"),
          .parent         = TYPE_RASPI_MACHINE,
          .class_init     = raspi3b_machine_class_init,
  #endif
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 20/21] aspeed/smc: fix some alignment issues
+[PULL 16/18] hw/arm/raspi: Introduce RaspiProcessorId enum
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+As we only support a reduced set of the REV_CODE_PROCESSOR id
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+encoded in the board revision, define the PROCESSOR_ID values
-Message-id: 20180921161939.822-6-clg@kaod.org
+as an enum. We can simplify the board_soc_type and cores_count
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+methods.
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-7-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/aspeed_smc.c | 8 ++++----
+ hw/arm/raspi.c | 45 +++++++++++++++++++++------------------------
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 21 insertions(+), 24 deletions(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/hw/arm/raspi.c
-+++ b/hw/ssi/aspeed_smc.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ FIELD(REV_CODE, MANUFACTURER,      16, 4);
- static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
+ FIELD(REV_CODE, MEMORY_SIZE,       20, 3);
-                                            uint64_t data, unsigned size)
+ FIELD(REV_CODE, STYLE,             23, 1);
 +typedef enum RaspiProcessorId {
 +    PROCESSOR_ID_BCM2836 = 1,
 +    PROCESSOR_ID_BCM2837 = 2,
 +} RaspiProcessorId;
 +
 +static const struct {
 +    const char *type;
 +    int cores_count;
 +} soc_property[] = {
 +    [PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
 +    [PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
 +};
 +
  static uint64_t board_ram_size(uint32_t board_rev)
  {
--   qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
+     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
--                 PRIx64 "\n", __func__, addr, size, data);
+     return 256 * MiB << FIELD_EX32(board_rev, REV_CODE, MEMORY_SIZE);
 +    qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
 +                  PRIx64 "\n", __func__, addr, size, data);
  }
- static const MemoryRegionOps aspeed_smc_flash_default_ops = {
+-static int board_processor_id(uint32_t board_rev)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
++static RaspiProcessorId board_processor_id(uint32_t board_rev)
-      */
+ {
-     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
++    int proc_id = FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
-         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
++
--                ssi_transfer(fl->controller->spi, 0xFF);
+     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
-+            ssi_transfer(fl->controller->spi, 0xFF);
+-    return FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
-         }
++    assert(proc_id < ARRAY_SIZE(soc_property) && soc_property[proc_id].type);
-     }
++
 +    return proc_id;
  }
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
  static int board_version(uint32_t board_rev)
@@ -XXX,XX +XXX,XX @@ static int board_version(uint32_t board_rev)
  static const char *board_soc_type(uint32_t board_rev)
  {
 -    static const char *soc_types[] = {
 -        NULL, TYPE_BCM2836, TYPE_BCM2837,
 -    };
 -    int proc_id = board_processor_id(board_rev);
 -
 -    if (proc_id >= ARRAY_SIZE(soc_types) || !soc_types[proc_id]) {
 -        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
 -                     proc_id, board_rev);
 -        exit(1);
 -    }
 -    return soc_types[proc_id];
 +    return soc_property[board_processor_id(board_rev)].type;
  }
- static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
+ static int cores_count(uint32_t board_rev)
 -                           unsigned size)
 +                                   unsigned size)
  {
-     AspeedSMCFlash *fl = opaque;
+-    static const int soc_cores_count[] = {
-     AspeedSMCState *s = fl->controller;
+-        0, BCM283X_NCPUS, BCM283X_NCPUS,
 -    };
 -    int proc_id = board_processor_id(board_rev);
 -
 -    if (proc_id >= ARRAY_SIZE(soc_cores_count) || !soc_cores_count[proc_id]) {
 -        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
 -                     proc_id, board_rev);
 -        exit(1);
 -    }
 -    return soc_cores_count[proc_id];
 +    return soc_property[board_processor_id(board_rev)].cores_count;
  }
  static const char *board_type(uint32_t board_rev)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 07/21] aspeed/i2c: interrupts should be cleared by software only
+[PULL 17/18] hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-aspeed i2c interrupts should be cleared by software only, and the bus
+The firmware load address depends on the SoC ("processor id") used,
-interrupt should be lowered when all interrupts have been cleared.
+not on the version of the board.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Suggested-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20180914063506.20815-2-clg@kaod.org
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-[PMM: drop TODO comment describing an issue which is
+Message-id: 20200924111808.77168-8-f4bug@amsat.org
  fixed later in the patch series, and clean up commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i2c/aspeed_i2c.c | 16 ++++++++++++----
+ hw/arm/raspi.c | 3 ++-
-file changed, 12 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/hw/arm/raspi.c
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
- #define I2CD_AC_TIMING_REG2     0x08       /* Clock and AC Timing Control #1 */
+      * the normal Linux boot process
- #define I2CD_INTR_CTRL_REG      0x0c       /* I2CD Interrupt Control */
+      */
- #define I2CD_INTR_STS_REG       0x10       /* I2CD Interrupt Status */
+     if (machine->firmware) {
-+
+-        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
-+#define   I2CD_INTR_SLAVE_ADDR_MATCH       (0x1 << 31) /* 0: addr1 1: addr2 */
++        hwaddr firmware_addr = processor_id <= PROCESSOR_ID_BCM2836
-+#define   I2CD_INTR_SLAVE_ADDR_RX_PENDING  (0x1 << 30)
++                             ? FIRMWARE_ADDR_2 : FIRMWARE_ADDR_3;
-+/* bits[19-16] Reserved */
+         /* load the firmware image (typically kernel.img) */
-+
+         r = load_image_targphys(machine->firmware, firmware_addr,
-+/* All bits below are cleared by writing 1 */
+                                 ram_size - firmware_addr);
 +#define   I2CD_INTR_SLAVE_INACTIVE_TIMEOUT (0x1 << 15)
  #define   I2CD_INTR_SDA_DL_TIMEOUT         (0x1 << 14)
  #define   I2CD_INTR_BUS_RECOVER_DONE       (0x1 << 13)
  #define   I2CD_INTR_SMBUS_ALERT            (0x1 << 12) /* Bus [0-3] only */
@@ -XXX,XX +XXX,XX @@
  #define   I2CD_INTR_SMBUS_DEV_ALERT_ADDR   (0x1 << 10) /* Removed */
  #define   I2CD_INTR_SMBUS_DEF_ADDR         (0x1 << 9)  /* Removed */
  #define   I2CD_INTR_GCALL_ADDR             (0x1 << 8)  /* Removed */
 -#define   I2CD_INTR_SLAVE_MATCH            (0x1 << 7)  /* use RX_DONE */
 +#define   I2CD_INTR_SLAVE_ADDR_RX_MATCH    (0x1 << 7)  /* use RX_DONE */
  #define   I2CD_INTR_SCL_TIMEOUT            (0x1 << 6)
  #define   I2CD_INTR_ABNORMAL               (0x1 << 5)
  #define   I2CD_INTR_NORMAL_STOP            (0x1 << 4)
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
  {
      bus->cmd &= ~0xFFFF;
      bus->cmd |= value & 0xFFFF;
 -    bus->intr_status = 0;
      if (bus->cmd & I2CD_M_START_CMD) {
          uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
          break;
      case I2CD_INTR_STS_REG:
          bus->intr_status &= ~(value & 0x7FFF);
 -        bus->controller->intr_status &= ~(1 << bus->id);
 -        qemu_irq_lower(bus->controller->irq);
 +        if (!bus->intr_status) {
 +            bus->controller->intr_status &= ~(1 << bus->id);
 +            qemu_irq_lower(bus->controller->irq);
 +        }
          break;
      case I2CD_DEV_ADDR_REG:
          qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 16/21] hw/timer/cmsdk-apb-dualtimer: Add missing 'break' statements
+Deleted patch
-Add 'break' statements missing from a switch in the APB dual-timer
-write function. Spotted by Coverity as CID 1395626 and 1395633.
-Reported-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180924123122.14549-1-peter.maydell@linaro.org
----
- hw/timer/cmsdk-apb-dualtimer.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-dualtimer.c
-+++ b/hw/timer/cmsdk-apb-dualtimer.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
-         case A_TIMERITCR:
-             s->timeritcr = value & R_TIMERITCR_VALID_MASK;
-             cmsdk_apb_dualtimer_update(s);
-+            break;
-         case A_TIMERITOP:
-             s->timeritop = value & R_TIMERITOP_VALID_MASK;
-             cmsdk_apb_dualtimer_update(s);
-+            break;
-         default:
-         bad_offset:
-             qemu_log_mask(LOG_GUEST_ERROR,
---
-.19.0

-[Qemu-devel] [PULL 19/21] hw/arm/aspeed: Add an Aspeed machine class
+[PULL 18/18] hw/arm/raspi: Remove use of the 'version' value in the board code
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The code looks better, it removes duplicated lines and it will ease
+We expected the 'version' ID to match the board processor ID,
-the introduction of common properties for the Aspeed machines.
+but this is not always true (for example boards with revision
 id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
 This was not important because we were not modelling them, but
 since the recent refactor now allow to model these boards, it
 is safer to check the processor id directly. Remove the version
 check.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20180921161939.822-4-clg@kaod.org
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-9-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed.h |  46 +++++++++
+ hw/arm/raspi.c | 29 +++++++++++++----------------
- hw/arm/aspeed.c         | 212 +++++++++++++---------------------------
+file changed, 13 insertions(+), 16 deletions(-)
 files changed, 116 insertions(+), 142 deletions(-)
  create mode 100644 include/hw/arm/aspeed.h
-diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/aspeed.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Aspeed Machines
 + *
 + * Copyright 2018 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later.  See
 + * the COPYING file in the top-level directory.
 + */
 +#ifndef ARM_ASPEED_H
 +#define ARM_ASPEED_H
 +
 +#include "hw/boards.h"
 +
 +typedef struct AspeedBoardState AspeedBoardState;
 +
 +typedef struct AspeedBoardConfig {
 +    const char *name;
 +    const char *desc;
 +    const char *soc_name;
 +    uint32_t hw_strap1;
 +    const char *fmc_model;
 +    const char *spi_model;
 +    uint32_t num_cs;
 +    void (*i2c_init)(AspeedBoardState *bmc);
 +} AspeedBoardConfig;
 +
 +#define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
 +#define ASPEED_MACHINE(obj) \
 +    OBJECT_CHECK(AspeedMachine, (obj), TYPE_ASPEED_MACHINE)
 +
 +typedef struct AspeedMachine {
 +    MachineState parent_obj;
 +} AspeedMachine;
 +
 +#define ASPEED_MACHINE_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AspeedMachineClass, (klass), TYPE_ASPEED_MACHINE)
 +#define ASPEED_MACHINE_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AspeedMachineClass, (obj), TYPE_ASPEED_MACHINE)
 +
 +typedef struct AspeedMachineClass {
 +    MachineClass parent_obj;
 +    const AspeedBoardConfig *board;
 +} AspeedMachineClass;
 +
 +
 +#endif
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/arm/raspi.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static RaspiProcessorId board_processor_id(uint32_t board_rev)
- #include "cpu.h"
+     return proc_id;
  #include "exec/address-spaces.h"
  #include "hw/arm/arm.h"
 +#include "hw/arm/aspeed.h"
  #include "hw/arm/aspeed_soc.h"
  #include "hw/boards.h"
  #include "hw/i2c/smbus.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardState {
      MemoryRegion max_ram;
  } AspeedBoardState;
 -typedef struct AspeedBoardConfig {
 -    const char *soc_name;
 -    uint32_t hw_strap1;
 -    const char *fmc_model;
 -    const char *spi_model;
 -    uint32_t num_cs;
 -    void (*i2c_init)(AspeedBoardState *bmc);
 -} AspeedBoardConfig;
 -
 -enum {
 -    PALMETTO_BMC,
 -    AST2500_EVB,
 -    ROMULUS_BMC,
 -    WITHERSPOON_BMC,
 -};
 -
  /* Palmetto hardware value: 0x120CE416 */
  #define PALMETTO_BMC_HW_STRAP1 (                                        \
          SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_256MB) |               \
@@ -XXX,XX +XXX,XX @@ enum {
  /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
  #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 -static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
 -static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
 -static void romulus_bmc_i2c_init(AspeedBoardState *bmc);
 -static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
 -
 -static const AspeedBoardConfig aspeed_boards[] = {
 -    [PALMETTO_BMC] = {
 -        .soc_name  = "ast2400-a1",
 -        .hw_strap1 = PALMETTO_BMC_HW_STRAP1,
 -        .fmc_model = "n25q256a",
 -        .spi_model = "mx25l25635e",
 -        .num_cs    = 1,
 -        .i2c_init  = palmetto_bmc_i2c_init,
 -    },
 -    [AST2500_EVB]  = {
 -        .soc_name  = "ast2500-a1",
 -        .hw_strap1 = AST2500_EVB_HW_STRAP1,
 -        .fmc_model = "w25q256",
 -        .spi_model = "mx25l25635e",
 -        .num_cs    = 1,
 -        .i2c_init  = ast2500_evb_i2c_init,
 -    },
 -    [ROMULUS_BMC]  = {
 -        .soc_name  = "ast2500-a1",
 -        .hw_strap1 = ROMULUS_BMC_HW_STRAP1,
 -        .fmc_model = "n25q256a",
 -        .spi_model = "mx66l1g45g",
 -        .num_cs    = 2,
 -        .i2c_init  = romulus_bmc_i2c_init,
 -    },
 -    [WITHERSPOON_BMC]  = {
 -        .soc_name  = "ast2500-a1",
 -        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
 -        .fmc_model = "mx25l25635e",
 -        .spi_model = "mx66l1g45g",
 -        .num_cs    = 2,
 -        .i2c_init  = witherspoon_bmc_i2c_init,
 -    },
 -};
 -
  /*
   * The max ram region is for firmwares that scan the address space
   * with load/store to guess how much RAM the SoC has.
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
      object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
  }
--static void palmetto_bmc_init(MachineState *machine)
+-static int board_version(uint32_t board_rev)
 -{
--    aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
+-    return board_processor_id(board_rev) + 1;
 -}
 -
--static void palmetto_bmc_class_init(ObjectClass *oc, void *data)
+ static const char *board_soc_type(uint32_t board_rev)
 -{
 -    MachineClass *mc = MACHINE_CLASS(oc);
 -
 -    mc->desc = "OpenPOWER Palmetto BMC (ARM926EJ-S)";
 -    mc->init = palmetto_bmc_init;
 -    mc->max_cpus = 1;
 -    mc->no_sdcard = 1;
 -    mc->no_floppy = 1;
 -    mc->no_cdrom = 1;
 -    mc->no_parallel = 1;
 -}
 -
 -static const TypeInfo palmetto_bmc_type = {
 -    .name = MACHINE_TYPE_NAME("palmetto-bmc"),
 -    .parent = TYPE_MACHINE,
 -    .class_init = palmetto_bmc_class_init,
 -};
 -
  static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
  {
-     AspeedSoCState *soc = &bmc->soc;
+     return soc_property[board_processor_id(board_rev)].type;
-@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
+@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
+     cpu_set_pc(cs, info->smp_loader_start);
  }
--static void ast2500_evb_init(MachineState *machine)
+-static void setup_boot(MachineState *machine, int version, size_t ram_size)
--{
++static void setup_boot(MachineState *machine, RaspiProcessorId processor_id,
--    aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
++                       size_t ram_size)
 -}
 -
 -static void ast2500_evb_class_init(ObjectClass *oc, void *data)
 -{
 -    MachineClass *mc = MACHINE_CLASS(oc);
 -
 -    mc->desc = "Aspeed AST2500 EVB (ARM1176)";
 -    mc->init = ast2500_evb_init;
 -    mc->max_cpus = 1;
 -    mc->no_sdcard = 1;
 -    mc->no_floppy = 1;
 -    mc->no_cdrom = 1;
 -    mc->no_parallel = 1;
 -}
 -
 -static const TypeInfo ast2500_evb_type = {
 -    .name = MACHINE_TYPE_NAME("ast2500-evb"),
 -    .parent = TYPE_MACHINE,
 -    .class_init = ast2500_evb_class_init,
 -};
 -
  static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
  {
-     AspeedSoCState *soc = &bmc->soc;
+     RaspiMachineState *s = RASPI_MACHINE(machine);
-@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
+     int r;
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
+@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      s->binfo.ram_size = ram_size;
      s->binfo.nb_cpus = machine->smp.cpus;
 -    if (version <= 2) {
 -        /* The rpi1 and 2 require some custom setup code to run in Secure
 -         * mode before booting a kernel (to set up the SMC vectors so
 -         * that we get a no-op SMC; this is used by Linux to call the
 +    if (processor_id <= PROCESSOR_ID_BCM2836) {
 +        /*
 +         * The BCM2835 and BCM2836 require some custom setup code to run
 +         * in Secure mode before booting a kernel (to set up the SMC vectors
 +         * so that we get a no-op SMC; this is used by Linux to call the
           * firmware for some cache maintenance operations.
 -         * The rpi3 doesn't need this.
 +         * The BCM2837 doesn't need this.
           */
          s->binfo.board_setup_addr = BOARDSETUP_ADDR;
          s->binfo.write_board_setup = write_board_setup;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
          s->binfo.secure_boot = true;
      }
 -    /* Pi2 and Pi3 requires SMP setup */
 -    if (version >= 2) {
 +    /* BCM2836 and BCM2837 requires SMP setup */
 +    if (processor_id >= PROCESSOR_ID_BCM2836) {
          s->binfo.smp_loader_start = SMPBOOT_ADDR;
 -        if (version == 2) {
 +        if (processor_id == PROCESSOR_ID_BCM2836) {
              s->binfo.write_secondary_boot = write_smpboot;
          } else {
              s->binfo.write_secondary_boot = write_smpboot64;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
      RaspiMachineClass *mc = RASPI_MACHINE_GET_CLASS(machine);
      RaspiMachineState *s = RASPI_MACHINE(machine);
      uint32_t board_rev = mc->board_rev;
 -    int version = board_version(board_rev);
      uint64_t ram_size = board_ram_size(board_rev);
      uint32_t vcram_size;
      DriveInfo *di;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
      vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
                                            &error_abort);
 -    setup_boot(machine, version, machine->ram_size - vcram_size);
 +    setup_boot(machine, board_processor_id(mc->board_rev),
 +               machine->ram_size - vcram_size);
  }
--static void romulus_bmc_init(MachineState *machine)
+ static void raspi_machine_class_common_init(MachineClass *mc,
 -{
 -    aspeed_board_init(machine, &aspeed_boards[ROMULUS_BMC]);
 -}
 -
 -static void romulus_bmc_class_init(ObjectClass *oc, void *data)
 -{
 -    MachineClass *mc = MACHINE_CLASS(oc);
 -
 -    mc->desc = "OpenPOWER Romulus BMC (ARM1176)";
 -    mc->init = romulus_bmc_init;
 -    mc->max_cpus = 1;
 -    mc->no_sdcard = 1;
 -    mc->no_floppy = 1;
 -    mc->no_cdrom = 1;
 -    mc->no_parallel = 1;
 -}
 -
 -static const TypeInfo romulus_bmc_type = {
 -    .name = MACHINE_TYPE_NAME("romulus-bmc"),
 -    .parent = TYPE_MACHINE,
 -    .class_init = romulus_bmc_class_init,
 -};
 -
  static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
  {
      AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 x60);
  }
 -static void witherspoon_bmc_init(MachineState *machine)
 +static void aspeed_machine_init(MachineState *machine)
  {
 -    aspeed_board_init(machine, &aspeed_boards[WITHERSPOON_BMC]);
 +    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
 +
 +    aspeed_board_init(machine, amc->board);
  }
 -static void witherspoon_bmc_class_init(ObjectClass *oc, void *data)
 +static void aspeed_machine_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
 +    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 +    const AspeedBoardConfig *board = data;
 -    mc->desc = "OpenPOWER Witherspoon BMC (ARM1176)";
 -    mc->init = witherspoon_bmc_init;
 +    mc->desc = board->desc;
 +    mc->init = aspeed_machine_init;
      mc->max_cpus = 1;
      mc->no_sdcard = 1;
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->no_parallel = 1;
 +    amc->board = board;
  }
 -static const TypeInfo witherspoon_bmc_type = {
 -    .name = MACHINE_TYPE_NAME("witherspoon-bmc"),
 +static const TypeInfo aspeed_machine_type = {
 +    .name = TYPE_ASPEED_MACHINE,
      .parent = TYPE_MACHINE,
 -    .class_init = witherspoon_bmc_class_init,
 +    .instance_size = sizeof(AspeedMachine),
 +    .class_size = sizeof(AspeedMachineClass),
 +    .abstract = true,
  };
 -static void aspeed_machine_init(void)
 +static const AspeedBoardConfig aspeed_boards[] = {
 +    {
 +        .name      = MACHINE_TYPE_NAME("palmetto-bmc"),
 +        .desc      = "OpenPOWER Palmetto BMC (ARM926EJ-S)",
 +        .soc_name  = "ast2400-a1",
 +        .hw_strap1 = PALMETTO_BMC_HW_STRAP1,
 +        .fmc_model = "n25q256a",
 +        .spi_model = "mx25l25635e",
 +        .num_cs    = 1,
 +        .i2c_init  = palmetto_bmc_i2c_init,
 +    }, {
 +        .name      = MACHINE_TYPE_NAME("ast2500-evb"),
 +        .desc      = "Aspeed AST2500 EVB (ARM1176)",
 +        .soc_name  = "ast2500-a1",
 +        .hw_strap1 = AST2500_EVB_HW_STRAP1,
 +        .fmc_model = "w25q256",
 +        .spi_model = "mx25l25635e",
 +        .num_cs    = 1,
 +        .i2c_init  = ast2500_evb_i2c_init,
 +    }, {
 +        .name      = MACHINE_TYPE_NAME("romulus-bmc"),
 +        .desc      = "OpenPOWER Romulus BMC (ARM1176)",
 +        .soc_name  = "ast2500-a1",
 +        .hw_strap1 = ROMULUS_BMC_HW_STRAP1,
 +        .fmc_model = "n25q256a",
 +        .spi_model = "mx66l1g45g",
 +        .num_cs    = 2,
 +        .i2c_init  = romulus_bmc_i2c_init,
 +    }, {
 +        .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
 +        .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
 +        .soc_name  = "ast2500-a1",
 +        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
 +        .fmc_model = "mx25l25635e",
 +        .spi_model = "mx66l1g45g",
 +        .num_cs    = 2,
 +        .i2c_init  = witherspoon_bmc_i2c_init,
 +    },
 +};
 +
 +static void aspeed_machine_types(void)
  {
 -    type_register_static(&palmetto_bmc_type);
 -    type_register_static(&ast2500_evb_type);
 -    type_register_static(&romulus_bmc_type);
 -    type_register_static(&witherspoon_bmc_type);
 +    int i;
 +
 +    type_register_static(&aspeed_machine_type);
 +    for (i = 0; i < ARRAY_SIZE(aspeed_boards); ++i) {
 +        TypeInfo ti = {
 +            .name       = aspeed_boards[i].name,
 +            .parent     = TYPE_ASPEED_MACHINE,
 +            .class_init = aspeed_machine_class_init,
 +            .class_data = (void *)&aspeed_boards[i],
 +        };
 +        type_register(&ti);
 +    }
  }
 -type_init(aspeed_machine_init)
 +type_init(aspeed_machine_types)
 --
-.19.0
+.20.1

target-arm queue of various easier things that had piled
up while I was on holiday.

thanks
-- PMM

The following changes since commit 506e4a00de01e0b29fa83db5cbbc3d154253b4ea:

Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.1-20180925' into staging (2018-09-25 13:30:45 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180925

for you to fetch changes up to 4a87106b160a3e72152443065fb92f8a1313c23d:

target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode (2018-09-25 14:14:07 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs
 * hw/arm/exynos4210: fix Exynos4210 UART support
 * hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes
 * arm: Add BBC micro:bit machine
 * aspeed/i2c: Fix interrupt handling bugs
 * hw/arm/smmu-common: Fix the name of the iommu memory regions
 * hw/arm/smmuv3: fix eventq recording and IRQ triggerring
 * hw/intc/arm_gic: Document QEMU interface
 * hw/intc/arm_gic: Drop GIC_BASE_IRQ macro
 * hw/net/pcnet-pci: Convert away from old_mmio accessors
 * hw/timer/cmsdk-apb-dualtimer: Add missing 'break' statements
 * aspeed/timer: fix compile breakage with clang 3.4.2
 * hw/arm/aspeed: change the FMC flash model of the AST2500 evb
 * hw/arm/aspeed: Minor code cleanups
 * target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode

----------------------------------------------------------------
Bartlomiej Zolnierkiewicz (1):
      hw/arm/exynos4210: fix Exynos4210 UART support

Cédric Le Goater (5):
      aspeed/i2c: interrupts should be cleared by software only
      aspeed/timer: fix compile breakage with clang 3.4.2
      hw/arm/aspeed: change the FMC flash model of the AST2500 evb
      hw/arm/aspeed: Add an Aspeed machine class
      aspeed/smc: fix some alignment issues

Eric Auger (2):
      hw/arm/smmu-common: Fix the name of the iommu memory regions
      hw/arm/smmuv3: fix eventq recording and IRQ triggerring

Guenter Roeck (2):
      aspeed/i2c: Handle receive command in separate function
      aspeed/i2c: Fix receive done interrupt handling

Joel Stanley (3):
      MAINTAINERS: Add NRF51 entry
      arm: Add Nordic Semiconductor nRF51 SoC
      arm: Add BBC micro:bit machine

Peter Maydell (6):
      hw/intc/arm_gic: Document QEMU interface
      hw/intc/arm_gic: Drop GIC_BASE_IRQ macro
      hw/net/pcnet-pci: Convert away from old_mmio accessors
      hw/net/pcnet-pci: Unify pcnet_ioport_read/write and pcnet_mmio_read/write
      hw/timer/cmsdk-apb-dualtimer: Add missing 'break' statements
      target/arm: Start AArch32 CPUs with EL2 but not EL3 in Hyp mode

Richard Henderson (1):
      target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs

Shannon Zhao (1):
      hw/arm/virt-acpi-build: Add a check for memory-less NUMA nodes

From: Richard Henderson <richard.henderson@linaro.org>

Not only are the sve-related tb_flags fields unused when SVE is
disabled, but not all of the cpu registers are initialized properly
for computing same.  This can corrupt other fields by ORing in -1,
which might result in QEMU crashing.

This bug was not present in 3.0, but this patch is cc'd to
stable because adf92eab90e3f5f34c285 where the bug was
introduced was marked for stable.

Fixes: adf92eab90e3f5f34c285
Cc: qemu-stable@nongnu.org (3.0.1)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 45 ++++++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 21 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
     uint32_t flags;
 
     if (is_a64(env)) {
-        int sve_el = sve_exception_el(env);
-        uint32_t zcr_len;
-
         *pc = env->pc;
         flags = ARM_TBFLAG_AARCH64_STATE_MASK;
         /* Get control bits for tagged addresses */
         flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
         flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
-        flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
 
-        /* If SVE is disabled, but FP is enabled,
-           then the effective len is 0.  */
-        if (sve_el != 0 && fp_el == 0) {
-            zcr_len = 0;
-        } else {
-            int current_el = arm_current_el(env);
-            ARMCPU *cpu = arm_env_get_cpu(env);
+        if (arm_feature(env, ARM_FEATURE_SVE)) {
+            int sve_el = sve_exception_el(env);
+            uint32_t zcr_len;
 
-            zcr_len = cpu->sve_max_vq - 1;
-            if (current_el <= 1) {
-                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
-            }
-            if (current_el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
-            }
-            if (current_el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
-                zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+            /* If SVE is disabled, but FP is enabled,
+             * then the effective len is 0.
+             */
+            if (sve_el != 0 && fp_el == 0) {
+                zcr_len = 0;
+            } else {
+                int current_el = arm_current_el(env);
+                ARMCPU *cpu = arm_env_get_cpu(env);
+
+                zcr_len = cpu->sve_max_vq - 1;
+                if (current_el <= 1) {
+                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
+                }
+                if (current_el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
+                }
+                if (current_el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
+                    zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+                }
             }
+            flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
+            flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
         }
-        flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
     } else {
         *pc = env->regs[15];
         flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
-- 
2.19.0

From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

commit 97274d0c05d4 ("hw/char/exynos4210_uart.c: Remove unneeded
handling of NULL chardev") broke Exynos4210 support as it removed
NULL 'Chardev *chr' handling from exynos4210_uart_create() and
currently exynos4210_init() always passes NULL as 'Chardev *chr'
argument to exynos4210_uart_create() calls. Fix it by adding
missing serial_hd() calls to exynos4210_init().

Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 9310418.Wg32kryeWE@amdc3058
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 
     /*** UARTs ***/
     exynos4210_uart_create(EXYNOS4210_UART0_BASE_ADDR,
-                           EXYNOS4210_UART0_FIFO_SIZE, 0, NULL,
+                           EXYNOS4210_UART0_FIFO_SIZE, 0, serial_hd(0),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 0)]);
 
     exynos4210_uart_create(EXYNOS4210_UART1_BASE_ADDR,
-                           EXYNOS4210_UART1_FIFO_SIZE, 1, NULL,
+                           EXYNOS4210_UART1_FIFO_SIZE, 1, serial_hd(1),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 1)]);
 
     exynos4210_uart_create(EXYNOS4210_UART2_BASE_ADDR,
-                           EXYNOS4210_UART2_FIFO_SIZE, 2, NULL,
+                           EXYNOS4210_UART2_FIFO_SIZE, 2, serial_hd(2),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 2)]);
 
     exynos4210_uart_create(EXYNOS4210_UART3_BASE_ADDR,
-                           EXYNOS4210_UART3_FIFO_SIZE, 3, NULL,
+                           EXYNOS4210_UART3_FIFO_SIZE, 3, serial_hd(3),
                   s->irq_table[exynos4210_get_irq(EXYNOS4210_UART_INT_GRP, 3)]);
 
     /*** SD/MMC host controllers ***/
-- 
2.19.0

From: Shannon Zhao <shannon.zhaosl@gmail.com>

Like commit 16b4226(hw/acpi-build: Add a check for memory-less NUMA node
), it also needs to check memory length for NUMA nodes on ARM.

Signed-off-by: Shannon Zhao <shannon.zhaosl@gmail.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20180911112643.19296-1-shenglong.zsl@alibaba-inc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_srat(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 
     mem_base = vms->memmap[VIRT_MEM].base;
     for (i = 0; i < nb_numa_nodes; ++i) {
-        numamem = acpi_data_push(table_data, sizeof(*numamem));
-        build_srat_memory(numamem, mem_base, numa_info[i].node_mem, i,
-                          MEM_AFFINITY_ENABLED);
-        mem_base += numa_info[i].node_mem;
+        if (numa_info[i].node_mem > 0) {
+            numamem = acpi_data_push(table_data, sizeof(*numamem));
+            build_srat_memory(numamem, mem_base, numa_info[i].node_mem, i,
+                              MEM_AFFINITY_ENABLED);
+            mem_base += numa_info[i].node_mem;
+        }
     }
 
     build_header(linker, table_data, (void *)(table_data->data + srat_start),
-- 
2.19.0

From: Joel Stanley <joel@jms.id.au>

The nRF51 is a Cortex-M0 microcontroller with an on-board radio module,
plus other common ARM SoC peripherals.

http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf

This defines a basic model of the CPU and memory, with no peripherals
implemented at this stage.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-id: 20180831220920.27113-3-joel@jms.id.au
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: wrapped a few long lines]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs            |   1 +
 include/hw/arm/nrf51_soc.h      |  41 ++++++++++
 hw/arm/nrf51_soc.c              | 133 ++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 4 files changed, 176 insertions(+)
 create mode 100644 include/hw/arm/nrf51_soc.h
 create mode 100644 hw/arm/nrf51_soc.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IOTKIT) += iotkit.o
 obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
 obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
 obj-$(CONFIG_FSL_IMX6UL) += fsl-imx6ul.o mcimx6ul-evk.o
+obj-$(CONFIG_NRF51_SOC) += nrf51_soc.o
diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nordic Semiconductor nRF51  SoC
+ *
+ * Copyright 2018 Joel Stanley <joel@jms.id.au>
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef NRF51_SOC_H
+#define NRF51_SOC_H
+
+#include "hw/sysbus.h"
+#include "hw/arm/armv7m.h"
+
+#define TYPE_NRF51_SOC "nrf51-soc"
+#define NRF51_SOC(obj) \
+    OBJECT_CHECK(NRF51State, (obj), TYPE_NRF51_SOC)
+
+typedef struct NRF51State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    ARMv7MState cpu;
+
+    MemoryRegion iomem;
+    MemoryRegion sram;
+    MemoryRegion flash;
+
+    uint32_t sram_size;
+    uint32_t flash_size;
+
+    MemoryRegion *board_memory;
+
+    MemoryRegion container;
+
+} NRF51State;
+
+#endif
+
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nordic Semiconductor nRF51 SoC
+ * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.1.pdf
+ *
+ * Copyright 2018 Joel Stanley <joel@jms.id.au>
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "hw/arm/arm.h"
+#include "hw/sysbus.h"
+#include "hw/boards.h"
+#include "hw/devices.h"
+#include "hw/misc/unimp.h"
+#include "exec/address-spaces.h"
+#include "sysemu/sysemu.h"
+#include "qemu/log.h"
+#include "cpu.h"
+
+#include "hw/arm/nrf51_soc.h"
+
+#define IOMEM_BASE      0x40000000
+#define IOMEM_SIZE      0x20000000
+
+#define FICR_BASE       0x10000000
+#define FICR_SIZE       0x000000fc
+
+#define FLASH_BASE      0x00000000
+#define SRAM_BASE       0x20000000
+
+#define PRIVATE_BASE    0xF0000000
+#define PRIVATE_SIZE    0x10000000
+
+/*
+ * The size and base is for the NRF51822 part. If other parts
+ * are supported in the future, add a sub-class of NRF51SoC for
+ * the specific variants
+ */
+#define NRF51822_FLASH_SIZE     (256 * 1024)
+#define NRF51822_SRAM_SIZE      (16 * 1024)
+
+static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+{
+    NRF51State *s = NRF51_SOC(dev_soc);
+    Error *err = NULL;
+
+    if (!s->board_memory) {
+        error_setg(errp, "memory property was not set");
+        return;
+    }
+
+    object_property_set_link(OBJECT(&s->cpu), OBJECT(&s->container), "memory",
+            &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    memory_region_add_subregion_overlap(&s->container, 0, s->board_memory, -1);
+
+    memory_region_init_rom(&s->flash, OBJECT(s), "nrf51.flash", s->flash_size,
+            &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(&s->container, FLASH_BASE, &s->flash);
+
+    memory_region_init_ram(&s->sram, NULL, "nrf51.sram", s->sram_size, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
+
+    create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
+    create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
+    create_unimplemented_device("nrf51_soc.private",
+                                PRIVATE_BASE, PRIVATE_SIZE);
+}
+
+static void nrf51_soc_init(Object *obj)
+{
+    NRF51State *s = NRF51_SOC(obj);
+
+    memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
+
+    sysbus_init_child_obj(OBJECT(s), "armv6m", OBJECT(&s->cpu), sizeof(s->cpu),
+                          TYPE_ARMV7M);
+    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
+                         ARM_CPU_TYPE_NAME("cortex-m0"));
+    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+}
+
+static Property nrf51_soc_properties[] = {
+    DEFINE_PROP_LINK("memory", NRF51State, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("sram-size", NRF51State, sram_size, NRF51822_SRAM_SIZE),
+    DEFINE_PROP_UINT32("flash-size", NRF51State, flash_size,
+                       NRF51822_FLASH_SIZE),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void nrf51_soc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = nrf51_soc_realize;
+    dc->props = nrf51_soc_properties;
+}
+
+static const TypeInfo nrf51_soc_info = {
+    .name          = TYPE_NRF51_SOC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(NRF51State),
+    .instance_init = nrf51_soc_init,
+    .class_init    = nrf51_soc_class_init,
+};
+
+static void nrf51_soc_types(void)
+{
+    type_register_static(&nrf51_soc_info);
+}
+type_init(nrf51_soc_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_STM32F2XX_SYSCFG=y
 CONFIG_STM32F2XX_ADC=y
 CONFIG_STM32F2XX_SPI=y
 CONFIG_STM32F205_SOC=y
+CONFIG_NRF51_SOC=y
 
 CONFIG_CMSDK_APB_TIMER=y
 CONFIG_CMSDK_APB_DUALTIMER=y
-- 
2.19.0

From: Joel Stanley <joel@jms.id.au>

This adds the base for a machine model of the BBC micro:bit:

https://en.wikipedia.org/wiki/Micro_Bit

This is a system with a nRF51 SoC containing the main processor, with
various peripherals on board.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-id: 20180831220920.27113-4-joel@jms.id.au
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs |  2 +-
 hw/arm/microbit.c    | 67 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/microbit.c

From: Cédric Le Goater <clg@kaod.org>

aspeed i2c interrupts should be cleared by software only, and the bus
interrupt should be lowered when all interrupts have been cleared.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180914063506.20815-2-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: drop TODO comment describing an issue which is
 fixed later in the patch series, and clean up commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@
 #define I2CD_AC_TIMING_REG2     0x08       /* Clock and AC Timing Control #1 */
 #define I2CD_INTR_CTRL_REG      0x0c       /* I2CD Interrupt Control */
 #define I2CD_INTR_STS_REG       0x10       /* I2CD Interrupt Status */
+
+#define   I2CD_INTR_SLAVE_ADDR_MATCH       (0x1 << 31) /* 0: addr1 1: addr2 */
+#define   I2CD_INTR_SLAVE_ADDR_RX_PENDING  (0x1 << 30)
+/* bits[19-16] Reserved */
+
+/* All bits below are cleared by writing 1 */
+#define   I2CD_INTR_SLAVE_INACTIVE_TIMEOUT (0x1 << 15)
 #define   I2CD_INTR_SDA_DL_TIMEOUT         (0x1 << 14)
 #define   I2CD_INTR_BUS_RECOVER_DONE       (0x1 << 13)
 #define   I2CD_INTR_SMBUS_ALERT            (0x1 << 12) /* Bus [0-3] only */
@@ -XXX,XX +XXX,XX @@
 #define   I2CD_INTR_SMBUS_DEV_ALERT_ADDR   (0x1 << 10) /* Removed */
 #define   I2CD_INTR_SMBUS_DEF_ADDR         (0x1 << 9)  /* Removed */
 #define   I2CD_INTR_GCALL_ADDR             (0x1 << 8)  /* Removed */
-#define   I2CD_INTR_SLAVE_MATCH            (0x1 << 7)  /* use RX_DONE */
+#define   I2CD_INTR_SLAVE_ADDR_RX_MATCH    (0x1 << 7)  /* use RX_DONE */
 #define   I2CD_INTR_SCL_TIMEOUT            (0x1 << 6)
 #define   I2CD_INTR_ABNORMAL               (0x1 << 5)
 #define   I2CD_INTR_NORMAL_STOP            (0x1 << 4)
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 {
     bus->cmd &= ~0xFFFF;
     bus->cmd |= value & 0xFFFF;
-    bus->intr_status = 0;
 
     if (bus->cmd & I2CD_M_START_CMD) {
         uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
         break;
     case I2CD_INTR_STS_REG:
         bus->intr_status &= ~(value & 0x7FFF);
-        bus->controller->intr_status &= ~(1 << bus->id);
-        qemu_irq_lower(bus->controller->irq);
+        if (!bus->intr_status) {
+            bus->controller->intr_status &= ~(1 << bus->id);
+            qemu_irq_lower(bus->controller->irq);
+        }
         break;
     case I2CD_DEV_ADDR_REG:
         qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-- 
2.19.0

From: Guenter Roeck <linux@roeck-us.net>

Receive command handling may have to be deferred if a previous receive
done interrupt was not yet acknowledged. Move receive command handling
into a separate function to prepare for the necessary changes.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180914063506.20815-3-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
     return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
 }
 
+static void aspeed_i2c_handle_rx_cmd(AspeedI2CBus *bus)
+{
+    int ret;
+
+    aspeed_i2c_set_state(bus, I2CD_MRXD);
+    ret = i2c_recv(bus->bus);
+    if (ret < 0) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
+        ret = 0xff;
+    } else {
+        bus->intr_status |= I2CD_INTR_RX_DONE;
+    }
+    bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
+    if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
+        i2c_nack(bus->bus);
+    }
+    bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
+    aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+}
+
 /*
  * The state machine needs some refinement. It is only used to track
  * invalid STOP commands for the moment.
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
     }
 
     if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
-        int ret;
-
-        aspeed_i2c_set_state(bus, I2CD_MRXD);
-        ret = i2c_recv(bus->bus);
-        if (ret < 0) {
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
-            ret = 0xff;
-        } else {
-            bus->intr_status |= I2CD_INTR_RX_DONE;
-        }
-        bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
-        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
-            i2c_nack(bus->bus);
-        }
-        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
-        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+        aspeed_i2c_handle_rx_cmd(bus);
     }
 
     if (bus->cmd & I2CD_M_STOP_CMD) {
-- 
2.19.0

From: Guenter Roeck <linux@roeck-us.net>

The AST2500 datasheet says:

I2CD10 Interrupt Status Register
       bit 2 Receive Done Interrupt status
             S/W needs to clear this status bit to allow next data receiving

The Rx interrupt done interrupt status bit needs to be cleared
explicitly before the next byte can be received, and must therefore
not be auto-cleared. Also, receiving the next byte must be delayed
until the bit has been cleared.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180914063506.20815-4-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
-    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
+    if ((bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) &&
+        !(bus->intr_status & I2CD_INTR_RX_DONE)) {
         aspeed_i2c_handle_rx_cmd(bus);
     }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
                                  uint64_t value, unsigned size)
 {
     AspeedI2CBus *bus = opaque;
+    bool handle_rx;
 
     switch (offset) {
     case I2CD_FUN_CTRL_REG:
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
         bus->intr_ctrl = value & 0x7FFF;
         break;
     case I2CD_INTR_STS_REG:
+        handle_rx = (bus->intr_status & I2CD_INTR_RX_DONE) &&
+                (value & I2CD_INTR_RX_DONE);
         bus->intr_status &= ~(value & 0x7FFF);
         if (!bus->intr_status) {
             bus->controller->intr_status &= ~(1 << bus->id);
             qemu_irq_lower(bus->controller->irq);
         }
+        if (handle_rx && (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST))) {
+            aspeed_i2c_handle_rx_cmd(bus);
+            aspeed_i2c_bus_raise_interrupt(bus);
+        }
         break;
     case I2CD_DEV_ADDR_REG:
         qemu_log_mask(LOG_UNIMP, "%s: slave mode not implemented\n",
-- 
2.19.0

From: Eric Auger <eric.auger@redhat.com>

At the point smmu_find_add_as() gets called, the bus number might
not be computed. Let's change the name of IOMMU memory region and
just use the devfn and an incrementing index.

The name only is used for debug.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20180921070138.10114-2-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
     SMMUState *s = opaque;
     SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
     SMMUDevice *sdev;
+    static uint index;
 
     if (!sbus) {
         sbus = g_malloc0(sizeof(SMMUPciBus) +
@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
 
     sdev = sbus->pbdev[devfn];
     if (!sdev) {
-        char *name = g_strdup_printf("%s-%d-%d",
-                                     s->mrtypename,
-                                     pci_bus_num(bus), devfn);
+        char *name = g_strdup_printf("%s-%d-%d", s->mrtypename, devfn, index++);
+
         sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
 
         sdev->smmu = s;
-- 
2.19.0

From: Eric Auger <eric.auger@redhat.com>

The event queue management is broken today. Event records
are not properly written as EVT_SET_* macro was not updating
the actual event record. Also the event queue interrupt
is not correctly triggered.

Fixes: bb981004eaf4 ("hw/arm/smmuv3: Event queue recording helper")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20180921070138.10114-3-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 26 +++++++++++++-------------
 hw/arm/smmuv3.c          |  2 +-
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
 
 #define EVT_Q_OVERFLOW        (1 << 31)
 
-#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
-#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
-#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
-#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
-#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
-#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
-#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
-#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
-#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
-#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
-#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
+#define EVT_SET_TYPE(x, v)  ((x)->word[0] = deposit32((x)->word[0], 0 , 8 , v))
+#define EVT_SET_SSV(x, v)   ((x)->word[0] = deposit32((x)->word[0], 11, 1 , v))
+#define EVT_SET_SSID(x, v)  ((x)->word[0] = deposit32((x)->word[0], 12, 20, v))
+#define EVT_SET_SID(x, v)   ((x)->word[1] = v)
+#define EVT_SET_STAG(x, v)  ((x)->word[2] = deposit32((x)->word[2], 0 , 16, v))
+#define EVT_SET_STALL(x, v) ((x)->word[2] = deposit32((x)->word[2], 31, 1 , v))
+#define EVT_SET_PNU(x, v)   ((x)->word[3] = deposit32((x)->word[3], 1 , 1 , v))
+#define EVT_SET_IND(x, v)   ((x)->word[3] = deposit32((x)->word[3], 2 , 1 , v))
+#define EVT_SET_RNW(x, v)   ((x)->word[3] = deposit32((x)->word[3], 3 , 1 , v))
+#define EVT_SET_S2(x, v)    ((x)->word[3] = deposit32((x)->word[3], 7 , 1 , v))
+#define EVT_SET_CLASS(x, v) ((x)->word[3] = deposit32((x)->word[3], 8 , 2 , v))
 #define EVT_SET_ADDR(x, addr)                             \
     do {                                                  \
             (x)->word[5] = (uint32_t)(addr >> 32);        \
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
     } while (0)
 #define EVT_SET_ADDR2(x, addr)                            \
     do {                                                  \
-            deposit32((x)->word[7], 3, 29, addr >> 16);   \
-            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
+            (x)->word[7] = deposit32((x)->word[7], 3, 29, addr >> 16);   \
+            (x)->word[7] = deposit32((x)->word[7], 0, 16, addr & 0xffff);\
     } while (0)
 
 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
         return r;
     }
 
-    if (smmuv3_q_empty(q)) {
+    if (!smmuv3_q_empty(q)) {
         smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
     }
     return MEMTX_OK;
-- 
2.19.0

The GICv2's QEMU interface (sysbus MMIO regions, IRQs,
etc) is now quite complicated with the addition of the
virtualization extensions. Add a comment in the header
file which documents it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180823103818.31189-1-peter.maydell@linaro.org
---
 include/hw/intc/arm_gic.h | 43 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gic.h
+++ b/include/hw/intc/arm_gic.h
@@ -XXX,XX +XXX,XX @@
  * with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
+/*
+ * QEMU interface:
+ *  + QOM property "num-cpu": number of CPUs to support
+ *  + QOM property "num-irq": number of IRQs (including both SPIs and PPIs)
+ *  + QOM property "revision": GIC version (1 or 2), or 0 for the 11MPCore GIC
+ *  + QOM property "has-security-extensions": set true if the GIC should
+ *    implement the security extensions
+ *  + QOM property "has-virtualization-extensions": set true if the GIC should
+ *    implement the virtualization extensions
+ *  + unnamed GPIO inputs: (where P is number of SPIs, i.e. num-irq - 32)
+ *    [0..P-1]  SPIs
+ *    [P..P+31] PPIs for CPU 0
+ *    [P+32..P+63] PPIs for CPU 1
+ *    ...
+ *  + sysbus IRQs: (in order; number will vary depending on number of cores)
+ *    - IRQ for CPU 0
+ *    - IRQ for CPU 1
+ *      ...
+ *    - FIQ for CPU 0
+ *    - FIQ for CPU 1
+ *      ...
+ *    - VIRQ for CPU 0 (exists even if virt extensions not present)
+ *    - VIRQ for CPU 1 (exists even if virt extensions not present)
+ *      ...
+ *    - VFIQ for CPU 0 (exists even if virt extensions not present)
+ *    - VFIQ for CPU 1 (exists even if virt extensions not present)
+ *      ...
+ *    - maintenance IRQ for CPU i/f 0 (only if virt extensions present)
+ *    - maintenance IRQ for CPU i/f 1 (only if virt extensions present)
+ *  + sysbus MMIO regions: (in order; numbers will vary depending on
+ *    whether virtualization extensions are present and on number of cores)
+ *    - distributor registers (GICD*)
+ *    - CPU interface for the accessing core (GICC*)
+ *    - virtual interface control registers (GICH*) (only if virt extns present)
+ *    - virtual CPU interface for the accessing core (GICV*) (only if virt)
+ *    - CPU 0 CPU interface registers
+ *    - CPU 1 CPU interface registers
+ *      ...
+ *    - CPU 0 virtual interface control registers (only if virt extns present)
+ *    - CPU 1 virtual interface control registers (only if virt extns present)
+ *      ...
+ */
+
 #ifndef HW_ARM_GIC_H
 #define HW_ARM_GIC_H
 
-- 
2.19.0

The GIC_BASE_IRQ macro is a leftover from when we shared code
between the GICv2 and the v7M NVIC. Since the NVIC is now
split off, GIC_BASE_IRQ is always 0, and we can just delete it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20180824161819.11085-1-peter.maydell@linaro.org
---
 hw/intc/gic_internal.h   |  2 --
 hw/intc/arm_gic.c        | 31 ++++++++++++++-----------------
 hw/intc/arm_gic_common.c |  1 -
 3 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/hw/intc/gic_internal.h b/hw/intc/gic_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gic_internal.h
+++ b/hw/intc/gic_internal.h
@@ -XXX,XX +XXX,XX @@
 
 #define ALL_CPU_MASK ((unsigned)(((1 << GIC_NCPU) - 1)))
 
-#define GIC_BASE_IRQ 0
-
 #define GIC_DIST_SET_ENABLED(irq, cm) (s->irq_state[irq].enabled |= (cm))
 #define GIC_DIST_CLEAR_ENABLED(irq, cm) (s->irq_state[irq].enabled &= ~(cm))
 #define GIC_DIST_TEST_ENABLED(irq, cm) ((s->irq_state[irq].enabled & (cm)) != 0)
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             res = 0;
             if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
                 /* Every byte offset holds 8 group status bits */
-                irq = (offset - 0x080) * 8 + GIC_BASE_IRQ;
+                irq = (offset - 0x080) * 8;
                 if (irq >= s->num_irq) {
                     goto bad_reg;
                 }
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             irq = (offset - 0x100) * 8;
         else
             irq = (offset - 0x180) * 8;
-        irq += GIC_BASE_IRQ;
         if (irq >= s->num_irq)
             goto bad_reg;
         res = 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             irq = (offset - 0x200) * 8;
         else
             irq = (offset - 0x280) * 8;
-        irq += GIC_BASE_IRQ;
         if (irq >= s->num_irq)
             goto bad_reg;
         res = 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             goto bad_reg;
         }
 
-        irq += GIC_BASE_IRQ;
         if (irq >= s->num_irq)
             goto bad_reg;
         res = 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
         }
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = (offset - 0x400) + GIC_BASE_IRQ;
+        irq = (offset - 0x400);
         if (irq >= s->num_irq)
             goto bad_reg;
         res = gic_dist_get_priority(s, cpu, irq, attrs);
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
             /* For uniprocessor GICs these RAZ/WI */
             res = 0;
         } else {
-            irq = (offset - 0x800) + GIC_BASE_IRQ;
+            irq = (offset - 0x800);
             if (irq >= s->num_irq) {
                 goto bad_reg;
             }
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_readb(void *opaque, hwaddr offset, MemTxAttrs attrs)
         }
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
+        irq = (offset - 0xc00) * 4;
         if (irq >= s->num_irq)
             goto bad_reg;
         res = 0;
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
              */
             if (!(s->security_extn && !attrs.secure) && gic_has_groups(s)) {
                 /* Every byte offset holds 8 group status bits */
-                irq = (offset - 0x80) * 8 + GIC_BASE_IRQ;
+                irq = (offset - 0x80) * 8;
                 if (irq >= s->num_irq) {
                     goto bad_reg;
                 }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0x180) {
         /* Interrupt Set Enable.  */
-        irq = (offset - 0x100) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x100) * 8;
         if (irq >= s->num_irq)
             goto bad_reg;
         if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0x200) {
         /* Interrupt Clear Enable.  */
-        irq = (offset - 0x180) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x180) * 8;
         if (irq >= s->num_irq)
             goto bad_reg;
         if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0x280) {
         /* Interrupt Set Pending.  */
-        irq = (offset - 0x200) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x200) * 8;
         if (irq >= s->num_irq)
             goto bad_reg;
         if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0x300) {
         /* Interrupt Clear Pending.  */
-        irq = (offset - 0x280) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x280) * 8;
         if (irq >= s->num_irq)
             goto bad_reg;
         if (irq < GIC_NR_SGIS) {
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
             goto bad_reg;
         }
 
-        irq = (offset - 0x300) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x300) * 8;
         if (irq >= s->num_irq) {
             goto bad_reg;
         }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
             goto bad_reg;
         }
 
-        irq = (offset - 0x380) * 8 + GIC_BASE_IRQ;
+        irq = (offset - 0x380) * 8;
         if (irq >= s->num_irq) {
             goto bad_reg;
         }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0x800) {
         /* Interrupt Priority.  */
-        irq = (offset - 0x400) + GIC_BASE_IRQ;
+        irq = (offset - 0x400);
         if (irq >= s->num_irq)
             goto bad_reg;
         gic_dist_set_priority(s, cpu, irq, value, attrs);
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
          * annoying exception of the 11MPCore's GIC.
          */
         if (s->num_cpu != 1 || s->revision == REV_11MPCORE) {
-            irq = (offset - 0x800) + GIC_BASE_IRQ;
+            irq = (offset - 0x800);
             if (irq >= s->num_irq) {
                 goto bad_reg;
             }
@@ -XXX,XX +XXX,XX @@ static void gic_dist_writeb(void *opaque, hwaddr offset,
         }
     } else if (offset < 0xf00) {
         /* Interrupt Configuration.  */
-        irq = (offset - 0xc00) * 4 + GIC_BASE_IRQ;
+        irq = (offset - 0xc00) * 4;
         if (irq >= s->num_irq)
             goto bad_reg;
         if (irq < GIC_NR_SGIS)
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gic_common_realize(DeviceState *dev, Error **errp)
                    s->num_cpu, GIC_NCPU);
         return;
     }
-    s->num_irq += GIC_BASE_IRQ;
     if (s->num_irq > GIC_MAXIRQ) {
         error_setg(errp,
                    "requested %u interrupt lines exceeds GIC maximum %d",
-- 
2.19.0

Convert the pcnet-pci device away from using the old_mmio
MemoryRegionOps accessor functions.

This commit is a no-behaviour-change API conversion.
(Since PCNET_PNPMMIO_SIZE is 0x20, the old "addr & 0x10"
check and the new "addr < 0x10" check are exact opposites;
the new code is phrased to be parallel with the
pcnet_io_read/write functions.)

I have left a TODO comment marker because the similarity
between the MMIO and IO accessor behaviour is suspicious
and they could be combined, but this will be left to a
different patch.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/pcnet-pci.c  | 133 ++++++++++++++++++--------------------------
 hw/net/trace-events |   8 +--
 2 files changed, 57 insertions(+), 84 deletions(-)

diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pcnet_io_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-static void pcnet_mmio_writeb(void *opaque, hwaddr addr, uint32_t val)
+/*
+ * TODO: should MMIO accesses to the addresses corresponding to the
+ * APROM also honour the BCR_DWIO() setting? If so, then these functions
+ * and pcnet_ioport_write/pcnet_ioport_read could be merged.
+ * If not, then should pcnet_ioport_{read,write}{w,l} really check
+ * BCR_DWIO() for MMIO writes ?
+ */
+static void pcnet_mmio_write(void *opaque, hwaddr addr, uint64_t value,
+                             unsigned size)
 {
     PCNetState *d = opaque;
 
-    trace_pcnet_mmio_writeb(opaque, addr, val);
-    if (!(addr & 0x10))
-        pcnet_aprom_writeb(d, addr & 0x0f, val);
-}
+    trace_pcnet_mmio_write(opaque, addr, size, val);
 
-static uint32_t pcnet_mmio_readb(void *opaque, hwaddr addr)
-{
-    PCNetState *d = opaque;
-    uint32_t val = -1;
-
-    if (!(addr & 0x10))
-        val = pcnet_aprom_readb(d, addr & 0x0f);
-    trace_pcnet_mmio_readb(opaque, addr, val);
-    return val;
-}
-
-static void pcnet_mmio_writew(void *opaque, hwaddr addr, uint32_t val)
-{
-    PCNetState *d = opaque;
-
-    trace_pcnet_mmio_writew(opaque, addr, val);
-    if (addr & 0x10)
-        pcnet_ioport_writew(d, addr & 0x0f, val);
-    else {
-        addr &= 0x0f;
-        pcnet_aprom_writeb(d, addr, val & 0xff);
-        pcnet_aprom_writeb(d, addr+1, (val & 0xff00) >> 8);
+    if (addr < 0x10) {
+        if (size == 1) {
+            pcnet_aprom_writeb(d, addr, data);
+        } else if ((addr & 1) == 0 && size == 2) {
+            pcnet_aprom_writeb(d, addr, data & 0xff);
+            pcnet_aprom_writeb(d, addr + 1, data >> 8);
+        } else if ((addr & 3) == 0 && size == 4) {
+            pcnet_aprom_writeb(d, addr, data & 0xff);
+            pcnet_aprom_writeb(d, addr + 1, (data >> 8) & 0xff);
+            pcnet_aprom_writeb(d, addr + 2, (data >> 16) & 0xff);
+            pcnet_aprom_writeb(d, addr + 3, data >> 24);
+        }
+    } else {
+        if (size == 2) {
+            pcnet_ioport_writew(d, addr, data);
+        } else if (size == 4) {
+            pcnet_ioport_writel(d, addr, data);
+        }
     }
 }
 
-static uint32_t pcnet_mmio_readw(void *opaque, hwaddr addr)
-{
-    PCNetState *d = opaque;
-    uint32_t val = -1;
-
-    if (addr & 0x10)
-        val = pcnet_ioport_readw(d, addr & 0x0f);
-    else {
-        addr &= 0x0f;
-        val = pcnet_aprom_readb(d, addr+1);
-        val <<= 8;
-        val |= pcnet_aprom_readb(d, addr);
-    }
-    trace_pcnet_mmio_readw(opaque, addr, val);
-    return val;
-}
-
-static void pcnet_mmio_writel(void *opaque, hwaddr addr, uint32_t val)
+static uint64_t pcnet_mmio_read(void *opque, hwaddr addr, unsigned size)
 {
     PCNetState *d = opaque;
 
-    trace_pcnet_mmio_writel(opaque, addr, val);
-    if (addr & 0x10)
-        pcnet_ioport_writel(d, addr & 0x0f, val);
-    else {
-        addr &= 0x0f;
-        pcnet_aprom_writeb(d, addr, val & 0xff);
-        pcnet_aprom_writeb(d, addr+1, (val & 0xff00) >> 8);
-        pcnet_aprom_writeb(d, addr+2, (val & 0xff0000) >> 16);
-        pcnet_aprom_writeb(d, addr+3, (val & 0xff000000) >> 24);
-    }
-}
+    trace_pcnet_ioport_read(opaque, addr, size);
 
-static uint32_t pcnet_mmio_readl(void *opaque, hwaddr addr)
-{
-    PCNetState *d = opaque;
-    uint32_t val;
-
-    if (addr & 0x10)
-        val = pcnet_ioport_readl(d, addr & 0x0f);
-    else {
-        addr &= 0x0f;
-        val = pcnet_aprom_readb(d, addr+3);
-        val <<= 8;
-        val |= pcnet_aprom_readb(d, addr+2);
-        val <<= 8;
-        val |= pcnet_aprom_readb(d, addr+1);
-        val <<= 8;
-        val |= pcnet_aprom_readb(d, addr);
+    if (addr < 0x10) {
+        if (size == 1) {
+            return pcnet_aprom_readb(d, addr);
+        } else if ((addr & 1) == 0 && size == 2) {
+            return pcnet_aprom_readb(d, addr) |
+                   (pcnet_aprom_readb(d, addr + 1) << 8);
+        } else if ((addr & 3) == 0 && size == 4) {
+            return pcnet_aprom_readb(d, addr) |
+                   (pcnet_aprom_readb(d, addr + 1) << 8) |
+                   (pcnet_aprom_readb(d, addr + 2) << 16) |
+                   (pcnet_aprom_readb(d, addr + 3) << 24);
+        }
+    } else {
+        if (size == 2) {
+            return pcnet_ioport_readw(d, addr);
+        } else if (size == 4) {
+            return pcnet_ioport_readl(d, addr);
+        }
     }
-    trace_pcnet_mmio_readl(opaque, addr, val);
-    return val;
+    return ((uint64_t)1 << (size * 8)) - 1;
 }
 
 static const VMStateDescription vmstate_pci_pcnet = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pci_pcnet = {
 /* PCI interface */
 
 static const MemoryRegionOps pcnet_mmio_ops = {
-    .old_mmio = {
-        .read = { pcnet_mmio_readb, pcnet_mmio_readw, pcnet_mmio_readl },
-        .write = { pcnet_mmio_writeb, pcnet_mmio_writew, pcnet_mmio_writel },
-    },
+    .read = pcnet_mmio_read,
+    .write = pcnet_mmio_write,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 1,
+    .impl.max_access_size = 4,
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x
 pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
 pcnet_ioport_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
 pcnet_ioport_write(void *opaque, uint64_t addr, uint64_t data, unsigned size) "opaque=%p addr=0x%"PRIx64" data=0x%"PRIx64" size=%d"
-pcnet_mmio_writeb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-pcnet_mmio_writew(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-pcnet_mmio_writel(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-pcnet_mmio_readb(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-pcnet_mmio_readw(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
-pcnet_mmio_readl(void *opaque, uint64_t addr, uint32_t val) "opaque=%p addr=0x%"PRIx64" val=0x%x"
+pcnet_mmio_write(void *opaque, uint64_t addr, uint32_t val, unsigned size) "opaque=%p addr=0x%"PRIx64" val=0x%x size=%d"
+pcnet_mmio_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
 
 # hw/net/net_rx_pkt.c
 net_rx_pkt_parsed(bool ip4, bool ip6, bool udp, bool tcp, size_t l3o, size_t l4o, size_t l5o) "RX packet parsed: ip4: %d, ip6: %d, udp: %d, tcp: %d, l3 offset: %zu, l4 offset: %zu, l5 offset: %zu"
-- 
2.19.0

The only difference between our implementation of the pcnet ioport
accessors and the mmio accessors is that the former check BCR_DWIO to
see what access widths are permitted for addresses in the aprom range
(0x0..0xf). In fact our failure to do this in the mmio accessors
is a bug (one which was fixed for the ioport accessors in
commit 7ba79741970 in 2011).

The data sheet for the Am79C970A does not describe the DWIO
bit as only applying for I/O space mapped I/O resources and
not memory mapped I/O resources, and our MMIO accessors already
honour DWIO for accesses in the 0x10..0x1f range (since the
pcnet_ioport_{read,write}{w,l} functions check it).

The data sheet for the later but compatible Am79C976 is clearer:
it states specifically "DWIO mode applies to both I/O- and
memory-mapped acceses." This seems to be reasonable evidence
in favour of interpretating the Am79C970A spec as being the same.

(NB: Linux's pcnet driver only supports I/O accesses, so the
MMIO access part of this device is probably untested anyway.)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/pcnet-pci.c  | 67 ++-------------------------------------------
 hw/net/trace-events |  2 --
 2 files changed, 2 insertions(+), 67 deletions(-)

diff --git a/hw/net/pcnet-pci.c b/hw/net/pcnet-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/pcnet-pci.c
+++ b/hw/net/pcnet-pci.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps pcnet_io_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
-/*
- * TODO: should MMIO accesses to the addresses corresponding to the
- * APROM also honour the BCR_DWIO() setting? If so, then these functions
- * and pcnet_ioport_write/pcnet_ioport_read could be merged.
- * If not, then should pcnet_ioport_{read,write}{w,l} really check
- * BCR_DWIO() for MMIO writes ?
- */
-static void pcnet_mmio_write(void *opaque, hwaddr addr, uint64_t value,
-                             unsigned size)
-{
-    PCNetState *d = opaque;
-
-    trace_pcnet_mmio_write(opaque, addr, size, val);
-
-    if (addr < 0x10) {
-        if (size == 1) {
-            pcnet_aprom_writeb(d, addr, data);
-        } else if ((addr & 1) == 0 && size == 2) {
-            pcnet_aprom_writeb(d, addr, data & 0xff);
-            pcnet_aprom_writeb(d, addr + 1, data >> 8);
-        } else if ((addr & 3) == 0 && size == 4) {
-            pcnet_aprom_writeb(d, addr, data & 0xff);
-            pcnet_aprom_writeb(d, addr + 1, (data >> 8) & 0xff);
-            pcnet_aprom_writeb(d, addr + 2, (data >> 16) & 0xff);
-            pcnet_aprom_writeb(d, addr + 3, data >> 24);
-        }
-    } else {
-        if (size == 2) {
-            pcnet_ioport_writew(d, addr, data);
-        } else if (size == 4) {
-            pcnet_ioport_writel(d, addr, data);
-        }
-    }
-}
-
-static uint64_t pcnet_mmio_read(void *opque, hwaddr addr, unsigned size)
-{
-    PCNetState *d = opaque;
-
-    trace_pcnet_ioport_read(opaque, addr, size);
-
-    if (addr < 0x10) {
-        if (size == 1) {
-            return pcnet_aprom_readb(d, addr);
-        } else if ((addr & 1) == 0 && size == 2) {
-            return pcnet_aprom_readb(d, addr) |
-                   (pcnet_aprom_readb(d, addr + 1) << 8);
-        } else if ((addr & 3) == 0 && size == 4) {
-            return pcnet_aprom_readb(d, addr) |
-                   (pcnet_aprom_readb(d, addr + 1) << 8) |
-                   (pcnet_aprom_readb(d, addr + 2) << 16) |
-                   (pcnet_aprom_readb(d, addr + 3) << 24);
-        }
-    } else {
-        if (size == 2) {
-            return pcnet_ioport_readw(d, addr);
-        } else if (size == 4) {
-            return pcnet_ioport_readl(d, addr);
-        }
-    }
-    return ((uint64_t)1 << (size * 8)) - 1;
-}
-
 static const VMStateDescription vmstate_pci_pcnet = {
     .name = "pcnet",
     .version_id = 3,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_pci_pcnet = {
 /* PCI interface */
 
 static const MemoryRegionOps pcnet_mmio_ops = {
-    .read = pcnet_mmio_read,
-    .write = pcnet_mmio_write,
+    .read = pcnet_ioport_read,
+    .write = pcnet_ioport_write,
     .valid.min_access_size = 1,
     .valid.max_access_size = 4,
     .impl.min_access_size = 1,
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ pcnet_aprom_writeb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x
 pcnet_aprom_readb(void *opaque, uint32_t addr, uint32_t val) "opaque=%p addr=0x%08x val=0x%02x"
 pcnet_ioport_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
 pcnet_ioport_write(void *opaque, uint64_t addr, uint64_t data, unsigned size) "opaque=%p addr=0x%"PRIx64" data=0x%"PRIx64" size=%d"
-pcnet_mmio_write(void *opaque, uint64_t addr, uint32_t val, unsigned size) "opaque=%p addr=0x%"PRIx64" val=0x%x size=%d"
-pcnet_mmio_read(void *opaque, uint64_t addr, unsigned size) "opaque=%p addr=0x%"PRIx64" size=%d"
 
 # hw/net/net_rx_pkt.c
 net_rx_pkt_parsed(bool ip4, bool ip6, bool udp, bool tcp, size_t l3o, size_t l4o, size_t l5o) "RX packet parsed: ip4: %d, ip6: %d, udp: %d, tcp: %d, l3 offset: %zu, l4 offset: %zu, l5 offset: %zu"
-- 
2.19.0

Add 'break' statements missing from a switch in the APB dual-timer
write function. Spotted by Coverity as CID 1395626 and 1395633.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180924123122.14549-1-peter.maydell@linaro.org
---
 hw/timer/cmsdk-apb-dualtimer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_write(void *opaque, hwaddr offset,
         case A_TIMERITCR:
             s->timeritcr = value & R_TIMERITCR_VALID_MASK;
             cmsdk_apb_dualtimer_update(s);
+            break;
         case A_TIMERITOP:
             s->timeritop = value & R_TIMERITOP_VALID_MASK;
             cmsdk_apb_dualtimer_update(s);
+            break;
         default:
         bad_offset:
             qemu_log_mask(LOG_GUEST_ERROR,
-- 
2.19.0

From: Cédric Le Goater <clg@kaod.org>

In file included from /home/thuth/devel/qemu/hw/timer/aspeed_timer.c:16:
/home/thuth/devel/qemu/include/hw/misc/aspeed_scu.h:37:3: error:
redefinition of typedef 'AspeedSCUState' is a C11 feature
      [-Werror,-Wtypedef-redefinition]
} AspeedSCUState;
  ^
/home/thuth/devel/qemu/include/hw/timer/aspeed_timer.h:27:31: note:
previous definition is here
typedef struct AspeedSCUState AspeedSCUState;

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180921161939.822-2-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/aspeed_timer.h | 3 +--
 hw/timer/aspeed_timer.c         | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/hw/timer/aspeed_timer.h b/include/hw/timer/aspeed_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/aspeed_timer.h
+++ b/include/hw/timer/aspeed_timer.h
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_TIMER_H
 
 #include "qemu/timer.h"
-
-typedef struct AspeedSCUState AspeedSCUState;
+#include "hw/misc/aspeed_scu.h"
 
 #define ASPEED_TIMER(obj) \
     OBJECT_CHECK(AspeedTimerCtrlState, (obj), TYPE_ASPEED_TIMER);
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/timer/aspeed_timer.h"
-#include "hw/misc/aspeed_scu.h"
 #include "qemu-common.h"
 #include "qemu/bitops.h"
 #include "qemu/timer.h"
-- 
2.19.0

From: Cédric Le Goater <clg@kaod.org>

The AST2500 evb is shipped with a W25Q256 which has a non volatile bit
to make the chip operate in 4 Byte address mode at power up. This
should be an interesting feature to model as it will exercise a bit
more the SMC controllers and MMIO execution at boot time.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180921161939.822-3-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
     [AST2500_EVB]  = {
         .soc_name  = "ast2500-a1",
         .hw_strap1 = AST2500_EVB_HW_STRAP1,
-        .fmc_model = "n25q256a",
+        .fmc_model = "w25q256",
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
         .i2c_init  = ast2500_evb_i2c_init,
-- 
2.19.0

From: Cédric Le Goater <clg@kaod.org>

The code looks better, it removes duplicated lines and it will ease
the introduction of common properties for the Aspeed machines.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180921161939.822-4-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed.h |  46 +++++++++
 hw/arm/aspeed.c         | 212 +++++++++++++---------------------------
 2 files changed, 116 insertions(+), 142 deletions(-)
 create mode 100644 include/hw/arm/aspeed.h

diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/aspeed.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Aspeed Machines
+ *
+ * Copyright 2018 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+#ifndef ARM_ASPEED_H
+#define ARM_ASPEED_H
+
+#include "hw/boards.h"
+
+typedef struct AspeedBoardState AspeedBoardState;
+
+typedef struct AspeedBoardConfig {
+    const char *name;
+    const char *desc;
+    const char *soc_name;
+    uint32_t hw_strap1;
+    const char *fmc_model;
+    const char *spi_model;
+    uint32_t num_cs;
+    void (*i2c_init)(AspeedBoardState *bmc);
+} AspeedBoardConfig;
+
+#define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
+#define ASPEED_MACHINE(obj) \
+    OBJECT_CHECK(AspeedMachine, (obj), TYPE_ASPEED_MACHINE)
+
+typedef struct AspeedMachine {
+    MachineState parent_obj;
+} AspeedMachine;
+
+#define ASPEED_MACHINE_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedMachineClass, (klass), TYPE_ASPEED_MACHINE)
+#define ASPEED_MACHINE_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedMachineClass, (obj), TYPE_ASPEED_MACHINE)
+
+typedef struct AspeedMachineClass {
+    MachineClass parent_obj;
+    const AspeedBoardConfig *board;
+} AspeedMachineClass;
+
+
+#endif
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/arm.h"
+#include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
 #include "hw/i2c/smbus.h"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardState {
     MemoryRegion max_ram;
 } AspeedBoardState;
 
-typedef struct AspeedBoardConfig {
-    const char *soc_name;
-    uint32_t hw_strap1;
-    const char *fmc_model;
-    const char *spi_model;
-    uint32_t num_cs;
-    void (*i2c_init)(AspeedBoardState *bmc);
-} AspeedBoardConfig;
-
-enum {
-    PALMETTO_BMC,
-    AST2500_EVB,
-    ROMULUS_BMC,
-    WITHERSPOON_BMC,
-};
-
 /* Palmetto hardware value: 0x120CE416 */
 #define PALMETTO_BMC_HW_STRAP1 (                                        \
         SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_256MB) |               \
@@ -XXX,XX +XXX,XX @@ enum {
 /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 
-static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
-static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
-static void romulus_bmc_i2c_init(AspeedBoardState *bmc);
-static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
-
-static const AspeedBoardConfig aspeed_boards[] = {
-    [PALMETTO_BMC] = {
-        .soc_name  = "ast2400-a1",
-        .hw_strap1 = PALMETTO_BMC_HW_STRAP1,
-        .fmc_model = "n25q256a",
-        .spi_model = "mx25l25635e",
-        .num_cs    = 1,
-        .i2c_init  = palmetto_bmc_i2c_init,
-    },
-    [AST2500_EVB]  = {
-        .soc_name  = "ast2500-a1",
-        .hw_strap1 = AST2500_EVB_HW_STRAP1,
-        .fmc_model = "w25q256",
-        .spi_model = "mx25l25635e",
-        .num_cs    = 1,
-        .i2c_init  = ast2500_evb_i2c_init,
-    },
-    [ROMULUS_BMC]  = {
-        .soc_name  = "ast2500-a1",
-        .hw_strap1 = ROMULUS_BMC_HW_STRAP1,
-        .fmc_model = "n25q256a",
-        .spi_model = "mx66l1g45g",
-        .num_cs    = 2,
-        .i2c_init  = romulus_bmc_i2c_init,
-    },
-    [WITHERSPOON_BMC]  = {
-        .soc_name  = "ast2500-a1",
-        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
-        .fmc_model = "mx25l25635e",
-        .spi_model = "mx66l1g45g",
-        .num_cs    = 2,
-        .i2c_init  = witherspoon_bmc_i2c_init,
-    },
-};
-
 /*
  * The max ram region is for firmwares that scan the address space
  * with load/store to guess how much RAM the SoC has.
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
     object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
-static void palmetto_bmc_init(MachineState *machine)
-{
-    aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
-}
-
-static void palmetto_bmc_class_init(ObjectClass *oc, void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-
-    mc->desc = "OpenPOWER Palmetto BMC (ARM926EJ-S)";
-    mc->init = palmetto_bmc_init;
-    mc->max_cpus = 1;
-    mc->no_sdcard = 1;
-    mc->no_floppy = 1;
-    mc->no_cdrom = 1;
-    mc->no_parallel = 1;
-}
-
-static const TypeInfo palmetto_bmc_type = {
-    .name = MACHINE_TYPE_NAME("palmetto-bmc"),
-    .parent = TYPE_MACHINE,
-    .class_init = palmetto_bmc_class_init,
-};
-
 static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
-static void ast2500_evb_init(MachineState *machine)
-{
-    aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
-}
-
-static void ast2500_evb_class_init(ObjectClass *oc, void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-
-    mc->desc = "Aspeed AST2500 EVB (ARM1176)";
-    mc->init = ast2500_evb_init;
-    mc->max_cpus = 1;
-    mc->no_sdcard = 1;
-    mc->no_floppy = 1;
-    mc->no_cdrom = 1;
-    mc->no_parallel = 1;
-}
-
-static const TypeInfo ast2500_evb_type = {
-    .name = MACHINE_TYPE_NAME("ast2500-evb"),
-    .parent = TYPE_MACHINE,
-    .class_init = ast2500_evb_class_init,
-};
-
 static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
-static void romulus_bmc_init(MachineState *machine)
-{
-    aspeed_board_init(machine, &aspeed_boards[ROMULUS_BMC]);
-}
-
-static void romulus_bmc_class_init(ObjectClass *oc, void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-
-    mc->desc = "OpenPOWER Romulus BMC (ARM1176)";
-    mc->init = romulus_bmc_init;
-    mc->max_cpus = 1;
-    mc->no_sdcard = 1;
-    mc->no_floppy = 1;
-    mc->no_cdrom = 1;
-    mc->no_parallel = 1;
-}
-
-static const TypeInfo romulus_bmc_type = {
-    .name = MACHINE_TYPE_NAME("romulus-bmc"),
-    .parent = TYPE_MACHINE,
-    .class_init = romulus_bmc_class_init,
-};
-
 static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
                      0x60);
 }
 
-static void witherspoon_bmc_init(MachineState *machine)
+static void aspeed_machine_init(MachineState *machine)
 {
-    aspeed_board_init(machine, &aspeed_boards[WITHERSPOON_BMC]);
+    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
+
+    aspeed_board_init(machine, amc->board);
 }
 
-static void witherspoon_bmc_class_init(ObjectClass *oc, void *data)
+static void aspeed_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+    const AspeedBoardConfig *board = data;
 
-    mc->desc = "OpenPOWER Witherspoon BMC (ARM1176)";
-    mc->init = witherspoon_bmc_init;
+    mc->desc = board->desc;
+    mc->init = aspeed_machine_init;
     mc->max_cpus = 1;
     mc->no_sdcard = 1;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
+    amc->board = board;
 }
 
-static const TypeInfo witherspoon_bmc_type = {
-    .name = MACHINE_TYPE_NAME("witherspoon-bmc"),
+static const TypeInfo aspeed_machine_type = {
+    .name = TYPE_ASPEED_MACHINE,
     .parent = TYPE_MACHINE,
-    .class_init = witherspoon_bmc_class_init,
+    .instance_size = sizeof(AspeedMachine),
+    .class_size = sizeof(AspeedMachineClass),
+    .abstract = true,
 };
 
-static void aspeed_machine_init(void)
+static const AspeedBoardConfig aspeed_boards[] = {
+    {
+        .name      = MACHINE_TYPE_NAME("palmetto-bmc"),
+        .desc      = "OpenPOWER Palmetto BMC (ARM926EJ-S)",
+        .soc_name  = "ast2400-a1",
+        .hw_strap1 = PALMETTO_BMC_HW_STRAP1,
+        .fmc_model = "n25q256a",
+        .spi_model = "mx25l25635e",
+        .num_cs    = 1,
+        .i2c_init  = palmetto_bmc_i2c_init,
+    }, {
+        .name      = MACHINE_TYPE_NAME("ast2500-evb"),
+        .desc      = "Aspeed AST2500 EVB (ARM1176)",
+        .soc_name  = "ast2500-a1",
+        .hw_strap1 = AST2500_EVB_HW_STRAP1,
+        .fmc_model = "w25q256",
+        .spi_model = "mx25l25635e",
+        .num_cs    = 1,
+        .i2c_init  = ast2500_evb_i2c_init,
+    }, {
+        .name      = MACHINE_TYPE_NAME("romulus-bmc"),
+        .desc      = "OpenPOWER Romulus BMC (ARM1176)",
+        .soc_name  = "ast2500-a1",
+        .hw_strap1 = ROMULUS_BMC_HW_STRAP1,
+        .fmc_model = "n25q256a",
+        .spi_model = "mx66l1g45g",
+        .num_cs    = 2,
+        .i2c_init  = romulus_bmc_i2c_init,
+    }, {
+        .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
+        .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
+        .soc_name  = "ast2500-a1",
+        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
+        .fmc_model = "mx25l25635e",
+        .spi_model = "mx66l1g45g",
+        .num_cs    = 2,
+        .i2c_init  = witherspoon_bmc_i2c_init,
+    },
+};
+
+static void aspeed_machine_types(void)
 {
-    type_register_static(&palmetto_bmc_type);
-    type_register_static(&ast2500_evb_type);
-    type_register_static(&romulus_bmc_type);
-    type_register_static(&witherspoon_bmc_type);
+    int i;
+
+    type_register_static(&aspeed_machine_type);
+    for (i = 0; i < ARRAY_SIZE(aspeed_boards); ++i) {
+        TypeInfo ti = {
+            .name       = aspeed_boards[i].name,
+            .parent     = TYPE_ASPEED_MACHINE,
+            .class_init = aspeed_machine_class_init,
+            .class_data = (void *)&aspeed_boards[i],
+        };
+        type_register(&ti);
+    }
 }
 
-type_init(aspeed_machine_init)
+type_init(aspeed_machine_types)
-- 
2.19.0

From: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180921161939.822-6-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_default_read(void *opaque, hwaddr addr,
 static void aspeed_smc_flash_default_write(void *opaque, hwaddr addr,
                                            uint64_t data, unsigned size)
 {
-   qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
-                 PRIx64 "\n", __func__, addr, size, data);
+    qemu_log_mask(LOG_GUEST_ERROR, "%s: To 0x%" HWADDR_PRIx " of size %u: 0x%"
+                  PRIx64 "\n", __func__, addr, size, data);
 }
 
 static const MemoryRegionOps aspeed_smc_flash_default_ops = {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_flash_setup(AspeedSMCFlash *fl, uint32_t addr)
      */
     if (aspeed_smc_flash_mode(fl) == CTRL_FREADMODE) {
         for (i = 0; i < aspeed_smc_flash_dummies(fl); i++) {
-                ssi_transfer(fl->controller->spi, 0xFF);
+            ssi_transfer(fl->controller->spi, 0xFF);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_flash_read(void *opaque, hwaddr addr, unsigned size)
 }
 
 static void aspeed_smc_flash_write(void *opaque, hwaddr addr, uint64_t data,
-                           unsigned size)
+                                   unsigned size)
 {
     AspeedSMCFlash *fl = opaque;
     AspeedSMCState *s = fl->controller;
-- 
2.19.0

The ARMv8 architecture defines that an AArch32 CPU starts
in SVC mode, unless EL2 is the highest available EL, in
which case it starts in Hyp mode. (In ARMv7 a CPU with EL2
but not EL3 was not a valid configuration, but we don't
specifically reject this if the user asks for one.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20180823135047.16525-1-peter.maydell@linaro.org
---
 target/arm/cpu.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->cp15.c15_cpar = 1;
     }
 #else
-    /* SVC mode with interrupts disabled.  */
-    env->uncached_cpsr = ARM_CPU_MODE_SVC;
+
+    /*
+     * If the highest available EL is EL2, AArch32 will start in Hyp
+     * mode; otherwise it starts in SVC. Note that if we start in
+     * AArch64 then these values in the uncached_cpsr will be ignored.
+     */
+    if (arm_feature(env, ARM_FEATURE_EL2) &&
+        !arm_feature(env, ARM_FEATURE_EL3)) {
+        env->uncached_cpsr = ARM_CPU_MODE_HYP;
+    } else {
+        env->uncached_cpsr = ARM_CPU_MODE_SVC;
+    }
     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-- 
2.19.0

Nothing very exciting this time around...

-- PMM

The following changes since commit 37a712a0f969ca2df7f01182409a6c4825cebfb5:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2020-10-01 12:23:19 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201001

for you to fetch changes up to cdfaa57dcb53ba012439765a1462247dfda8595d:

hw/arm/raspi: Remove use of the 'version' value in the board code (2020-10-01 15:31:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * Make isar_feature_aa32_fp16_arith() handle M-profile
 * Fix SVE splice
 * Fix SVE LDR/STR
 * Remove ignore_memory_transaction_failures on the raspi2
 * raspi: Various cleanup/refactoring

----------------------------------------------------------------
Peter Maydell (5):
      target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
      target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
      hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
      target/arm: Add ID register values for Cortex-M0
      target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile

Philippe Mathieu-Daudé (11):
      hw/arm/raspi: Define various blocks base addresses
      hw/arm/bcm2835: Add more unimplemented peripherals
      hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
      hw/arm/raspi: Display the board revision in the machine description
      hw/arm/raspi: Load the firmware on the first core
      hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
      hw/arm/raspi: Avoid using TypeInfo::class_data pointer
      hw/arm/raspi: Use more specific machine names
      hw/arm/raspi: Introduce RaspiProcessorId enum
      hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
      hw/arm/raspi: Remove use of the 'version' value in the board code

Richard Henderson (2):
      target/arm: Fix sve ldr/str
      target/arm: Fix SVE splice

The ARM_FEATURE_PXN bit indicates whether the CPU supports the PXN
bit in short-descriptor translation table format descriptors.  This
is indicated by ID_MMFR0.VMSA being at least 0b0100.  Replace the
feature bit with an ID register check, in line with our preference
for ID register checks over feature bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-2-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 15 ++++++++++++++-
 target/arm/cpu.c    |  1 -
 target/arm/helper.c |  5 +++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, FHM, 8, 4)
 FIELD(ID_ISAR6, SB, 12, 4)
 FIELD(ID_ISAR6, SPECRES, 16, 4)
 
+FIELD(ID_MMFR0, VMSA, 0, 4)
+FIELD(ID_MMFR0, PMSA, 4, 4)
+FIELD(ID_MMFR0, OUTERSHR, 8, 4)
+FIELD(ID_MMFR0, SHARELVL, 12, 4)
+FIELD(ID_MMFR0, TCM, 16, 4)
+FIELD(ID_MMFR0, AUXREG, 20, 4)
+FIELD(ID_MMFR0, FCSE, 24, 4)
+FIELD(ID_MMFR0, INNERSHR, 28, 4)
+
 FIELD(ID_MMFR3, CMAINTVA, 0, 4)
 FIELD(ID_MMFR3, CMAINTSW, 4, 4)
 FIELD(ID_MMFR3, BPMAINT, 8, 4)
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */
     ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */
     ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
-    ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
     ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
     ARM_FEATURE_V8,
     ARM_FEATURE_AARCH64, /* supports 64 bit mode */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 4;
 }
 
+static inline bool isar_feature_aa32_pxn(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_mmfr0, ID_MMFR0, VMSA) >= 4;
+}
+
 static inline bool isar_feature_aa32_pan(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
-        set_feature(env, ARM_FEATURE_PXN);
     }
     if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
         set_feature(env, ARM_FEATURE_CBAR);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
                              target_ulong *page_size, ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    ARMCPU *cpu = env_archcpu(env);
     int level = 1;
     uint32_t table;
     uint32_t desc;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         goto do_fault;
     }
     type = (desc & 3);
-    if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
+    if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
         /* Section translation fault, or attempt to use the encoding
          * which is Reserved on implementations without PXN.
          */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         pxn = desc & 1;
         ns = extract32(desc, 19, 1);
     } else {
-        if (arm_feature(env, ARM_FEATURE_PXN)) {
+        if (cpu_isar_feature(aa32_pxn, cpu)) {
             pxn = (desc >> 2) & 1;
         }
         ns = extract32(desc, 3, 1);
-- 
2.20.1

Move the id_pfr0 and id_pfr1 fields into the ARMISARegisters
sub-struct. We're going to want id_pfr1 for an isar_features
check, and moving both at the same time avoids an odd
inconsistency.

Changes other than the ones to cpu.h and kvm64.c made
automatically with:
  perl -p -i -e 's/cpu->id_pfr/cpu->isar.id_pfr/' target/arm/*.c hw/intc/armv7m_nvic.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-3-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  4 ++--
 hw/intc/armv7m_nvic.c |  4 ++--
 target/arm/cpu.c      | 20 ++++++++++----------
 target/arm/cpu64.c    | 12 ++++++------
 target/arm/cpu_tcg.c  | 36 ++++++++++++++++++------------------
 target/arm/helper.c   |  4 ++--
 target/arm/kvm64.c    |  4 ++++
 7 files changed, 44 insertions(+), 40 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint32_t id_mmfr2;
         uint32_t id_mmfr3;
         uint32_t id_mmfr4;
+        uint32_t id_pfr0;
+        uint32_t id_pfr1;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     uint32_t reset_fpsid;
     uint32_t ctr;
     uint32_t reset_sctlr;
-    uint32_t id_pfr0;
-    uint32_t id_pfr1;
     uint64_t pmceid0;
     uint64_t pmceid1;
     uint32_t id_afr0;
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                       "Aux Fault status registers unimplemented\n");
         return 0;
     case 0xd40: /* PFR0.  */
-        return cpu->id_pfr0;
+        return cpu->isar.id_pfr0;
     case 0xd44: /* PFR1.  */
-        return cpu->id_pfr1;
+        return cpu->isar.id_pfr1;
     case 0xd48: /* DFR0.  */
         return cpu->isar.id_dfr0;
     case 0xd4c: /* AFR0.  */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         /* Disable the security extension feature bits in the processor feature
          * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
          */
-        cpu->id_pfr1 &= ~0xf0;
+        cpu->isar.id_pfr1 &= ~0xf0;
         cpu->isar.id_aa64pfr0 &= ~0xf000;
     }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * id_aa64pfr0_el1[11:8].
          */
         cpu->isar.id_aa64pfr0 &= ~0xf00;
-        cpu->id_pfr1 &= ~0xf000;
+        cpu->isar.id_pfr1 &= ~0xf000;
     }
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00011111;
     cpu->ctr = 0x82048004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x1031;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x1031;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x400;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x31100003;
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x01111111;
     cpu->ctr = 0x80038003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x1031;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x1031;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x000;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x00100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x84448003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x00001131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00001131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x00001131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00001131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x33;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x11111111;
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0;
     cpu->id_afr0 = 0x2;
     cpu->isar.id_mmfr0 = 0x01100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     cpu->midr = 0x410fc231;
     cpu->pmsav7_dregion = 8;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000000;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x12000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00100030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000210;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
     cpu->isar.id_dfr0 = 0x00200000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00101F40;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMSA);
     set_feature(&cpu->env, ARM_FEATURE_PMU);
     cpu->midr = 0x411fc153; /* r1p3 */
-    cpu->id_pfr0 = 0x0131;
-    cpu->id_pfr1 = 0x001;
+    cpu->isar.id_pfr0 = 0x0131;
+    cpu->isar.id_pfr1 = 0x001;
     cpu->isar.id_dfr0 = 0x010400;
     cpu->id_afr0 = 0x0;
     cpu->isar.id_mmfr0 = 0x0210030;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint64_t pfr1 = cpu->id_pfr1;
+    uint64_t pfr1 = cpu->isar.id_pfr1;
 
     if (env->gicv3state) {
         pfr1 |= 1 << 28;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->id_pfr0 },
+              .resetvalue = cpu->isar.id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
              */
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * than skipping the reads and leaving 0, as we must avoid
          * considering the values in every case.
          */
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
+                              ARM64_SYS_REG(3, 0, 0, 1, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
+                              ARM64_SYS_REG(3, 0, 0, 1, 1));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 2));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
-- 
2.20.1

M-profile CPUs only implement the ID registers as guest-visible if
the CPU implements the Main Extension (all our current CPUs except
the Cortex-M0 do).

Currently we handle this by having the Cortex-M0 leave the ID
register values in the ARMCPU struct as zero, but this conflicts with
our design decision to make QEMU behaviour be keyed off ID register
fields wherever possible.

Explicitly code the ID registers in the NVIC to return 0 if the Main
Extension is not implemented, so we can make the M0 model set the
ARMCPU struct fields to obtain the correct behaviour without those
values becoming guest-visible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-4-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                       "Aux Fault status registers unimplemented\n");
         return 0;
     case 0xd40: /* PFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_pfr0;
     case 0xd44: /* PFR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_pfr1;
     case 0xd48: /* DFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_dfr0;
     case 0xd4c: /* AFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->id_afr0;
     case 0xd50: /* MMFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr0;
     case 0xd54: /* MMFR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr1;
     case 0xd58: /* MMFR2.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr2;
     case 0xd5c: /* MMFR3.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr3;
     case 0xd60: /* ISAR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar0;
     case 0xd64: /* ISAR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar1;
     case 0xd68: /* ISAR2.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar2;
     case 0xd6c: /* ISAR3.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar3;
     case 0xd70: /* ISAR4.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar4;
     case 0xd74: /* ISAR5.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar5;
     case 0xd78: /* CLIDR */
         return cpu->clidr;
-- 
2.20.1

Give the Cortex-M0 ID register values corresponding to its
implemented behaviour.  These will not be guest-visible but will be
used to govern the behaviour of QEMU's emulation.  We use the same
values that the Cortex-M3 does.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-5-peter.maydell@linaro.org
---
 target/arm/cpu_tcg.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void cortex_m0_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
 
     cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
 }
 
 static void cortex_m3_initfn(Object *obj)
-- 
2.20.1

The M-profile definition of the MVFR1 ID register differs slightly
from the A-profile one, and in particular the check for "does the CPU
support fp16 arithmetic" is not the same.

We don't currently implement any M-profile CPUs with fp16 arithmetic,
so this is not yet a visible bug, but correcting the logic now
disarms this beartrap for when we eventually do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-6-peter.maydell@linaro.org
---
 target/arm/cpu.h | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
 FIELD(ID_MMFR4, CCIDX, 24, 4)
 FIELD(ID_MMFR4, EVT, 28, 4)
 
+FIELD(ID_PFR1, PROGMOD, 0, 4)
+FIELD(ID_PFR1, SECURITY, 4, 4)
+FIELD(ID_PFR1, MPROGMOD, 8, 4)
+FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
+FIELD(ID_PFR1, GENTIMER, 16, 4)
+FIELD(ID_PFR1, SEC_FRAC, 20, 4)
+FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
+FIELD(ID_PFR1, GIC, 28, 4)
+
 FIELD(ID_AA64ISAR0, AES, 4, 4)
 FIELD(ID_AA64ISAR0, SHA1, 8, 4)
 FIELD(ID_AA64ISAR0, SHA2, 12, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(MVFR0, FPROUND, 28, 4)
 
 FIELD(MVFR1, FPFTZ, 0, 4)
 FIELD(MVFR1, FPDNAN, 4, 4)
-FIELD(MVFR1, SIMDLS, 8, 4)
-FIELD(MVFR1, SIMDINT, 12, 4)
-FIELD(MVFR1, SIMDSP, 16, 4)
-FIELD(MVFR1, SIMDHP, 20, 4)
+FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
+FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
+FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
+FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
+FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
+FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
 FIELD(MVFR1, FPHP, 24, 4)
 FIELD(MVFR1, SIMDFMAC, 28, 4)
 
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
     return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
 }
 
+static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+}
+
 static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+    /* Sadly this is encoded differently for A-profile and M-profile */
+    if (isar_feature_aa32_mprofile(id)) {
+        return FIELD_EX32(id->mvfr1, MVFR1, FP16) > 0;
+    } else {
+        return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+    }
 }
 
 static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mte update missed a bit when producing clean addresses.

Fixes: b2aa8879b88
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200916014102.2446323-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         for (i = 0; i < len_align; i += 8) {
             tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEQ);
             tcg_gen_st_i64(t0, cpu_env, vofs + i);
-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
         }
         tcg_temp_free_i64(t0);
     } else {
@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         for (i = 0; i < len_align; i += 8) {
             tcg_gen_ld_i64(t0, cpu_env, vofs + i);
             tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEQ);
-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
         }
         tcg_temp_free_i64(t0);
     } else {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

While converting to gen_gvec_ool_zzzp, we lost passing
a->esz as the data argument to the function.

Fixes: 36cbb7a8e71
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200918000500.2690937-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_SPLICE(DisasContext *s, arg_rprr_esz *a)
 {
     if (sve_access_check(s)) {
         gen_gvec_ool_zzzp(s, gen_helper_sve_splice,
-                          a->rd, a->rn, a->rm, a->pg, 0);
+                          a->rd, a->rn, a->rm, a->pg, a->esz);
     }
     return true;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The Raspberry firmware is closed-source. While running it, it
accesses various I/O registers. Logging these accesses as UNIMP
(unimplemented) help to understand what the firmware is doing
(ideally we want it able to boot a Linux kernel).

Document various blocks we might use later.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200921034729.432931-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/raspi_platform.h | 51 +++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -XXX,XX +XXX,XX @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Various undocumented addresses and names come from Herman Hermitage's VC4
+ * documentation:
+ * https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
  */
 
 #ifndef HW_ARM_RASPI_PLATFORM_H
 #define HW_ARM_RASPI_PLATFORM_H
 
 #define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
-#define IC0_OFFSET              0x2000
+#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
+#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
 #define ST_OFFSET               0x3000   /* System Timer */
+#define TXP_OFFSET              0x4000   /* Transposer */
+#define JPEG_OFFSET             0x5000
 #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
 #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
-#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
+#define ARBA_OFFSET             0x9000
+#define BRDG_OFFSET             0xa000
+#define ARM_OFFSET              0xB000   /* ARM control block */
 #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
 #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
-#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
+#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
 #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
                                                       * Doorbells & Mailboxes */
 #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
@@ -XXX,XX +XXX,XX @@
 #define AVS_OFFSET              0x103000 /* Audio Video Standard */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
-#define UART0_OFFSET            0x201000
-#define MMCI0_OFFSET            0x202000
-#define I2S_OFFSET              0x203000
-#define SPI0_OFFSET             0x204000
+#define UART0_OFFSET            0x201000 /* PL011 */
+#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
+#define I2S_OFFSET              0x203000 /* PCM */
+#define SPI0_OFFSET             0x204000 /* SPI master */
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define PIXV0_OFFSET            0x206000
+#define PIXV1_OFFSET            0x207000
+#define DPI_OFFSET              0x208000
+#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
+#define PWM_OFFSET              0x20c000
+#define PERM_OFFSET             0x20d000
+#define TEC_OFFSET              0x20e000
 #define OTP_OFFSET              0x20f000
+#define SLIM_OFFSET             0x210000 /* SLIMbus */
+#define CPG_OFFSET              0x211000
 #define THERMAL_OFFSET          0x212000
-#define BSC_SL_OFFSET           0x214000 /* SPI slave */
+#define AVSP_OFFSET             0x213000
+#define BSC_SL_OFFSET           0x214000 /* SPI slave (bootrom) */
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
+#define EMMC2_OFFSET            0x340000
+#define HVS_OFFSET              0x400000
 #define SMI_OFFSET              0x600000
+#define DSI1_OFFSET             0x700000
+#define UCAM_OFFSET             0x800000
+#define CMI_OFFSET              0x802000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
 #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
+#define VECA_OFFSET             0x806000
+#define PIXV2_OFFSET            0x807000
+#define HDMI_OFFSET             0x808000
+#define HDCP_OFFSET             0x809000
+#define ARBR0_OFFSET            0x80a000
 #define DBUS_OFFSET             0x900000
 #define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define V3D_OFFSET              0xc00000
 #define SDRAMC_OFFSET           0xe00000
+#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
+#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
+#define ARBR1_OFFSET            0xe04000
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
+#define DCRC_OFFSET             0xe07000
+#define AXIP_OFFSET             0xe08000
 
 /* GPU interrupts */
 #define INTERRUPT_TIMER0               0
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The bcm2835-v3d is used since Linux 4.7, see commit
49ac67e0c39c ("ARM: bcm2835: Add VC4 to the device tree"),
and the bcm2835-txp since Linux 4.19, see commit
b7dd29b401f5 ("ARM: dts: bcm283x: Add Transposer block").

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200921034729.432931-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h | 2 ++
 hw/arm/bcm2835_peripherals.c         | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
 
     BCM2835SystemTimerState systmr;
     BCM2835MphiState mphi;
+    UnimplementedDeviceState txp;
     UnimplementedDeviceState armtmr;
     UnimplementedDeviceState cprman;
     UnimplementedDeviceState a2w;
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
     UnimplementedDeviceState otp;
     UnimplementedDeviceState dbus;
     UnimplementedDeviceState ave0;
+    UnimplementedDeviceState v3d;
     UnimplementedDeviceState bscsl;
     UnimplementedDeviceState smi;
     DWC2State dwc2;
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
                                INTERRUPT_USB));
 
+    create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
     create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
     create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
     create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
     create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
+    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x1000);
     create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Commit 1c3db49d39 added the raspi3, which uses the same peripherals
than the raspi2 (but with different ARM cores). The raspi3 was
introduced without the ignore_memory_transaction_failures flag.
Almost 2 years later, the machine is usable running U-Boot and
Linux.
In commit 00cbd5bd74 we mapped a lot of unimplemented devices,
commit d442d95f added thermal block and commit 0e5bbd7406 the
system timer.
As we are happy with the raspi3, let's remove this flag on the
raspi2.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200921034729.432931-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     mc->default_cpus = mc->min_cpus = mc->max_cpus = cores_count(board_rev);
     mc->default_ram_size = board_ram_size(board_rev);
     mc->default_ram_id = "ram";
-    if (board_version(board_rev) == 2) {
-        mc->ignore_memory_transaction_failures = true;
-    }
 };
 
 static const TypeInfo raspi_machine_types[] = {
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Display the board revision in the machine description.

Before:

$ qemu-system-aarch64 -M help | fgrep raspi
  raspi2               Raspberry Pi 2B
  raspi3               Raspberry Pi 3B

After:

raspi2               Raspberry Pi 2B (revision 1.1)
  raspi3               Raspberry Pi 3B (revision 1.2)

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     uint32_t board_rev = (uint32_t)(uintptr_t)data;
 
     rmc->board_rev = board_rev;
-    mc->desc = g_strdup_printf("Raspberry Pi %s", board_type(board_rev));
+    mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
+                               board_type(board_rev),
+                               FIELD_EX32(board_rev, REV_CODE, REVISION));
     mc->init = raspi_machine_init;
     mc->block_default_type = IF_SD;
     mc->no_parallel = 1;
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The 'first_cpu' is more a QEMU accelerator-related concept
than a variable the machine requires to use.
Since the machine is aware of its CPUs, directly use the
first one to load the firmware.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
 
 static void setup_boot(MachineState *machine, int version, size_t ram_size)
 {
+    RaspiMachineState *s = RASPI_MACHINE(machine);
     static struct arm_boot_info binfo;
     int r;
 
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
         binfo.firmware_loaded = true;
     }
 
-    arm_load_kernel(ARM_CPU(first_cpu), machine, &binfo);
+    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
 }
 
 static void raspi_machine_init(MachineState *machine)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The arm_boot_info structure belong to the machine,
move it to RaspiMachineState.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ struct RaspiMachineState {
     MachineState parent_obj;
     /*< public >*/
     BCM283XState soc;
+    struct arm_boot_info binfo;
 };
 typedef struct RaspiMachineState RaspiMachineState;
 
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
 static void setup_boot(MachineState *machine, int version, size_t ram_size)
 {
     RaspiMachineState *s = RASPI_MACHINE(machine);
-    static struct arm_boot_info binfo;
     int r;
 
-    binfo.board_id = MACH_TYPE_BCM2708;
-    binfo.ram_size = ram_size;
-    binfo.nb_cpus = machine->smp.cpus;
+    s->binfo.board_id = MACH_TYPE_BCM2708;
+    s->binfo.ram_size = ram_size;
+    s->binfo.nb_cpus = machine->smp.cpus;
 
     if (version <= 2) {
         /* The rpi1 and 2 require some custom setup code to run in Secure
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
          * firmware for some cache maintenance operations.
          * The rpi3 doesn't need this.
          */
-        binfo.board_setup_addr = BOARDSETUP_ADDR;
-        binfo.write_board_setup = write_board_setup;
-        binfo.secure_board_setup = true;
-        binfo.secure_boot = true;
+        s->binfo.board_setup_addr = BOARDSETUP_ADDR;
+        s->binfo.write_board_setup = write_board_setup;
+        s->binfo.secure_board_setup = true;
+        s->binfo.secure_boot = true;
     }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-        binfo.smp_loader_start = SMPBOOT_ADDR;
+        s->binfo.smp_loader_start = SMPBOOT_ADDR;
         if (version == 2) {
-            binfo.write_secondary_boot = write_smpboot;
+            s->binfo.write_secondary_boot = write_smpboot;
         } else {
-            binfo.write_secondary_boot = write_smpboot64;
+            s->binfo.write_secondary_boot = write_smpboot64;
         }
-        binfo.secondary_cpu_reset_hook = reset_secondary;
+        s->binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
     /* If the user specified a "firmware" image (e.g. UEFI), we bypass
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
             exit(1);
         }
 
-        binfo.entry = firmware_addr;
-        binfo.firmware_loaded = true;
+        s->binfo.entry = firmware_addr;
+        s->binfo.firmware_loaded = true;
     }
 
-    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
+    arm_load_kernel(&s->soc.cpu[0].core, machine, &s->binfo);
 }
 
 static void raspi_machine_init(MachineState *machine)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Using class_data pointer to create a MachineClass is not
the recommended way anymore. The correct way is to open-code
the MachineClass::fields in the class_init() method.

We can not use TYPE_RASPI_MACHINE::class_base_init() because
it is called *before* each machine class_init(), therefore the
board_rev field is not populated. We have to manually call
raspi_machine_class_common_init() for each machine.

This partly reverts commit a03bde3674e.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
     setup_boot(machine, version, machine->ram_size - vcram_size);
 }
 
-static void raspi_machine_class_init(ObjectClass *oc, void *data)
+static void raspi_machine_class_common_init(MachineClass *mc,
+                                            uint32_t board_rev)
 {
-    MachineClass *mc = MACHINE_CLASS(oc);
-    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-    uint32_t board_rev = (uint32_t)(uintptr_t)data;
-
-    rmc->board_rev = board_rev;
     mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
                                board_type(board_rev),
                                FIELD_EX32(board_rev, REV_CODE, REVISION));
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_id = "ram";
 };
 
+static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+    rmc->board_rev = 0xa21041;
+    raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+
+#ifdef TARGET_AARCH64
+static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+    rmc->board_rev = 0xa02082;
+    raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+#endif /* TARGET_AARCH64 */
+
 static const TypeInfo raspi_machine_types[] = {
     {
         .name           = MACHINE_TYPE_NAME("raspi2"),
         .parent         = TYPE_RASPI_MACHINE,
-        .class_init     = raspi_machine_class_init,
-        .class_data     = (void *)0xa21041,
+        .class_init     = raspi2b_machine_class_init,
 #ifdef TARGET_AARCH64
     }, {
         .name           = MACHINE_TYPE_NAME("raspi3"),
         .parent         = TYPE_RASPI_MACHINE,
-        .class_init     = raspi_machine_class_init,
-        .class_data     = (void *)0xa02082,
+        .class_init     = raspi3b_machine_class_init,
 #endif
     }, {
         .name           = TYPE_RASPI_MACHINE,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Now that we can instantiate different machines based on their
board_rev register value, we can have various raspi2 and raspi3.

In commit fc78a990ec103 we corrected the machine description.
Correct the machine names too. For backward compatibility, add
an alias to the previous generic name.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 
+    mc->alias = "raspi2";
     rmc->board_rev = 0xa21041;
     raspi_machine_class_common_init(mc, rmc->board_rev);
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 
+    mc->alias = "raspi3";
     rmc->board_rev = 0xa02082;
     raspi_machine_class_common_init(mc, rmc->board_rev);
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo raspi_machine_types[] = {
     {
-        .name           = MACHINE_TYPE_NAME("raspi2"),
+        .name           = MACHINE_TYPE_NAME("raspi2b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi2b_machine_class_init,
 #ifdef TARGET_AARCH64
     }, {
-        .name           = MACHINE_TYPE_NAME("raspi3"),
+        .name           = MACHINE_TYPE_NAME("raspi3b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi3b_machine_class_init,
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As we only support a reduced set of the REV_CODE_PROCESSOR id
encoded in the board revision, define the PROCESSOR_ID values
as an enum. We can simplify the board_soc_type and cores_count
methods.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-7-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 45 +++++++++++++++++++++------------------------
 1 file changed, 21 insertions(+), 24 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ FIELD(REV_CODE, MANUFACTURER,      16, 4);
 FIELD(REV_CODE, MEMORY_SIZE,       20, 3);
 FIELD(REV_CODE, STYLE,             23, 1);
 
+typedef enum RaspiProcessorId {
+    PROCESSOR_ID_BCM2836 = 1,
+    PROCESSOR_ID_BCM2837 = 2,
+} RaspiProcessorId;
+
+static const struct {
+    const char *type;
+    int cores_count;
+} soc_property[] = {
+    [PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
+    [PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
+};
+
 static uint64_t board_ram_size(uint32_t board_rev)
 {
     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
     return 256 * MiB << FIELD_EX32(board_rev, REV_CODE, MEMORY_SIZE);
 }
 
-static int board_processor_id(uint32_t board_rev)
+static RaspiProcessorId board_processor_id(uint32_t board_rev)
 {
+    int proc_id = FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+
     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
-    return FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+    assert(proc_id < ARRAY_SIZE(soc_property) && soc_property[proc_id].type);
+
+    return proc_id;
 }
 
 static int board_version(uint32_t board_rev)
@@ -XXX,XX +XXX,XX @@ static int board_version(uint32_t board_rev)
 
 static const char *board_soc_type(uint32_t board_rev)
 {
-    static const char *soc_types[] = {
-        NULL, TYPE_BCM2836, TYPE_BCM2837,
-    };
-    int proc_id = board_processor_id(board_rev);
-
-    if (proc_id >= ARRAY_SIZE(soc_types) || !soc_types[proc_id]) {
-        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
-                     proc_id, board_rev);
-        exit(1);
-    }
-    return soc_types[proc_id];
+    return soc_property[board_processor_id(board_rev)].type;
 }
 
 static int cores_count(uint32_t board_rev)
 {
-    static const int soc_cores_count[] = {
-        0, BCM283X_NCPUS, BCM283X_NCPUS,
-    };
-    int proc_id = board_processor_id(board_rev);
-
-    if (proc_id >= ARRAY_SIZE(soc_cores_count) || !soc_cores_count[proc_id]) {
-        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
-                     proc_id, board_rev);
-        exit(1);
-    }
-    return soc_cores_count[proc_id];
+    return soc_property[board_processor_id(board_rev)].cores_count;
 }
 
 static const char *board_type(uint32_t board_rev)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The firmware load address depends on the SoC ("processor id") used,
not on the version of the board.

Suggested-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      * the normal Linux boot process
      */
     if (machine->firmware) {
-        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
+        hwaddr firmware_addr = processor_id <= PROCESSOR_ID_BCM2836
+                             ? FIRMWARE_ADDR_2 : FIRMWARE_ADDR_3;
         /* load the firmware image (typically kernel.img) */
         r = load_image_targphys(machine->firmware, firmware_addr,
                                 ram_size - firmware_addr);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We expected the 'version' ID to match the board processor ID,
but this is not always true (for example boards with revision
id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
This was not important because we were not modelling them, but
since the recent refactor now allow to model these boards, it
is safer to check the processor id directly. Remove the version
check.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-9-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static RaspiProcessorId board_processor_id(uint32_t board_rev)
     return proc_id;
 }
 
-static int board_version(uint32_t board_rev)
-{
-    return board_processor_id(board_rev) + 1;
-}
-
 static const char *board_soc_type(uint32_t board_rev)
 {
     return soc_property[board_processor_id(board_rev)].type;
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-static void setup_boot(MachineState *machine, int version, size_t ram_size)
+static void setup_boot(MachineState *machine, RaspiProcessorId processor_id,
+                       size_t ram_size)
 {
     RaspiMachineState *s = RASPI_MACHINE(machine);
     int r;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     s->binfo.ram_size = ram_size;
     s->binfo.nb_cpus = machine->smp.cpus;
 
-    if (version <= 2) {
-        /* The rpi1 and 2 require some custom setup code to run in Secure
-         * mode before booting a kernel (to set up the SMC vectors so
-         * that we get a no-op SMC; this is used by Linux to call the
+    if (processor_id <= PROCESSOR_ID_BCM2836) {
+        /*
+         * The BCM2835 and BCM2836 require some custom setup code to run
+         * in Secure mode before booting a kernel (to set up the SMC vectors
+         * so that we get a no-op SMC; this is used by Linux to call the
          * firmware for some cache maintenance operations.
-         * The rpi3 doesn't need this.
+         * The BCM2837 doesn't need this.
          */
         s->binfo.board_setup_addr = BOARDSETUP_ADDR;
         s->binfo.write_board_setup = write_board_setup;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
         s->binfo.secure_boot = true;
     }
 
-    /* Pi2 and Pi3 requires SMP setup */
-    if (version >= 2) {
+    /* BCM2836 and BCM2837 requires SMP setup */
+    if (processor_id >= PROCESSOR_ID_BCM2836) {
         s->binfo.smp_loader_start = SMPBOOT_ADDR;
-        if (version == 2) {
+        if (processor_id == PROCESSOR_ID_BCM2836) {
             s->binfo.write_secondary_boot = write_smpboot;
         } else {
             s->binfo.write_secondary_boot = write_smpboot64;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
     RaspiMachineClass *mc = RASPI_MACHINE_GET_CLASS(machine);
     RaspiMachineState *s = RASPI_MACHINE(machine);
     uint32_t board_rev = mc->board_rev;
-    int version = board_version(board_rev);
     uint64_t ram_size = board_ram_size(board_rev);
     uint32_t vcram_size;
     DriveInfo *di;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
 
     vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
                                           &error_abort);
-    setup_boot(machine, version, machine->ram_size - vcram_size);
+    setup_boot(machine, board_processor_id(mc->board_rev),
+               machine->ram_size - vcram_size);
 }
 
 static void raspi_machine_class_common_init(MachineClass *mc,
-- 
2.20.1