Series comparison

-[Qemu-devel] [PULL 00/19] target-arm queue
+[PULL 00/23] target-arm queue
-Latest set of arm patches. I may end up doing another pullreq at the
+The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:
 end of the week, but this is big enough to send out, plus it has
 several instances of "let me take the first N patches in your series"
 in it, so getting those into master makes patch respins for those
 submitters easier.
-thanks
+  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)
 -- PMM
 The following changes since commit dddb37495b844270088e68e3bf30b764d48d863f:
   Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20181015.0' into staging (2018-10-15 18:44:04 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181016
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913
-for you to fetch changes up to bdaffef4bb0729a74c7a325dba5c61d8cd8f464f:
+for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:
-  coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls (2018-10-16 16:16:42 +0100)
+  hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
+ * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
- * target/arm: Fix aarch64_sve_change_el wrt EL0
+   line user-created devices are not plugged into them
- * target/arm: Define fields of ISAR registers
+ * Take an exception if PSTATE.IL is set
- * target/arm: Align cortex-r5 id_isar0
+ * Support an emulated ITS in the virt board
- * target/arm: Fix cortex-a7 id_isar0
+ * Add support for kudo-bmc board
- * net/cadence_gem: Fix various bugs, add support for new
+ * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
-   features that will be used by the Xilinx Versal board
+ * cadence_uart: Fix clock handling issues that prevented
- * target-arm: powerctl: Enable HVC when starting CPUs to EL2
+   u-boot from running
  * target/arm: Add the Cortex-A72
  * target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
  * target/arm: Mask PMOVSR writes based on supported counters
  * target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
  * coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls
 ----------------------------------------------------------------
-Aaron Lindsay (2):
+Bin Meng (6):
-      target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
+      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
-      target/arm: Mask PMOVSR writes based on supported counters
+      hw/char: cadence_uart: Disable transmit when input clock is disabled
       hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
       hw/char: cadence_uart: Convert to memop_with_attrs() ops
       hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
       hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
-Edgar E. Iglesias (10):
+Chris Rauer (1):
-      net: cadence_gem: Disable TSU feature bit
+      hw/arm: Add support for kudo-bmc board.
       net: cadence_gem: Announce availability of priority queues
       net: cadence_gem: Use uint32_t for 32bit descriptor words
       net: cadence_gem: Add macro with max number of descriptor words
       net: cadence_gem: Add support for extended descriptors
       net: cadence_gem: Add support for selecting the DMA MemoryRegion
       net: cadence_gem: Implement support for 64bit descriptor addresses
       net: cadence_gem: Announce 64bit addressing support
       target-arm: powerctl: Enable HVC when starting CPUs to EL2
       target/arm: Add the Cortex-A72
-Jerome Forissier (1):
+Marc Zyngier (1):
-      hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
+      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
-Peter Maydell (2):
+Peter Maydell (5):
-      target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
+      target/arm: Take an exception if PSTATE.IL is set
-      coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls
+      qdev: Support marking individual buses as 'full'
       hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
       hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
       hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
-Richard Henderson (4):
+Richard Henderson (1):
-      target/arm: Fix aarch64_sve_change_el wrt EL0
+      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
       target/arm: Define fields of ISAR registers
       target/arm: Align cortex-r5 id_isar0
       target/arm: Fix cortex-a7 id_isar0
- include/hw/net/cadence_gem.h               |   7 +-
+Shashi Mallela (9):
- target/arm/cpu.h                           |  95 +++++++++++++-
+      hw/intc: GICv3 ITS initial framework
- hw/arm/virt.c                              |   4 +
+      hw/intc: GICv3 ITS register definitions added
- hw/net/cadence_gem.c                       | 192 +++++++++++++++++++++--------
+      hw/intc: GICv3 ITS command queue framework
- target/arm/arm-powerctl.c                  |  10 ++
+      hw/intc: GICv3 ITS Command processing
- target/arm/cpu.c                           |   7 +-
+      hw/intc: GICv3 ITS Feature enablement
- target/arm/cpu64.c                         |  66 +++++++++-
+      hw/intc: GICv3 redistributor ITS processing
- target/arm/helper.c                        |  27 ++--
+      tests/data/acpi/virt: Add IORT files for ITS
- target/arm/op_helper.c                     |   6 +-
+      hw/arm/virt: add ITS support in virt GIC
- scripts/coccinelle/inplace-byteswaps.cocci |  65 ++++++++++
+      tests/data/acpi/virt: Update IORT files for ITS
 files changed, 408 insertions(+), 71 deletions(-)
  create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci
+ docs/system/arm/nuvoton.rst            |    1 +
+ hw/intc/gicv3_internal.h               |  188 ++++-
+ include/hw/arm/virt.h                  |    2 +
+ include/hw/intc/arm_gicv3_common.h     |   13 +
+ include/hw/intc/arm_gicv3_its_common.h |   32 +-
+ include/hw/qdev-core.h                 |   24 +
+ target/arm/cpu.h                       |    1 +
+ target/arm/kvm_arm.h                   |    4 +-
+ target/arm/syndrome.h                  |    5 +
+ target/arm/translate.h                 |    2 +
+ hw/arm/mps2-tz.c                       |   92 ++-
+ hw/arm/mps2.c                          |   12 +-
+ hw/arm/npcm7xx_boards.c                |   34 +
+ hw/arm/virt.c                          |   29 +-
+ hw/char/cadence_uart.c                 |   61 +-
+ hw/intc/arm_gicv3.c                    |   14 +
+ hw/intc/arm_gicv3_common.c             |   13 +
+ hw/intc/arm_gicv3_cpuif.c              |    7 +-
+ hw/intc/arm_gicv3_dist.c               |    5 +-
+ hw/intc/arm_gicv3_its.c                | 1322 ++++++++++++++++++++++++++++++++
+ hw/intc/arm_gicv3_its_common.c         |    7 +-
+ hw/intc/arm_gicv3_its_kvm.c            |    2 +-
+ hw/intc/arm_gicv3_redist.c             |  153 +++-
+ hw/misc/zynq_slcr.c                    |   31 +-
+ softmmu/qdev-monitor.c                 |    7 +-
+ target/arm/helper-a64.c                |    1 +
+ target/arm/helper.c                    |    8 +
+ target/arm/kvm.c                       |    7 +-
+ target/arm/translate-a64.c             |  255 +++---
+ target/arm/translate.c                 |   21 +
+ hw/intc/meson.build                    |    1 +
+ tests/data/acpi/virt/IORT              |  Bin 0 -> 124 bytes
+ tests/data/acpi/virt/IORT.memhp        |  Bin 0 -> 124 bytes
+ tests/data/acpi/virt/IORT.numamem      |  Bin 0 -> 124 bytes
+ tests/data/acpi/virt/IORT.pxb          |  Bin 0 -> 124 bytes
+files changed, 2144 insertions(+), 210 deletions(-)
+ create mode 100644 hw/intc/arm_gicv3_its.c
+ create mode 100644 tests/data/acpi/virt/IORT
+ create mode 100644 tests/data/acpi/virt/IORT.memhp
+ create mode 100644 tests/data/acpi/virt/IORT.numamem
+ create mode 100644 tests/data/acpi/virt/IORT.pxb

-New patch
+[PULL 01/23] hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
+From: Bin Meng <bmeng.cn@gmail.com>
+As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
+does not receive anything. Debugging shows that the UART input clock
+frequency is zero which prevents the UART from receiving anything as
+per the logic in uart_receive().
+From zynq_slcr_reset_exit() comment, it intends to compute output
+clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
+is called to accomplish the task, inside which device_is_in_reset()
+is called to actually make the attempt in vain.
+Rework reset_hold() and reset_exit() so that in the reset exit phase,
+the logic can really compute output clocks in reset_exit().
+With this change, upstream U-Boot boots properly again with:
+$ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
+    -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0
+Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
+file changed, 18 insertions(+), 13 deletions(-)
+diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/zynq_slcr.c
++++ b/hw/misc/zynq_slcr.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
+     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
+                             reg ## _ ## enable_field ## _SHIFT)
++static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
++{
++    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
++    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
++    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
++
++    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
++
++    /* compute uartX reference clocks */
++    clock_set(s->uart0_ref_clk,
++              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
++    clock_set(s->uart1_ref_clk,
++              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
++}
++
+ /**
+  * Compute and set the ouputs clocks periods.
+  * But do not propagate them further. Connected clocks
+@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
+         ps_clk = 0;
+     }
+-    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
+-    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
+-    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
+-
+-    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
+-
+-    /* compute uartX reference clocks */
+-    clock_set(s->uart0_ref_clk,
+-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
+-    clock_set(s->uart1_ref_clk,
+-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
++    zynq_slcr_compute_clocks_internal(s, ps_clk);
+ }
+ /**
+@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
+     ZynqSLCRState *s = ZYNQ_SLCR(obj);
+     /* will disable all output clocks */
+-    zynq_slcr_compute_clocks(s);
++    zynq_slcr_compute_clocks_internal(s, 0);
+     zynq_slcr_propagate_clocks(s);
+ }
+@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
+     ZynqSLCRState *s = ZYNQ_SLCR(obj);
+     /* will compute output clocks according to ps_clk and registers */
+-    zynq_slcr_compute_clocks(s);
++    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
+     zynq_slcr_propagate_clocks(s);
+ }
+--
+.20.1

-[Qemu-devel] [PULL 16/19] target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
+[PULL 02/23] hw/char: cadence_uart: Disable transmit when input clock is disabled
-From: Aaron Lindsay <aclindsa@gmail.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-I previously fixed this for PMINTENSET_EL1, but missed these.
+At present when input clock is disabled, any character transmitted
 to tx fifo can still show on the serial line, which is wrong.
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
-Signed-off-by: Aaron Lindsay <aclindsa@gmail.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20181010203735.27918-2-aclindsa@gmail.com
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 6 ++++--
+ hw/char/cadence_uart.c | 5 +++++
-file changed, 4 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/char/cadence_uart.c
-+++ b/target/arm/helper.c
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
-       .writefn = pmintenset_write, .raw_writefn = raw_write,
+ static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
-       .resetvalue = 0x0 },
+                                int size)
-     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
+ {
--      .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
++    /* ignore characters when unclocked or in reset */
-+      .access = PL1_RW, .accessfn = access_tpm,
++    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+      .type = ARM_CP_ALIAS | ARM_CP_IO,
++        return;
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
++    }
-       .writefn = pmintenclr_write, },
++
-     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
+     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
-       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
+         return;
--      .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
+     }
 +      .access = PL1_RW, .accessfn = access_tpm,
 +      .type = ARM_CP_ALIAS | ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
        .writefn = pmintenclr_write },
      { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 13/19] net: cadence_gem: Announce 64bit addressing support
+[PULL 03/23] hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-Announce 64bit addressing support.
+Currently the clock/reset check is done in uart_receive(), but we
 can move the check to uart_can_receive() which is earlier.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
 Message-id: 20181011021931.4249-9-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/cadence_gem.c | 3 ++-
+ hw/char/cadence_uart.c | 17 ++++++++++-------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 10 insertions(+), 7 deletions(-)
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/hw/char/cadence_uart.c
-+++ b/hw/net/cadence_gem.c
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
- #define GEM_DESCONF4      (0x0000028C/4)
+ static int uart_can_receive(void *opaque)
- #define GEM_DESCONF5      (0x00000290/4)
+ {
- #define GEM_DESCONF6      (0x00000294/4)
+     CadenceUARTState *s = opaque;
-+#define GEM_DESCONF6_64B_MASK (1U << 23)
+-    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
- #define GEM_DESCONF7      (0x00000298/4)
+-    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
++    int ret;
- #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
++    uint32_t ch_mode;
-@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
++
-     s->regs[GEM_DESCONF] = 0x02500111;
++    /* ignore characters when unclocked or in reset */
-     s->regs[GEM_DESCONF2] = 0x2ab13fff;
++    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-     s->regs[GEM_DESCONF5] = 0x002f2045;
++        return 0;
--    s->regs[GEM_DESCONF6] = 0x0;
++    }
-+    s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
++
++    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
-     queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
++    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
-     s->regs[GEM_DESCONF6] |= queues_mask;
      if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
          ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
      CadenceUARTState *s = opaque;
      uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 -    /* ignore characters when unclocked or in reset */
 -    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 -        return;
 -    }
 -
      if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
          uart_write_rx_fifo(opaque, buf, size);
      }
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 15/19] target/arm: Add the Cortex-A72
+[PULL 04/23] hw/char: cadence_uart: Convert to memop_with_attrs() ops
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-Add the ARM Cortex-A72.
+This converts uart_read() and uart_write() to memop_with_attrs() ops.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Message-id: 20181011021931.4249-11-edgar.iglesias@gmail.com
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu64.c | 66 +++++++++++++++++++++++++++++++++++++++++++---
+ hw/char/cadence_uart.c | 26 +++++++++++++++-----------
-file changed, 63 insertions(+), 3 deletions(-)
+file changed, 15 insertions(+), 11 deletions(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/hw/char/cadence_uart.c
-+++ b/target/arm/cpu64.c
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
      uart_update_status(s);
  }
- #endif
+-static void uart_write(void *opaque, hwaddr offset,
--static const ARMCPRegInfo cortex_a57_a53_cp_reginfo[] = {
+-                          uint64_t value, unsigned size)
-+static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
++static MemTxResult uart_write(void *opaque, hwaddr offset,
- #ifndef CONFIG_USER_ONLY
++                              uint64_t value, unsigned size, MemTxAttrs attrs)
-     { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
+ {
-       .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
+     CadenceUARTState *s = opaque;
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
-     cpu->gic_num_lrs = 4;
+     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
-     cpu->gic_vpribits = 5;
+     offset >>= 2;
-     cpu->gic_vprebits = 5;
+     if (offset >= CADENCE_UART_R_MAX) {
--    define_arm_cp_regs(cpu, cortex_a57_a53_cp_reginfo);
+-        return;
-+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
++        return MEMTX_DECODE_ERROR;
      }
      switch (offset) {
      case R_IER: /* ier (wts imr) */
@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
          break;
      }
      uart_update_status(s);
 +
 +    return MEMTX_OK;
  }
- static void aarch64_a53_initfn(Object *obj)
+-static uint64_t uart_read(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
+-        unsigned size)
-     cpu->gic_num_lrs = 4;
++static MemTxResult uart_read(void *opaque, hwaddr offset,
-     cpu->gic_vpribits = 5;
++                             uint64_t *value, unsigned size, MemTxAttrs attrs)
-     cpu->gic_vprebits = 5;
+ {
--    define_arm_cp_regs(cpu, cortex_a57_a53_cp_reginfo);
+     CadenceUARTState *s = opaque;
-+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+     uint32_t c = 0;
-+}
-+
+     offset >>= 2;
-+static void aarch64_a72_initfn(Object *obj)
+     if (offset >= CADENCE_UART_R_MAX) {
-+{
+-        c = 0;
-+    ARMCPU *cpu = ARM_CPU(obj);
+-    } else if (offset == R_TX_RX) {
-+
++        return MEMTX_DECODE_ERROR;
-+    cpu->dtb_compatible = "arm,cortex-a72";
++    }
-+    set_feature(&cpu->env, ARM_FEATURE_V8);
++    if (offset == R_TX_RX) {
-+    set_feature(&cpu->env, ARM_FEATURE_VFP4);
+         uart_read_rx_fifo(s, &c);
-+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+     } else {
-+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+-       c = s->r[offset];
-+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
++        c = s->r[offset];
-+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+     }
-+    set_feature(&cpu->env, ARM_FEATURE_V8_AES);
-+    set_feature(&cpu->env, ARM_FEATURE_V8_SHA1);
+     DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
-+    set_feature(&cpu->env, ARM_FEATURE_V8_SHA256);
+-    return c;
-+    set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
++    *value = c;
-+    set_feature(&cpu->env, ARM_FEATURE_CRC);
++    return MEMTX_OK;
 +    set_feature(&cpu->env, ARM_FEATURE_EL2);
 +    set_feature(&cpu->env, ARM_FEATURE_EL3);
 +    set_feature(&cpu->env, ARM_FEATURE_PMU);
 +    cpu->midr = 0x410fd083;
 +    cpu->revidr = 0x00000000;
 +    cpu->reset_fpsid = 0x41034080;
 +    cpu->mvfr0 = 0x10110222;
 +    cpu->mvfr1 = 0x12111111;
 +    cpu->mvfr2 = 0x00000043;
 +    cpu->ctr = 0x8444c004;
 +    cpu->reset_sctlr = 0x00c50838;
 +    cpu->id_pfr0 = 0x00000131;
 +    cpu->id_pfr1 = 0x00011011;
 +    cpu->id_dfr0 = 0x03010066;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->id_mmfr0 = 0x10201105;
 +    cpu->id_mmfr1 = 0x40000000;
 +    cpu->id_mmfr2 = 0x01260000;
 +    cpu->id_mmfr3 = 0x02102211;
 +    cpu->id_isar0 = 0x02101110;
 +    cpu->id_isar1 = 0x13112111;
 +    cpu->id_isar2 = 0x21232042;
 +    cpu->id_isar3 = 0x01112131;
 +    cpu->id_isar4 = 0x00011142;
 +    cpu->id_isar5 = 0x00011121;
 +    cpu->id_aa64pfr0 = 0x00002222;
 +    cpu->id_aa64dfr0 = 0x10305106;
 +    cpu->pmceid0 = 0x00000000;
 +    cpu->pmceid1 = 0x00000000;
 +    cpu->id_aa64isar0 = 0x00011120;
 +    cpu->id_aa64mmfr0 = 0x00001124;
 +    cpu->dbgdidr = 0x3516d000;
 +    cpu->clidr = 0x0a200023;
 +    cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
 +    cpu->ccsidr[1] = 0x201fe012; /* 48KB L1 icache */
 +    cpu->ccsidr[2] = 0x707fe07a; /* 1MB L2 cache */
 +    cpu->dcz_blocksize = 4; /* 64 bytes */
 +    cpu->gic_num_lrs = 4;
 +    cpu->gic_vpribits = 5;
 +    cpu->gic_vprebits = 5;
 +    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
  }
- static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
+ static const MemoryRegionOps uart_ops = {
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPUInfo {
+-    .read = uart_read,
- static const ARMCPUInfo aarch64_cpus[] = {
+-    .write = uart_write,
-     { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
++    .read_with_attrs = uart_read,
-     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
++    .write_with_attrs = uart_write,
-+    { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
+     .endianness = DEVICE_NATIVE_ENDIAN,
      { .name = "max",                .initfn = aarch64_max_initfn },
      { .name = NULL }
  };
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 09/19] net: cadence_gem: Add macro with max number of descriptor words
+[PULL 05/23] hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-Add macro with max number of DMA descriptor words.
+Read or write to uart registers when unclocked or in reset should be
-No functional change.
+ignored. Add the check there, and as a result of this, the check in
 uart_write_tx_fifo() is now unnecessary.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20181011021931.4249-5-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/cadence_gem.h | 5 ++++-
+ hw/char/cadence_uart.c | 15 ++++++++++-----
- hw/net/cadence_gem.c         | 4 ++--
+file changed, 10 insertions(+), 5 deletions(-)
 files changed, 6 insertions(+), 3 deletions(-)
-diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/cadence_gem.h
+--- a/hw/char/cadence_uart.c
-+++ b/include/hw/net/cadence_gem.h
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
+ static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
- #define CADENCE_GEM_MAXREG        (0x00000800 / 4) /* Last valid GEM address */
+                                int size)
+ {
-+/* Max number of words in a DMA descriptor.  */
+-    /* ignore characters when unclocked or in reset */
-+#define DESC_MAX_NUM_WORDS              2
+-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 -        return;
 -    }
 -
      if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
  {
      CadenceUARTState *s = opaque;
 +    /* ignore access when unclocked or in reset */
 +    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        return MEMTX_ERROR;
 +    }
 +
- #define MAX_PRIORITY_QUEUES             8
+     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
- #define MAX_TYPE1_SCREENERS             16
+     offset >>= 2;
- #define MAX_TYPE2_SCREENERS             16
+     if (offset >= CADENCE_UART_R_MAX) {
-@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
+     CadenceUARTState *s = opaque;
-     uint8_t can_rx_state; /* Debug only */
+     uint32_t c = 0;
--    uint32_t rx_desc[MAX_PRIORITY_QUEUES][2];
++    /* ignore access when unclocked or in reset */
-+    uint32_t rx_desc[MAX_PRIORITY_QUEUES][DESC_MAX_NUM_WORDS];
++    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
++        return MEMTX_ERROR;
-     bool sar_active[4];
++    }
- } CadenceGEMState;
++
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+     offset >>= 2;
-index XXXXXXX..XXXXXXX 100644
+     if (offset >= CADENCE_UART_R_MAX) {
---- a/hw/net/cadence_gem.c
+         return MEMTX_DECODE_ERROR;
 +++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_transmit_updatestats(CadenceGEMState *s, const uint8_t *packet,
   */
  static void gem_transmit(CadenceGEMState *s)
  {
 -    uint32_t desc[2];
 +    uint32_t desc[DESC_MAX_NUM_WORDS];
      hwaddr packet_desc_addr;
      uint8_t     tx_packet[2048];
      uint8_t     *p;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
              /* Last descriptor for this packet; hand the whole thing off */
              if (tx_desc_get_last(desc)) {
 -                uint32_t desc_first[2];
 +                uint32_t desc_first[DESC_MAX_NUM_WORDS];
                  /* Modify the 1st descriptor of this packet to be owned by
                   * the processor.
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 14/19] target-arm: powerctl: Enable HVC when starting CPUs to EL2
+[PULL 06/23] hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Bin Meng <bmeng.cn@gmail.com>
-When QEMU provides the equivalent of the EL3 firmware, we
+We've got SW that expects FSBL (Bootlooader) to setup clocks and
-need to enable HVCs in scr_el3 when turning on CPUs that
+resets. It's quite common that users run that SW on QEMU without
-target EL2.
+FSBL (FSBL typically requires the Xilinx tools installed). That's
 fine, since users can stil use -device loader to enable clocks etc.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+To help folks understand what's going, a log (guest-error) message
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+would be helpful here. In particular with the serial port since
-Message-id: 20181011021931.4249-10-edgar.iglesias@gmail.com
+things will go very quiet if they get things wrong.
 Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arm-powerctl.c | 10 ++++++++++
+ hw/char/cadence_uart.c | 8 ++++++++
-file changed, 10 insertions(+)
+file changed, 8 insertions(+)
-diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-powerctl.c
+--- a/hw/char/cadence_uart.c
-+++ b/target/arm/arm-powerctl.c
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
+@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
-     } else {
-         /* Processor is not in secure mode */
+     /* ignore characters when unclocked or in reset */
-         target_cpu->env.cp15.scr_el3 |= SCR_NS;
+     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
-+        /*
++                      __func__);
-+         * If QEMU is providing the equivalent of EL3 firmware, then we need
+         return 0;
 +         * to make sure a CPU targeting EL2 comes out of reset with a
 +         * functional HVC insn.
 +         */
 +        if (arm_feature(&target_cpu->env, ARM_FEATURE_EL3)
 +            && info->target_el == 2) {
 +            target_cpu->env.cp15.scr_el3 |= SCR_HCE;
 +        }
      }
-     /* We check if the started CPU is now at the correct level */
+@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
      /* ignore characters when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
      /* ignore access when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return MEMTX_ERROR;
      }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
      /* ignore access when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return MEMTX_ERROR;
      }
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 07/19] net: cadence_gem: Announce availability of priority queues
+[PULL 07/23] hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Marc Zyngier <maz@kernel.org>
-Announce the availability of the various priority queues.
+Although we probe for the IPA limits imposed by KVM (and the hardware)
-This fixes an issue where guest kernels would miss to
+when computing the memory map, we still use the old style '0' when
-configure secondary queues due to inproper feature bits.
+creating a scratch VM in kvm_arm_create_scratch_host_vcpu().
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+On systems that are severely IPA challenged (such as the Apple M1),
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+this results in a failure as KVM cannot use the default 40bit that
-Message-id: 20181011021931.4249-3-edgar.iglesias@gmail.com
+'0' represents.
 Instead, probe for the extension and use the reported IPA limit
 if available.
 Cc: Andrew Jones <drjones@redhat.com>
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20210822144441.1290891-2-maz@kernel.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/cadence_gem.c | 6 +++++-
+ target/arm/kvm.c | 7 ++++++-
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/target/arm/kvm.c
-+++ b/hw/net/cadence_gem.c
++++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
-     int i;
+                                       struct kvm_vcpu_init *init)
-     CadenceGEMState *s = CADENCE_GEM(d);
+ {
-     const uint8_t *a;
+     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
-+    uint32_t queues_mask;
++    int max_vm_pa_size;
-     DB_PRINT("\n");
+     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+     if (kvmfd < 0) {
-@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+         goto err;
-     s->regs[GEM_DESCONF] = 0x02500111;
+     }
-     s->regs[GEM_DESCONF2] = 0x2ab13fff;
+-    vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
-     s->regs[GEM_DESCONF5] = 0x002f2045;
++    max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
--    s->regs[GEM_DESCONF6] = 0x00000200;
++    if (max_vm_pa_size < 0) {
-+    s->regs[GEM_DESCONF6] = 0x0;
++        max_vm_pa_size = 0;
-+
++    }
-+    queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
++    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
-+    s->regs[GEM_DESCONF6] |= queues_mask;
+     if (vmfd < 0) {
+         goto err;
-     /* Set MAC address */
+     }
      a = &s->conf.macaddr.a[0];
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 17/19] target/arm: Mask PMOVSR writes based on supported counters
+[PULL 08/23] hw/arm: Add support for kudo-bmc board.
-From: Aaron Lindsay <aclindsa@gmail.com>
+From: Chris Rauer <crauer@google.com>
-This is an amendment to my earlier patch:
+kudo-bmc is a board supported by OpenBMC.
-    commit 7ece99b17e832065236c07a158dfac62619ef99b
+https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo
     Author: Aaron Lindsay <alindsay@codeaurora.org>
     Date:   Thu Apr 26 11:04:39 2018 +0100
-    target/arm: Mask PMU register writes based on PMCR_EL0.N
+Since v1:
 - hyphenated Cortex-A9
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Tested: Booted kudo firmware.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Chris Rauer <crauer@google.com>
-Message-id: 20181010203735.27918-3-aclindsa@gmail.com
+Reviewed-by: Patrick Venture <venture@google.com>
 Message-id: 20210907223234.1165705-1-crauer@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 1 +
+ docs/system/arm/nuvoton.rst |  1 +
-file changed, 1 insertion(+)
+ hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
 files changed, 35 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/docs/system/arm/nuvoton.rst
-+++ b/target/arm/helper.c
++++ b/docs/system/arm/nuvoton.rst
-@@ -XXX,XX +XXX,XX @@ static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
- static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                          uint64_t value)
+ - ``quanta-gbs-bmc``    Quanta GBS server BMC
  - ``quanta-gsj``        Quanta GSJ server BMC
 +- ``kudo-bmc``          Fii USA Kudo server BMC
  There are also two more SoCs, NPCM710 and NPCM705, which are single-core
  variants of NPCM750 and NPCM730, respectively. These are currently not
 diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx_boards.c
 +++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
  #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
  #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
  #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
 +#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
  static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
      npcm7xx_load_kernel(machine, soc);
  }
 +static void kudo_bmc_init(MachineState *machine)
 +{
 +    NPCM7xxState *soc;
 +
 +    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
 +    npcm7xx_connect_dram(soc, machine->ram);
 +    qdev_realize(DEVICE(soc), NULL, &error_fatal);
 +
 +    npcm7xx_load_bootrom(machine, soc);
 +    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 0, 0));
 +    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 3, 0));
 +
 +    npcm7xx_load_kernel(machine, soc);
 +}
 +
  static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
  {
-+    value &= pmu_counter_mask(env);
+     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
-     env->cp15.c9_pmovsr &= ~value;
+@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
      mc->default_ram_size = 1 * GiB;
  }
++static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
++{
++    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
++    MachineClass *mc = MACHINE_CLASS(oc);
++
++    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
++
++    mc->desc = "Kudo BMC (Cortex-A9)";
++    mc->init = kudo_bmc_init;
++    mc->default_ram_size = 1 * GiB;
++};
++
+ static const TypeInfo npcm7xx_machine_types[] = {
+     {
+         .name           = TYPE_NPCM7XX_MACHINE,
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
+         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
+         .parent         = TYPE_NPCM7XX_MACHINE,
+         .class_init     = gbs_bmc_machine_class_init,
++    }, {
++        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
++        .parent         = TYPE_NPCM7XX_MACHINE,
++        .class_init     = kudo_bmc_machine_class_init,
+     },
+ };
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 19/19] coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls
+[PULL 09/23] hw/intc: GICv3 ITS initial framework
-Add a new Coccinelle script which replaces uses of the inplace
+From: Shashi Mallela <shashi.mallela@linaro.org>
 byteswapping functions *_to_cpus() and cpu_to_*s() with their
 not-in-place equivalents. This is useful for where the swapping
 is done on members of a packed struct -- taking the address
 of the member to pass it to an inplace function is undefined
 behaviour in C.
+Added register definitions relevant to ITS,implemented overall
+ITS device framework with stubs for ITS control and translater
+regions read/write,extended ITS common to handle mmio init between
+existing kvm device and newer qemu device.
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181009181612.10633-1-peter.maydell@linaro.org
 ---
- scripts/coccinelle/inplace-byteswaps.cocci | 65 ++++++++++++++++++++++
+ hw/intc/gicv3_internal.h               |  96 +++++++++-
-file changed, 65 insertions(+)
+ include/hw/intc/arm_gicv3_its_common.h |   9 +-
- create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci
+ hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
  hw/intc/arm_gicv3_its_common.c         |   7 +-
  hw/intc/arm_gicv3_its_kvm.c            |   2 +-
  hw/intc/meson.build                    |   1 +
 files changed, 342 insertions(+), 14 deletions(-)
  create mode 100644 hw/intc/arm_gicv3_its.c
-diff --git a/scripts/coccinelle/inplace-byteswaps.cocci b/scripts/coccinelle/inplace-byteswaps.cocci
+diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/gicv3_internal.h
 +++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
  #ifndef QEMU_ARM_GICV3_INTERNAL_H
  #define QEMU_ARM_GICV3_INTERNAL_H
 +#include "hw/registerfields.h"
  #include "hw/intc/arm_gicv3_common.h"
  /* Distributor registers, as offsets from the distributor base address */
@@ -XXX,XX +XXX,XX @@
  #define GICD_CTLR_E1NWF             (1U << 7)
  #define GICD_CTLR_RWP               (1U << 31)
 +/* 16 bits EventId */
 +#define GICD_TYPER_IDBITS            0xf
 +
  /*
   * Redistributor frame offsets from RD_base
   */
@@ -XXX,XX +XXX,XX @@
  #define GICR_WAKER_ProcessorSleep    (1U << 1)
  #define GICR_WAKER_ChildrenAsleep    (1U << 2)
 -#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
 -#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
 -#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
 -#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
 -#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
 +FIELD(GICR_PROPBASER, IDBITS, 0, 5)
 +FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
 +FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 -#define GICR_PENDBASER_PTZ                     (1ULL << 62)
 -#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
 -#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
 -#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
 -#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
 +FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 +FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 +FIELD(GICR_PENDBASER, PTZ, 62, 1)
  #define ICC_CTLR_EL1_CBPR           (1U << 0)
  #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
  #define ICH_VTR_EL2_PREBITS_SHIFT 26
  #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 +/* ITS Registers */
 +
 +FIELD(GITS_BASER, SIZE, 0, 8)
 +FIELD(GITS_BASER, PAGESIZE, 8, 2)
 +FIELD(GITS_BASER, SHAREABILITY, 10, 2)
 +FIELD(GITS_BASER, PHYADDR, 12, 36)
 +FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
 +FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
 +FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
 +FIELD(GITS_BASER, OUTERCACHE, 53, 3)
 +FIELD(GITS_BASER, TYPE, 56, 3)
 +FIELD(GITS_BASER, INNERCACHE, 59, 3)
 +FIELD(GITS_BASER, INDIRECT, 62, 1)
 +FIELD(GITS_BASER, VALID, 63, 1)
 +
 +FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 +
 +FIELD(GITS_TYPER, PHYSICAL, 0, 1)
 +FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
 +FIELD(GITS_TYPER, IDBITS, 8, 5)
 +FIELD(GITS_TYPER, DEVBITS, 13, 5)
 +FIELD(GITS_TYPER, SEIS, 18, 1)
 +FIELD(GITS_TYPER, PTA, 19, 1)
 +FIELD(GITS_TYPER, CIDBITS, 32, 4)
 +FIELD(GITS_TYPER, CIL, 36, 1)
 +
 +#define GITS_BASER_PAGESIZE_4K                0
 +#define GITS_BASER_PAGESIZE_16K               1
 +#define GITS_BASER_PAGESIZE_64K               2
 +
 +#define GITS_BASER_TYPE_DEVICE               1ULL
 +#define GITS_BASER_TYPE_COLLECTION           4ULL
 +
 +/**
 + * Default features advertised by this version of ITS
 + */
 +/* Physical LPIs supported */
 +#define GITS_TYPE_PHYSICAL           (1U << 0)
 +
 +/*
 + * 12 bytes Interrupt translation Table Entry size
 + * as per Table 5.3 in GICv3 spec
 + * ITE Lower 8 Bytes
 + *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
 + *   Values:  |    1023   |  IntNum  | IntType |  Valid |
 + * ITE Higher 4 Bytes
 + *   Bits:    | 31 ... 16 | 15 ...0 |
 + *   Values:  |  vPEID    |  ICID   |
 + */
 +#define ITS_ITT_ENTRY_SIZE            0xC
 +
 +/* 16 bits EventId */
 +#define ITS_IDBITS                   GICD_TYPER_IDBITS
 +
 +/* 16 bits DeviceId */
 +#define ITS_DEVBITS                   0xF
 +
 +/* 16 bits CollectionId */
 +#define ITS_CIDBITS                  0xF
 +
 +/*
 + * 8 bytes Device Table Entry size
 + * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
 + */
 +#define GITS_DTE_SIZE                 (0x8ULL)
 +
 +/*
 + * 8 bytes Collection Table Entry size
 + * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
 + */
 +#define GITS_CTE_SIZE                 (0x8ULL)
 +
  /* Special interrupt IDs */
  #define INTID_SECURE 1020
  #define INTID_NONSECURE 1021
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/intc/arm_gicv3_common.h"
  #include "qom/object.h"
 +#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
 +
  #define ITS_CONTROL_SIZE 0x10000
  #define ITS_TRANS_SIZE   0x10000
  #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
  #define GITS_CTLR        0x0
  #define GITS_IIDR        0x4
 +#define GITS_TYPER       0x8
  #define GITS_CBASER      0x80
  #define GITS_CWRITER     0x88
  #define GITS_CREADR      0x90
  #define GITS_BASER       0x100
 +#define GITS_TRANSLATER  0x0040
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      /* Registers */
      uint32_t ctlr;
      uint32_t iidr;
 +    uint64_t typer;
      uint64_t cbaser;
      uint64_t cwriter;
      uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
  typedef struct GICv3ITSState GICv3ITSState;
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                   const MemoryRegionOps *tops);
  #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
  typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/scripts/coccinelle/inplace-byteswaps.cocci
++++ b/hw/intc/arm_gicv3_its.c
 @@ -XXX,XX +XXX,XX @@
-+// Replace uses of in-place byteswapping functions with calls to the
++/*
-+// equivalent not-in-place functions.  This is necessary to avoid
++ * ITS emulation for a GICv3-based system
-+// undefined behaviour if the expression being swapped is a field in a
++ *
-+// packed struct.
++ * Copyright Linaro.org 2021
-+
++ *
-+@@
++ * Authors:
-+expression E;
++ *  Shashi Mallela <shashi.mallela@linaro.org>
-+@@
++ *
-+-be16_to_cpus(&E);
++ * This work is licensed under the terms of the GNU GPL, version 2 or (at your
-++E = be16_to_cpu(E);
++ * option) any later version.  See the COPYING file in the top-level directory.
-+@@
++ *
-+expression E;
++ */
-+@@
++
-+-be32_to_cpus(&E);
++#include "qemu/osdep.h"
-++E = be32_to_cpu(E);
++#include "qemu/log.h"
-+@@
++#include "hw/qdev-properties.h"
-+expression E;
++#include "hw/intc/arm_gicv3_its_common.h"
-+@@
++#include "gicv3_internal.h"
-+-be64_to_cpus(&E);
++#include "qom/object.h"
-++E = be64_to_cpu(E);
++#include "qapi/error.h"
-+@@
++
-+expression E;
++typedef struct GICv3ITSClass GICv3ITSClass;
-+@@
++/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
-+-cpu_to_be16s(&E);
++DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
-++E = cpu_to_be16(E);
++                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
-+@@
++
-+expression E;
++struct GICv3ITSClass {
-+@@
++    GICv3ITSCommonClass parent_class;
-+-cpu_to_be32s(&E);
++    void (*parent_reset)(DeviceState *dev);
-++E = cpu_to_be32(E);
++};
-+@@
++
-+expression E;
++static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
-+@@
++                                               uint64_t data, unsigned size,
-+-cpu_to_be64s(&E);
++                                               MemTxAttrs attrs)
-++E = cpu_to_be64(E);
++{
-+@@
++    return MEMTX_OK;
-+expression E;
++}
-+@@
++
-+-le16_to_cpus(&E);
++static bool its_writel(GICv3ITSState *s, hwaddr offset,
-++E = le16_to_cpu(E);
++                              uint64_t value, MemTxAttrs attrs)
-+@@
++{
-+expression E;
++    bool result = true;
-+@@
++
-+-le32_to_cpus(&E);
++    return result;
-++E = le32_to_cpu(E);
++}
-+@@
++
-+expression E;
++static bool its_readl(GICv3ITSState *s, hwaddr offset,
-+@@
++                             uint64_t *data, MemTxAttrs attrs)
-+-le64_to_cpus(&E);
++{
-++E = le64_to_cpu(E);
++    bool result = true;
-+@@
++
-+expression E;
++    return result;
-+@@
++}
-+-cpu_to_le16s(&E);
++
-++E = cpu_to_le16(E);
++static bool its_writell(GICv3ITSState *s, hwaddr offset,
-+@@
++                               uint64_t value, MemTxAttrs attrs)
-+expression E;
++{
-+@@
++    bool result = true;
-+-cpu_to_le32s(&E);
++
-++E = cpu_to_le32(E);
++    return result;
-+@@
++}
-+expression E;
++
-+@@
++static bool its_readll(GICv3ITSState *s, hwaddr offset,
-+-cpu_to_le64s(&E);
++                              uint64_t *data, MemTxAttrs attrs)
-++E = cpu_to_le64(E);
++{
 +    bool result = true;
 +
 +    return result;
 +}
 +
 +static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
 +                                  unsigned size, MemTxAttrs attrs)
 +{
 +    GICv3ITSState *s = (GICv3ITSState *)opaque;
 +    bool result;
 +
 +    switch (size) {
 +    case 4:
 +        result = its_readl(s, offset, data, attrs);
 +        break;
 +    case 8:
 +        result = its_readll(s, offset, data, attrs);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
 +
 +    if (!result) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest read at offset " TARGET_FMT_plx
 +                      "size %u\n", __func__, offset, size);
 +        /*
 +         * The spec requires that reserved registers are RAZ/WI;
 +         * so use false returns from leaf functions as a way to
 +         * trigger the guest-error logging but don't return it to
 +         * the caller, or we'll cause a spurious guest data abort.
 +         */
 +        *data = 0;
 +    }
 +    return MEMTX_OK;
 +}
 +
 +static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
 +                                   unsigned size, MemTxAttrs attrs)
 +{
 +    GICv3ITSState *s = (GICv3ITSState *)opaque;
 +    bool result;
 +
 +    switch (size) {
 +    case 4:
 +        result = its_writel(s, offset, data, attrs);
 +        break;
 +    case 8:
 +        result = its_writell(s, offset, data, attrs);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
 +
 +    if (!result) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write at offset " TARGET_FMT_plx
 +                      "size %u\n", __func__, offset, size);
 +        /*
 +         * The spec requires that reserved registers are RAZ/WI;
 +         * so use false returns from leaf functions as a way to
 +         * trigger the guest-error logging but don't return it to
 +         * the caller, or we'll cause a spurious guest data abort.
 +         */
 +    }
 +    return MEMTX_OK;
 +}
 +
 +static const MemoryRegionOps gicv3_its_control_ops = {
 +    .read_with_attrs = gicv3_its_read,
 +    .write_with_attrs = gicv3_its_write,
 +    .valid.min_access_size = 4,
 +    .valid.max_access_size = 8,
 +    .impl.min_access_size = 4,
 +    .impl.max_access_size = 8,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static const MemoryRegionOps gicv3_its_translation_ops = {
 +    .write_with_attrs = gicv3_its_translation_write,
 +    .valid.min_access_size = 2,
 +    .valid.max_access_size = 4,
 +    .impl.min_access_size = 2,
 +    .impl.max_access_size = 4,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
 +{
 +    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
 +    int i;
 +
 +    for (i = 0; i < s->gicv3->num_cpu; i++) {
 +        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
 +            error_setg(errp, "Physical LPI not supported by CPU %d", i);
 +            return;
 +        }
 +    }
 +
 +    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 +
 +    /* set the ITS default features supported */
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
 +                          GITS_TYPE_PHYSICAL);
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
 +                          ITS_ITT_ENTRY_SIZE - 1);
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
 +    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
 +}
 +
 +static void gicv3_its_reset(DeviceState *dev)
 +{
 +    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
 +    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
 +
 +    c->parent_reset(dev);
 +
 +    /* Quiescent bit reset to 1 */
 +    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
 +
 +    /*
 +     * setting GITS_BASER0.Type = 0b001 (Device)
 +     *         GITS_BASER1.Type = 0b100 (Collection Table)
 +     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
 +     *         GITS_BASER<0,1>.Page_Size = 64KB
 +     * and default translation table entry size to 16 bytes
 +     */
 +    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
 +                             GITS_BASER_TYPE_DEVICE);
 +    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
 +                             GITS_BASER_PAGESIZE_64K);
 +    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
 +                             GITS_DTE_SIZE - 1);
 +
 +    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
 +                             GITS_BASER_TYPE_COLLECTION);
 +    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
 +                             GITS_BASER_PAGESIZE_64K);
 +    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
 +                             GITS_CTE_SIZE - 1);
 +}
 +
 +static Property gicv3_its_props[] = {
 +    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
 +                     GICv3State *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void gicv3_its_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
 +
 +    dc->realize = gicv3_arm_its_realize;
 +    device_class_set_props(dc, gicv3_its_props);
 +    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
 +}
 +
 +static const TypeInfo gicv3_its_info = {
 +    .name = TYPE_ARM_GICV3_ITS,
 +    .parent = TYPE_ARM_GICV3_ITS_COMMON,
 +    .instance_size = sizeof(GICv3ITSState),
 +    .class_init = gicv3_its_class_init,
 +    .class_size = sizeof(GICv3ITSClass),
 +};
 +
 +static void gicv3_its_register_types(void)
 +{
 +    type_register_static(&gicv3_its_info);
 +}
 +
 +type_init(gicv3_its_register_types)
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
  static const VMStateDescription vmstate_its = {
      .name = "arm_gicv3_its",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
      .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                         const MemoryRegionOps *tops)
  {
      SysBusDevice *sbd = SYS_BUS_DEVICE(s);
      memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                            "control", ITS_CONTROL_SIZE);
      memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
 -                          &gicv3_its_trans_ops, s,
 +                          tops ? tops : &gicv3_its_trans_ops, s,
                            "translation", ITS_TRANS_SIZE);
      /* Our two regions are always adjacent, therefore we now combine them
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                              KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 -    gicv3_its_init_mmio(s, NULL);
 +    gicv3_its_init_mmio(s, NULL, NULL);
      if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
          GITS_CTLR)) {
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
    'arm_gicv3_dist.c',
    'arm_gicv3_its_common.c',
    'arm_gicv3_redist.c',
 +  'arm_gicv3_its.c',
  ))
  softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
  softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 08/19] net: cadence_gem: Use uint32_t for 32bit descriptor words
+[PULL 10/23] hw/intc: GICv3 ITS register definitions added
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Use uint32_t instead of unsigned to describe 32bit descriptor words.
+Defined descriptors for ITS device table,collection table and ITS
 command queue entities.Implemented register read/write functions,
 extract ITS table parameters and command queue parameters,extended
 gicv3 common to capture qemu address space(which host the ITS table
 platform memories required for subsequent ITS processing) and
 initialize the same in ITS device.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20181011021931.4249-4-edgar.iglesias@gmail.com
+Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/cadence_gem.h |  2 +-
+ hw/intc/gicv3_internal.h               |  29 ++
- hw/net/cadence_gem.c         | 42 ++++++++++++++++++------------------
+ include/hw/intc/arm_gicv3_common.h     |   3 +
-files changed, 22 insertions(+), 22 deletions(-)
+ include/hw/intc/arm_gicv3_its_common.h |  23 ++
  hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
 files changed, 431 insertions(+)
-diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/cadence_gem.h
+--- a/hw/intc/gicv3_internal.h
-+++ b/include/hw/net/cadence_gem.h
++++ b/hw/intc/gicv3_internal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
+ FIELD(GITS_BASER, INDIRECT, 62, 1)
-     uint8_t can_rx_state; /* Debug only */
+ FIELD(GITS_BASER, VALID, 63, 1)
--    unsigned rx_desc[MAX_PRIORITY_QUEUES][2];
++FIELD(GITS_CBASER, SIZE, 0, 8)
-+    uint32_t rx_desc[MAX_PRIORITY_QUEUES][2];
++FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
++FIELD(GITS_CBASER, PHYADDR, 12, 40)
-     bool sar_active[4];
++FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
- } CadenceGEMState;
++FIELD(GITS_CBASER, INNERCACHE, 59, 3)
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
++FIELD(GITS_CBASER, VALID, 63, 1)
 +
 +FIELD(GITS_CREADR, STALLED, 0, 1)
 +FIELD(GITS_CREADR, OFFSET, 5, 15)
 +
 +FIELD(GITS_CWRITER, RETRY, 0, 1)
 +FIELD(GITS_CWRITER, OFFSET, 5, 15)
 +
 +FIELD(GITS_CTLR, ENABLED, 0, 1)
  FIELD(GITS_CTLR, QUIESCENT, 31, 1)
  FIELD(GITS_TYPER, PHYSICAL, 0, 1)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
  FIELD(GITS_TYPER, CIDBITS, 32, 4)
  FIELD(GITS_TYPER, CIL, 36, 1)
 +#define GITS_IDREGS           0xFFD0
 +
 +#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
 +
 +#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
 +                                              R_GITS_BASER_TYPE_MASK)
 +
  #define GITS_BASER_PAGESIZE_4K                0
  #define GITS_BASER_PAGESIZE_16K               1
  #define GITS_BASER_PAGESIZE_64K               2
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
  #define GITS_BASER_TYPE_DEVICE               1ULL
  #define GITS_BASER_TYPE_COLLECTION           4ULL
 +#define GITS_PAGE_SIZE_4K       0x1000
 +#define GITS_PAGE_SIZE_16K      0x4000
 +#define GITS_PAGE_SIZE_64K      0x10000
 +
 +#define L1TABLE_ENTRY_SIZE         8
 +
 +#define GITS_CMDQ_ENTRY_SIZE               32
 +
  /**
   * Default features advertised by this version of ITS
   */
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/include/hw/intc/arm_gicv3_common.h
-+++ b/hw/net/cadence_gem.c
++++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
      int dev_fd; /* kvm device fd if backed by kvm vgic support */
      Error *migration_blocker;
 +    MemoryRegion *dma;
 +    AddressSpace dma_as;
 +
      /* Distributor */
      /* for a GIC with the security extensions the NS banked version of this
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
 @@ -XXX,XX +XXX,XX @@
- #define GEM_MODID_VALUE 0x00020118
+ #define GITS_TRANSLATER  0x0040
--static inline unsigned tx_desc_get_buffer(unsigned *desc)
++typedef struct {
-+static inline unsigned tx_desc_get_buffer(uint32_t *desc)
++    bool valid;
 +    bool indirect;
 +    uint16_t entry_sz;
 +    uint32_t page_sz;
 +    uint32_t max_entries;
 +    union {
 +        uint32_t max_devids;
 +        uint32_t max_collids;
 +    } maxids;
 +    uint64_t base_addr;
 +} TableDesc;
 +
 +typedef struct {
 +    bool valid;
 +    uint32_t max_entries;
 +    uint64_t base_addr;
 +} CmdQDesc;
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      uint64_t creadr;
      uint64_t baser[8];
 +    TableDesc  dt;
 +    TableDesc  ct;
 +    CmdQDesc   cq;
 +
      Error *migration_blocker;
  };
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
      void (*parent_reset)(DeviceState *dev);
  };
 +static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
 +{
 +    uint64_t result = 0;
 +
 +    switch (page_sz) {
 +    case GITS_PAGE_SIZE_4K:
 +    case GITS_PAGE_SIZE_16K:
 +        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
 +        break;
 +
 +    case GITS_PAGE_SIZE_64K:
 +        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
 +        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
 +        break;
 +
 +    default:
 +        break;
 +    }
 +    return result;
 +}
 +
 +/*
 + * This function extracts the ITS Device and Collection table specific
 + * parameters (like base_addr, size etc) from GITS_BASER register.
 + * It is called during ITS enable and also during post_load migration
 + */
 +static void extract_table_params(GICv3ITSState *s)
 +{
 +    uint16_t num_pages = 0;
 +    uint8_t  page_sz_type;
 +    uint8_t type;
 +    uint32_t page_sz = 0;
 +    uint64_t value;
 +
 +    for (int i = 0; i < 8; i++) {
 +        value = s->baser[i];
 +
 +        if (!value) {
 +            continue;
 +        }
 +
 +        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
 +
 +        switch (page_sz_type) {
 +        case 0:
 +            page_sz = GITS_PAGE_SIZE_4K;
 +            break;
 +
 +        case 1:
 +            page_sz = GITS_PAGE_SIZE_16K;
 +            break;
 +
 +        case 2:
 +        case 3:
 +            page_sz = GITS_PAGE_SIZE_64K;
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
 +        }
 +
 +        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
 +
 +        type = FIELD_EX64(value, GITS_BASER, TYPE);
 +
 +        switch (type) {
 +
 +        case GITS_BASER_TYPE_DEVICE:
 +            memset(&s->dt, 0 , sizeof(s->dt));
 +            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
 +
 +            if (!s->dt.valid) {
 +                return;
 +            }
 +
 +            s->dt.page_sz = page_sz;
 +            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
 +            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
 +
 +            if (!s->dt.indirect) {
 +                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
 +            } else {
 +                s->dt.max_entries = (((num_pages * page_sz) /
 +                                     L1TABLE_ENTRY_SIZE) *
 +                                     (page_sz / s->dt.entry_sz));
 +            }
 +
 +            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
 +                                       DEVBITS) + 1));
 +
 +            s->dt.base_addr = baser_base_addr(value, page_sz);
 +
 +            break;
 +
 +        case GITS_BASER_TYPE_COLLECTION:
 +            memset(&s->ct, 0 , sizeof(s->ct));
 +            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
 +
 +            /*
 +             * GITS_TYPER.HCC is 0 for this implementation
 +             * hence writes are discarded if ct.valid is 0
 +             */
 +            if (!s->ct.valid) {
 +                return;
 +            }
 +
 +            s->ct.page_sz = page_sz;
 +            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
 +            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
 +
 +            if (!s->ct.indirect) {
 +                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
 +            } else {
 +                s->ct.max_entries = (((num_pages * page_sz) /
 +                                     L1TABLE_ENTRY_SIZE) *
 +                                     (page_sz / s->ct.entry_sz));
 +            }
 +
 +            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
 +                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
 +                                            GITS_TYPER, CIDBITS) + 1));
 +            } else {
 +                /* 16-bit CollectionId supported when CIL == 0 */
 +                s->ct.maxids.max_collids = (1UL << 16);
 +            }
 +
 +            s->ct.base_addr = baser_base_addr(value, page_sz);
 +
 +            break;
 +
 +        default:
 +            break;
 +        }
 +    }
 +}
 +
 +static void extract_cmdq_params(GICv3ITSState *s)
 +{
 +    uint16_t num_pages = 0;
 +    uint64_t value = s->cbaser;
 +
 +    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
 +
 +    memset(&s->cq, 0 , sizeof(s->cq));
 +    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
 +
 +    if (s->cq.valid) {
 +        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
 +                             GITS_CMDQ_ENTRY_SIZE;
 +        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
 +        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
 +    }
 +}
 +
  static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                 uint64_t data, unsigned size,
                                                 MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
                                uint64_t value, MemTxAttrs attrs)
  {
-     return desc[0];
+     bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_CTLR:
 +        s->ctlr |= (value & ~(s->ctlr));
 +
 +        if (s->ctlr & ITS_CTLR_ENABLED) {
 +            extract_table_params(s);
 +            extract_cmdq_params(s);
 +            s->creadr = 0;
 +        }
 +        break;
 +    case GITS_CBASER:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = deposit64(s->cbaser, 0, 32, value);
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CBASER + 4:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = deposit64(s->cbaser, 32, 32, value);
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CWRITER:
 +        s->cwriter = deposit64(s->cwriter, 0, 32,
 +                               (value & ~R_GITS_CWRITER_RETRY_MASK));
 +        break;
 +    case GITS_CWRITER + 4:
 +        s->cwriter = deposit64(s->cwriter, 32, 32, value);
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = deposit64(s->creadr, 0, 32,
 +                                  (value & ~R_GITS_CREADR_STALLED_MASK));
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_CREADR + 4:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = deposit64(s->creadr, 32, 32, value);
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        /*
 +         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            index = (offset - GITS_BASER) / 8;
 +
 +            if (offset & 7) {
 +                value <<= 32;
 +                value &= ~GITS_BASER_RO_MASK;
 +                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
 +                s->baser[index] |= value;
 +            } else {
 +                value &= ~GITS_BASER_RO_MASK;
 +                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
 +                s->baser[index] |= value;
 +            }
 +        }
 +        break;
 +    case GITS_IIDR:
 +    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
 +        /* RO registers, ignore the write */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write to RO register at offset "
 +                      TARGET_FMT_plx "\n", __func__, offset);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
--static inline unsigned tx_desc_get_used(unsigned *desc)
+@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
-+static inline unsigned tx_desc_get_used(uint32_t *desc)
+                              uint64_t *data, MemTxAttrs attrs)
  {
-     return (desc[1] & DESC_1_USED) ? 1 : 0;
+     bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_CTLR:
 +        *data = s->ctlr;
 +        break;
 +    case GITS_IIDR:
 +        *data = gicv3_iidr();
 +        break;
 +    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
 +        /* ID registers */
 +        *data = gicv3_idreg(offset - GITS_IDREGS);
 +        break;
 +    case GITS_TYPER:
 +        *data = extract64(s->typer, 0, 32);
 +        break;
 +    case GITS_TYPER + 4:
 +        *data = extract64(s->typer, 32, 32);
 +        break;
 +    case GITS_CBASER:
 +        *data = extract64(s->cbaser, 0, 32);
 +        break;
 +    case GITS_CBASER + 4:
 +        *data = extract64(s->cbaser, 32, 32);
 +        break;
 +    case GITS_CREADR:
 +        *data = extract64(s->creadr, 0, 32);
 +        break;
 +    case GITS_CREADR + 4:
 +        *data = extract64(s->creadr, 32, 32);
 +        break;
 +    case GITS_CWRITER:
 +        *data = extract64(s->cwriter, 0, 32);
 +        break;
 +    case GITS_CWRITER + 4:
 +        *data = extract64(s->cwriter, 32, 32);
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        if (offset & 7) {
 +            *data = extract64(s->baser[index], 32, 32);
 +        } else {
 +            *data = extract64(s->baser[index], 0, 32);
 +        }
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
--static inline void tx_desc_set_used(unsigned *desc)
+@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
-+static inline void tx_desc_set_used(uint32_t *desc)
+                                uint64_t value, MemTxAttrs attrs)
  {
-     desc[1] |= DESC_1_USED;
+     bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        /*
 +         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            index = (offset - GITS_BASER) / 8;
 +            s->baser[index] &= GITS_BASER_RO_MASK;
 +            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
 +        }
 +        break;
 +    case GITS_CBASER:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = value;
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CWRITER:
 +        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_TYPER:
 +        /* RO registers, ignore the write */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write to RO register at offset "
 +                      TARGET_FMT_plx "\n", __func__, offset);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
--static inline unsigned tx_desc_get_wrap(unsigned *desc)
+@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
-+static inline unsigned tx_desc_get_wrap(uint32_t *desc)
+                               uint64_t *data, MemTxAttrs attrs)
  {
-     return (desc[1] & DESC_1_TX_WRAP) ? 1 : 0;
+     bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_TYPER:
 +        *data = s->typer;
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        *data = s->baser[index];
 +        break;
 +    case GITS_CBASER:
 +        *data = s->cbaser;
 +        break;
 +    case GITS_CREADR:
 +        *data = s->creadr;
 +        break;
 +    case GITS_CWRITER:
 +        *data = s->cwriter;
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
--static inline unsigned tx_desc_get_last(unsigned *desc)
+@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
-+static inline unsigned tx_desc_get_last(uint32_t *desc)
      gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 +    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
 +                       "gicv3-its-sysmem");
 +
      /* set the ITS default features supported */
      s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                            GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                               GITS_CTE_SIZE - 1);
  }
 +static void gicv3_its_post_load(GICv3ITSState *s)
 +{
 +    if (s->ctlr & ITS_CTLR_ENABLED) {
 +        extract_table_params(s);
 +        extract_cmdq_params(s);
 +    }
 +}
 +
  static Property gicv3_its_props[] = {
      DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                       GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
  {
-     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
+     DeviceClass *dc = DEVICE_CLASS(klass);
      GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
 +    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
      dc->realize = gicv3_arm_its_realize;
      device_class_set_props(dc, gicv3_its_props);
      device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
 +    icc->post_load = gicv3_its_post_load;
  }
--static inline void tx_desc_set_last(unsigned *desc)
+ static const TypeInfo gicv3_its_info = {
 +static inline void tx_desc_set_last(uint32_t *desc)
  {
      desc[1] |= DESC_1_TX_LAST;
  }
 -static inline unsigned tx_desc_get_length(unsigned *desc)
 +static inline unsigned tx_desc_get_length(uint32_t *desc)
  {
      return desc[1] & DESC_1_LENGTH;
  }
 -static inline void print_gem_tx_desc(unsigned *desc, uint8_t queue)
 +static inline void print_gem_tx_desc(uint32_t *desc, uint8_t queue)
  {
      DB_PRINT("TXDESC (queue %" PRId8 "):\n", queue);
      DB_PRINT("bufaddr: 0x%08x\n", *desc);
@@ -XXX,XX +XXX,XX @@ static inline void print_gem_tx_desc(unsigned *desc, uint8_t queue)
      DB_PRINT("length:  %d\n", tx_desc_get_length(desc));
  }
 -static inline unsigned rx_desc_get_buffer(unsigned *desc)
 +static inline unsigned rx_desc_get_buffer(uint32_t *desc)
  {
      return desc[0] & ~0x3UL;
  }
 -static inline unsigned rx_desc_get_wrap(unsigned *desc)
 +static inline unsigned rx_desc_get_wrap(uint32_t *desc)
  {
      return desc[0] & DESC_0_RX_WRAP ? 1 : 0;
  }
 -static inline unsigned rx_desc_get_ownership(unsigned *desc)
 +static inline unsigned rx_desc_get_ownership(uint32_t *desc)
  {
      return desc[0] & DESC_0_RX_OWNERSHIP ? 1 : 0;
  }
 -static inline void rx_desc_set_ownership(unsigned *desc)
 +static inline void rx_desc_set_ownership(uint32_t *desc)
  {
      desc[0] |= DESC_0_RX_OWNERSHIP;
  }
 -static inline void rx_desc_set_sof(unsigned *desc)
 +static inline void rx_desc_set_sof(uint32_t *desc)
  {
      desc[1] |= DESC_1_RX_SOF;
  }
 -static inline void rx_desc_set_eof(unsigned *desc)
 +static inline void rx_desc_set_eof(uint32_t *desc)
  {
      desc[1] |= DESC_1_RX_EOF;
  }
 -static inline void rx_desc_set_length(unsigned *desc, unsigned len)
 +static inline void rx_desc_set_length(uint32_t *desc, unsigned len)
  {
      desc[1] &= ~DESC_1_LENGTH;
      desc[1] |= len;
  }
 -static inline void rx_desc_set_broadcast(unsigned *desc)
 +static inline void rx_desc_set_broadcast(uint32_t *desc)
  {
      desc[1] |= R_DESC_1_RX_BROADCAST;
  }
 -static inline void rx_desc_set_unicast_hash(unsigned *desc)
 +static inline void rx_desc_set_unicast_hash(uint32_t *desc)
  {
      desc[1] |= R_DESC_1_RX_UNICAST_HASH;
  }
 -static inline void rx_desc_set_multicast_hash(unsigned *desc)
 +static inline void rx_desc_set_multicast_hash(uint32_t *desc)
  {
      desc[1] |= R_DESC_1_RX_MULTICAST_HASH;
  }
 -static inline void rx_desc_set_sar(unsigned *desc, int sar_idx)
 +static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
  {
      desc[1] = deposit32(desc[1], R_DESC_1_RX_SAR_SHIFT, R_DESC_1_RX_SAR_LENGTH,
                          sar_idx);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit_updatestats(CadenceGEMState *s, const uint8_t *packet,
   */
  static void gem_transmit(CadenceGEMState *s)
  {
 -    unsigned    desc[2];
 +    uint32_t desc[2];
      hwaddr packet_desc_addr;
      uint8_t     tx_packet[2048];
      uint8_t     *p;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
              /* Last descriptor for this packet; hand the whole thing off */
              if (tx_desc_get_last(desc)) {
 -                unsigned    desc_first[2];
 +                uint32_t desc_first[2];
                  /* Modify the 1st descriptor of this packet to be owned by
                   * the processor.
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 12/19] net: cadence_gem: Implement support for 64bit descriptor addresses
+[PULL 11/23] hw/intc: GICv3 ITS command queue framework
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Implement support for 64bit descriptor addresses.
+Added functionality to trigger ITS command queue processing on
 write to CWRITE register and process each command queue entry to
 identify the command type and handle commands like MAPD,MAPC,SYNC.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20181011021931.4249-8-edgar.iglesias@gmail.com
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Message-id: 20210910143951.92242-4-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/cadence_gem.c | 47 ++++++++++++++++++++++++++++++++++++--------
+ hw/intc/gicv3_internal.h |  40 +++++
-file changed, 39 insertions(+), 8 deletions(-)
+ hw/intc/arm_gicv3_its.c  | 319 +++++++++++++++++++++++++++++++++++++++
 files changed, 359 insertions(+)
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/hw/intc/gicv3_internal.h
-+++ b/hw/net/cadence_gem.c
++++ b/hw/intc/gicv3_internal.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
- #define GEM_RECEIVE_Q1_PTR              (0x00000480 / 4)
+ #define L1TABLE_ENTRY_SIZE         8
- #define GEM_RECEIVE_Q7_PTR              (GEM_RECEIVE_Q1_PTR + 6)
+ #define GITS_CMDQ_ENTRY_SIZE               32
-+#define GEM_TBQPH                       (0x000004C8 / 4)
++#define NUM_BYTES_IN_DW                     8
-+#define GEM_RBQPH                       (0x000004D4 / 4)
++
-+
++#define CMD_MASK                  0xff
- #define GEM_INT_Q1_ENABLE               (0x00000600 / 4)
++
- #define GEM_INT_Q7_ENABLE               (GEM_INT_Q1_ENABLE + 6)
++/* ITS Commands */
++#define GITS_CMD_CLEAR            0x04
-@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
++#define GITS_CMD_DISCARD          0x0F
-     return 0;
++#define GITS_CMD_INT              0x03
 +#define GITS_CMD_MAPC             0x09
 +#define GITS_CMD_MAPD             0x08
 +#define GITS_CMD_MAPI             0x0B
 +#define GITS_CMD_MAPTI            0x0A
 +#define GITS_CMD_INV              0x0C
 +#define GITS_CMD_INVALL           0x0D
 +#define GITS_CMD_SYNC             0x05
 +
 +/* MAPC command fields */
 +#define ICID_LENGTH                  16
 +#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
 +FIELD(MAPC, RDBASE, 16, 32)
 +
 +#define RDBASE_PROCNUM_LENGTH        16
 +#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
 +
 +/* MAPD command fields */
 +#define ITTADDR_LENGTH               44
 +#define ITTADDR_SHIFT                 8
 +#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 +#define SIZE_MASK                 0x1f
 +
 +#define DEVID_SHIFT                  32
 +#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 +
 +#define VALID_SHIFT               63
 +#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
 +#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
 +#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
  /**
   * Default features advertised by this version of ITS
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
   * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
   */
  #define GITS_DTE_SIZE                 (0x8ULL)
 +#define GITS_DTE_ITTADDR_SHIFT           6
 +#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
 +                                                      ITTADDR_LENGTH)
  /*
   * 8 bytes Collection Table Entry size
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
      return result;
  }
-+static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
++static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
 +                       uint64_t rdbase)
 +{
-+    hwaddr desc_addr = 0;
++    AddressSpace *as = &s->gicv3->dma_as;
-+
++    uint64_t value;
-+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
++    uint64_t l2t_addr;
-+        desc_addr = s->regs[tx ? GEM_TBQPH : GEM_RBQPH];
++    bool valid_l2t;
-+    }
++    uint32_t l2t_id;
-+    desc_addr <<= 32;
++    uint32_t max_l2_entries;
-+    desc_addr |= tx ? s->tx_desc_addr[q] : s->rx_desc_addr[q];
++    uint64_t cte = 0;
-+    return desc_addr;
++    MemTxResult res = MEMTX_OK;
 +
 +    if (!s->ct.valid) {
 +        return true;
 +    }
 +
 +    if (valid) {
 +        /* add mapping entry to collection table */
 +        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
 +    }
 +
 +    /*
 +     * The specification defines the format of level 1 entries of a
 +     * 2-level table, but the format of level 2 entries and the format
 +     * of flat-mapped tables is IMPDEF.
 +     */
 +    if (s->ct.indirect) {
 +        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->ct.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return false;
 +        }
 +
 +        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +        if (valid_l2t) {
 +            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
 +
 +            l2t_addr = value & ((1ULL << 51) - 1);
 +
 +            address_space_stq_le(as, l2t_addr +
 +                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
 +                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
 +        }
 +    } else {
 +        /* Flat level table */
 +        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
 +                             cte, MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +    if (res != MEMTX_OK) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
-+static hwaddr gem_get_tx_desc_addr(CadenceGEMState *s, int q)
++static bool process_mapc(GICv3ITSState *s, uint32_t offset)
 +{
-+    return gem_get_desc_addr(s, true, q);
++    AddressSpace *as = &s->gicv3->dma_as;
 +    uint16_t icid;
 +    uint64_t rdbase;
 +    bool valid;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = false;
 +    uint64_t value;
 +
 +    offset += NUM_BYTES_IN_DW;
 +    offset += NUM_BYTES_IN_DW;
 +
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    icid = value & ICID_MASK;
 +
 +    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
 +    rdbase &= RDBASE_PROCNUM_MASK;
 +
 +    valid = (value & CMD_FIELD_VALID_MASK);
 +
 +    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "ITS MAPC: invalid collection table attributes "
 +                      "icid %d rdbase %lu\n",  icid, rdbase);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        result = update_cte(s, icid, valid, rdbase);
 +    }
 +
 +    return result;
 +}
 +
-+static hwaddr gem_get_rx_desc_addr(CadenceGEMState *s, int q)
++static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
 +                       uint8_t size, uint64_t itt_addr)
 +{
-+    return gem_get_desc_addr(s, false, q);
++    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t value;
 +    uint64_t l2t_addr;
 +    bool valid_l2t;
 +    uint32_t l2t_id;
 +    uint32_t max_l2_entries;
 +    uint64_t dte = 0;
 +    MemTxResult res = MEMTX_OK;
 +
 +    if (s->dt.valid) {
 +        if (valid) {
 +            /* add mapping entry to device table */
 +            dte = (valid & TABLE_ENTRY_VALID_MASK) |
 +                  ((size & SIZE_MASK) << 1U) |
 +                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
 +        }
 +    } else {
 +        return true;
 +    }
 +
 +    /*
 +     * The specification defines the format of level 1 entries of a
 +     * 2-level table, but the format of level 2 entries and the format
 +     * of flat-mapped tables is IMPDEF.
 +     */
 +    if (s->dt.indirect) {
 +        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->dt.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return false;
 +        }
 +
 +        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +        if (valid_l2t) {
 +            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
 +
 +            l2t_addr = value & ((1ULL << 51) - 1);
 +
 +            address_space_stq_le(as, l2t_addr +
 +                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
 +                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
 +        }
 +    } else {
 +        /* Flat level table */
 +        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
 +                             dte, MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +    if (res != MEMTX_OK) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
- static void gem_get_rx_desc(CadenceGEMState *s, int q)
++static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
- {
++{
--    DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
++    AddressSpace *as = &s->gicv3->dma_as;
-+    hwaddr desc_addr = gem_get_rx_desc_addr(s, q);
++    uint32_t devid;
-+
++    uint8_t size;
-+    DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", desc_addr);
++    uint64_t itt_addr;
-+
++    bool valid;
-     /* read current descriptor */
++    MemTxResult res = MEMTX_OK;
--    address_space_read(&s->dma_as, s->rx_desc_addr[q], MEMTXATTRS_UNSPECIFIED,
++    bool result = false;
-+    address_space_read(&s->dma_as, desc_addr, MEMTXATTRS_UNSPECIFIED,
++
-                        (uint8_t *)s->rx_desc[q],
++    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
-                        sizeof(uint32_t) * gem_get_desc_len(s, true));
++
++    offset += NUM_BYTES_IN_DW;
-     /* Descriptor owned by software ? */
++    value = address_space_ldq_le(as, s->cq.base_addr + offset,
-     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
++                                 MEMTXATTRS_UNSPECIFIED, &res);
--        DB_PRINT("descriptor 0x%x owned by sw.\n",
++
--                 (unsigned)s->rx_desc_addr[q]);
++    if (res != MEMTX_OK) {
-+        DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
++        return result;
-         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
++    }
-         s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
++
-         /* Handle interrupt consequences */
++    size = (value & SIZE_MASK);
-@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
++
-     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
++    offset += NUM_BYTES_IN_DW;
++    value = address_space_ldq_le(as, s->cq.base_addr + offset,
-     while (bytes_to_copy) {
++                                 MEMTXATTRS_UNSPECIFIED, &res);
-+        hwaddr desc_addr;
++
-+
++    if (res != MEMTX_OK) {
-         /* Do nothing if receive is not enabled. */
++        return result;
-         if (!gem_can_receive(nc)) {
++    }
-             assert(!first_desc);
++
-@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
++    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
 +
 +    valid = (value & CMD_FIELD_VALID_MASK);
 +
 +    if ((devid > s->dt.maxids.max_devids) ||
 +        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "ITS MAPD: invalid device table attributes "
 +                      "devid %d or size %d\n", devid, size);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        result = update_dte(s, devid, valid, size, itt_addr);
 +    }
 +
 +    return result;
 +}
 +
 +/*
 + * Current implementation blocks until all
 + * commands are processed
 + */
 +static void process_cmdq(GICv3ITSState *s)
 +{
 +    uint32_t wr_offset = 0;
 +    uint32_t rd_offset = 0;
 +    uint32_t cq_offset = 0;
 +    uint64_t data;
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = true;
 +    uint8_t cmd;
 +
 +    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +        return;
 +    }
 +
 +    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
 +
 +    if (wr_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid write offset "
 +                      "%d\n", __func__, wr_offset);
 +        return;
 +    }
 +
 +    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
 +
 +    if (rd_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid read offset "
 +                      "%d\n", __func__, rd_offset);
 +        return;
 +    }
 +
 +    while (wr_offset != rd_offset) {
 +        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
 +        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
 +                                    MEMTXATTRS_UNSPECIFIED, &res);
 +        if (res != MEMTX_OK) {
 +            result = false;
 +        }
 +        cmd = (data & CMD_MASK);
 +
 +        switch (cmd) {
 +        case GITS_CMD_INT:
 +            break;
 +        case GITS_CMD_CLEAR:
 +            break;
 +        case GITS_CMD_SYNC:
 +            /*
 +             * Current implementation makes a blocking synchronous call
 +             * for every command issued earlier, hence the internal state
 +             * is already consistent by the time SYNC command is executed.
 +             * Hence no further processing is required for SYNC command.
 +             */
 +            break;
 +        case GITS_CMD_MAPD:
 +            result = process_mapd(s, data, cq_offset);
 +            break;
 +        case GITS_CMD_MAPC:
 +            result = process_mapc(s, cq_offset);
 +            break;
 +        case GITS_CMD_MAPTI:
 +            break;
 +        case GITS_CMD_MAPI:
 +            break;
 +        case GITS_CMD_DISCARD:
 +            break;
 +        case GITS_CMD_INV:
 +        case GITS_CMD_INVALL:
 +            break;
 +        default:
 +            break;
 +        }
 +        if (result) {
 +            rd_offset++;
 +            rd_offset %= s->cq.max_entries;
 +            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
 +        } else {
 +            /*
 +             * in this implementation, in case of dma read/write error
 +             * we stall the command processing
 +             */
 +            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: %x cmd processing failed\n", __func__, cmd);
 +            break;
 +        }
 +    }
 +}
 +
  /*
   * This function extracts the ITS Device and Collection table specific
   * parameters (like base_addr, size etc) from GITS_BASER register.
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
              extract_table_params(s);
              extract_cmdq_params(s);
              s->creadr = 0;
 +            process_cmdq(s);
          }
+         break;
-         /* Descriptor write-back.  */
+     case GITS_CBASER:
--        address_space_write(&s->dma_as, s->rx_desc_addr[q],
+@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
-+        desc_addr = gem_get_rx_desc_addr(s, q);
+     case GITS_CWRITER:
-+        address_space_write(&s->dma_as, desc_addr,
+         s->cwriter = deposit64(s->cwriter, 0, 32,
-                             MEMTXATTRS_UNSPECIFIED,
+                                (value & ~R_GITS_CWRITER_RETRY_MASK));
-                             (uint8_t *)s->rx_desc[q],
++        if (s->cwriter != s->creadr) {
-                             sizeof(uint32_t) * gem_get_desc_len(s, true));
++            process_cmdq(s);
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
++        }
+         break;
-     for (q = s->num_priority_queues - 1; q >= 0; q--) {
+     case GITS_CWRITER + 4:
-         /* read current descriptor */
+         s->cwriter = deposit64(s->cwriter, 32, 32, value);
--        packet_desc_addr = s->tx_desc_addr[q];
+@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
-+        packet_desc_addr = gem_get_tx_desc_addr(s, q);
+         break;
+     case GITS_CWRITER:
-         DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
+         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
-         address_space_read(&s->dma_as, packet_desc_addr,
++        if (s->cwriter != s->creadr) {
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
++            process_cmdq(s);
-             /* Last descriptor for this packet; hand the whole thing off */
++        }
-             if (tx_desc_get_last(desc)) {
+         break;
-                 uint32_t desc_first[DESC_MAX_NUM_WORDS];
+     case GITS_CREADR:
-+                hwaddr desc_addr = gem_get_tx_desc_addr(s, q);
+         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
                  /* Modify the 1st descriptor of this packet to be owned by
                   * the processor.
                   */
 -                address_space_read(&s->dma_as, s->tx_desc_addr[q],
 +                address_space_read(&s->dma_as, desc_addr,
                                     MEMTXATTRS_UNSPECIFIED,
                                     (uint8_t *)desc_first,
                                     sizeof(desc_first));
                  tx_desc_set_used(desc_first);
 -                address_space_write(&s->dma_as, s->tx_desc_addr[q],
 +                address_space_write(&s->dma_as, desc_addr,
                                    MEMTXATTRS_UNSPECIFIED,
                                    (uint8_t *)desc_first,
                                     sizeof(desc_first));
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 03/19] target/arm: Define fields of ISAR registers
+[PULL 12/23] hw/intc: GICv3 ITS Command processing
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+translation which triggers an LPI via INT command as well as write
-Message-id: 20181008212205.17752-3-richard.henderson@linaro.org
+to GITS_TRANSLATER register,defined enum to differentiate between ITS
 command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
 Each of these commands make use of other functionalities implemented to
 get device table entry,collection table entry or interrupt translation
 table entry required for their processing.
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/intc/gicv3_internal.h           |  12 +
-file changed, 88 insertions(+)
+ include/hw/intc/arm_gicv3_common.h |   2 +
  hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
 files changed, 378 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/gicv3_internal.h
-+++ b/target/arm/cpu.h
++++ b/hw/intc/gicv3_internal.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CSSELR, LEVEL, 1, 3)
+@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
  #define SIZE_MASK                 0x1f
 +/* MAPI command fields */
 +#define EVENTID_MASK              ((1ULL << 32) - 1)
 +
 +/* MAPTI command fields */
 +#define pINTID_SHIFT                 32
 +#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
 +
  #define DEVID_SHIFT                  32
  #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
   *   Values:  |  vPEID    |  ICID   |
   */
- FIELD(V7M_CSSELR, INDEX, 0, 4)
+ #define ITS_ITT_ENTRY_SIZE            0xC
 +#define ITE_ENTRY_INTTYPE_SHIFT        1
 +#define ITE_ENTRY_INTID_SHIFT          2
 +#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
 +#define ITE_ENTRY_INTSP_SHIFT          26
 +#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
  /* 16 bits EventId */
  #define ITS_IDBITS                   GICD_TYPER_IDBITS
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_common.h
 +++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@
  #define GICV3_MAXIRQ 1020
  #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
 +#define GICV3_LPI_INTID_START 8192
 +
  #define GICV3_REDIST_SIZE 0x20000
  /* Number of SGI target-list bits */
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
      void (*parent_reset)(DeviceState *dev);
  };
 +/*
-+ * System register ID fields.
++ * This is an internal enum used to distinguish between LPI triggered
 + * via command queue and LPI triggered via gits_translater write.
 + */
-+FIELD(ID_ISAR0, SWAP, 0, 4)
++typedef enum ItsCmdType {
-+FIELD(ID_ISAR0, BITCOUNT, 4, 4)
++    NONE = 0, /* internal indication for GITS_TRANSLATER write */
-+FIELD(ID_ISAR0, BITFIELD, 8, 4)
++    CLEAR = 1,
-+FIELD(ID_ISAR0, CMPBRANCH, 12, 4)
++    DISCARD = 2,
-+FIELD(ID_ISAR0, COPROC, 16, 4)
++    INT = 3,
-+FIELD(ID_ISAR0, DEBUG, 20, 4)
++} ItsCmdType;
-+FIELD(ID_ISAR0, DIVIDE, 24, 4)
++
-+
++typedef struct {
-+FIELD(ID_ISAR1, ENDIAN, 0, 4)
++    uint32_t iteh;
-+FIELD(ID_ISAR1, EXCEPT, 4, 4)
++    uint64_t itel;
-+FIELD(ID_ISAR1, EXCEPT_AR, 8, 4)
++} IteEntry;
-+FIELD(ID_ISAR1, EXTEND, 12, 4)
++
-+FIELD(ID_ISAR1, IFTHEN, 16, 4)
+ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
-+FIELD(ID_ISAR1, IMMEDIATE, 20, 4)
+ {
-+FIELD(ID_ISAR1, INTERWORK, 24, 4)
+     uint64_t result = 0;
-+FIELD(ID_ISAR1, JAZELLE, 28, 4)
+@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
-+
+     return result;
-+FIELD(ID_ISAR2, LOADSTORE, 0, 4)
+ }
-+FIELD(ID_ISAR2, MEMHINT, 4, 4)
-+FIELD(ID_ISAR2, MULTIACCESSINT, 8, 4)
++static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
-+FIELD(ID_ISAR2, MULT, 12, 4)
++                    MemTxResult *res)
-+FIELD(ID_ISAR2, MULTS, 16, 4)
++{
-+FIELD(ID_ISAR2, MULTU, 20, 4)
++    AddressSpace *as = &s->gicv3->dma_as;
-+FIELD(ID_ISAR2, PSR_AR, 24, 4)
++    uint64_t l2t_addr;
-+FIELD(ID_ISAR2, REVERSAL, 28, 4)
++    uint64_t value;
-+
++    bool valid_l2t;
-+FIELD(ID_ISAR3, SATURATE, 0, 4)
++    uint32_t l2t_id;
-+FIELD(ID_ISAR3, SIMD, 4, 4)
++    uint32_t max_l2_entries;
-+FIELD(ID_ISAR3, SVC, 8, 4)
++
-+FIELD(ID_ISAR3, SYNCHPRIM, 12, 4)
++    if (s->ct.indirect) {
-+FIELD(ID_ISAR3, TABBRANCH, 16, 4)
++        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
-+FIELD(ID_ISAR3, T32COPY, 20, 4)
++
-+FIELD(ID_ISAR3, TRUENOP, 24, 4)
++        value = address_space_ldq_le(as,
-+FIELD(ID_ISAR3, T32EE, 28, 4)
++                                     s->ct.base_addr +
-+
++                                     (l2t_id * L1TABLE_ENTRY_SIZE),
-+FIELD(ID_ISAR4, UNPRIV, 0, 4)
++                                     MEMTXATTRS_UNSPECIFIED, res);
-+FIELD(ID_ISAR4, WITHSHIFTS, 4, 4)
++
-+FIELD(ID_ISAR4, WRITEBACK, 8, 4)
++        if (*res == MEMTX_OK) {
-+FIELD(ID_ISAR4, SMC, 12, 4)
++            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
-+FIELD(ID_ISAR4, BARRIER, 16, 4)
++
-+FIELD(ID_ISAR4, SYNCHPRIM_FRAC, 20, 4)
++            if (valid_l2t) {
-+FIELD(ID_ISAR4, PSR_M, 24, 4)
++                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
-+FIELD(ID_ISAR4, SWP_FRAC, 28, 4)
++
-+
++                l2t_addr = value & ((1ULL << 51) - 1);
-+FIELD(ID_ISAR5, SEVL, 0, 4)
++
-+FIELD(ID_ISAR5, AES, 4, 4)
++                *cte =  address_space_ldq_le(as, l2t_addr +
-+FIELD(ID_ISAR5, SHA1, 8, 4)
++                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
-+FIELD(ID_ISAR5, SHA2, 12, 4)
++                                    MEMTXATTRS_UNSPECIFIED, res);
-+FIELD(ID_ISAR5, CRC32, 16, 4)
++           }
-+FIELD(ID_ISAR5, RDM, 24, 4)
++       }
-+FIELD(ID_ISAR5, VCMA, 28, 4)
++    } else {
-+
++        /* Flat level table */
-+FIELD(ID_ISAR6, JSCVT, 0, 4)
++        *cte =  address_space_ldq_le(as, s->ct.base_addr +
-+FIELD(ID_ISAR6, DP, 4, 4)
++                                     (icid * GITS_CTE_SIZE),
-+FIELD(ID_ISAR6, FHM, 8, 4)
++                                      MEMTXATTRS_UNSPECIFIED, res);
-+FIELD(ID_ISAR6, SB, 12, 4)
++    }
-+FIELD(ID_ISAR6, SPECRES, 16, 4)
++
-+
++    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
-+FIELD(ID_AA64ISAR0, AES, 4, 4)
++}
-+FIELD(ID_AA64ISAR0, SHA1, 8, 4)
++
-+FIELD(ID_AA64ISAR0, SHA2, 12, 4)
++static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
-+FIELD(ID_AA64ISAR0, CRC32, 16, 4)
++                       IteEntry ite)
-+FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)
++{
-+FIELD(ID_AA64ISAR0, RDM, 28, 4)
++    AddressSpace *as = &s->gicv3->dma_as;
-+FIELD(ID_AA64ISAR0, SHA3, 32, 4)
++    uint64_t itt_addr;
-+FIELD(ID_AA64ISAR0, SM3, 36, 4)
++    MemTxResult res = MEMTX_OK;
-+FIELD(ID_AA64ISAR0, SM4, 40, 4)
++
-+FIELD(ID_AA64ISAR0, DP, 44, 4)
++    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
-+FIELD(ID_AA64ISAR0, FHM, 48, 4)
++    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
-+FIELD(ID_AA64ISAR0, TS, 52, 4)
++
-+FIELD(ID_AA64ISAR0, TLB, 56, 4)
++    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
-+FIELD(ID_AA64ISAR0, RNDR, 60, 4)
++                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
-+
++                         &res);
-+FIELD(ID_AA64ISAR1, DPB, 0, 4)
++
-+FIELD(ID_AA64ISAR1, APA, 4, 4)
++    if (res == MEMTX_OK) {
-+FIELD(ID_AA64ISAR1, API, 8, 4)
++        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
-+FIELD(ID_AA64ISAR1, JSCVT, 12, 4)
++                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
-+FIELD(ID_AA64ISAR1, FCMA, 16, 4)
++                             MEMTXATTRS_UNSPECIFIED, &res);
-+FIELD(ID_AA64ISAR1, LRCPC, 20, 4)
++    }
-+FIELD(ID_AA64ISAR1, GPA, 24, 4)
++    if (res != MEMTX_OK) {
-+FIELD(ID_AA64ISAR1, GPI, 28, 4)
++        return false;
-+FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
++    } else {
-+FIELD(ID_AA64ISAR1, SB, 36, 4)
++        return true;
-+FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
++    }
-+
++}
- QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
++
++static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
- /* If adding a feature bit which corresponds to a Linux ELF
++                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t itt_addr;
 +    bool status = false;
 +    IteEntry ite = {};
 +
 +    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
 +    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
 +
 +    ite.itel = address_space_ldq_le(as, itt_addr +
 +                                    (eventid * (sizeof(uint64_t) +
 +                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
 +                                    res);
 +
 +    if (*res == MEMTX_OK) {
 +        ite.iteh = address_space_ldl_le(as, itt_addr +
 +                                        (eventid * (sizeof(uint64_t) +
 +                                        sizeof(uint32_t))) + sizeof(uint32_t),
 +                                        MEMTXATTRS_UNSPECIFIED, res);
 +
 +        if (*res == MEMTX_OK) {
 +            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
 +                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
 +                    GITS_TYPE_PHYSICAL) {
 +                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
 +                               ITE_ENTRY_INTID_SHIFT;
 +                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
 +                    status = true;
 +                }
 +            }
 +        }
 +    }
 +    return status;
 +}
 +
 +static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t l2t_addr;
 +    uint64_t value;
 +    bool valid_l2t;
 +    uint32_t l2t_id;
 +    uint32_t max_l2_entries;
 +
 +    if (s->dt.indirect) {
 +        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->dt.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, res);
 +
 +        if (*res == MEMTX_OK) {
 +            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +            if (valid_l2t) {
 +                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
 +
 +                l2t_addr = value & ((1ULL << 51) - 1);
 +
 +                value =  address_space_ldq_le(as, l2t_addr +
 +                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
 +                                   MEMTXATTRS_UNSPECIFIED, res);
 +            }
 +        }
 +    } else {
 +        /* Flat level table */
 +        value = address_space_ldq_le(as, s->dt.base_addr +
 +                                     (devid * GITS_DTE_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, res);
 +    }
 +
 +    return value;
 +}
 +
 +/*
 + * This function handles the processing of following commands based on
 + * the ItsCmdType parameter passed:-
 + * 1. triggering of lpi interrupt translation via ITS INT command
 + * 2. triggering of lpi interrupt translation via gits_translater register
 + * 3. handling of ITS CLEAR command
 + * 4. handling of ITS DISCARD command
 + */
 +static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
 +                            ItsCmdType cmd)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint32_t devid, eventid;
 +    MemTxResult res = MEMTX_OK;
 +    bool dte_valid;
 +    uint64_t dte = 0;
 +    uint32_t max_eventid;
 +    uint16_t icid = 0;
 +    uint32_t pIntid = 0;
 +    bool ite_valid = false;
 +    uint64_t cte = 0;
 +    bool cte_valid = false;
 +    bool result = false;
 +
 +    if (cmd == NONE) {
 +        devid = offset;
 +    } else {
 +        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
 +
 +        offset += NUM_BYTES_IN_DW;
 +        value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    eventid = (value & EVENTID_MASK);
 +
 +    dte = get_dte(s, devid, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
 +
 +    if (dte_valid) {
 +        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
 +
 +        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return result;
 +        }
 +
 +        if (ite_valid) {
 +            cte_valid = get_cte(s, icid, &cte, &res);
 +        }
 +
 +        if (res != MEMTX_OK) {
 +            return result;
 +        }
 +    }
 +
 +    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
 +            !cte_valid || (eventid > max_eventid)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes "
 +                      "devid %d or eventid %d or invalid dte %d or"
 +                      "invalid cte %d or invalid ite %d\n",
 +                      __func__, devid, eventid, dte_valid, cte_valid,
 +                      ite_valid);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        /*
 +         * Current implementation only supports rdbase == procnum
 +         * Hence rdbase physical address is ignored
 +         */
 +        if (cmd == DISCARD) {
 +            IteEntry ite = {};
 +            /* remove mapping from interrupt translation table */
 +            result = update_ite(s, eventid, dte, ite);
 +        }
 +    }
 +
 +    return result;
 +}
 +
 +static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
 +                          bool ignore_pInt)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint32_t devid, eventid;
 +    uint32_t pIntid = 0;
 +    uint32_t max_eventid, max_Intid;
 +    bool dte_valid;
 +    MemTxResult res = MEMTX_OK;
 +    uint16_t icid = 0;
 +    uint64_t dte = 0;
 +    IteEntry ite;
 +    uint32_t int_spurious = INTID_SPURIOUS;
 +    bool result = false;
 +
 +    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    eventid = (value & EVENTID_MASK);
 +
 +    if (!ignore_pInt) {
 +        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
 +    }
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    icid = value & ICID_MASK;
 +
 +    dte = get_dte(s, devid, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
 +
 +    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
 +
 +    if (!ignore_pInt) {
 +        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
 +    }
 +
 +    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
 +            || !dte_valid || (eventid > max_eventid) ||
 +            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
 +            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes "
 +                      "devid %d or icid %d or eventid %d or pIntid %d or"
 +                      "unmapped dte %d\n", __func__, devid, icid, eventid,
 +                      pIntid, dte_valid);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        /* add ite entry to interrupt translation table */
 +        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
 +                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
 +
 +        if (ignore_pInt) {
 +            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
 +        } else {
 +            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
 +        }
 +        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
 +        ite.iteh = icid;
 +
 +        result = update_ite(s, eventid, dte, ite);
 +    }
 +
 +    return result;
 +}
 +
  static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
                         uint64_t rdbase)
  {
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
          switch (cmd) {
          case GITS_CMD_INT:
 +            res = process_its_cmd(s, data, cq_offset, INT);
              break;
          case GITS_CMD_CLEAR:
 +            res = process_its_cmd(s, data, cq_offset, CLEAR);
              break;
          case GITS_CMD_SYNC:
              /*
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
              result = process_mapc(s, cq_offset);
              break;
          case GITS_CMD_MAPTI:
 +            result = process_mapti(s, data, cq_offset, false);
              break;
          case GITS_CMD_MAPI:
 +            result = process_mapti(s, data, cq_offset, true);
              break;
          case GITS_CMD_DISCARD:
 +            result = process_its_cmd(s, data, cq_offset, DISCARD);
              break;
          case GITS_CMD_INV:
          case GITS_CMD_INVALL:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                 uint64_t data, unsigned size,
                                                 MemTxAttrs attrs)
  {
 -    return MEMTX_OK;
 +    GICv3ITSState *s = (GICv3ITSState *)opaque;
 +    bool result = true;
 +    uint32_t devid = 0;
 +
 +    switch (offset) {
 +    case GITS_TRANSLATER:
 +        if (s->ctlr & ITS_CTLR_ENABLED) {
 +            devid = attrs.requester_id;
 +            result = process_its_cmd(s, data, devid, NONE);
 +        }
 +        break;
 +    default:
 +        break;
 +    }
 +
 +    if (result) {
 +        return MEMTX_OK;
 +    } else {
 +        return MEMTX_ERROR;
 +    }
  }
  static bool its_writel(GICv3ITSState *s, hwaddr offset,
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 11/19] net: cadence_gem: Add support for selecting the DMA MemoryRegion
+[PULL 13/23] hw/intc: GICv3 ITS Feature enablement
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Add support for selecting the Memory Region that the GEM
+Added properties to enable ITS feature and define qemu system
-will do DMA to.
+address space memory in gicv3 common,setup distributor and
 redistributor registers to indicate LPI support.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20181011021931.4249-7-edgar.iglesias@gmail.com
+Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/net/cadence_gem.h |  2 ++
+ hw/intc/gicv3_internal.h           |  2 ++
- hw/net/cadence_gem.c         | 59 ++++++++++++++++++++++--------------
+ include/hw/intc/arm_gicv3_common.h |  1 +
-files changed, 39 insertions(+), 22 deletions(-)
+ hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
  hw/intc/arm_gicv3_dist.c           |  5 ++++-
  hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
 files changed, 28 insertions(+), 4 deletions(-)
-diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/cadence_gem.h
+--- a/hw/intc/gicv3_internal.h
-+++ b/include/hw/net/cadence_gem.h
++++ b/hw/intc/gicv3_internal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+@@ -XXX,XX +XXX,XX @@
+ #define GICD_CTLR_E1NWF             (1U << 7)
-     /*< public >*/
+ #define GICD_CTLR_RWP               (1U << 31)
-     MemoryRegion iomem;
-+    MemoryRegion *dma_mr;
++#define GICD_TYPER_LPIS_SHIFT          17
-+    AddressSpace dma_as;
++
-     NICState *nic;
+ /* 16 bits EventId */
-     NICConf conf;
+ #define GICD_TYPER_IDBITS            0xf
-     qemu_irq irq[MAX_PRIORITY_QUEUES];
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/include/hw/intc/arm_gicv3_common.h
-+++ b/hw/net/cadence_gem.c
++++ b/include/hw/intc/arm_gicv3_common.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct GICv3State {
- #include "hw/net/cadence_gem.h"
+     uint32_t num_cpu;
- #include "qapi/error.h"
+     uint32_t num_irq;
- #include "qemu/log.h"
+     uint32_t revision;
-+#include "sysemu/dma.h"
++    bool lpi_enable;
- #include "net/checksum.h"
+     bool security_extn;
+     bool irq_reset_nonsecure;
- #ifdef CADENCE_GEM_ERR_DEBUG
+     bool gicd_no_migration_shift_bug;
-@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
+diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
- {
+index XXXXXXX..XXXXXXX 100644
-     DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
+--- a/hw/intc/arm_gicv3_common.c
-     /* read current descriptor */
++++ b/hw/intc/arm_gicv3_common.c
--    cpu_physical_memory_read(s->rx_desc_addr[q],
+@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
--                             (uint8_t *)s->rx_desc[q],
+         return;
--                             sizeof(uint32_t) * gem_get_desc_len(s, true));
+     }
-+    address_space_read(&s->dma_as, s->rx_desc_addr[q], MEMTXATTRS_UNSPECIFIED,
-+                       (uint8_t *)s->rx_desc[q],
++    if (s->lpi_enable && !s->dma) {
-+                       sizeof(uint32_t) * gem_get_desc_len(s, true));
++        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
++        return;
-     /* Descriptor owned by software ? */
++    }
      if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
                  rx_desc_get_buffer(s->rx_desc[q]));
          /* Copy packet data to emulated DMA buffer */
 -        cpu_physical_memory_write(rx_desc_get_buffer(s, s->rx_desc[q]) +
 +        address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
                                                                    rxbuf_offset,
 -                                  rxbuf_ptr,
 -                                  MIN(bytes_to_copy, rxbufsize));
 +                            MEMTXATTRS_UNSPECIFIED, rxbuf_ptr,
 +                            MIN(bytes_to_copy, rxbufsize));
          rxbuf_ptr += MIN(bytes_to_copy, rxbufsize);
          bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
          }
          /* Descriptor write-back.  */
 -        cpu_physical_memory_write(s->rx_desc_addr[q],
 -                                  (uint8_t *)s->rx_desc[q],
 -                                  sizeof(uint32_t) * gem_get_desc_len(s, true));
 +        address_space_write(&s->dma_as, s->rx_desc_addr[q],
 +                            MEMTXATTRS_UNSPECIFIED,
 +                            (uint8_t *)s->rx_desc[q],
 +                            sizeof(uint32_t) * gem_get_desc_len(s, true));
          /* Next descriptor */
          if (rx_desc_get_wrap(s->rx_desc[q])) {
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
          packet_desc_addr = s->tx_desc_addr[q];
          DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
 -        cpu_physical_memory_read(packet_desc_addr,
 -                                 (uint8_t *)desc,
 -                                 sizeof(uint32_t) * gem_get_desc_len(s, false));
 +        address_space_read(&s->dma_as, packet_desc_addr,
 +                           MEMTXATTRS_UNSPECIFIED, (uint8_t *)desc,
 +                           sizeof(uint32_t) * gem_get_desc_len(s, false));
          /* Handle all descriptors owned by hardware */
          while (tx_desc_get_used(desc) == 0) {
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
              /* Gather this fragment of the packet from "dma memory" to our
               * contig buffer.
               */
 -            cpu_physical_memory_read(tx_desc_get_buffer(s, desc), p,
 -                                     tx_desc_get_length(desc));
 +            address_space_read(&s->dma_as, tx_desc_get_buffer(s, desc),
 +                               MEMTXATTRS_UNSPECIFIED,
 +                               p, tx_desc_get_length(desc));
              p += tx_desc_get_length(desc);
              total_bytes += tx_desc_get_length(desc);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                  /* Modify the 1st descriptor of this packet to be owned by
                   * the processor.
                   */
 -                cpu_physical_memory_read(s->tx_desc_addr[q],
 -                                         (uint8_t *)desc_first,
 -                                         sizeof(desc_first));
 +                address_space_read(&s->dma_as, s->tx_desc_addr[q],
 +                                   MEMTXATTRS_UNSPECIFIED,
 +                                   (uint8_t *)desc_first,
 +                                   sizeof(desc_first));
                  tx_desc_set_used(desc_first);
 -                cpu_physical_memory_write(s->tx_desc_addr[q],
 -                                          (uint8_t *)desc_first,
 -                                          sizeof(desc_first));
 +                address_space_write(&s->dma_as, s->tx_desc_addr[q],
 +                                  MEMTXATTRS_UNSPECIFIED,
 +                                  (uint8_t *)desc_first,
 +                                   sizeof(desc_first));
                  /* Advance the hardware current descriptor past this packet */
                  if (tx_desc_get_wrap(desc)) {
                      s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                  packet_desc_addr += 4 * gem_get_desc_len(s, false);
              }
              DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
 -            cpu_physical_memory_read(packet_desc_addr, (uint8_t *)desc,
 -                                sizeof(uint32_t) * gem_get_desc_len(s, false));
 +            address_space_read(&s->dma_as, packet_desc_addr,
 +                              MEMTXATTRS_UNSPECIFIED, (uint8_t *)desc,
 +                              sizeof(uint32_t) * gem_get_desc_len(s, false));
          }
          if (tx_desc_get_used(desc)) {
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
      CadenceGEMState *s = CADENCE_GEM(dev);
      int i;
 +    address_space_init(&s->dma_as,
 +                       s->dma_mr ? s->dma_mr : get_system_memory(), "dma");
 +
-     if (s->num_priority_queues == 0 ||
+     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
-         s->num_priority_queues > MAX_PRIORITY_QUEUES) {
-         error_setg(errp, "Invalid num-priority-queues value: %" PRIx8,
+     for (i = 0; i < s->num_cpu; i++) {
-@@ -XXX,XX +XXX,XX @@ static void gem_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
-                           "enet", sizeof(s->regs));
+             (1 << 24) |
+             (i << 8) |
-     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+             (last << 4);
 +
-+    object_property_add_link(obj, "dma", TYPE_MEMORY_REGION,
++        if (s->lpi_enable) {
-+                             (Object **)&s->dma_mr,
++            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
-+                             qdev_prop_allow_set_link_before_realize,
++        }
-+                             OBJ_PROP_LINK_STRONG,
+     }
 +                             &error_abort);
  }
- static const VMStateDescription vmstate_cadence_gem = {
+@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
      DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
      DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
      DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
 +    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
      DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
      DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
                        redist_region_count, qdev_prop_uint32, uint32_t),
 +    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_dist.c
 +++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
           * A3V == 1 (non-zero values of Affinity level 3 supported)
           * IDbits == 0xf (we support 16-bit interrupt identifiers)
           * DVIS == 0 (Direct virtual LPI injection not supported)
 -         * LPIS == 0 (LPIs not supported)
 +         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
 +         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
 +         *                      by GICD_TYPER.IDbits)
           * MBIS == 0 (message-based SPIs not supported)
           * SecurityExtn == 1 if security extns supported
           * CPUNumber == 0 since for us ARE is always 1
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
          bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
          *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
 +            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
              (0xf << 19) | itlinesnumber;
          return true;
      }
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
      case GICR_CTLR:
          /* For our implementation, GICR_TYPER.DPGS is 0 and so all
           * the DPG bits are RAZ/WI. We don't do anything asynchronously,
 -         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
 -         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
 -         * bits for us.
 +         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
 +         * implement LPIs) so Enable_LPIs is programmable.
           */
 +        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
 +            if (value & GICR_CTLR_ENABLE_LPIS) {
 +                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
 +            } else {
 +                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
 +            }
 +        }
          return MEMTX_OK;
      case GICR_STATUSR:
          /* RAZ/WI for our implementation */
 --
-.19.0
+.20.1

-New patch
+[PULL 14/23] hw/intc: GICv3 redistributor ITS processing
+From: Shashi Mallela <shashi.mallela@linaro.org>
 Implemented lpi processing at redistributor to get lpi config info
 from lpi configuration table,determine priority,set pending state in
 lpi pending table and forward the lpi to cpuif.Added logic to invoke
 redistributor lpi processing with translated LPI which set/clear LPI
 from ITS device as part of ITS INT,CLEAR,DISCARD command and
 GITS_TRANSLATER processing.
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/intc/gicv3_internal.h           |   9 ++
  include/hw/intc/arm_gicv3_common.h |   7 ++
  hw/intc/arm_gicv3.c                |  14 +++
  hw/intc/arm_gicv3_common.c         |   1 +
  hw/intc/arm_gicv3_cpuif.c          |   7 +-
  hw/intc/arm_gicv3_its.c            |  23 +++++
  hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
 files changed, 200 insertions(+), 2 deletions(-)
 diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/gicv3_internal.h
 +++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
  FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
  FIELD(GICR_PENDBASER, PTZ, 62, 1)
 +#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
 +
  #define ICC_CTLR_EL1_CBPR           (1U << 0)
  #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
  #define ICC_CTLR_EL1_PMHE           (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
  #define L1TABLE_ENTRY_SIZE         8
 +#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
 +#define LPI_PRIORITY_MASK         0xfc
 +
  #define GITS_CMDQ_ENTRY_SIZE               32
  #define NUM_BYTES_IN_DW                     8
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
   * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
   */
  #define GITS_CTE_SIZE                 (0x8ULL)
 +#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
  /* Special interrupt IDs */
  #define INTID_SECURE 1020
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                 unsigned size, MemTxAttrs attrs);
  void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
  void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_update_lpi(GICv3CPUState *cs);
  void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
  void gicv3_init_cpuif(GICv3State *s);
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_common.h
 +++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
       * real state above; it doesn't need to be migrated.
       */
      PendingIrq hppi;
 +
 +    /*
 +     * Cached information recalculated from LPI tables
 +     * in guest memory
 +     */
 +    PendingIrq hpplpi;
 +
      /* This is temporary working state, to avoid a malloc in gicv3_update() */
      bool seenbetter;
  };
 diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3.c
 +++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
          cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
      }
 +    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
 +        (cs->hpplpi.prio != 0xff)) {
 +        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
 +            cs->hppi.irq = cs->hpplpi.irq;
 +            cs->hppi.prio = cs->hpplpi.prio;
 +            cs->hppi.grp = cs->hpplpi.grp;
 +            seenbetter = true;
 +        }
 +    }
 +
      /* If the best interrupt we just found would preempt whatever
       * was the previous best interrupt before this update, then
       * we know it's definitely the best one now.
@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
  static void arm_gicv3_post_load(GICv3State *s)
  {
 +    int i;
      /* Recalculate our cached idea of the current highest priority
       * pending interrupt, but don't set IRQ or FIQ lines.
       */
 +    for (i = 0; i < s->num_cpu; i++) {
 +        gicv3_redist_update_lpi(&s->cpu[i]);
 +    }
      gicv3_full_update_noirqset(s);
      /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
      gicv3_cache_all_target_cpustates(s);
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
          memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
          cs->hppi.prio = 0xff;
 +        cs->hpplpi.prio = 0xff;
          /* State in the CPU interface must *not* be reset here, because it
           * is part of the CPU's reset domain, not the GIC device's.
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
          cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
          cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
          gicv3_redist_update(cs);
 -    } else {
 +    } else if (irq < GICV3_LPI_INTID_START) {
          gicv3_gicd_active_set(cs->gic, irq);
          gicv3_gicd_pending_clear(cs->gic, irq);
          gicv3_update(cs->gic, irq, 1);
 +    } else {
 +        gicv3_redist_lpi_pending(cs, irq, 0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
      trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
                                 gicv3_redist_affid(cs), value);
 -    if (irq >= cs->gic->num_irq) {
 +    if ((irq >= cs->gic->num_irq) &&
 +        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
          /* This handles two cases:
           * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
           * to the GICC_EOIR, the GIC ignores that write.
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
      uint64_t cte = 0;
      bool cte_valid = false;
      bool result = false;
 +    uint64_t rdbase;
      if (cmd == NONE) {
          devid = offset;
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
           * Current implementation only supports rdbase == procnum
           * Hence rdbase physical address is ignored
           */
 +        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
 +
 +        if (rdbase > s->gicv3->num_cpu) {
 +            return result;
 +        }
 +
 +        if ((cmd == CLEAR) || (cmd == DISCARD)) {
 +            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
 +        } else {
 +            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
 +        }
 +
          if (cmd == DISCARD) {
              IteEntry ite = {};
              /* remove mapping from interrupt translation table */
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
      MemTxResult res = MEMTX_OK;
      bool result = true;
      uint8_t cmd;
 +    int i;
      if (!(s->ctlr & ITS_CTLR_ENABLED)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
              break;
          case GITS_CMD_INV:
          case GITS_CMD_INVALL:
 +            /*
 +             * Current implementation doesn't cache any ITS tables,
 +             * but the calculated lpi priority information. We only
 +             * need to trigger lpi priority re-calculation to be in
 +             * sync with LPI config table or pending table changes.
 +             */
 +            for (i = 0; i < s->gicv3->num_cpu; i++) {
 +                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
 +            }
              break;
          default:
              break;
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
          if (cs->gicr_typer & GICR_TYPER_PLPIS) {
              if (value & GICR_CTLR_ENABLE_LPIS) {
                  cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
 +                /* Check for any pending interr in pending table */
 +                gicv3_redist_update_lpi(cs);
 +                gicv3_redist_update(cs);
              } else {
                  cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
              }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
      return r;
  }
 +static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
 +{
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpict_baddr;
 +    uint8_t lpite;
 +    uint8_t prio;
 +
 +    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
 +
 +    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
 +                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
 +                       sizeof(lpite));
 +
 +    if (!(lpite & LPI_CTE_ENABLED)) {
 +        return;
 +    }
 +
 +    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
 +        prio = lpite & LPI_PRIORITY_MASK;
 +    } else {
 +        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
 +    }
 +
 +    if ((prio < cs->hpplpi.prio) ||
 +        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
 +        cs->hpplpi.irq = irq;
 +        cs->hpplpi.prio = prio;
 +        /* LPIs are always non-secure Grp1 interrupts */
 +        cs->hpplpi.grp = GICV3_G1NS;
 +    }
 +}
 +
 +void gicv3_redist_update_lpi(GICv3CPUState *cs)
 +{
 +    /*
 +     * This function scans the LPI pending table and for each pending
 +     * LPI, reads the corresponding entry from LPI configuration table
 +     * to extract the priority info and determine if the current LPI
 +     * priority is lower than the last computed high priority lpi interrupt.
 +     * If yes, replace current LPI as the new high priority lpi interrupt.
 +     */
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpipt_baddr;
 +    uint32_t pendt_size = 0;
 +    uint8_t pend;
 +    int i, bit;
 +    uint64_t idbits;
 +
 +    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 GICD_TYPER_IDBITS);
 +
 +    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
 +        !cs->gicr_pendbaser) {
 +        return;
 +    }
 +
 +    cs->hpplpi.prio = 0xff;
 +
 +    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +
 +    /* Determine the highest priority pending interrupt among LPIs */
 +    pendt_size = (1ULL << (idbits + 1));
 +
 +    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
 +        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
 +                           sizeof(pend));
 +
 +        while (pend) {
 +            bit = ctz32(pend);
 +            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
 +            pend &= ~(1 << bit);
 +        }
 +    }
 +}
 +
 +void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
 +{
 +    /*
 +     * This function updates the pending bit in lpi pending table for
 +     * the irq being activated or deactivated.
 +     */
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpipt_baddr;
 +    bool ispend = false;
 +    uint8_t pend;
 +
 +    /*
 +     * get the bit value corresponding to this irq in the
 +     * lpi pending table
 +     */
 +    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +
 +    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
 +                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
 +
 +    ispend = extract32(pend, irq % 8, 1);
 +
 +    /* no change in the value of pending bit, return */
 +    if (ispend == level) {
 +        return;
 +    }
 +    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
 +
 +    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
 +                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
 +
 +    /*
 +     * check if this LPI is better than the current hpplpi, if yes
 +     * just set hpplpi.prio and .irq without doing a full rescan
 +     */
 +    if (level) {
 +        gicv3_redist_check_lpi_priority(cs, irq);
 +    } else {
 +        if (irq == cs->hpplpi.irq) {
 +            gicv3_redist_update_lpi(cs);
 +        }
 +    }
 +}
 +
 +void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
 +{
 +    uint64_t idbits;
 +
 +    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 GICD_TYPER_IDBITS);
 +
 +    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
 +         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
 +         irq < GICV3_LPI_INTID_START) {
 +        return;
 +    }
 +
 +    /* set/clear the pending bit for this irq */
 +    gicv3_redist_lpi_pending(cs, irq, level);
 +
 +    gicv3_redist_update(cs);
 +}
 +
  void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
  {
      /* Update redistributor state for a change in an external PPI input line */
 --
 .20.1

-[Qemu-devel] [PULL 06/19] net: cadence_gem: Disable TSU feature bit
+[PULL 15/23] tests/data/acpi/virt: Add IORT files for ITS
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Disable the Timestamping Unit feature bit since QEMU does not
+Added expected IORT files applicable with latest GICv3
-yet support it. This allows guest SW to correctly probe for
+ITS changes.Temporarily differences in these files are
-its existance.
+okay.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Acked-by: Igor Mammedov <imammedo@redhat.com>
-Message-id: 20181011021931.4249-2-edgar.iglesias@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/cadence_gem.c | 2 +-
+ tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
-file changed, 1 insertion(+), 1 deletion(-)
+ tests/data/acpi/virt/IORT                   | 0
  tests/data/acpi/virt/IORT.memhp             | 0
  tests/data/acpi/virt/IORT.numamem           | 0
  tests/data/acpi/virt/IORT.pxb               | 0
 files changed, 4 insertions(+)
  create mode 100644 tests/data/acpi/virt/IORT
  create mode 100644 tests/data/acpi/virt/IORT.memhp
  create mode 100644 tests/data/acpi/virt/IORT.numamem
  create mode 100644 tests/data/acpi/virt/IORT.pxb
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/hw/net/cadence_gem.c
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+@@ -1 +1,5 @@
-     s->regs[GEM_MODID] = s->revision;
+ /* List of comma-separated changed AML files to ignore */
-     s->regs[GEM_DESCONF] = 0x02500111;
++"tests/data/acpi/virt/IORT",
-     s->regs[GEM_DESCONF2] = 0x2ab13fff;
++"tests/data/acpi/virt/IORT.memhp",
--    s->regs[GEM_DESCONF5] = 0x002f2145;
++"tests/data/acpi/virt/IORT.numamem",
-+    s->regs[GEM_DESCONF5] = 0x002f2045;
++"tests/data/acpi/virt/IORT.pxb",
-     s->regs[GEM_DESCONF6] = 0x00000200;
+diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
+new file mode 100644
-     /* Set MAC address */
+index XXXXXXX..XXXXXXX
 diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
 new file mode 100644
 index XXXXXXX..XXXXXXX
 diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
 new file mode 100644
 index XXXXXXX..XXXXXXX
 diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 01/19] hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
+[PULL 16/23] hw/arm/virt: add ITS support in virt GIC
-From: Jerome Forissier <jerome.forissier@linaro.org>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Bindings for /secure-chosen and /secure-chosen/stdout-path have been
+Included creation of ITS as part of virt platform GIC
-proposed 1.5 years ago [1] and implemented in OP-TEE at the same time [2].
+initialization. This Emulated ITS model now co-exists with kvm
-They've now been officially agreed on, so we can implement them
+ITS and is enabled in absence of kvm irq kernel support in a
-in QEMU.
+platform.
-This patch creates the property when the machine is secure.
+Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 [1] https://patchwork.kernel.org/patch/9602401/
 [2] https://github.com/OP-TEE/optee_os/commit/4dc31c52544a
 Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
 Message-id: 20181005080729.6480-1-jerome.forissier@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: commit message tweak]
+Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 4 ++++
+ include/hw/arm/virt.h |  2 ++
-file changed, 4 insertions(+)
+ target/arm/kvm_arm.h  |  4 ++--
  hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 files changed, 31 insertions(+), 4 deletions(-)
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+     MachineClass parent;
+     bool disallow_affinity_adjustment;
+     bool no_its;
++    bool no_tcg_its;
+     bool no_pmu;
+     bool claim_edge_triggered_timers;
+     bool smbios_old_sys_ver;
+@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
+     bool highmem;
+     bool highmem_ecam;
+     bool its;
++    bool tcg_its;
+     bool virt;
+     bool ras;
+     bool mte;
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm_arm.h
++++ b/target/arm/kvm_arm.h
+@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
+         /* KVM implementation requires this capability */
+         return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
+     } else {
+-        /* Software emulation is not implemented yet */
+-        return NULL;
++        /* Software emulation based model */
++        return "arm-gicv3-its";
+     }
+ }
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, qemu_irq *pic, int uart,
+@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
-         /* Mark as not usable by the normal world */
+     const char *itsclass = its_class_name();
-         qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
+     DeviceState *dev;
-         qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
 +    if (!strcmp(itsclass, "arm-gicv3-its")) {
 +        if (!vms->tcg_its) {
 +            itsclass = NULL;
 +        }
 +    }
 +
-+        qemu_fdt_add_subnode(vms->fdt, "/secure-chosen");
+     if (!itsclass) {
-+        qemu_fdt_setprop_string(vms->fdt, "/secure-chosen", "stdout-path",
+         /* Do nothing if not supported */
-+                                nodename);
+         return;
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
      vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
  }
 -static void create_gic(VirtMachineState *vms)
 +static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
  {
      MachineState *ms = MACHINE(vms);
      /* We create a standalone GIC */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
                               nb_redist_regions);
          qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
 +        if (!kvm_irqchip_in_kernel()) {
 +            if (vms->tcg_its) {
 +                object_property_set_link(OBJECT(vms->gic), "sysmem",
 +                                         OBJECT(mem), &error_fatal);
 +                qdev_prop_set_bit(vms->gic, "has-lpi", true);
 +            }
 +        }
 +
          if (nb_redist_regions == 2) {
              uint32_t redist1_capacity =
                      vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 -    create_gic(vms);
 +    create_gic(vms, sysmem);
      virt_cpu_post_init(vms, sysmem);
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
      } else {
          /* Default allows ITS instantiation */
          vms->its = true;
 +
 +        if (vmc->no_tcg_its) {
 +            vms->tcg_its = false;
 +        } else {
 +            vms->tcg_its = true;
 +        }
      }
-     g_free(nodename);
+     /* Default disallows iommu instantiation */
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
  static void virt_machine_6_1_options(MachineClass *mc)
  {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
      virt_machine_6_2_options(mc);
      compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
 +
 +    /* qemu ITS was introduced with 6.2 */
 +    vmc->no_tcg_its = true;
  }
  DEFINE_VIRT_MACHINE(6, 1)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 05/19] target/arm: Fix cortex-a7 id_isar0
+[PULL 17/23] tests/data/acpi/virt: Update IORT files for ITS
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-The incorrect value advertised only thumb2 div without arm div.
+Updated expected IORT files applicable with latest GICv3
 ITS changes.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Full diff of new file disassembly:
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181008212205.17752-6-richard.henderson@linaro.org
+/*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20180629 (64-bit version)
  * Copyright (c) 2000 - 2018 Intel Corporation
  *
  * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
  *
  * ACPI Data Table [IORT]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
  */
 [000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
 [004h 0004   4]                 Table Length : 0000007C
 [008h 0008   1]                     Revision : 00
 [009h 0009   1]                     Checksum : 07
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001
 [024h 0036   4]                   Node Count : 00000002
 [028h 0040   4]                  Node Offset : 00000030
 [02Ch 0044   4]                     Reserved : 00000000
 [030h 0048   1]                         Type : 00
 [031h 0049   2]                       Length : 0018
 [033h 0051   1]                     Revision : 00
 [034h 0052   4]                     Reserved : 00000000
 [038h 0056   4]                Mapping Count : 00000000
 [03Ch 0060   4]               Mapping Offset : 00000000
 [040h 0064   4]                     ItsCount : 00000001
 [044h 0068   4]                  Identifiers : 00000000
 [048h 0072   1]                         Type : 02
 [049h 0073   2]                       Length : 0034
 [04Bh 0075   1]                     Revision : 00
 [04Ch 0076   4]                     Reserved : 00000000
 [050h 0080   4]                Mapping Count : 00000001
 [054h 0084   4]               Mapping Offset : 00000020
 [058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
 [058h 0088   4]              Cache Coherency : 00000001
 [05Ch 0092   1]        Hints (decoded below) : 00
                                    Transient : 0
                               Write Allocate : 0
                                Read Allocate : 0
                                     Override : 0
 [05Dh 0093   2]                     Reserved : 0000
 [05Fh 0095   1] Memory Flags (decoded below) : 03
                                    Coherency : 1
                             Device Attribute : 1
 [060h 0096   4]                ATS Attribute : 00000000
 [064h 0100   4]           PCI Segment Number : 00000000
 [068h 0104   1]            Memory Size Limit : 00
 [069h 0105   3]                     Reserved : 000000
 [068h 0104   4]                   Input base : 00000000
 [06Ch 0108   4]                     ID Count : 0000FFFF
 [070h 0112   4]                  Output Base : 00000000
 [074h 0116   4]             Output Reference : 00000030
 [078h 0120   4]        Flags (decoded below) : 00000000
                               Single Mapping : 0
 Raw Table Data: Length 124 (0x7C)
 : 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
 : 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
 : 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
 : 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
 : 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
 : 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
 : 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
 : 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Acked-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c | 5 ++++-
+ tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
-file changed, 4 insertions(+), 1 deletion(-)
+ tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
  tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
  tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
  tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
 files changed, 4 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/target/arm/cpu.c
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
+@@ -1,5 +1 @@
-     cpu->id_mmfr1 = 0x40000000;
+ /* List of comma-separated changed AML files to ignore */
-     cpu->id_mmfr2 = 0x01240000;
+-"tests/data/acpi/virt/IORT",
-     cpu->id_mmfr3 = 0x02102211;
+-"tests/data/acpi/virt/IORT.memhp",
--    cpu->id_isar0 = 0x01101110;
+-"tests/data/acpi/virt/IORT.numamem",
-+    /* a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but
+-"tests/data/acpi/virt/IORT.pxb",
-+     * table 4-41 gives 0x02101110, which includes the arm div insns.
+diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
-+     */
+index XXXXXXX..XXXXXXX 100644
-+    cpu->id_isar0 = 0x02101110;
+GIT binary patch
-     cpu->id_isar1 = 0x13112111;
+literal 124
-     cpu->id_isar2 = 0x21232041;
+zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
-     cpu->id_isar3 = 0x11112131;
+QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 02/19] target/arm: Fix aarch64_sve_change_el wrt EL0
+[PULL 18/23] target/arm: Take an exception if PSTATE.IL is set
-From: Richard Henderson <richard.henderson@linaro.org>
+In v8A, the PSTATE.IL bit is set for various kinds of illegal
 exception return or mode-change attempts.  We already set PSTATE.IL
 (or its AArch32 equivalent CPSR.IL) in all those cases, but we
 weren't implementing the part of the behaviour where attempting to
 execute an instruction with PSTATE.IL takes an immediate exception
 with an appropriate syndrome value.
-At present we assert:
+Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
 to take an exception instead of whatever the instruction would have
 been.
-  arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.
+PSTATE.IL and CPSR.IL change only on exception entry, attempted
 exception exit, and various AArch32 mode changes via cpsr_write().
 These places generally already rebuild the hflags, so the only place
 we need an extra rebuild_hflags call is in the illegal-return
 codepath of the AArch64 exception_return helper.
-The comment in arm_el_is_aa64 explains why asking about EL0 without
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 extra information is impossible.  Add an extra argument to provide
 it from the surrounding context.
 Fixes: 0ab5953b00b3
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181008212205.17752-2-richard.henderson@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 [rth: Added missing returns; set IL bit in syndrome]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/cpu.h       |  7 +++++--
+ target/arm/cpu.h           |  1 +
- target/arm/helper.c    | 16 ++++++++++++----
+ target/arm/syndrome.h      |  5 +++++
- target/arm/op_helper.c |  6 +++++-
+ target/arm/translate.h     |  2 ++
-files changed, 22 insertions(+), 7 deletions(-)
+ target/arm/helper-a64.c    |  1 +
  target/arm/helper.c        |  8 ++++++++
  target/arm/translate-a64.c | 11 +++++++++++
  target/arm/translate.c     | 21 +++++++++++++++++++++
 files changed, 49 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
- int aarch64_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
+ FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
- int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+ /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
- void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
+ FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
--void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el);
++FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
-+void aarch64_sve_change_el(CPUARMState *env, int old_el,
-+                           int new_el, bool el0_a64);
+ /*
- #else
+  * Bit usage when in AArch32 state, both A- and M-profile.
- static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
+diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
--static inline void aarch64_sve_change_el(CPUARMState *env, int o, int n) { }
+index XXXXXXX..XXXXXXX 100644
-+static inline void aarch64_sve_change_el(CPUARMState *env, int o,
+--- a/target/arm/syndrome.h
-+                                         int n, bool a)
++++ b/target/arm/syndrome.h
-+{ }
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
- #endif
+            (cv << 24) | (cond << 20) | ti;
+ }
- target_ulong do_arm_semihosting(CPUARMState *env);
 +static inline uint32_t syn_illegalstate(void)
 +{
 +    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
 +}
 +
  #endif /* TARGET_ARM_SYNDROME_H */
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool hstr_active;
      /* True if memory operations require alignment */
      bool align_mem;
 +    /* True if PSTATE.IL is set */
 +    bool pstate_il;
      /*
       * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
       *  < 0, set by the current instruction.
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ illegal_return:
      if (!arm_singlestep_active(env)) {
          env->pstate &= ~PSTATE_SS;
      }
 +    helper_rebuild_hflags_a64(env, cur_el);
      qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                    "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
  }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
-     unsigned int new_mode = aarch64_pstate_mode(new_el, true);
+         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
-     unsigned int cur_el = arm_current_el(env);
+     }
--    aarch64_sve_change_el(env, cur_el, new_el);
++    if (env->uncached_cpsr & CPSR_IL) {
-+    /*
++        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
-+     * Note that new_el can never be 0.  If cur_el is 0, then
++    }
-+     * el0_a64 is is_a64(), else el0_a64 is ignored.
++
-+     */
+     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
-+    aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+ }
-     if (cur_el < new_el) {
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
-         /* Entry vector offset depends on whether the implemented EL
+         }
-@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
+     }
- /*
-  * Notice a change in SVE vector size when changing EL.
++    if (env->pstate & PSTATE_IL) {
-  */
++        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
--void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el)
++    }
-+void aarch64_sve_change_el(CPUARMState *env, int old_el,
++
-+                           int new_el, bool el0_a64)
+     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
- {
+         /*
-     int old_len, new_len;
+          * Set MTE_ACTIVE if any access may be Checked, and leave clear
-+    bool old_a64, new_a64;
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
      /* Nothing to do if no SVE.  */
      if (!arm_feature(env, ARM_FEATURE_SVE)) {
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el)
       * we already have the correct register contents when encountering the
       * vq0->vq0 transition between EL0->EL1.
       */
 -    old_len = (arm_el_is_aa64(env, old_el) && !sve_exception_el(env, old_el)
 +    old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
 +    old_len = (old_a64 && !sve_exception_el(env, old_el)
                 ? sve_zcr_len_for_el(env, old_el) : 0);
 -    new_len = (arm_el_is_aa64(env, new_el) && !sve_exception_el(env, new_el)
 +    new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
 +    new_len = (new_a64 && !sve_exception_el(env, new_el)
                 ? sve_zcr_len_for_el(env, new_el) : 0);
      /* When changing vector length, clear inaccessible state.  */
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/op_helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-                       "AArch64 EL%d PC 0x%" PRIx64 "\n",
+     s->fp_access_checked = false;
-                       cur_el, new_el, env->pc);
+     s->sve_access_checked = false;
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
      if (dc_isar_feature(aa64_bti, s)) {
          if (s->base.num_insns == 1) {
              /*
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
  #endif
      dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
      dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
 +    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
      dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
      dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
      dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          return;
      }
--    aarch64_sve_change_el(env, cur_el, new_el);
-+    /*
++    if (s->pstate_il) {
-+     * Note that cur_el can never be 0.  If new_el is 0, then
++        /*
-+     * el0_a64 is return_to_aa64, else el0_a64 is ignored.
++         * Illegal execution state. This has priority over BTI
-+     */
++         * exceptions, but comes after instruction abort exceptions.
-+    aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
++         */
++        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-     qemu_mutex_lock_iothread();
++                           syn_illegalstate(), default_exception_el(s));
-     arm_call_el_change_hook(arm_env_get_cpu(env));
++        return;
 +    }
 +
      if (cond == 0xf) {
          /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
           * choose to UNDEF. In ARMv5 and above the space is used
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
  #endif
      dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
      dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
 +    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
      if (arm_feature(env, ARM_FEATURE_M)) {
          dc->vfp_enabled = 1;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      }
      dc->insn = insn;
 +    if (dc->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(dc));
 +        return;
 +    }
 +
      if (dc->eci) {
          /*
           * For M-profile continuable instructions, ECI/ICI handling
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 04/19] target/arm: Align cortex-r5 id_isar0
+[PULL 19/23] target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
 From: Richard Henderson <richard.henderson@linaro.org>
-The missing nibble made it more difficult to read.
+It is confusing to have different exits from translation
+for various conditions in separate functions.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Merge disas_a64_insn into its only caller.  Standardize
 on the "s" name for the DisasContext, as the code from
 disas_a64_insn had more instances.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181008212205.17752-5-richard.henderson@linaro.org
+Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c | 2 +-
+ target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 109 insertions(+), 115 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
-     cpu->id_mmfr1 = 0x00000000;
+     return false;
-     cpu->id_mmfr2 = 0x01200000;
+ }
-     cpu->id_mmfr3 = 0x0211;
--    cpu->id_isar0 = 0x2101111;
+-/* C3.1 A64 instruction index by encoding */
-+    cpu->id_isar0 = 0x02101111;
+-static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-     cpu->id_isar1 = 0x13112111;
+-{
-     cpu->id_isar2 = 0x21232141;
+-    uint32_t insn;
-     cpu->id_isar3 = 0x01112131;
+-
 -    s->pc_curr = s->base.pc_next;
 -    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 -    s->insn = insn;
 -    s->base.pc_next += 4;
 -
 -    s->fp_access_checked = false;
 -    s->sve_access_checked = false;
 -
 -    if (s->pstate_il) {
 -        /*
 -         * Illegal execution state. This has priority over BTI
 -         * exceptions, but comes after instruction abort exceptions.
 -         */
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_illegalstate(), default_exception_el(s));
 -        return;
 -    }
 -
 -    if (dc_isar_feature(aa64_bti, s)) {
 -        if (s->base.num_insns == 1) {
 -            /*
 -             * At the first insn of the TB, compute s->guarded_page.
 -             * We delayed computing this until successfully reading
 -             * the first insn of the TB, above.  This (mostly) ensures
 -             * that the softmmu tlb entry has been populated, and the
 -             * page table GP bit is available.
 -             *
 -             * Note that we need to compute this even if btype == 0,
 -             * because this value is used for BR instructions later
 -             * where ENV is not available.
 -             */
 -            s->guarded_page = is_guarded_page(env, s);
 -
 -            /* First insn can have btype set to non-zero.  */
 -            tcg_debug_assert(s->btype >= 0);
 -
 -            /*
 -             * Note that the Branch Target Exception has fairly high
 -             * priority -- below debugging exceptions but above most
 -             * everything else.  This allows us to handle this now
 -             * instead of waiting until the insn is otherwise decoded.
 -             */
 -            if (s->btype != 0
 -                && s->guarded_page
 -                && !btype_destination_ok(insn, s->bt, s->btype)) {
 -                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                                   syn_btitrap(s->btype),
 -                                   default_exception_el(s));
 -                return;
 -            }
 -        } else {
 -            /* Not the first insn: btype must be 0.  */
 -            tcg_debug_assert(s->btype == 0);
 -        }
 -    }
 -
 -    switch (extract32(insn, 25, 4)) {
 -    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
 -        unallocated_encoding(s);
 -        break;
 -    case 0x2:
 -        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
 -            unallocated_encoding(s);
 -        }
 -        break;
 -    case 0x8: case 0x9: /* Data processing - immediate */
 -        disas_data_proc_imm(s, insn);
 -        break;
 -    case 0xa: case 0xb: /* Branch, exception generation and system insns */
 -        disas_b_exc_sys(s, insn);
 -        break;
 -    case 0x4:
 -    case 0x6:
 -    case 0xc:
 -    case 0xe:      /* Loads and stores */
 -        disas_ldst(s, insn);
 -        break;
 -    case 0x5:
 -    case 0xd:      /* Data processing - register */
 -        disas_data_proc_reg(s, insn);
 -        break;
 -    case 0x7:
 -    case 0xf:      /* Data processing - SIMD and floating point */
 -        disas_data_proc_simd_fp(s, insn);
 -        break;
 -    default:
 -        assert(FALSE); /* all 15 cases should be handled above */
 -        break;
 -    }
 -
 -    /* if we allocated any temporaries, free them here */
 -    free_tmp_a64(s);
 -
 -    /*
 -     * After execution of most insns, btype is reset to 0.
 -     * Note that we set btype == -1 when the insn sets btype.
 -     */
 -    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 -        reset_btype(s);
 -    }
 -}
 -
  static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                            CPUState *cpu)
  {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
  {
 -    DisasContext *dc = container_of(dcbase, DisasContext, base);
 +    DisasContext *s = container_of(dcbase, DisasContext, base);
      CPUARMState *env = cpu->env_ptr;
 +    uint32_t insn;
 -    if (dc->ss_active && !dc->pstate_ss) {
 +    if (s->ss_active && !s->pstate_ss) {
          /* Singlestep state is Active-pending.
           * If we're in this state at the start of a TB then either
           *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
           * "did not step an insn" case, and so the syndrome ISV and EX
           * bits should be zero.
           */
 -        assert(dc->base.num_insns == 1);
 -        gen_swstep_exception(dc, 0, 0);
 -        dc->base.is_jmp = DISAS_NORETURN;
 -    } else {
 -        disas_a64_insn(env, dc);
 +        assert(s->base.num_insns == 1);
 +        gen_swstep_exception(s, 0, 0);
 +        s->base.is_jmp = DISAS_NORETURN;
 +        return;
      }
 -    translator_loop_temp_check(&dc->base);
 +    s->pc_curr = s->base.pc_next;
 +    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 +    s->insn = insn;
 +    s->base.pc_next += 4;
 +
 +    s->fp_access_checked = false;
 +    s->sve_access_checked = false;
 +
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
 +    if (dc_isar_feature(aa64_bti, s)) {
 +        if (s->base.num_insns == 1) {
 +            /*
 +             * At the first insn of the TB, compute s->guarded_page.
 +             * We delayed computing this until successfully reading
 +             * the first insn of the TB, above.  This (mostly) ensures
 +             * that the softmmu tlb entry has been populated, and the
 +             * page table GP bit is available.
 +             *
 +             * Note that we need to compute this even if btype == 0,
 +             * because this value is used for BR instructions later
 +             * where ENV is not available.
 +             */
 +            s->guarded_page = is_guarded_page(env, s);
 +
 +            /* First insn can have btype set to non-zero.  */
 +            tcg_debug_assert(s->btype >= 0);
 +
 +            /*
 +             * Note that the Branch Target Exception has fairly high
 +             * priority -- below debugging exceptions but above most
 +             * everything else.  This allows us to handle this now
 +             * instead of waiting until the insn is otherwise decoded.
 +             */
 +            if (s->btype != 0
 +                && s->guarded_page
 +                && !btype_destination_ok(insn, s->bt, s->btype)) {
 +                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                                   syn_btitrap(s->btype),
 +                                   default_exception_el(s));
 +                return;
 +            }
 +        } else {
 +            /* Not the first insn: btype must be 0.  */
 +            tcg_debug_assert(s->btype == 0);
 +        }
 +    }
 +
 +    switch (extract32(insn, 25, 4)) {
 +    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
 +        unallocated_encoding(s);
 +        break;
 +    case 0x2:
 +        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
 +            unallocated_encoding(s);
 +        }
 +        break;
 +    case 0x8: case 0x9: /* Data processing - immediate */
 +        disas_data_proc_imm(s, insn);
 +        break;
 +    case 0xa: case 0xb: /* Branch, exception generation and system insns */
 +        disas_b_exc_sys(s, insn);
 +        break;
 +    case 0x4:
 +    case 0x6:
 +    case 0xc:
 +    case 0xe:      /* Loads and stores */
 +        disas_ldst(s, insn);
 +        break;
 +    case 0x5:
 +    case 0xd:      /* Data processing - register */
 +        disas_data_proc_reg(s, insn);
 +        break;
 +    case 0x7:
 +    case 0xf:      /* Data processing - SIMD and floating point */
 +        disas_data_proc_simd_fp(s, insn);
 +        break;
 +    default:
 +        assert(FALSE); /* all 15 cases should be handled above */
 +        break;
 +    }
 +
 +    /* if we allocated any temporaries, free them here */
 +    free_tmp_a64(s);
 +
 +    /*
 +     * After execution of most insns, btype is reset to 0.
 +     * Note that we set btype == -1 when the insn sets btype.
 +     */
 +    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 +        reset_btype(s);
 +    }
 +
 +    translator_loop_temp_check(&s->base);
  }
  static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 --
-.19.0
+.20.1

-[Qemu-devel] [PULL 10/19] net: cadence_gem: Add support for extended descriptors
+[PULL 20/23] qdev: Support marking individual buses as 'full'
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+By default, QEMU will allow devices to be plugged into a bus up to
 the bus class's device count limit.  If the user creates a device on
 the command line or via the monitor and doesn't explicitly specify
 the bus to plug it in, QEMU will plug it into the first non-full bus
 that it finds.
-Add support for extended descriptors with optional 64bit
+This is fine in most cases, but some machines have multiple buses of
-addressing and timestamping. QEMU will not yet provide
+a given type, some of which are dedicated to on-board devices and
-timestamps (always leaving the valid timestamp bit as zero).
+some of which have an externally exposed connector for user-pluggable
 devices. One example is I2C buses.
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Provide a new function qbus_mark_full() so that a machine model can
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+mark this kind of "internal only" bus as 'full' after it has created
-Message-id: 20181011021931.4249-6-edgar.iglesias@gmail.com
+all the devices that should be plugged into that bus. The "find a
 non-full bus" algorithm will then skip the internal-only bus when
 looking for a place to plug in user-created devices.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
 ---
- include/hw/net/cadence_gem.h |  2 +-
+ include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
- hw/net/cadence_gem.c         | 69 ++++++++++++++++++++++++++----------
+ softmmu/qdev-monitor.c |  7 ++++++-
-files changed, 52 insertions(+), 19 deletions(-)
+files changed, 30 insertions(+), 1 deletion(-)
-diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/cadence_gem.h
+--- a/include/hw/qdev-core.h
-+++ b/include/hw/net/cadence_gem.h
++++ b/include/hw/qdev-core.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct BusState {
- #define CADENCE_GEM_MAXREG        (0x00000800 / 4) /* Last valid GEM address */
+     HotplugHandler *hotplug_handler;
+     int max_index;
- /* Max number of words in a DMA descriptor.  */
+     bool realized;
--#define DESC_MAX_NUM_WORDS              2
++    bool full;
-+#define DESC_MAX_NUM_WORDS              6
+     int num_children;
- #define MAX_PRIORITY_QUEUES             8
+     /*
- #define MAX_TYPE1_SCREENERS             16
+@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+    return bus->hotplug_handler;
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/cadence_gem.c
 +++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
  #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
  #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
 +#define GEM_DMACFG_ADDR_64B    (1U << 30)
 +#define GEM_DMACFG_TX_BD_EXT   (1U << 29)
 +#define GEM_DMACFG_RX_BD_EXT   (1U << 28)
  #define GEM_DMACFG_RBUFSZ_M    0x00FF0000 /* DMA RX Buffer Size mask */
  #define GEM_DMACFG_RBUFSZ_S    16         /* DMA RX Buffer Size shift */
  #define GEM_DMACFG_RBUFSZ_MUL  64         /* DMA RX Buffer Size multiplier */
@@ -XXX,XX +XXX,XX @@
  #define GEM_MODID_VALUE 0x00020118
 -static inline unsigned tx_desc_get_buffer(uint32_t *desc)
 +static inline uint64_t tx_desc_get_buffer(CadenceGEMState *s, uint32_t *desc)
  {
 -    return desc[0];
 +    uint64_t ret = desc[0];
 +
 +    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
 +        ret |= (uint64_t)desc[2] << 32;
 +    }
 +    return ret;
  }
- static inline unsigned tx_desc_get_used(uint32_t *desc)
++/**
-@@ -XXX,XX +XXX,XX @@ static inline void print_gem_tx_desc(uint32_t *desc, uint8_t queue)
++ * qbus_mark_full: Mark this bus as full, so no more devices can be attached
-     DB_PRINT("length:  %d\n", tx_desc_get_length(desc));
++ * @bus: Bus to mark as full
- }
++ *
++ * By default, QEMU will allow devices to be plugged into a bus up
--static inline unsigned rx_desc_get_buffer(uint32_t *desc)
++ * to the bus class's device count limit. Calling this function
-+static inline uint64_t rx_desc_get_buffer(CadenceGEMState *s, uint32_t *desc)
++ * marks a particular bus as full, so that no more devices can be
- {
++ * plugged into it. In particular this means that the bus will not
--    return desc[0] & ~0x3UL;
++ * be considered as a candidate for plugging in devices created by
-+    uint64_t ret = desc[0] & ~0x3UL;
++ * the user on the commandline or via the monitor.
-+
++ * If a machine has multiple buses of a given type, such as I2C,
-+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
++ * where some of those buses in the real hardware are used only for
-+        ret |= (uint64_t)desc[2] << 32;
++ * internal devices and some are exposed via expansion ports, you
-+    }
++ * can use this function to mark the internal-only buses as full
-+    return ret;
++ * after you have created all their internal devices. Then user
 + * created devices will appear on the expansion-port bus where
 + * guest software expects them.
 + */
 +static inline void qbus_mark_full(BusState *bus)
 +{
 +    bus->full = true;
 +}
 +
-+static inline int gem_get_desc_len(CadenceGEMState *s, bool rx_n_tx)
+ void device_listener_register(DeviceListener *listener);
-+{
+ void device_listener_unregister(DeviceListener *listener);
-+    int ret = 2;
 diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
  static inline bool qbus_is_full(BusState *bus)
  {
 -    BusClass *bus_class = BUS_GET_CLASS(bus);
 +    BusClass *bus_class;
 +
-+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
++    if (bus->full) {
-+        ret += 2;
++        return true;
 +    }
-+    if (s->regs[GEM_DMACFG] & (rx_n_tx ? GEM_DMACFG_RX_BD_EXT
++    bus_class = BUS_GET_CLASS(bus);
-+                                       : GEM_DMACFG_TX_BD_EXT)) {
+     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
 +        ret += 2;
 +    }
 +
 +    assert(ret <= DESC_MAX_NUM_WORDS);
 +    return ret;
  }
- static inline unsigned rx_desc_get_wrap(uint32_t *desc)
-@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
-     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
-     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
-     s->regs_ro[GEM_NWSTATUS] = 0xFFFFFFFF;
--    s->regs_ro[GEM_DMACFG]   = 0xFE00F000;
-+    s->regs_ro[GEM_DMACFG]   = 0x8E00F000;
-     s->regs_ro[GEM_TXSTATUS] = 0xFFFFFE08;
-     s->regs_ro[GEM_RXQBASE]  = 0x00000003;
-     s->regs_ro[GEM_TXQBASE]  = 0x00000003;
-@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
-     DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
-     /* read current descriptor */
-     cpu_physical_memory_read(s->rx_desc_addr[q],
--                             (uint8_t *)s->rx_desc[q], sizeof(s->rx_desc[q]));
-+                             (uint8_t *)s->rx_desc[q],
-+                             sizeof(uint32_t) * gem_get_desc_len(s, true));
-     /* Descriptor owned by software ? */
-     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-                 rx_desc_get_buffer(s->rx_desc[q]));
-         /* Copy packet data to emulated DMA buffer */
--        cpu_physical_memory_write(rx_desc_get_buffer(s->rx_desc[q]) +
--                                                                 rxbuf_offset,
--                                  rxbuf_ptr, MIN(bytes_to_copy, rxbufsize));
-+        cpu_physical_memory_write(rx_desc_get_buffer(s, s->rx_desc[q]) +
-+                                                                  rxbuf_offset,
-+                                  rxbuf_ptr,
-+                                  MIN(bytes_to_copy, rxbufsize));
-         rxbuf_ptr += MIN(bytes_to_copy, rxbufsize);
-         bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
-@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-         /* Descriptor write-back.  */
-         cpu_physical_memory_write(s->rx_desc_addr[q],
-                                   (uint8_t *)s->rx_desc[q],
--                                  sizeof(s->rx_desc[q]));
-+                                  sizeof(uint32_t) * gem_get_desc_len(s, true));
-         /* Next descriptor */
-         if (rx_desc_get_wrap(s->rx_desc[q])) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-             s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
-         } else {
-             DB_PRINT("incrementing RX descriptor list\n");
--            s->rx_desc_addr[q] += 8;
-+            s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
-         }
-         gem_get_rx_desc(s, q);
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-         DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
-         cpu_physical_memory_read(packet_desc_addr,
--                                 (uint8_t *)desc, sizeof(desc));
-+                                 (uint8_t *)desc,
-+                                 sizeof(uint32_t) * gem_get_desc_len(s, false));
-         /* Handle all descriptors owned by hardware */
-         while (tx_desc_get_used(desc) == 0) {
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-             /* The real hardware would eat this (and possibly crash).
-              * For QEMU let's lend a helping hand.
-              */
--            if ((tx_desc_get_buffer(desc) == 0) ||
-+            if ((tx_desc_get_buffer(s, desc) == 0) ||
-                 (tx_desc_get_length(desc) == 0)) {
-                 DB_PRINT("Invalid TX descriptor @ 0x%x\n",
-                          (unsigned)packet_desc_addr);
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-             /* Gather this fragment of the packet from "dma memory" to our
-              * contig buffer.
-              */
--            cpu_physical_memory_read(tx_desc_get_buffer(desc), p,
-+            cpu_physical_memory_read(tx_desc_get_buffer(s, desc), p,
-                                      tx_desc_get_length(desc));
-             p += tx_desc_get_length(desc);
-             total_bytes += tx_desc_get_length(desc);
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-                 if (tx_desc_get_wrap(desc)) {
-                     s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
-                 } else {
--                    s->tx_desc_addr[q] = packet_desc_addr + 8;
-+                    s->tx_desc_addr[q] = packet_desc_addr +
-+                                         4 * gem_get_desc_len(s, false);
-                 }
-                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
-@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-                 tx_desc_set_last(desc);
-                 packet_desc_addr = s->regs[GEM_TXQBASE];
-             } else {
--                packet_desc_addr += 8;
-+                packet_desc_addr += 4 * gem_get_desc_len(s, false);
-             }
-             DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
--            cpu_physical_memory_read(packet_desc_addr,
--                                     (uint8_t *)desc, sizeof(desc));
-+            cpu_physical_memory_read(packet_desc_addr, (uint8_t *)desc,
-+                                sizeof(uint32_t) * gem_get_desc_len(s, false));
-         }
-         if (tx_desc_get_used(desc)) {
 --
-.19.0
+.20.1

-New patch
+[PULL 21/23] hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
+The mps2-tz boards use a data-driven structure to create the devices
+that sit behind peripheral protection controllers.  Currently the
+functions which create these devices are passed an 'opaque' pointer
+which is always the address within the machine struct of the device
+to create, and some "all devices need this" information like irqs and
+addresses.
+If a specific device needs more information than this, it is
+currently not possible to pass that through from the PPCInfo
+data structure. Add support for passing an extra data parameter,
+so that we can more flexibly handle the needs of specific
+device types. To provide some type-safety we make this extra
+parameter a pointer to a union (which initially has no members).
+In particular, we would like to be able to indicate which of the
+i2c controllers are for on-board devices only and which are
+connected to the external 'shield' expansion port; a subsequent
+patch will use this mechanism for that purpose.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
+---
+ hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
+file changed, 22 insertions(+), 13 deletions(-)
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+     }
+ }
++/* Union describing the device-specific extra data we pass to the devfn. */
++typedef union PPCExtraData {
++} PPCExtraData;
++
+ /* Most of the devices in the AN505 FPGA image sit behind
+  * Peripheral Protection Controllers. These data structures
+  * define the layout of which devices sit behind which PPCs.
+@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+  */
+ typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
+                                 const char *name, hwaddr size,
+-                                const int *irqs);
++                                const int *irqs,
++                                const PPCExtraData *extradata);
+ typedef struct PPCPortInfo {
+     const char *name;
+@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
+     hwaddr addr;
+     hwaddr size;
+     int irqs[3]; /* currently no device needs more IRQ lines than this */
++    PPCExtraData extradata; /* to pass device-specific info to the devfn */
+ } PPCPortInfo;
+ typedef struct PPCInfo {
+@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
+ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
+                                     void *opaque,
+                                     const char *name, hwaddr size,
+-                                    const int *irqs)
++                                    const int *irqs,
++                                    const PPCExtraData *extradata)
+ {
+     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
+      * and return a pointer to its MemoryRegion.
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
+ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
+                                const char *name, hwaddr size,
+-                               const int *irqs)
++                               const int *irqs, const PPCExtraData *extradata)
+ {
+     /* The irq[] array is tx, rx, combined, in that order */
+     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     MPS2SCC *scc = opaque;
+     DeviceState *sccdev;
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
+                                  const char *name, hwaddr size,
+-                                 const int *irqs)
++                                 const int *irqs, const PPCExtraData *extradata)
+ {
+     MPS2FPGAIO *fpgaio = opaque;
+     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
+                                   const char *name, hwaddr size,
+-                                  const int *irqs)
++                                  const int *irqs,
++                                  const PPCExtraData *extradata)
+ {
+     SysBusDevice *s;
+     NICInfo *nd = &nd_table[0];
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
+                                   const char *name, hwaddr size,
+-                                  const int *irqs)
++                                  const int *irqs,
++                                  const PPCExtraData *extradata)
+ {
+     /*
+      * The AN524 makes the ethernet and USB share a PPC port.
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     TZMPC *mpc = opaque;
+     int i = mpc - &mms->mpc[0];
+@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
+ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
+     PL080State *dma = opaque;
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     /*
+      * The AN505 has five PL022 SPI controllers.
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     ArmSbconI2CState *i2c = opaque;
+     SysBusDevice *s;
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
+ static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
+                               const char *name, hwaddr size,
+-                              const int *irqs)
++                              const int *irqs, const PPCExtraData *extradata)
+ {
+     PL031State *pl031 = opaque;
+     SysBusDevice *s;
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+             }
+             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
+-                              pinfo->irqs);
++                              pinfo->irqs, &pinfo->extradata);
+             portname = g_strdup_printf("port[%d]", port);
+             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
+                                      &error_fatal);
+--
+.20.1

-New patch
+[PULL 22/23] hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
+The various MPS2 boards have multiple I2C buses: typically a bus
+dedicated to the audio configuration, one for the LCD touchscreen
+controller, one for a DDR4 EEPROM, and two which are connected to the
+external Shield expansion connector.  Mark the buses which are used
+only for board-internal devices as 'full' so that if the user creates
+i2c devices on the commandline without specifying a bus name then
+they will be connected to the I2C controller used for the Shield
+connector, where guest software will expect them.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
+---
+ hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
+file changed, 43 insertions(+), 14 deletions(-)
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+ /* Union describing the device-specific extra data we pass to the devfn. */
+ typedef union PPCExtraData {
++    bool i2c_internal;
+ } PPCExtraData;
+ /* Most of the devices in the AN505 FPGA image sit behind
+@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
+     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
+     s = SYS_BUS_DEVICE(i2c);
+     sysbus_realize(s, &error_fatal);
++
++    /*
++     * If this is an internal-use-only i2c bus, mark it full
++     * so that user-created i2c devices are not plugged into it.
++     * If we implement models of any on-board i2c devices that
++     * plug in to one of the internal-use-only buses, then we will
++     * need to create and plugging those in here before we mark the
++     * bus as full.
++     */
++    if (extradata->i2c_internal) {
++        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
++        qbus_mark_full(qbus);
++    }
++
+     return sysbus_mmio_get_region(s, 0);
+ }
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
+                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
+                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
+-                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
+-                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
+-                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
+-                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
++                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
++                  { .i2c_internal = true /* touchscreen */ } },
++                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
++                  { .i2c_internal = true /* audio conf */ } },
++                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
++                  { .i2c_internal = false /* shield 0 */ } },
++                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
++                  { .i2c_internal = false /* shield 1 */ } },
+             },
+         }, {
+             .name = "apb_ppcexp2",
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+         }, {
+             .name = "apb_ppcexp1",
+             .ports = {
+-                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
+-                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
++                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
++                  { .i2c_internal = true /* touchscreen */ } },
++                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
++                  { .i2c_internal = true /* audio conf */ } },
+                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
+                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
+                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
+-                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
+-                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
++                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
++                  { .i2c_internal = false /* shield 0 */ } },
++                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
++                  { .i2c_internal = false /* shield 1 */ } },
+                 { /* port 7 reserved */ },
+-                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
++                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
++                  { .i2c_internal = true /* DDR4 EEPROM */ } },
+             },
+         }, {
+             .name = "apb_ppcexp2",
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+         }, {
+             .name = "apb_ppcexp1",
+             .ports = {
+-                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
+-                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
++                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
++                  { .i2c_internal = true /* touchscreen */ } },
++                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
++                  { .i2c_internal = true /* audio conf */ } },
+                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
+                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
+                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
+-                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
+-                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
++                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
++                  { .i2c_internal = false /* shield 0 */ } },
++                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
++                  { .i2c_internal = false /* shield 1 */ } },
+                 { /* port 7 reserved */ },
+-                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
++                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
++                  { .i2c_internal = true /* DDR4 EEPROM */ } },
+             },
+         }, {
+             .name = "apb_ppcexp2",
+--
+.20.1

-[Qemu-devel] [PULL 18/19] target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
+[PULL 23/23] hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
-The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
+The various MPS2 boards implemented in mps2.c have multiple I2C
-struct, which they fill in only if a fault occurs. This means that
+buses: a bus dedicated to the audio configuration, one for the LCD
-the caller must always zero-initialize the struct before passing
+touchscreen controller, and two which are connected to the external
-it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
+Shield expansion connector.  Mark the buses which are used only for
-Correct the error.
+board-internal devices as 'full' so that if the user creates i2c
 devices on the commandline without specifying a bus name then they
 will be connected to the I2C controller used for the Shield
 connector, where guest software will expect them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181011172057.9466-1-peter.maydell@linaro.org
+Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 4 ++--
+ hw/arm/mps2.c | 12 +++++++++++-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 11 insertions(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/mps2.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-     target_ulong page_size;
+x40023000,    /* Audio */
-     hwaddr physaddr;
+x40029000,    /* Shield0 */
-     int prot;
+x4002a000};   /* Shield1 */
--    ARMMMUFaultInfo fi;
+-        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
-+    ARMMMUFaultInfo fi = {};
++        DeviceState *dev;
-     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
++
-     int exc;
++        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
-     bool exc_secure;
++        if (i < 2) {
-@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
++            /*
-     target_ulong page_size;
++             * internal-only bus: mark it full to avoid user-created
-     hwaddr physaddr;
++             * i2c devices being plugged into it.
-     int prot;
++             */
--    ARMMMUFaultInfo fi;
++            BusState *qbus = qdev_get_child_bus(dev, "i2c");
-+    ARMMMUFaultInfo fi = {};
++            qbus_mark_full(qbus);
-     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
++        }
-     int exc;
+     }
-     bool exc_secure;
+     create_unimplemented_device("i2s", 0x40024000, 0x400);
 --
-.19.0
+.20.1

Latest set of arm patches. I may end up doing another pullreq at the
end of the week, but this is big enough to send out, plus it has
several instances of "let me take the first N patches in your series"
in it, so getting those into master makes patch respins for those
submitters easier.

thanks
-- PMM

The following changes since commit dddb37495b844270088e68e3bf30b764d48d863f:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-updates-20181015.0' into staging (2018-10-15 18:44:04 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181016

for you to fetch changes up to bdaffef4bb0729a74c7a325dba5c61d8cd8f464f:

coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls (2018-10-16 16:16:42 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART
 * target/arm: Fix aarch64_sve_change_el wrt EL0
 * target/arm: Define fields of ISAR registers
 * target/arm: Align cortex-r5 id_isar0
 * target/arm: Fix cortex-a7 id_isar0
 * net/cadence_gem: Fix various bugs, add support for new
   features that will be used by the Xilinx Versal board
 * target-arm: powerctl: Enable HVC when starting CPUs to EL2
 * target/arm: Add the Cortex-A72
 * target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
 * target/arm: Mask PMOVSR writes based on supported counters
 * target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
 * coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls

----------------------------------------------------------------
Aaron Lindsay (2):
      target/arm: Mark PMINTENCLR and PMINTENCLR_EL1 accesses as possibly doing IO
      target/arm: Mask PMOVSR writes based on supported counters

Edgar E. Iglesias (10):
      net: cadence_gem: Disable TSU feature bit
      net: cadence_gem: Announce availability of priority queues
      net: cadence_gem: Use uint32_t for 32bit descriptor words
      net: cadence_gem: Add macro with max number of descriptor words
      net: cadence_gem: Add support for extended descriptors
      net: cadence_gem: Add support for selecting the DMA MemoryRegion
      net: cadence_gem: Implement support for 64bit descriptor addresses
      net: cadence_gem: Announce 64bit addressing support
      target-arm: powerctl: Enable HVC when starting CPUs to EL2
      target/arm: Add the Cortex-A72

Jerome Forissier (1):
      hw/arm/virt: add DT property /secure-chosen/stdout-path indicating secure UART

Peter Maydell (2):
      target/arm: Initialize ARMMMUFaultInfo in v7m_stack_read/write
      coccinelle: new inplace-byteswaps.cocci to remove inplace-byteswapping calls

Richard Henderson (4):
      target/arm: Fix aarch64_sve_change_el wrt EL0
      target/arm: Define fields of ISAR registers
      target/arm: Align cortex-r5 id_isar0
      target/arm: Fix cortex-a7 id_isar0

include/hw/net/cadence_gem.h               |   7 +-
 target/arm/cpu.h                           |  95 +++++++++++++-
 hw/arm/virt.c                              |   4 +
 hw/net/cadence_gem.c                       | 192 +++++++++++++++++++++--------
 target/arm/arm-powerctl.c                  |  10 ++
 target/arm/cpu.c                           |   7 +-
 target/arm/cpu64.c                         |  66 +++++++++-
 target/arm/helper.c                        |  27 ++--
 target/arm/op_helper.c                     |   6 +-
 scripts/coccinelle/inplace-byteswaps.cocci |  65 ++++++++++
 10 files changed, 408 insertions(+), 71 deletions(-)
 create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci

From: Jerome Forissier <jerome.forissier@linaro.org>

Bindings for /secure-chosen and /secure-chosen/stdout-path have been
proposed 1.5 years ago [1] and implemented in OP-TEE at the same time [2].
They've now been officially agreed on, so we can implement them
in QEMU.

This patch creates the property when the machine is secure.

[1] https://patchwork.kernel.org/patch/9602401/
[2] https://github.com/OP-TEE/optee_os/commit/4dc31c52544a

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Message-id: 20181005080729.6480-1-jerome.forissier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: commit message tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, qemu_irq *pic, int uart,
         /* Mark as not usable by the normal world */
         qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
         qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
+
+        qemu_fdt_add_subnode(vms->fdt, "/secure-chosen");
+        qemu_fdt_setprop_string(vms->fdt, "/secure-chosen", "stdout-path",
+                                nodename);
     }
 
     g_free(nodename);
-- 
2.19.0

From: Richard Henderson <richard.henderson@linaro.org>

At present we assert:

arm_el_is_aa64: Assertion `el >= 1 && el <= 3' failed.

The comment in arm_el_is_aa64 explains why asking about EL0 without
extra information is impossible.  Add an extra argument to provide
it from the surrounding context.

Fixes: 0ab5953b00b3
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181008212205.17752-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |  7 +++++--
 target/arm/helper.c    | 16 ++++++++++++----
 target/arm/op_helper.c |  6 +++++-
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
 int aarch64_cpu_gdb_read_register(CPUState *cpu, uint8_t *buf, int reg);
 int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
-void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el);
+void aarch64_sve_change_el(CPUARMState *env, int old_el,
+                           int new_el, bool el0_a64);
 #else
 static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
-static inline void aarch64_sve_change_el(CPUARMState *env, int o, int n) { }
+static inline void aarch64_sve_change_el(CPUARMState *env, int o,
+                                         int n, bool a)
+{ }
 #endif
 
 target_ulong do_arm_semihosting(CPUARMState *env);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     unsigned int new_mode = aarch64_pstate_mode(new_el, true);
     unsigned int cur_el = arm_current_el(env);
 
-    aarch64_sve_change_el(env, cur_el, new_el);
+    /*
+     * Note that new_el can never be 0.  If cur_el is 0, then
+     * el0_a64 is is_a64(), else el0_a64 is ignored.
+     */
+    aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
 
     if (cur_el < new_el) {
         /* Entry vector offset depends on whether the implemented EL
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq)
 /*
  * Notice a change in SVE vector size when changing EL.
  */
-void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el)
+void aarch64_sve_change_el(CPUARMState *env, int old_el,
+                           int new_el, bool el0_a64)
 {
     int old_len, new_len;
+    bool old_a64, new_a64;
 
     /* Nothing to do if no SVE.  */
     if (!arm_feature(env, ARM_FEATURE_SVE)) {
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el, int new_el)
      * we already have the correct register contents when encountering the
      * vq0->vq0 transition between EL0->EL1.
      */
-    old_len = (arm_el_is_aa64(env, old_el) && !sve_exception_el(env, old_el)
+    old_a64 = old_el ? arm_el_is_aa64(env, old_el) : el0_a64;
+    old_len = (old_a64 && !sve_exception_el(env, old_el)
                ? sve_zcr_len_for_el(env, old_el) : 0);
-    new_len = (arm_el_is_aa64(env, new_el) && !sve_exception_el(env, new_el)
+    new_a64 = new_el ? arm_el_is_aa64(env, new_el) : el0_a64;
+    new_len = (new_a64 && !sve_exception_el(env, new_el)
                ? sve_zcr_len_for_el(env, new_el) : 0);
 
     /* When changing vector length, clear inaccessible state.  */
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
                       "AArch64 EL%d PC 0x%" PRIx64 "\n",
                       cur_el, new_el, env->pc);
     }
-    aarch64_sve_change_el(env, cur_el, new_el);
+    /*
+     * Note that cur_el can never be 0.  If new_el is 0, then
+     * el0_a64 is return_to_aa64, else el0_a64 is ignored.
+     */
+    aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
 
     qemu_mutex_lock_iothread();
     arm_call_el_change_hook(arm_env_get_cpu(env));
-- 
2.19.0

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181008212205.17752-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 88 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CSSELR, LEVEL, 1, 3)
  */
 FIELD(V7M_CSSELR, INDEX, 0, 4)
 
+/*
+ * System register ID fields.
+ */
+FIELD(ID_ISAR0, SWAP, 0, 4)
+FIELD(ID_ISAR0, BITCOUNT, 4, 4)
+FIELD(ID_ISAR0, BITFIELD, 8, 4)
+FIELD(ID_ISAR0, CMPBRANCH, 12, 4)
+FIELD(ID_ISAR0, COPROC, 16, 4)
+FIELD(ID_ISAR0, DEBUG, 20, 4)
+FIELD(ID_ISAR0, DIVIDE, 24, 4)
+
+FIELD(ID_ISAR1, ENDIAN, 0, 4)
+FIELD(ID_ISAR1, EXCEPT, 4, 4)
+FIELD(ID_ISAR1, EXCEPT_AR, 8, 4)
+FIELD(ID_ISAR1, EXTEND, 12, 4)
+FIELD(ID_ISAR1, IFTHEN, 16, 4)
+FIELD(ID_ISAR1, IMMEDIATE, 20, 4)
+FIELD(ID_ISAR1, INTERWORK, 24, 4)
+FIELD(ID_ISAR1, JAZELLE, 28, 4)
+
+FIELD(ID_ISAR2, LOADSTORE, 0, 4)
+FIELD(ID_ISAR2, MEMHINT, 4, 4)
+FIELD(ID_ISAR2, MULTIACCESSINT, 8, 4)
+FIELD(ID_ISAR2, MULT, 12, 4)
+FIELD(ID_ISAR2, MULTS, 16, 4)
+FIELD(ID_ISAR2, MULTU, 20, 4)
+FIELD(ID_ISAR2, PSR_AR, 24, 4)
+FIELD(ID_ISAR2, REVERSAL, 28, 4)
+
+FIELD(ID_ISAR3, SATURATE, 0, 4)
+FIELD(ID_ISAR3, SIMD, 4, 4)
+FIELD(ID_ISAR3, SVC, 8, 4)
+FIELD(ID_ISAR3, SYNCHPRIM, 12, 4)
+FIELD(ID_ISAR3, TABBRANCH, 16, 4)
+FIELD(ID_ISAR3, T32COPY, 20, 4)
+FIELD(ID_ISAR3, TRUENOP, 24, 4)
+FIELD(ID_ISAR3, T32EE, 28, 4)
+
+FIELD(ID_ISAR4, UNPRIV, 0, 4)
+FIELD(ID_ISAR4, WITHSHIFTS, 4, 4)
+FIELD(ID_ISAR4, WRITEBACK, 8, 4)
+FIELD(ID_ISAR4, SMC, 12, 4)
+FIELD(ID_ISAR4, BARRIER, 16, 4)
+FIELD(ID_ISAR4, SYNCHPRIM_FRAC, 20, 4)
+FIELD(ID_ISAR4, PSR_M, 24, 4)
+FIELD(ID_ISAR4, SWP_FRAC, 28, 4)
+
+FIELD(ID_ISAR5, SEVL, 0, 4)
+FIELD(ID_ISAR5, AES, 4, 4)
+FIELD(ID_ISAR5, SHA1, 8, 4)
+FIELD(ID_ISAR5, SHA2, 12, 4)
+FIELD(ID_ISAR5, CRC32, 16, 4)
+FIELD(ID_ISAR5, RDM, 24, 4)
+FIELD(ID_ISAR5, VCMA, 28, 4)
+
+FIELD(ID_ISAR6, JSCVT, 0, 4)
+FIELD(ID_ISAR6, DP, 4, 4)
+FIELD(ID_ISAR6, FHM, 8, 4)
+FIELD(ID_ISAR6, SB, 12, 4)
+FIELD(ID_ISAR6, SPECRES, 16, 4)
+
+FIELD(ID_AA64ISAR0, AES, 4, 4)
+FIELD(ID_AA64ISAR0, SHA1, 8, 4)
+FIELD(ID_AA64ISAR0, SHA2, 12, 4)
+FIELD(ID_AA64ISAR0, CRC32, 16, 4)
+FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)
+FIELD(ID_AA64ISAR0, RDM, 28, 4)
+FIELD(ID_AA64ISAR0, SHA3, 32, 4)
+FIELD(ID_AA64ISAR0, SM3, 36, 4)
+FIELD(ID_AA64ISAR0, SM4, 40, 4)
+FIELD(ID_AA64ISAR0, DP, 44, 4)
+FIELD(ID_AA64ISAR0, FHM, 48, 4)
+FIELD(ID_AA64ISAR0, TS, 52, 4)
+FIELD(ID_AA64ISAR0, TLB, 56, 4)
+FIELD(ID_AA64ISAR0, RNDR, 60, 4)
+
+FIELD(ID_AA64ISAR1, DPB, 0, 4)
+FIELD(ID_AA64ISAR1, APA, 4, 4)
+FIELD(ID_AA64ISAR1, API, 8, 4)
+FIELD(ID_AA64ISAR1, JSCVT, 12, 4)
+FIELD(ID_AA64ISAR1, FCMA, 16, 4)
+FIELD(ID_AA64ISAR1, LRCPC, 20, 4)
+FIELD(ID_AA64ISAR1, GPA, 24, 4)
+FIELD(ID_AA64ISAR1, GPI, 28, 4)
+FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
+FIELD(ID_AA64ISAR1, SB, 36, 4)
+FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
+
 QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
 
 /* If adding a feature bit which corresponds to a Linux ELF
-- 
2.19.0

From: Richard Henderson <richard.henderson@linaro.org>

The incorrect value advertised only thumb2 div without arm div.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181008212205.17752-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->id_mmfr1 = 0x40000000;
     cpu->id_mmfr2 = 0x01240000;
     cpu->id_mmfr3 = 0x02102211;
-    cpu->id_isar0 = 0x01101110;
+    /* a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but
+     * table 4-41 gives 0x02101110, which includes the arm div insns.
+     */
+    cpu->id_isar0 = 0x02101110;
     cpu->id_isar1 = 0x13112111;
     cpu->id_isar2 = 0x21232041;
     cpu->id_isar3 = 0x11112131;
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Announce the availability of the various priority queues.
This fixes an issue where guest kernels would miss to
configure secondary queues due to inproper feature bits.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/cadence_gem.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
     int i;
     CadenceGEMState *s = CADENCE_GEM(d);
     const uint8_t *a;
+    uint32_t queues_mask;
 
     DB_PRINT("\n");
 
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
     s->regs[GEM_DESCONF] = 0x02500111;
     s->regs[GEM_DESCONF2] = 0x2ab13fff;
     s->regs[GEM_DESCONF5] = 0x002f2045;
-    s->regs[GEM_DESCONF6] = 0x00000200;
+    s->regs[GEM_DESCONF6] = 0x0;
+
+    queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
+    s->regs[GEM_DESCONF6] |= queues_mask;
 
     /* Set MAC address */
     a = &s->conf.macaddr.a[0];
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Use uint32_t instead of unsigned to describe 32bit descriptor words.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-4-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/cadence_gem.h |  2 +-
 hw/net/cadence_gem.c         | 42 ++++++++++++++++++------------------
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
 
     uint8_t can_rx_state; /* Debug only */
 
-    unsigned rx_desc[MAX_PRIORITY_QUEUES][2];
+    uint32_t rx_desc[MAX_PRIORITY_QUEUES][2];
 
     bool sar_active[4];
 } CadenceGEMState;
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 
 #define GEM_MODID_VALUE 0x00020118
 
-static inline unsigned tx_desc_get_buffer(unsigned *desc)
+static inline unsigned tx_desc_get_buffer(uint32_t *desc)
 {
     return desc[0];
 }
 
-static inline unsigned tx_desc_get_used(unsigned *desc)
+static inline unsigned tx_desc_get_used(uint32_t *desc)
 {
     return (desc[1] & DESC_1_USED) ? 1 : 0;
 }
 
-static inline void tx_desc_set_used(unsigned *desc)
+static inline void tx_desc_set_used(uint32_t *desc)
 {
     desc[1] |= DESC_1_USED;
 }
 
-static inline unsigned tx_desc_get_wrap(unsigned *desc)
+static inline unsigned tx_desc_get_wrap(uint32_t *desc)
 {
     return (desc[1] & DESC_1_TX_WRAP) ? 1 : 0;
 }
 
-static inline unsigned tx_desc_get_last(unsigned *desc)
+static inline unsigned tx_desc_get_last(uint32_t *desc)
 {
     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
 }
 
-static inline void tx_desc_set_last(unsigned *desc)
+static inline void tx_desc_set_last(uint32_t *desc)
 {
     desc[1] |= DESC_1_TX_LAST;
 }
 
-static inline unsigned tx_desc_get_length(unsigned *desc)
+static inline unsigned tx_desc_get_length(uint32_t *desc)
 {
     return desc[1] & DESC_1_LENGTH;
 }
 
-static inline void print_gem_tx_desc(unsigned *desc, uint8_t queue)
+static inline void print_gem_tx_desc(uint32_t *desc, uint8_t queue)
 {
     DB_PRINT("TXDESC (queue %" PRId8 "):\n", queue);
     DB_PRINT("bufaddr: 0x%08x\n", *desc);
@@ -XXX,XX +XXX,XX @@ static inline void print_gem_tx_desc(unsigned *desc, uint8_t queue)
     DB_PRINT("length:  %d\n", tx_desc_get_length(desc));
 }
 
-static inline unsigned rx_desc_get_buffer(unsigned *desc)
+static inline unsigned rx_desc_get_buffer(uint32_t *desc)
 {
     return desc[0] & ~0x3UL;
 }
 
-static inline unsigned rx_desc_get_wrap(unsigned *desc)
+static inline unsigned rx_desc_get_wrap(uint32_t *desc)
 {
     return desc[0] & DESC_0_RX_WRAP ? 1 : 0;
 }
 
-static inline unsigned rx_desc_get_ownership(unsigned *desc)
+static inline unsigned rx_desc_get_ownership(uint32_t *desc)
 {
     return desc[0] & DESC_0_RX_OWNERSHIP ? 1 : 0;
 }
 
-static inline void rx_desc_set_ownership(unsigned *desc)
+static inline void rx_desc_set_ownership(uint32_t *desc)
 {
     desc[0] |= DESC_0_RX_OWNERSHIP;
 }
 
-static inline void rx_desc_set_sof(unsigned *desc)
+static inline void rx_desc_set_sof(uint32_t *desc)
 {
     desc[1] |= DESC_1_RX_SOF;
 }
 
-static inline void rx_desc_set_eof(unsigned *desc)
+static inline void rx_desc_set_eof(uint32_t *desc)
 {
     desc[1] |= DESC_1_RX_EOF;
 }
 
-static inline void rx_desc_set_length(unsigned *desc, unsigned len)
+static inline void rx_desc_set_length(uint32_t *desc, unsigned len)
 {
     desc[1] &= ~DESC_1_LENGTH;
     desc[1] |= len;
 }
 
-static inline void rx_desc_set_broadcast(unsigned *desc)
+static inline void rx_desc_set_broadcast(uint32_t *desc)
 {
     desc[1] |= R_DESC_1_RX_BROADCAST;
 }
 
-static inline void rx_desc_set_unicast_hash(unsigned *desc)
+static inline void rx_desc_set_unicast_hash(uint32_t *desc)
 {
     desc[1] |= R_DESC_1_RX_UNICAST_HASH;
 }
 
-static inline void rx_desc_set_multicast_hash(unsigned *desc)
+static inline void rx_desc_set_multicast_hash(uint32_t *desc)
 {
     desc[1] |= R_DESC_1_RX_MULTICAST_HASH;
 }
 
-static inline void rx_desc_set_sar(unsigned *desc, int sar_idx)
+static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
 {
     desc[1] = deposit32(desc[1], R_DESC_1_RX_SAR_SHIFT, R_DESC_1_RX_SAR_LENGTH,
                         sar_idx);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit_updatestats(CadenceGEMState *s, const uint8_t *packet,
  */
 static void gem_transmit(CadenceGEMState *s)
 {
-    unsigned    desc[2];
+    uint32_t desc[2];
     hwaddr packet_desc_addr;
     uint8_t     tx_packet[2048];
     uint8_t     *p;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
             /* Last descriptor for this packet; hand the whole thing off */
             if (tx_desc_get_last(desc)) {
-                unsigned    desc_first[2];
+                uint32_t desc_first[2];
 
                 /* Modify the 1st descriptor of this packet to be owned by
                  * the processor.
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add macro with max number of DMA descriptor words.
No functional change.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-5-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/cadence_gem.h | 5 ++++-
 hw/net/cadence_gem.c         | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for extended descriptors with optional 64bit
addressing and timestamping. QEMU will not yet provide
timestamps (always leaving the valid timestamp bit as zero).

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/cadence_gem.h |  2 +-
 hw/net/cadence_gem.c         | 69 ++++++++++++++++++++++++++----------
 2 files changed, 52 insertions(+), 19 deletions(-)

diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@
 #define CADENCE_GEM_MAXREG        (0x00000800 / 4) /* Last valid GEM address */
 
 /* Max number of words in a DMA descriptor.  */
-#define DESC_MAX_NUM_WORDS              2
+#define DESC_MAX_NUM_WORDS              6
 
 #define MAX_PRIORITY_QUEUES             8
 #define MAX_TYPE1_SCREENERS             16
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
 #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
 
+#define GEM_DMACFG_ADDR_64B    (1U << 30)
+#define GEM_DMACFG_TX_BD_EXT   (1U << 29)
+#define GEM_DMACFG_RX_BD_EXT   (1U << 28)
 #define GEM_DMACFG_RBUFSZ_M    0x00FF0000 /* DMA RX Buffer Size mask */
 #define GEM_DMACFG_RBUFSZ_S    16         /* DMA RX Buffer Size shift */
 #define GEM_DMACFG_RBUFSZ_MUL  64         /* DMA RX Buffer Size multiplier */
@@ -XXX,XX +XXX,XX @@
 
 #define GEM_MODID_VALUE 0x00020118
 
-static inline unsigned tx_desc_get_buffer(uint32_t *desc)
+static inline uint64_t tx_desc_get_buffer(CadenceGEMState *s, uint32_t *desc)
 {
-    return desc[0];
+    uint64_t ret = desc[0];
+
+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+        ret |= (uint64_t)desc[2] << 32;
+    }
+    return ret;
 }
 
 static inline unsigned tx_desc_get_used(uint32_t *desc)
@@ -XXX,XX +XXX,XX @@ static inline void print_gem_tx_desc(uint32_t *desc, uint8_t queue)
     DB_PRINT("length:  %d\n", tx_desc_get_length(desc));
 }
 
-static inline unsigned rx_desc_get_buffer(uint32_t *desc)
+static inline uint64_t rx_desc_get_buffer(CadenceGEMState *s, uint32_t *desc)
 {
-    return desc[0] & ~0x3UL;
+    uint64_t ret = desc[0] & ~0x3UL;
+
+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+        ret |= (uint64_t)desc[2] << 32;
+    }
+    return ret;
+}
+
+static inline int gem_get_desc_len(CadenceGEMState *s, bool rx_n_tx)
+{
+    int ret = 2;
+
+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+        ret += 2;
+    }
+    if (s->regs[GEM_DMACFG] & (rx_n_tx ? GEM_DMACFG_RX_BD_EXT
+                                       : GEM_DMACFG_TX_BD_EXT)) {
+        ret += 2;
+    }
+
+    assert(ret <= DESC_MAX_NUM_WORDS);
+    return ret;
 }
 
 static inline unsigned rx_desc_get_wrap(uint32_t *desc)
@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
     s->regs_ro[GEM_NWSTATUS] = 0xFFFFFFFF;
-    s->regs_ro[GEM_DMACFG]   = 0xFE00F000;
+    s->regs_ro[GEM_DMACFG]   = 0x8E00F000;
     s->regs_ro[GEM_TXSTATUS] = 0xFFFFFE08;
     s->regs_ro[GEM_RXQBASE]  = 0x00000003;
     s->regs_ro[GEM_TXQBASE]  = 0x00000003;
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
     DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
     /* read current descriptor */
     cpu_physical_memory_read(s->rx_desc_addr[q],
-                             (uint8_t *)s->rx_desc[q], sizeof(s->rx_desc[q]));
+                             (uint8_t *)s->rx_desc[q],
+                             sizeof(uint32_t) * gem_get_desc_len(s, true));
 
     /* Descriptor owned by software ? */
     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
                 rx_desc_get_buffer(s->rx_desc[q]));
 
         /* Copy packet data to emulated DMA buffer */
-        cpu_physical_memory_write(rx_desc_get_buffer(s->rx_desc[q]) +
-                                                                 rxbuf_offset,
-                                  rxbuf_ptr, MIN(bytes_to_copy, rxbufsize));
+        cpu_physical_memory_write(rx_desc_get_buffer(s, s->rx_desc[q]) +
+                                                                  rxbuf_offset,
+                                  rxbuf_ptr,
+                                  MIN(bytes_to_copy, rxbufsize));
         rxbuf_ptr += MIN(bytes_to_copy, rxbufsize);
         bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
 
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         /* Descriptor write-back.  */
         cpu_physical_memory_write(s->rx_desc_addr[q],
                                   (uint8_t *)s->rx_desc[q],
-                                  sizeof(s->rx_desc[q]));
+                                  sizeof(uint32_t) * gem_get_desc_len(s, true));
 
         /* Next descriptor */
         if (rx_desc_get_wrap(s->rx_desc[q])) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
             s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
         } else {
             DB_PRINT("incrementing RX descriptor list\n");
-            s->rx_desc_addr[q] += 8;
+            s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
         }
 
         gem_get_rx_desc(s, q);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
         DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
         cpu_physical_memory_read(packet_desc_addr,
-                                 (uint8_t *)desc, sizeof(desc));
+                                 (uint8_t *)desc,
+                                 sizeof(uint32_t) * gem_get_desc_len(s, false));
         /* Handle all descriptors owned by hardware */
         while (tx_desc_get_used(desc) == 0) {
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
             /* The real hardware would eat this (and possibly crash).
              * For QEMU let's lend a helping hand.
              */
-            if ((tx_desc_get_buffer(desc) == 0) ||
+            if ((tx_desc_get_buffer(s, desc) == 0) ||
                 (tx_desc_get_length(desc) == 0)) {
                 DB_PRINT("Invalid TX descriptor @ 0x%x\n",
                          (unsigned)packet_desc_addr);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
             /* Gather this fragment of the packet from "dma memory" to our
              * contig buffer.
              */
-            cpu_physical_memory_read(tx_desc_get_buffer(desc), p,
+            cpu_physical_memory_read(tx_desc_get_buffer(s, desc), p,
                                      tx_desc_get_length(desc));
             p += tx_desc_get_length(desc);
             total_bytes += tx_desc_get_length(desc);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 if (tx_desc_get_wrap(desc)) {
                     s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
                 } else {
-                    s->tx_desc_addr[q] = packet_desc_addr + 8;
+                    s->tx_desc_addr[q] = packet_desc_addr +
+                                         4 * gem_get_desc_len(s, false);
                 }
                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 tx_desc_set_last(desc);
                 packet_desc_addr = s->regs[GEM_TXQBASE];
             } else {
-                packet_desc_addr += 8;
+                packet_desc_addr += 4 * gem_get_desc_len(s, false);
             }
             DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
-            cpu_physical_memory_read(packet_desc_addr,
-                                     (uint8_t *)desc, sizeof(desc));
+            cpu_physical_memory_read(packet_desc_addr, (uint8_t *)desc,
+                                sizeof(uint32_t) * gem_get_desc_len(s, false));
         }
 
         if (tx_desc_get_used(desc)) {
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for selecting the Memory Region that the GEM
will do DMA to.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20181011021931.4249-7-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/cadence_gem.h |  2 ++
 hw/net/cadence_gem.c         | 59 ++++++++++++++++++++++--------------
 2 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
 
     /*< public >*/
     MemoryRegion iomem;
+    MemoryRegion *dma_mr;
+    AddressSpace dma_as;
     NICState *nic;
     NICConf conf;
     qemu_irq irq[MAX_PRIORITY_QUEUES];
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/cadence_gem.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
+#include "sysemu/dma.h"
 #include "net/checksum.h"
 
 #ifdef CADENCE_GEM_ERR_DEBUG
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
 {
     DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
     /* read current descriptor */
-    cpu_physical_memory_read(s->rx_desc_addr[q],
-                             (uint8_t *)s->rx_desc[q],
-                             sizeof(uint32_t) * gem_get_desc_len(s, true));
+    address_space_read(&s->dma_as, s->rx_desc_addr[q], MEMTXATTRS_UNSPECIFIED,
+                       (uint8_t *)s->rx_desc[q],
+                       sizeof(uint32_t) * gem_get_desc_len(s, true));
 
     /* Descriptor owned by software ? */
     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
                 rx_desc_get_buffer(s->rx_desc[q]));
 
         /* Copy packet data to emulated DMA buffer */
-        cpu_physical_memory_write(rx_desc_get_buffer(s, s->rx_desc[q]) +
+        address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
                                                                   rxbuf_offset,
-                                  rxbuf_ptr,
-                                  MIN(bytes_to_copy, rxbufsize));
+                            MEMTXATTRS_UNSPECIFIED, rxbuf_ptr,
+                            MIN(bytes_to_copy, rxbufsize));
         rxbuf_ptr += MIN(bytes_to_copy, rxbufsize);
         bytes_to_copy -= MIN(bytes_to_copy, rxbufsize);
 
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         }
 
         /* Descriptor write-back.  */
-        cpu_physical_memory_write(s->rx_desc_addr[q],
-                                  (uint8_t *)s->rx_desc[q],
-                                  sizeof(uint32_t) * gem_get_desc_len(s, true));
+        address_space_write(&s->dma_as, s->rx_desc_addr[q],
+                            MEMTXATTRS_UNSPECIFIED,
+                            (uint8_t *)s->rx_desc[q],
+                            sizeof(uint32_t) * gem_get_desc_len(s, true));
 
         /* Next descriptor */
         if (rx_desc_get_wrap(s->rx_desc[q])) {
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
         packet_desc_addr = s->tx_desc_addr[q];
 
         DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
-        cpu_physical_memory_read(packet_desc_addr,
-                                 (uint8_t *)desc,
-                                 sizeof(uint32_t) * gem_get_desc_len(s, false));
+        address_space_read(&s->dma_as, packet_desc_addr,
+                           MEMTXATTRS_UNSPECIFIED, (uint8_t *)desc,
+                           sizeof(uint32_t) * gem_get_desc_len(s, false));
         /* Handle all descriptors owned by hardware */
         while (tx_desc_get_used(desc) == 0) {
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
             /* Gather this fragment of the packet from "dma memory" to our
              * contig buffer.
              */
-            cpu_physical_memory_read(tx_desc_get_buffer(s, desc), p,
-                                     tx_desc_get_length(desc));
+            address_space_read(&s->dma_as, tx_desc_get_buffer(s, desc),
+                               MEMTXATTRS_UNSPECIFIED,
+                               p, tx_desc_get_length(desc));
             p += tx_desc_get_length(desc);
             total_bytes += tx_desc_get_length(desc);
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 /* Modify the 1st descriptor of this packet to be owned by
                  * the processor.
                  */
-                cpu_physical_memory_read(s->tx_desc_addr[q],
-                                         (uint8_t *)desc_first,
-                                         sizeof(desc_first));
+                address_space_read(&s->dma_as, s->tx_desc_addr[q],
+                                   MEMTXATTRS_UNSPECIFIED,
+                                   (uint8_t *)desc_first,
+                                   sizeof(desc_first));
                 tx_desc_set_used(desc_first);
-                cpu_physical_memory_write(s->tx_desc_addr[q],
-                                          (uint8_t *)desc_first,
-                                          sizeof(desc_first));
+                address_space_write(&s->dma_as, s->tx_desc_addr[q],
+                                  MEMTXATTRS_UNSPECIFIED,
+                                  (uint8_t *)desc_first,
+                                   sizeof(desc_first));
                 /* Advance the hardware current descriptor past this packet */
                 if (tx_desc_get_wrap(desc)) {
                     s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 packet_desc_addr += 4 * gem_get_desc_len(s, false);
             }
             DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
-            cpu_physical_memory_read(packet_desc_addr, (uint8_t *)desc,
-                                sizeof(uint32_t) * gem_get_desc_len(s, false));
+            address_space_read(&s->dma_as, packet_desc_addr,
+                              MEMTXATTRS_UNSPECIFIED, (uint8_t *)desc,
+                              sizeof(uint32_t) * gem_get_desc_len(s, false));
         }
 
         if (tx_desc_get_used(desc)) {
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
     CadenceGEMState *s = CADENCE_GEM(dev);
     int i;
 
+    address_space_init(&s->dma_as,
+                       s->dma_mr ? s->dma_mr : get_system_memory(), "dma");
+
     if (s->num_priority_queues == 0 ||
         s->num_priority_queues > MAX_PRIORITY_QUEUES) {
         error_setg(errp, "Invalid num-priority-queues value: %" PRIx8,
@@ -XXX,XX +XXX,XX @@ static void gem_init(Object *obj)
                           "enet", sizeof(s->regs));
 
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
+
+    object_property_add_link(obj, "dma", TYPE_MEMORY_REGION,
+                             (Object **)&s->dma_mr,
+                             qdev_prop_allow_set_link_before_realize,
+                             OBJ_PROP_LINK_STRONG,
+                             &error_abort);
 }
 
 static const VMStateDescription vmstate_cadence_gem = {
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Implement support for 64bit descriptor addresses.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-8-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/cadence_gem.c | 47 ++++++++++++++++++++++++++++++++++++--------
 1 file changed, 39 insertions(+), 8 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_RECEIVE_Q1_PTR              (0x00000480 / 4)
 #define GEM_RECEIVE_Q7_PTR              (GEM_RECEIVE_Q1_PTR + 6)
 
+#define GEM_TBQPH                       (0x000004C8 / 4)
+#define GEM_RBQPH                       (0x000004D4 / 4)
+
 #define GEM_INT_Q1_ENABLE               (0x00000600 / 4)
 #define GEM_INT_Q7_ENABLE               (GEM_INT_Q1_ENABLE + 6)
 
@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
     return 0;
 }
 
+static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
+{
+    hwaddr desc_addr = 0;
+
+    if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+        desc_addr = s->regs[tx ? GEM_TBQPH : GEM_RBQPH];
+    }
+    desc_addr <<= 32;
+    desc_addr |= tx ? s->tx_desc_addr[q] : s->rx_desc_addr[q];
+    return desc_addr;
+}
+
+static hwaddr gem_get_tx_desc_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_desc_addr(s, true, q);
+}
+
+static hwaddr gem_get_rx_desc_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_desc_addr(s, false, q);
+}
+
 static void gem_get_rx_desc(CadenceGEMState *s, int q)
 {
-    DB_PRINT("read descriptor 0x%x\n", (unsigned)s->rx_desc_addr[q]);
+    hwaddr desc_addr = gem_get_rx_desc_addr(s, q);
+
+    DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", desc_addr);
+
     /* read current descriptor */
-    address_space_read(&s->dma_as, s->rx_desc_addr[q], MEMTXATTRS_UNSPECIFIED,
+    address_space_read(&s->dma_as, desc_addr, MEMTXATTRS_UNSPECIFIED,
                        (uint8_t *)s->rx_desc[q],
                        sizeof(uint32_t) * gem_get_desc_len(s, true));
 
     /* Descriptor owned by software ? */
     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
-        DB_PRINT("descriptor 0x%x owned by sw.\n",
-                 (unsigned)s->rx_desc_addr[q]);
+        DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
         s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
         /* Handle interrupt consequences */
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
 
     while (bytes_to_copy) {
+        hwaddr desc_addr;
+
         /* Do nothing if receive is not enabled. */
         if (!gem_can_receive(nc)) {
             assert(!first_desc);
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         }
 
         /* Descriptor write-back.  */
-        address_space_write(&s->dma_as, s->rx_desc_addr[q],
+        desc_addr = gem_get_rx_desc_addr(s, q);
+        address_space_write(&s->dma_as, desc_addr,
                             MEMTXATTRS_UNSPECIFIED,
                             (uint8_t *)s->rx_desc[q],
                             sizeof(uint32_t) * gem_get_desc_len(s, true));
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
     for (q = s->num_priority_queues - 1; q >= 0; q--) {
         /* read current descriptor */
-        packet_desc_addr = s->tx_desc_addr[q];
+        packet_desc_addr = gem_get_tx_desc_addr(s, q);
 
         DB_PRINT("read descriptor 0x%" HWADDR_PRIx "\n", packet_desc_addr);
         address_space_read(&s->dma_as, packet_desc_addr,
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
             /* Last descriptor for this packet; hand the whole thing off */
             if (tx_desc_get_last(desc)) {
                 uint32_t desc_first[DESC_MAX_NUM_WORDS];
+                hwaddr desc_addr = gem_get_tx_desc_addr(s, q);
 
                 /* Modify the 1st descriptor of this packet to be owned by
                  * the processor.
                  */
-                address_space_read(&s->dma_as, s->tx_desc_addr[q],
+                address_space_read(&s->dma_as, desc_addr,
                                    MEMTXATTRS_UNSPECIFIED,
                                    (uint8_t *)desc_first,
                                    sizeof(desc_first));
                 tx_desc_set_used(desc_first);
-                address_space_write(&s->dma_as, s->tx_desc_addr[q],
+                address_space_write(&s->dma_as, desc_addr,
                                   MEMTXATTRS_UNSPECIFIED,
                                   (uint8_t *)desc_first,
                                    sizeof(desc_first));
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Announce 64bit addressing support.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-9-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/cadence_gem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_DESCONF4      (0x0000028C/4)
 #define GEM_DESCONF5      (0x00000290/4)
 #define GEM_DESCONF6      (0x00000294/4)
+#define GEM_DESCONF6_64B_MASK (1U << 23)
 #define GEM_DESCONF7      (0x00000298/4)
 
 #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
     s->regs[GEM_DESCONF] = 0x02500111;
     s->regs[GEM_DESCONF2] = 0x2ab13fff;
     s->regs[GEM_DESCONF5] = 0x002f2045;
-    s->regs[GEM_DESCONF6] = 0x0;
+    s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
 
     queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
     s->regs[GEM_DESCONF6] |= queues_mask;
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

When QEMU provides the equivalent of the EL3 firmware, we
need to enable HVCs in scr_el3 when turning on CPUs that
target EL2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-10-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-powerctl.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
     } else {
         /* Processor is not in secure mode */
         target_cpu->env.cp15.scr_el3 |= SCR_NS;
+
+        /*
+         * If QEMU is providing the equivalent of EL3 firmware, then we need
+         * to make sure a CPU targeting EL2 comes out of reset with a
+         * functional HVC insn.
+         */
+        if (arm_feature(&target_cpu->env, ARM_FEATURE_EL3)
+            && info->target_el == 2) {
+            target_cpu->env.cp15.scr_el3 |= SCR_HCE;
+        }
     }
 
     /* We check if the started CPU is now at the correct level */
-- 
2.19.0

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the ARM Cortex-A72.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181011021931.4249-11-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 66 +++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 63 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 }
 #endif
 
-static const ARMCPRegInfo cortex_a57_a53_cp_reginfo[] = {
+static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
 #ifndef CONFIG_USER_ONLY
     { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    define_arm_cp_regs(cpu, cortex_a57_a53_cp_reginfo);
+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
 static void aarch64_a53_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    define_arm_cp_regs(cpu, cortex_a57_a53_cp_reginfo);
+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+}
+
+static void aarch64_a72_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    cpu->dtb_compatible = "arm,cortex-a72";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_VFP4);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_V8_AES);
+    set_feature(&cpu->env, ARM_FEATURE_V8_SHA1);
+    set_feature(&cpu->env, ARM_FEATURE_V8_SHA256);
+    set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
+    set_feature(&cpu->env, ARM_FEATURE_CRC);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+    cpu->midr = 0x410fd083;
+    cpu->revidr = 0x00000000;
+    cpu->reset_fpsid = 0x41034080;
+    cpu->mvfr0 = 0x10110222;
+    cpu->mvfr1 = 0x12111111;
+    cpu->mvfr2 = 0x00000043;
+    cpu->ctr = 0x8444c004;
+    cpu->reset_sctlr = 0x00c50838;
+    cpu->id_pfr0 = 0x00000131;
+    cpu->id_pfr1 = 0x00011011;
+    cpu->id_dfr0 = 0x03010066;
+    cpu->id_afr0 = 0x00000000;
+    cpu->id_mmfr0 = 0x10201105;
+    cpu->id_mmfr1 = 0x40000000;
+    cpu->id_mmfr2 = 0x01260000;
+    cpu->id_mmfr3 = 0x02102211;
+    cpu->id_isar0 = 0x02101110;
+    cpu->id_isar1 = 0x13112111;
+    cpu->id_isar2 = 0x21232042;
+    cpu->id_isar3 = 0x01112131;
+    cpu->id_isar4 = 0x00011142;
+    cpu->id_isar5 = 0x00011121;
+    cpu->id_aa64pfr0 = 0x00002222;
+    cpu->id_aa64dfr0 = 0x10305106;
+    cpu->pmceid0 = 0x00000000;
+    cpu->pmceid1 = 0x00000000;
+    cpu->id_aa64isar0 = 0x00011120;
+    cpu->id_aa64mmfr0 = 0x00001124;
+    cpu->dbgdidr = 0x3516d000;
+    cpu->clidr = 0x0a200023;
+    cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+    cpu->ccsidr[1] = 0x201fe012; /* 48KB L1 icache */
+    cpu->ccsidr[2] = 0x707fe07a; /* 1MB L2 cache */
+    cpu->dcz_blocksize = 4; /* 64 bytes */
+    cpu->gic_num_lrs = 4;
+    cpu->gic_vpribits = 5;
+    cpu->gic_vprebits = 5;
+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
 static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPUInfo {
 static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
+    { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
     { .name = "max",                .initfn = aarch64_max_initfn },
     { .name = NULL }
 };
-- 
2.19.0

From: Aaron Lindsay <aclindsa@gmail.com>

I previously fixed this for PMINTENSET_EL1, but missed these.

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Signed-off-by: Aaron Lindsay <aclindsa@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181010203735.27918-2-aclindsa@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .writefn = pmintenset_write, .raw_writefn = raw_write,
       .resetvalue = 0x0 },
     { .name = "PMINTENCLR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 2,
-      .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write, },
     { .name = "PMINTENCLR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 9, .crm = 14, .opc2 = 2,
-      .access = PL1_RW, .accessfn = access_tpm, .type = ARM_CP_ALIAS,
+      .access = PL1_RW, .accessfn = access_tpm,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pminten),
       .writefn = pmintenclr_write },
     { .name = "CCSIDR", .state = ARM_CP_STATE_BOTH,
-- 
2.19.0

From: Aaron Lindsay <aclindsa@gmail.com>

This is an amendment to my earlier patch:
    commit 7ece99b17e832065236c07a158dfac62619ef99b
    Author: Aaron Lindsay <alindsay@codeaurora.org>
    Date:   Thu Apr 26 11:04:39 2018 +0100

target/arm: Mask PMU register writes based on PMCR_EL0.N

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181010203735.27918-3-aclindsa@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void pmovsr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
 {
+    value &= pmu_counter_mask(env);
     env->cp15.c9_pmovsr &= ~value;
 }
 
-- 
2.19.0

The get_phys_addr() functions take a pointer to an ARMMMUFaultInfo
struct, which they fill in only if a fault occurs. This means that
the caller must always zero-initialize the struct before passing
it in. We forgot to do this in v7m_stack_read() and v7m_stack_write().
Correct the error.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181011172057.9466-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_write(ARMCPU *cpu, uint32_t addr, uint32_t value,
     target_ulong page_size;
     hwaddr physaddr;
     int prot;
-    ARMMMUFaultInfo fi;
+    ARMMMUFaultInfo fi = {};
     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
     int exc;
     bool exc_secure;
@@ -XXX,XX +XXX,XX @@ static bool v7m_stack_read(ARMCPU *cpu, uint32_t *dest, uint32_t addr,
     target_ulong page_size;
     hwaddr physaddr;
     int prot;
-    ARMMMUFaultInfo fi;
+    ARMMMUFaultInfo fi = {};
     bool secure = mmu_idx & ARM_MMU_IDX_M_S;
     int exc;
     bool exc_secure;
-- 
2.19.0

Add a new Coccinelle script which replaces uses of the inplace
byteswapping functions *_to_cpus() and cpu_to_*s() with their
not-in-place equivalents. This is useful for where the swapping
is done on members of a packed struct -- taking the address
of the member to pass it to an inplace function is undefined
behaviour in C.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181009181612.10633-1-peter.maydell@linaro.org
---
 scripts/coccinelle/inplace-byteswaps.cocci | 65 ++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 scripts/coccinelle/inplace-byteswaps.cocci

diff --git a/scripts/coccinelle/inplace-byteswaps.cocci b/scripts/coccinelle/inplace-byteswaps.cocci
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/scripts/coccinelle/inplace-byteswaps.cocci
@@ -XXX,XX +XXX,XX @@
+// Replace uses of in-place byteswapping functions with calls to the
+// equivalent not-in-place functions.  This is necessary to avoid
+// undefined behaviour if the expression being swapped is a field in a
+// packed struct.
+
+@@
+expression E;
+@@
+-be16_to_cpus(&E);
++E = be16_to_cpu(E);
+@@
+expression E;
+@@
+-be32_to_cpus(&E);
++E = be32_to_cpu(E);
+@@
+expression E;
+@@
+-be64_to_cpus(&E);
++E = be64_to_cpu(E);
+@@
+expression E;
+@@
+-cpu_to_be16s(&E);
++E = cpu_to_be16(E);
+@@
+expression E;
+@@
+-cpu_to_be32s(&E);
++E = cpu_to_be32(E);
+@@
+expression E;
+@@
+-cpu_to_be64s(&E);
++E = cpu_to_be64(E);
+@@
+expression E;
+@@
+-le16_to_cpus(&E);
++E = le16_to_cpu(E);
+@@
+expression E;
+@@
+-le32_to_cpus(&E);
++E = le32_to_cpu(E);
+@@
+expression E;
+@@
+-le64_to_cpus(&E);
++E = le64_to_cpu(E);
+@@
+expression E;
+@@
+-cpu_to_le16s(&E);
++E = cpu_to_le16(E);
+@@
+expression E;
+@@
+-cpu_to_le32s(&E);
++E = cpu_to_le32(E);
+@@
+expression E;
+@@
+-cpu_to_le64s(&E);
++E = cpu_to_le64(E);
-- 
2.19.0

The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913

for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:

hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)

----------------------------------------------------------------
target-arm queue:
 * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
   line user-created devices are not plugged into them
 * Take an exception if PSTATE.IL is set
 * Support an emulated ITS in the virt board
 * Add support for kudo-bmc board
 * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
 * cadence_uart: Fix clock handling issues that prevented
   u-boot from running

----------------------------------------------------------------
Bin Meng (6):
      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
      hw/char: cadence_uart: Disable transmit when input clock is disabled
      hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
      hw/char: cadence_uart: Convert to memop_with_attrs() ops
      hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
      hw/char: cadence_uart: Log a guest error when device is unclocked or in reset

Chris Rauer (1):
      hw/arm: Add support for kudo-bmc board.

Marc Zyngier (1):
      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM

Peter Maydell (5):
      target/arm: Take an exception if PSTATE.IL is set
      qdev: Support marking individual buses as 'full'
      hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
      hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
      hw/arm/mps2.c: Mark internal-only I2C buses as 'full'

Richard Henderson (1):
      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn

Shashi Mallela (9):
      hw/intc: GICv3 ITS initial framework
      hw/intc: GICv3 ITS register definitions added
      hw/intc: GICv3 ITS command queue framework
      hw/intc: GICv3 ITS Command processing
      hw/intc: GICv3 ITS Feature enablement
      hw/intc: GICv3 redistributor ITS processing
      tests/data/acpi/virt: Add IORT files for ITS
      hw/arm/virt: add ITS support in virt GIC
      tests/data/acpi/virt: Update IORT files for ITS

From: Bin Meng <bmeng.cn@gmail.com>

As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
does not receive anything. Debugging shows that the UART input clock
frequency is zero which prevents the UART from receiving anything as
per the logic in uart_receive().

From zynq_slcr_reset_exit() comment, it intends to compute output
clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
is called to accomplish the task, inside which device_is_in_reset()
is called to actually make the attempt in vain.

Rework reset_hold() and reset_exit() so that in the reset exit phase,
the logic can really compute output clocks in reset_exit().

With this change, upstream U-Boot boots properly again with:

$ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
    -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0

Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
                             reg ## _ ## enable_field ## _SHIFT)
 
+static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
+{
+    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
+    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
+    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
+
+    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
+
+    /* compute uartX reference clocks */
+    clock_set(s->uart0_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
+    clock_set(s->uart1_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+}
+
 /**
  * Compute and set the ouputs clocks periods.
  * But do not propagate them further. Connected clocks
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
         ps_clk = 0;
     }
 
-    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
-    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
-    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
-
-    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
-
-    /* compute uartX reference clocks */
-    clock_set(s->uart0_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
-    clock_set(s->uart1_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+    zynq_slcr_compute_clocks_internal(s, ps_clk);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will disable all output clocks */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, 0);
     zynq_slcr_propagate_clocks(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will compute output clocks according to ps_clk and registers */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
     zynq_slcr_propagate_clocks(s);
 }
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

At present when input clock is disabled, any character transmitted
to tx fifo can still show on the serial line, which is wrong.

Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return;
+    }
+
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Currently the clock/reset check is done in uart_receive(), but we
can move the check to uart_can_receive() which is earlier.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
 static int uart_can_receive(void *opaque)
 {
     CadenceUARTState *s = opaque;
-    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
-    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
+    int ret;
+    uint32_t ch_mode;
+
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return 0;
+    }
+
+    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
+    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
     CadenceUARTState *s = opaque;
     uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         uart_write_rx_fifo(opaque, buf, size);
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

This converts uart_read() and uart_write() to memop_with_attrs() ops.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
     uart_update_status(s);
 }
 
-static void uart_write(void *opaque, hwaddr offset,
-                          uint64_t value, unsigned size)
+static MemTxResult uart_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        return;
+        return MEMTX_DECODE_ERROR;
     }
     switch (offset) {
     case R_IER: /* ier (wts imr) */
@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
         break;
     }
     uart_update_status(s);
+
+    return MEMTX_OK;
 }
 
-static uint64_t uart_read(void *opaque, hwaddr offset,
-        unsigned size)
+static MemTxResult uart_read(void *opaque, hwaddr offset,
+                             uint64_t *value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        c = 0;
-    } else if (offset == R_TX_RX) {
+        return MEMTX_DECODE_ERROR;
+    }
+    if (offset == R_TX_RX) {
         uart_read_rx_fifo(s, &c);
     } else {
-       c = s->r[offset];
+        c = s->r[offset];
     }
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
-    return c;
+    *value = c;
+    return MEMTX_OK;
 }
 
 static const MemoryRegionOps uart_ops = {
-    .read = uart_read,
-    .write = uart_write,
+    .read_with_attrs = uart_read,
+    .write_with_attrs = uart_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Read or write to uart registers when unclocked or in reset should be
ignored. Add the check there, and as a result of this, the check in
uart_write_tx_fifo() is now unnecessary.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 {
     CadenceUARTState *s = opaque;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
         return MEMTX_DECODE_ERROR;
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

We've got SW that expects FSBL (Bootlooader) to setup clocks and
resets. It's quite common that users run that SW on QEMU without
FSBL (FSBL typically requires the Xilinx tools installed). That's
fine, since users can stil use -device loader to enable clocks etc.

To help folks understand what's going, a log (guest-error) message
would be helpful here. In particular with the serial port since
things will go very quiet if they get things wrong.

Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

Although we probe for the IPA limits imposed by KVM (and the hardware)
when computing the memory map, we still use the old style '0' when
creating a scratch VM in kvm_arm_create_scratch_host_vcpu().

On systems that are severely IPA challenged (such as the Apple M1),
this results in a failure as KVM cannot use the default 40bit that
'0' represents.

Instead, probe for the extension and use the reported IPA limit
if available.

Cc: Andrew Jones <drjones@redhat.com>
Cc: Eric Auger <eric.auger@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20210822144441.1290891-2-maz@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
                                       struct kvm_vcpu_init *init)
 {
     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
+    int max_vm_pa_size;
 
     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
     if (kvmfd < 0) {
         goto err;
     }
-    vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
+    if (max_vm_pa_size < 0) {
+        max_vm_pa_size = 0;
+    }
+    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
     if (vmfd < 0) {
         goto err;
     }
-- 
2.20.1

From: Chris Rauer <crauer@google.com>

kudo-bmc is a board supported by OpenBMC.
https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo

Since v1:
- hyphenated Cortex-A9

Tested: Booted kudo firmware.
Signed-off-by: Chris Rauer <crauer@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20210907223234.1165705-1-crauer@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst |  1 +
 hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
 
 - ``quanta-gbs-bmc``    Quanta GBS server BMC
 - ``quanta-gsj``        Quanta GSJ server BMC
+- ``kudo-bmc``          Fii USA Kudo server BMC
 
 There are also two more SoCs, NPCM710 and NPCM705, which are single-core
 variants of NPCM750 and NPCM730, respectively. These are currently not
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
 #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
 #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
+#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
 
 static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 
@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
     npcm7xx_load_kernel(machine, soc);
 }
 
+static void kudo_bmc_init(MachineState *machine)
+{
+    NPCM7xxState *soc;
+
+    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
+    npcm7xx_connect_dram(soc, machine->ram);
+    qdev_realize(DEVICE(soc), NULL, &error_fatal);
+
+    npcm7xx_load_bootrom(machine, soc);
+    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 0, 0));
+    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 3, 0));
+
+    npcm7xx_load_kernel(machine, soc);
+}
+
 static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
 {
     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 1 * GiB;
 }
 
+static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
+{
+    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
+
+    mc->desc = "Kudo BMC (Cortex-A9)";
+    mc->init = kudo_bmc_init;
+    mc->default_ram_size = 1 * GiB;
+};
+
 static const TypeInfo npcm7xx_machine_types[] = {
     {
         .name           = TYPE_NPCM7XX_MACHINE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = gbs_bmc_machine_class_init,
+    }, {
+        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
+        .parent         = TYPE_NPCM7XX_MACHINE,
+        .class_init     = kudo_bmc_machine_class_init,
     },
 };
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added register definitions relevant to ITS,implemented overall
ITS device framework with stubs for ITS control and translater
regions read/write,extended ITS common to handle mmio init between
existing kvm device and newer qemu device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  96 +++++++++-
 include/hw/intc/arm_gicv3_its_common.h |   9 +-
 hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
 hw/intc/arm_gicv3_its_common.c         |   7 +-
 hw/intc/arm_gicv3_its_kvm.c            |   2 +-
 hw/intc/meson.build                    |   1 +
 6 files changed, 342 insertions(+), 14 deletions(-)
 create mode 100644 hw/intc/arm_gicv3_its.c

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_ARM_GICV3_INTERNAL_H
 #define QEMU_ARM_GICV3_INTERNAL_H
 
+#include "hw/registerfields.h"
 #include "hw/intc/arm_gicv3_common.h"
 
 /* Distributor registers, as offsets from the distributor base address */
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+/* 16 bits EventId */
+#define GICD_TYPER_IDBITS            0xf
+
 /*
  * Redistributor frame offsets from RD_base
  */
@@ -XXX,XX +XXX,XX @@
 #define GICR_WAKER_ProcessorSleep    (1U << 1)
 #define GICR_WAKER_ChildrenAsleep    (1U << 2)
 
-#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
-#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
-#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
+FIELD(GICR_PROPBASER, IDBITS, 0, 5)
+FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
+FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 
-#define GICR_PENDBASER_PTZ                     (1ULL << 62)
-#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
-#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
+FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
+FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
+FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
 #define ICH_VTR_EL2_PREBITS_SHIFT 26
 #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 
+/* ITS Registers */
+
+FIELD(GITS_BASER, SIZE, 0, 8)
+FIELD(GITS_BASER, PAGESIZE, 8, 2)
+FIELD(GITS_BASER, SHAREABILITY, 10, 2)
+FIELD(GITS_BASER, PHYADDR, 12, 36)
+FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
+FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
+FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
+FIELD(GITS_BASER, OUTERCACHE, 53, 3)
+FIELD(GITS_BASER, TYPE, 56, 3)
+FIELD(GITS_BASER, INNERCACHE, 59, 3)
+FIELD(GITS_BASER, INDIRECT, 62, 1)
+FIELD(GITS_BASER, VALID, 63, 1)
+
+FIELD(GITS_CTLR, QUIESCENT, 31, 1)
+
+FIELD(GITS_TYPER, PHYSICAL, 0, 1)
+FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
+FIELD(GITS_TYPER, IDBITS, 8, 5)
+FIELD(GITS_TYPER, DEVBITS, 13, 5)
+FIELD(GITS_TYPER, SEIS, 18, 1)
+FIELD(GITS_TYPER, PTA, 19, 1)
+FIELD(GITS_TYPER, CIDBITS, 32, 4)
+FIELD(GITS_TYPER, CIL, 36, 1)
+
+#define GITS_BASER_PAGESIZE_4K                0
+#define GITS_BASER_PAGESIZE_16K               1
+#define GITS_BASER_PAGESIZE_64K               2
+
+#define GITS_BASER_TYPE_DEVICE               1ULL
+#define GITS_BASER_TYPE_COLLECTION           4ULL
+
+/**
+ * Default features advertised by this version of ITS
+ */
+/* Physical LPIs supported */
+#define GITS_TYPE_PHYSICAL           (1U << 0)
+
+/*
+ * 12 bytes Interrupt translation Table Entry size
+ * as per Table 5.3 in GICv3 spec
+ * ITE Lower 8 Bytes
+ *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
+ *   Values:  |    1023   |  IntNum  | IntType |  Valid |
+ * ITE Higher 4 Bytes
+ *   Bits:    | 31 ... 16 | 15 ...0 |
+ *   Values:  |  vPEID    |  ICID   |
+ */
+#define ITS_ITT_ENTRY_SIZE            0xC
+
+/* 16 bits EventId */
+#define ITS_IDBITS                   GICD_TYPER_IDBITS
+
+/* 16 bits DeviceId */
+#define ITS_DEVBITS                   0xF
+
+/* 16 bits CollectionId */
+#define ITS_CIDBITS                  0xF
+
+/*
+ * 8 bytes Device Table Entry size
+ * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
+ */
+#define GITS_DTE_SIZE                 (0x8ULL)
+
+/*
+ * 8 bytes Collection Table Entry size
+ * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
+ */
+#define GITS_CTE_SIZE                 (0x8ULL)
+
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
 #define INTID_NONSECURE 1021
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gicv3_common.h"
 #include "qom/object.h"
 
+#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
+
 #define ITS_CONTROL_SIZE 0x10000
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
 #define GITS_CTLR        0x0
 #define GITS_IIDR        0x4
+#define GITS_TYPER       0x8
 #define GITS_CBASER      0x80
 #define GITS_CWRITER     0x88
 #define GITS_CREADR      0x90
 #define GITS_BASER       0x100
 
+#define GITS_TRANSLATER  0x0040
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     /* Registers */
     uint32_t ctlr;
     uint32_t iidr;
+    uint64_t typer;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
 typedef struct GICv3ITSState GICv3ITSState;
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                   const MemoryRegionOps *tops);
 
 #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
 typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ITS emulation for a GICv3-based system
+ *
+ * Copyright Linaro.org 2021
+ *
+ * Authors:
+ *  Shashi Mallela <shashi.mallela@linaro.org>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at your
+ * option) any later version.  See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/arm_gicv3_its_common.h"
+#include "gicv3_internal.h"
+#include "qom/object.h"
+#include "qapi/error.h"
+
+typedef struct GICv3ITSClass GICv3ITSClass;
+/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
+DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
+                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
+
+struct GICv3ITSClass {
+    GICv3ITSCommonClass parent_class;
+    void (*parent_reset)(DeviceState *dev);
+};
+
+static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
+                                               uint64_t data, unsigned size,
+                                               MemTxAttrs attrs)
+{
+    return MEMTX_OK;
+}
+
+static bool its_writel(GICv3ITSState *s, hwaddr offset,
+                              uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readl(GICv3ITSState *s, hwaddr offset,
+                             uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_writell(GICv3ITSState *s, hwaddr offset,
+                               uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readll(GICv3ITSState *s, hwaddr offset,
+                              uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
+                                  unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_readl(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_readll(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest read at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        *data = 0;
+    }
+    return MEMTX_OK;
+}
+
+static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
+                                   unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_writel(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_writell(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+    }
+    return MEMTX_OK;
+}
+
+static const MemoryRegionOps gicv3_its_control_ops = {
+    .read_with_attrs = gicv3_its_read,
+    .write_with_attrs = gicv3_its_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const MemoryRegionOps gicv3_its_translation_ops = {
+    .write_with_attrs = gicv3_its_translation_write,
+    .valid.min_access_size = 2,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 2,
+    .impl.max_access_size = 4,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    int i;
+
+    for (i = 0; i < s->gicv3->num_cpu; i++) {
+        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
+            error_setg(errp, "Physical LPI not supported by CPU %d", i);
+            return;
+        }
+    }
+
+    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
+
+    /* set the ITS default features supported */
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
+                          GITS_TYPE_PHYSICAL);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
+                          ITS_ITT_ENTRY_SIZE - 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
+}
+
+static void gicv3_its_reset(DeviceState *dev)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
+
+    c->parent_reset(dev);
+
+    /* Quiescent bit reset to 1 */
+    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
+
+    /*
+     * setting GITS_BASER0.Type = 0b001 (Device)
+     *         GITS_BASER1.Type = 0b100 (Collection Table)
+     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
+     *         GITS_BASER<0,1>.Page_Size = 64KB
+     * and default translation table entry size to 16 bytes
+     */
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_DEVICE);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
+                             GITS_DTE_SIZE - 1);
+
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_COLLECTION);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
+                             GITS_CTE_SIZE - 1);
+}
+
+static Property gicv3_its_props[] = {
+    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
+                     GICv3State *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void gicv3_its_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+
+    dc->realize = gicv3_arm_its_realize;
+    device_class_set_props(dc, gicv3_its_props);
+    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+}
+
+static const TypeInfo gicv3_its_info = {
+    .name = TYPE_ARM_GICV3_ITS,
+    .parent = TYPE_ARM_GICV3_ITS_COMMON,
+    .instance_size = sizeof(GICv3ITSState),
+    .class_init = gicv3_its_class_init,
+    .class_size = sizeof(GICv3ITSClass),
+};
+
+static void gicv3_its_register_types(void)
+{
+    type_register_static(&gicv3_its_info);
+}
+
+type_init(gicv3_its_register_types)
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
 
 static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
+    .version_id = 1,
+    .minimum_version_id = 1,
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                         const MemoryRegionOps *tops)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(s);
 
     memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                           "control", ITS_CONTROL_SIZE);
     memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
-                          &gicv3_its_trans_ops, s,
+                          tops ? tops : &gicv3_its_trans_ops, s,
                           "translation", ITS_TRANS_SIZE);
 
     /* Our two regions are always adjacent, therefore we now combine them
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 
-    gicv3_its_init_mmio(s, NULL);
+    gicv3_its_init_mmio(s, NULL, NULL);
 
     if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
         GITS_CTLR)) {
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gicv3_dist.c',
   'arm_gicv3_its_common.c',
   'arm_gicv3_redist.c',
+  'arm_gicv3_its.c',
 ))
 softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
 softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Defined descriptors for ITS device table,collection table and ITS
command queue entities.Implemented register read/write functions,
extract ITS table parameters and command queue parameters,extended
gicv3 common to capture qemu address space(which host the ITS table
platform memories required for subsequent ITS processing) and
initialize the same in ITS device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  29 ++
 include/hw/intc/arm_gicv3_common.h     |   3 +
 include/hw/intc/arm_gicv3_its_common.h |  23 ++
 hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
 4 files changed, 431 insertions(+)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
 FIELD(GITS_BASER, INDIRECT, 62, 1)
 FIELD(GITS_BASER, VALID, 63, 1)
 
+FIELD(GITS_CBASER, SIZE, 0, 8)
+FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
+FIELD(GITS_CBASER, PHYADDR, 12, 40)
+FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
+FIELD(GITS_CBASER, INNERCACHE, 59, 3)
+FIELD(GITS_CBASER, VALID, 63, 1)
+
+FIELD(GITS_CREADR, STALLED, 0, 1)
+FIELD(GITS_CREADR, OFFSET, 5, 15)
+
+FIELD(GITS_CWRITER, RETRY, 0, 1)
+FIELD(GITS_CWRITER, OFFSET, 5, 15)
+
+FIELD(GITS_CTLR, ENABLED, 0, 1)
 FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 
 FIELD(GITS_TYPER, PHYSICAL, 0, 1)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
 FIELD(GITS_TYPER, CIDBITS, 32, 4)
 FIELD(GITS_TYPER, CIL, 36, 1)
 
+#define GITS_IDREGS           0xFFD0
+
+#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
+
+#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
+                                              R_GITS_BASER_TYPE_MASK)
+
 #define GITS_BASER_PAGESIZE_4K                0
 #define GITS_BASER_PAGESIZE_16K               1
 #define GITS_BASER_PAGESIZE_64K               2
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define GITS_BASER_TYPE_DEVICE               1ULL
 #define GITS_BASER_TYPE_COLLECTION           4ULL
 
+#define GITS_PAGE_SIZE_4K       0x1000
+#define GITS_PAGE_SIZE_16K      0x4000
+#define GITS_PAGE_SIZE_64K      0x10000
+
+#define L1TABLE_ENTRY_SIZE         8
+
+#define GITS_CMDQ_ENTRY_SIZE               32
+
 /**
  * Default features advertised by this version of ITS
  */
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     int dev_fd; /* kvm device fd if backed by kvm vgic support */
     Error *migration_blocker;
 
+    MemoryRegion *dma;
+    AddressSpace dma_as;
+
     /* Distributor */
 
     /* for a GIC with the security extensions the NS banked version of this
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 
 #define GITS_TRANSLATER  0x0040
 
+typedef struct {
+    bool valid;
+    bool indirect;
+    uint16_t entry_sz;
+    uint32_t page_sz;
+    uint32_t max_entries;
+    union {
+        uint32_t max_devids;
+        uint32_t max_collids;
+    } maxids;
+    uint64_t base_addr;
+} TableDesc;
+
+typedef struct {
+    bool valid;
+    uint32_t max_entries;
+    uint64_t base_addr;
+} CmdQDesc;
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     uint64_t creadr;
     uint64_t baser[8];
 
+    TableDesc  dt;
+    TableDesc  ct;
+    CmdQDesc   cq;
+
     Error *migration_blocker;
 };
 
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
+{
+    uint64_t result = 0;
+
+    switch (page_sz) {
+    case GITS_PAGE_SIZE_4K:
+    case GITS_PAGE_SIZE_16K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
+        break;
+
+    case GITS_PAGE_SIZE_64K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
+        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
+        break;
+
+    default:
+        break;
+    }
+    return result;
+}
+
+/*
+ * This function extracts the ITS Device and Collection table specific
+ * parameters (like base_addr, size etc) from GITS_BASER register.
+ * It is called during ITS enable and also during post_load migration
+ */
+static void extract_table_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint8_t  page_sz_type;
+    uint8_t type;
+    uint32_t page_sz = 0;
+    uint64_t value;
+
+    for (int i = 0; i < 8; i++) {
+        value = s->baser[i];
+
+        if (!value) {
+            continue;
+        }
+
+        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
+
+        switch (page_sz_type) {
+        case 0:
+            page_sz = GITS_PAGE_SIZE_4K;
+            break;
+
+        case 1:
+            page_sz = GITS_PAGE_SIZE_16K;
+            break;
+
+        case 2:
+        case 3:
+            page_sz = GITS_PAGE_SIZE_64K;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+
+        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
+
+        type = FIELD_EX64(value, GITS_BASER, TYPE);
+
+        switch (type) {
+
+        case GITS_BASER_TYPE_DEVICE:
+            memset(&s->dt, 0 , sizeof(s->dt));
+            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            if (!s->dt.valid) {
+                return;
+            }
+
+            s->dt.page_sz = page_sz;
+            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->dt.indirect) {
+                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
+            } else {
+                s->dt.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->dt.entry_sz));
+            }
+
+            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
+                                       DEVBITS) + 1));
+
+            s->dt.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        case GITS_BASER_TYPE_COLLECTION:
+            memset(&s->ct, 0 , sizeof(s->ct));
+            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            /*
+             * GITS_TYPER.HCC is 0 for this implementation
+             * hence writes are discarded if ct.valid is 0
+             */
+            if (!s->ct.valid) {
+                return;
+            }
+
+            s->ct.page_sz = page_sz;
+            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->ct.indirect) {
+                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
+            } else {
+                s->ct.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->ct.entry_sz));
+            }
+
+            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
+                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
+                                            GITS_TYPER, CIDBITS) + 1));
+            } else {
+                /* 16-bit CollectionId supported when CIL == 0 */
+                s->ct.maxids.max_collids = (1UL << 16);
+            }
+
+            s->ct.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        default:
+            break;
+        }
+    }
+}
+
+static void extract_cmdq_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint64_t value = s->cbaser;
+
+    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
+
+    memset(&s->cq, 0 , sizeof(s->cq));
+    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
+
+    if (s->cq.valid) {
+        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
+                             GITS_CMDQ_ENTRY_SIZE;
+        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
+        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
+    }
+}
+
 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
                               uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        s->ctlr |= (value & ~(s->ctlr));
+
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            extract_table_params(s);
+            extract_cmdq_params(s);
+            s->creadr = 0;
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 0, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CBASER + 4:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 32, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = deposit64(s->cwriter, 0, 32,
+                               (value & ~R_GITS_CWRITER_RETRY_MASK));
+        break;
+    case GITS_CWRITER + 4:
+        s->cwriter = deposit64(s->cwriter, 32, 32, value);
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 0, 32,
+                                  (value & ~R_GITS_CREADR_STALLED_MASK));
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_CREADR + 4:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 32, 32, value);
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+
+            if (offset & 7) {
+                value <<= 32;
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
+                s->baser[index] |= value;
+            } else {
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
+                s->baser[index] |= value;
+            }
+        }
+        break;
+    case GITS_IIDR:
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
                              uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        *data = s->ctlr;
+        break;
+    case GITS_IIDR:
+        *data = gicv3_iidr();
+        break;
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* ID registers */
+        *data = gicv3_idreg(offset - GITS_IDREGS);
+        break;
+    case GITS_TYPER:
+        *data = extract64(s->typer, 0, 32);
+        break;
+    case GITS_TYPER + 4:
+        *data = extract64(s->typer, 32, 32);
+        break;
+    case GITS_CBASER:
+        *data = extract64(s->cbaser, 0, 32);
+        break;
+    case GITS_CBASER + 4:
+        *data = extract64(s->cbaser, 32, 32);
+        break;
+    case GITS_CREADR:
+        *data = extract64(s->creadr, 0, 32);
+        break;
+    case GITS_CREADR + 4:
+        *data = extract64(s->creadr, 32, 32);
+        break;
+    case GITS_CWRITER:
+        *data = extract64(s->cwriter, 0, 32);
+        break;
+    case GITS_CWRITER + 4:
+        *data = extract64(s->cwriter, 32, 32);
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        if (offset & 7) {
+            *data = extract64(s->baser[index], 32, 32);
+        } else {
+            *data = extract64(s->baser[index], 0, 32);
+        }
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
                                uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+            s->baser[index] &= GITS_BASER_RO_MASK;
+            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = value;
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_TYPER:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
                               uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_TYPER:
+        *data = s->typer;
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        *data = s->baser[index];
+        break;
+    case GITS_CBASER:
+        *data = s->cbaser;
+        break;
+    case GITS_CREADR:
+        *data = s->creadr;
+        break;
+    case GITS_CWRITER:
+        *data = s->cwriter;
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 
+    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
+                       "gicv3-its-sysmem");
+
     /* set the ITS default features supported */
     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                           GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                              GITS_CTE_SIZE - 1);
 }
 
+static void gicv3_its_post_load(GICv3ITSState *s)
+{
+    if (s->ctlr & ITS_CTLR_ENABLED) {
+        extract_table_params(s);
+        extract_cmdq_params(s);
+    }
+}
+
 static Property gicv3_its_props[] = {
     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                      GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
 
     dc->realize = gicv3_arm_its_realize;
     device_class_set_props(dc, gicv3_its_props);
     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+    icc->post_load = gicv3_its_post_load;
 }
 
 static const TypeInfo gicv3_its_info = {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added functionality to trigger ITS command queue processing on
write to CWRITE register and process each command queue entry to
identify the command type and handle commands like MAPD,MAPC,SYNC.

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define L1TABLE_ENTRY_SIZE         8
 
 #define GITS_CMDQ_ENTRY_SIZE               32
+#define NUM_BYTES_IN_DW                     8
+
+#define CMD_MASK                  0xff
+
+/* ITS Commands */
+#define GITS_CMD_CLEAR            0x04
+#define GITS_CMD_DISCARD          0x0F
+#define GITS_CMD_INT              0x03
+#define GITS_CMD_MAPC             0x09
+#define GITS_CMD_MAPD             0x08
+#define GITS_CMD_MAPI             0x0B
+#define GITS_CMD_MAPTI            0x0A
+#define GITS_CMD_INV              0x0C
+#define GITS_CMD_INVALL           0x0D
+#define GITS_CMD_SYNC             0x05
+
+/* MAPC command fields */
+#define ICID_LENGTH                  16
+#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
+FIELD(MAPC, RDBASE, 16, 32)
+
+#define RDBASE_PROCNUM_LENGTH        16
+#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
+
+/* MAPD command fields */
+#define ITTADDR_LENGTH               44
+#define ITTADDR_SHIFT                 8
+#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
+#define SIZE_MASK                 0x1f
+
+#define DEVID_SHIFT                  32
+#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
+
+#define VALID_SHIFT               63
+#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
+#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
+#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
 
 /**
  * Default features advertised by this version of ITS
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
  * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
  */
 #define GITS_DTE_SIZE                 (0x8ULL)
+#define GITS_DTE_ITTADDR_SHIFT           6
+#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
+                                                      ITTADDR_LENGTH)
 
 /*
  * 8 bytes Collection Table Entry size
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
+                       uint64_t rdbase)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t cte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (!s->ct.valid) {
+        return true;
+    }
+
+    if (valid) {
+        /* add mapping entry to collection table */
+        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
+                             cte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapc(GICv3ITSState *s, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint16_t icid;
+    uint64_t rdbase;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+    uint64_t value;
+
+    offset += NUM_BYTES_IN_DW;
+    offset += NUM_BYTES_IN_DW;
+
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
+    rdbase &= RDBASE_PROCNUM_MASK;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPC: invalid collection table attributes "
+                      "icid %d rdbase %lu\n",  icid, rdbase);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_cte(s, icid, valid, rdbase);
+    }
+
+    return result;
+}
+
+static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
+                       uint8_t size, uint64_t itt_addr)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t dte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (s->dt.valid) {
+        if (valid) {
+            /* add mapping entry to device table */
+            dte = (valid & TABLE_ENTRY_VALID_MASK) |
+                  ((size & SIZE_MASK) << 1U) |
+                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
+        }
+    } else {
+        return true;
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
+                             dte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid;
+    uint8_t size;
+    uint64_t itt_addr;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    size = (value & SIZE_MASK);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((devid > s->dt.maxids.max_devids) ||
+        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPD: invalid device table attributes "
+                      "devid %d or size %d\n", devid, size);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_dte(s, devid, valid, size, itt_addr);
+    }
+
+    return result;
+}
+
+/*
+ * Current implementation blocks until all
+ * commands are processed
+ */
+static void process_cmdq(GICv3ITSState *s)
+{
+    uint32_t wr_offset = 0;
+    uint32_t rd_offset = 0;
+    uint32_t cq_offset = 0;
+    uint64_t data;
+    AddressSpace *as = &s->gicv3->dma_as;
+    MemTxResult res = MEMTX_OK;
+    bool result = true;
+    uint8_t cmd;
+
+    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+        return;
+    }
+
+    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
+
+    if (wr_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid write offset "
+                      "%d\n", __func__, wr_offset);
+        return;
+    }
+
+    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
+
+    if (rd_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid read offset "
+                      "%d\n", __func__, rd_offset);
+        return;
+    }
+
+    while (wr_offset != rd_offset) {
+        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
+        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
+                                    MEMTXATTRS_UNSPECIFIED, &res);
+        if (res != MEMTX_OK) {
+            result = false;
+        }
+        cmd = (data & CMD_MASK);
+
+        switch (cmd) {
+        case GITS_CMD_INT:
+            break;
+        case GITS_CMD_CLEAR:
+            break;
+        case GITS_CMD_SYNC:
+            /*
+             * Current implementation makes a blocking synchronous call
+             * for every command issued earlier, hence the internal state
+             * is already consistent by the time SYNC command is executed.
+             * Hence no further processing is required for SYNC command.
+             */
+            break;
+        case GITS_CMD_MAPD:
+            result = process_mapd(s, data, cq_offset);
+            break;
+        case GITS_CMD_MAPC:
+            result = process_mapc(s, cq_offset);
+            break;
+        case GITS_CMD_MAPTI:
+            break;
+        case GITS_CMD_MAPI:
+            break;
+        case GITS_CMD_DISCARD:
+            break;
+        case GITS_CMD_INV:
+        case GITS_CMD_INVALL:
+            break;
+        default:
+            break;
+        }
+        if (result) {
+            rd_offset++;
+            rd_offset %= s->cq.max_entries;
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
+        } else {
+            /*
+             * in this implementation, in case of dma read/write error
+             * we stall the command processing
+             */
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: %x cmd processing failed\n", __func__, cmd);
+            break;
+        }
+    }
+}
+
 /*
  * This function extracts the ITS Device and Collection table specific
  * parameters (like base_addr, size etc) from GITS_BASER register.
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
             extract_table_params(s);
             extract_cmdq_params(s);
             s->creadr = 0;
+            process_cmdq(s);
         }
         break;
     case GITS_CBASER:
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
     case GITS_CWRITER:
         s->cwriter = deposit64(s->cwriter, 0, 32,
                                (value & ~R_GITS_CWRITER_RETRY_MASK));
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CWRITER + 4:
         s->cwriter = deposit64(s->cwriter, 32, 32, value);
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
         break;
     case GITS_CWRITER:
         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CREADR:
         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
translation which triggers an LPI via INT command as well as write
to GITS_TRANSLATER register,defined enum to differentiate between ITS
command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
Each of these commands make use of other functionalities implemented to
get device table entry,collection table entry or interrupt translation
table entry required for their processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  12 +
 include/hw/intc/arm_gicv3_common.h |   2 +
 hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
 3 files changed, 378 insertions(+), 1 deletion(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
 #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 #define SIZE_MASK                 0x1f
 
+/* MAPI command fields */
+#define EVENTID_MASK              ((1ULL << 32) - 1)
+
+/* MAPTI command fields */
+#define pINTID_SHIFT                 32
+#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
+
 #define DEVID_SHIFT                  32
 #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  *   Values:  |  vPEID    |  ICID   |
  */
 #define ITS_ITT_ENTRY_SIZE            0xC
+#define ITE_ENTRY_INTTYPE_SHIFT        1
+#define ITE_ENTRY_INTID_SHIFT          2
+#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
+#define ITE_ENTRY_INTSP_SHIFT          26
+#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
 
 /* 16 bits EventId */
 #define ITS_IDBITS                   GICD_TYPER_IDBITS
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@
 #define GICV3_MAXIRQ 1020
 #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
 
+#define GICV3_LPI_INTID_START 8192
+
 #define GICV3_REDIST_SIZE 0x20000
 
 /* Number of SGI target-list bits */
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+/*
+ * This is an internal enum used to distinguish between LPI triggered
+ * via command queue and LPI triggered via gits_translater write.
+ */
+typedef enum ItsCmdType {
+    NONE = 0, /* internal indication for GITS_TRANSLATER write */
+    CLEAR = 1,
+    DISCARD = 2,
+    INT = 3,
+} ItsCmdType;
+
+typedef struct {
+    uint32_t iteh;
+    uint64_t itel;
+} IteEntry;
+
 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
 {
     uint64_t result = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
+                    MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                *cte =  address_space_ldq_le(as, l2t_addr +
+                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                    MEMTXATTRS_UNSPECIFIED, res);
+           }
+       }
+    } else {
+        /* Flat level table */
+        *cte =  address_space_ldq_le(as, s->ct.base_addr +
+                                     (icid * GITS_CTE_SIZE),
+                                      MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
+}
+
+static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                       IteEntry ite)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    MemTxResult res = MEMTX_OK;
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
+                         &res);
+
+    if (res == MEMTX_OK) {
+        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
+                             MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    bool status = false;
+    IteEntry ite = {};
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    ite.itel = address_space_ldq_le(as, itt_addr +
+                                    (eventid * (sizeof(uint64_t) +
+                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
+                                    res);
+
+    if (*res == MEMTX_OK) {
+        ite.iteh = address_space_ldl_le(as, itt_addr +
+                                        (eventid * (sizeof(uint64_t) +
+                                        sizeof(uint32_t))) + sizeof(uint32_t),
+                                        MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
+                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
+                    GITS_TYPE_PHYSICAL) {
+                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
+                               ITE_ENTRY_INTID_SHIFT;
+                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
+                    status = true;
+                }
+            }
+        }
+    }
+    return status;
+}
+
+static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                value =  address_space_ldq_le(as, l2t_addr +
+                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                   MEMTXATTRS_UNSPECIFIED, res);
+            }
+        }
+    } else {
+        /* Flat level table */
+        value = address_space_ldq_le(as, s->dt.base_addr +
+                                     (devid * GITS_DTE_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return value;
+}
+
+/*
+ * This function handles the processing of following commands based on
+ * the ItsCmdType parameter passed:-
+ * 1. triggering of lpi interrupt translation via ITS INT command
+ * 2. triggering of lpi interrupt translation via gits_translater register
+ * 3. handling of ITS CLEAR command
+ * 4. handling of ITS DISCARD command
+ */
+static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                            ItsCmdType cmd)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    MemTxResult res = MEMTX_OK;
+    bool dte_valid;
+    uint64_t dte = 0;
+    uint32_t max_eventid;
+    uint16_t icid = 0;
+    uint32_t pIntid = 0;
+    bool ite_valid = false;
+    uint64_t cte = 0;
+    bool cte_valid = false;
+    bool result = false;
+
+    if (cmd == NONE) {
+        devid = offset;
+    } else {
+        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+        offset += NUM_BYTES_IN_DW;
+        value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+    }
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    if (dte_valid) {
+        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+
+        if (ite_valid) {
+            cte_valid = get_cte(s, icid, &cte, &res);
+        }
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
+            !cte_valid || (eventid > max_eventid)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or eventid %d or invalid dte %d or"
+                      "invalid cte %d or invalid ite %d\n",
+                      __func__, devid, eventid, dte_valid, cte_valid,
+                      ite_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /*
+         * Current implementation only supports rdbase == procnum
+         * Hence rdbase physical address is ignored
+         */
+        if (cmd == DISCARD) {
+            IteEntry ite = {};
+            /* remove mapping from interrupt translation table */
+            result = update_ite(s, eventid, dte, ite);
+        }
+    }
+
+    return result;
+}
+
+static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                          bool ignore_pInt)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    uint32_t pIntid = 0;
+    uint32_t max_eventid, max_Intid;
+    bool dte_valid;
+    MemTxResult res = MEMTX_OK;
+    uint16_t icid = 0;
+    uint64_t dte = 0;
+    IteEntry ite;
+    uint32_t int_spurious = INTID_SPURIOUS;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    if (!ignore_pInt) {
+        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
+    }
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+    if (!ignore_pInt) {
+        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
+            || !dte_valid || (eventid > max_eventid) ||
+            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
+            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or icid %d or eventid %d or pIntid %d or"
+                      "unmapped dte %d\n", __func__, devid, icid, eventid,
+                      pIntid, dte_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /* add ite entry to interrupt translation table */
+        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
+                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
+
+        if (ignore_pInt) {
+            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
+        } else {
+            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
+        }
+        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
+        ite.iteh = icid;
+
+        result = update_ite(s, eventid, dte, ite);
+    }
+
+    return result;
+}
+
 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
                        uint64_t rdbase)
 {
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
 
         switch (cmd) {
         case GITS_CMD_INT:
+            res = process_its_cmd(s, data, cq_offset, INT);
             break;
         case GITS_CMD_CLEAR:
+            res = process_its_cmd(s, data, cq_offset, CLEAR);
             break;
         case GITS_CMD_SYNC:
             /*
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             result = process_mapc(s, cq_offset);
             break;
         case GITS_CMD_MAPTI:
+            result = process_mapti(s, data, cq_offset, false);
             break;
         case GITS_CMD_MAPI:
+            result = process_mapti(s, data, cq_offset, true);
             break;
         case GITS_CMD_DISCARD:
+            result = process_its_cmd(s, data, cq_offset, DISCARD);
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
 {
-    return MEMTX_OK;
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result = true;
+    uint32_t devid = 0;
+
+    switch (offset) {
+    case GITS_TRANSLATER:
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            devid = attrs.requester_id;
+            result = process_its_cmd(s, data, devid, NONE);
+        }
+        break;
+    default:
+        break;
+    }
+
+    if (result) {
+        return MEMTX_OK;
+    } else {
+        return MEMTX_ERROR;
+    }
 }
 
 static bool its_writel(GICv3ITSState *s, hwaddr offset,
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added properties to enable ITS feature and define qemu system
address space memory in gicv3 common,setup distributor and
redistributor registers to indicate LPI support.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  2 ++
 include/hw/intc/arm_gicv3_common.h |  1 +
 hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
 hw/intc/arm_gicv3_dist.c           |  5 ++++-
 hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
 5 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+#define GICD_TYPER_LPIS_SHIFT          17
+
 /* 16 bits EventId */
 #define GICD_TYPER_IDBITS            0xf
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     uint32_t num_cpu;
     uint32_t num_irq;
     uint32_t revision;
+    bool lpi_enable;
     bool security_extn;
     bool irq_reset_nonsecure;
     bool gicd_no_migration_shift_bug;
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->lpi_enable && !s->dma) {
+        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
+        return;
+    }
+
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
             (1 << 24) |
             (i << 8) |
             (last << 4);
+
+        if (s->lpi_enable) {
+            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
     DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
     DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
+    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
     DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
                       redist_region_count, qdev_prop_uint32, uint32_t),
+    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
          * A3V == 1 (non-zero values of Affinity level 3 supported)
          * IDbits == 0xf (we support 16-bit interrupt identifiers)
          * DVIS == 0 (Direct virtual LPI injection not supported)
-         * LPIS == 0 (LPIs not supported)
+         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
+         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
+         *                      by GICD_TYPER.IDbits)
          * MBIS == 0 (message-based SPIs not supported)
          * SecurityExtn == 1 if security extns supported
          * CPUNumber == 0 since for us ARE is always 1
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
         bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
         *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
+            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
             (0xf << 19) | itlinesnumber;
         return true;
     }
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
     case GICR_CTLR:
         /* For our implementation, GICR_TYPER.DPGS is 0 and so all
          * the DPG bits are RAZ/WI. We don't do anything asynchronously,
-         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
-         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
-         * bits for us.
+         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
+         * implement LPIs) so Enable_LPIs is programmable.
          */
+        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
+            if (value & GICR_CTLR_ENABLE_LPIS) {
+                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+            } else {
+                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
+            }
+        }
         return MEMTX_OK;
     case GICR_STATUSR:
         /* RAZ/WI for our implementation */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Implemented lpi processing at redistributor to get lpi config info
from lpi configuration table,determine priority,set pending state in
lpi pending table and forward the lpi to cpuif.Added logic to invoke
redistributor lpi processing with translated LPI which set/clear LPI
from ITS device as part of ITS INT,CLEAR,DISCARD command and
GITS_TRANSLATER processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |   9 ++
 include/hw/intc/arm_gicv3_common.h |   7 ++
 hw/intc/arm_gicv3.c                |  14 +++
 hw/intc/arm_gicv3_common.c         |   1 +
 hw/intc/arm_gicv3_cpuif.c          |   7 +-
 hw/intc/arm_gicv3_its.c            |  23 +++++
 hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
 7 files changed, 200 insertions(+), 2 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
+#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
+
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
 #define ICC_CTLR_EL1_PMHE           (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 
 #define L1TABLE_ENTRY_SIZE         8
 
+#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
+#define LPI_PRIORITY_MASK         0xfc
+
 #define GITS_CMDQ_ENTRY_SIZE               32
 #define NUM_BYTES_IN_DW                     8
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
  */
 #define GITS_CTE_SIZE                 (0x8ULL)
+#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
 
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                unsigned size, MemTxAttrs attrs);
 void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_update_lpi(GICv3CPUState *cs);
 void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
 void gicv3_init_cpuif(GICv3State *s);
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
      * real state above; it doesn't need to be migrated.
      */
     PendingIrq hppi;
+
+    /*
+     * Cached information recalculated from LPI tables
+     * in guest memory
+     */
+    PendingIrq hpplpi;
+
     /* This is temporary working state, to avoid a malloc in gicv3_update() */
     bool seenbetter;
 };
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
         cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
     }
 
+    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
+        (cs->hpplpi.prio != 0xff)) {
+        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
+            cs->hppi.irq = cs->hpplpi.irq;
+            cs->hppi.prio = cs->hpplpi.prio;
+            cs->hppi.grp = cs->hpplpi.grp;
+            seenbetter = true;
+        }
+    }
+
     /* If the best interrupt we just found would preempt whatever
      * was the previous best interrupt before this update, then
      * we know it's definitely the best one now.
@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
 
 static void arm_gicv3_post_load(GICv3State *s)
 {
+    int i;
     /* Recalculate our cached idea of the current highest priority
      * pending interrupt, but don't set IRQ or FIQ lines.
      */
+    for (i = 0; i < s->num_cpu; i++) {
+        gicv3_redist_update_lpi(&s->cpu[i]);
+    }
     gicv3_full_update_noirqset(s);
     /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
     gicv3_cache_all_target_cpustates(s);
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
         memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
 
         cs->hppi.prio = 0xff;
+        cs->hpplpi.prio = 0xff;
 
         /* State in the CPU interface must *not* be reset here, because it
          * is part of the CPU's reset domain, not the GIC device's.
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
         gicv3_redist_update(cs);
-    } else {
+    } else if (irq < GICV3_LPI_INTID_START) {
         gicv3_gicd_active_set(cs->gic, irq);
         gicv3_gicd_pending_clear(cs->gic, irq);
         gicv3_update(cs->gic, irq, 1);
+    } else {
+        gicv3_redist_lpi_pending(cs, irq, 0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
                                gicv3_redist_affid(cs), value);
 
-    if (irq >= cs->gic->num_irq) {
+    if ((irq >= cs->gic->num_irq) &&
+        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
         /* This handles two cases:
          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
          * to the GICC_EOIR, the GIC ignores that write.
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
     uint64_t cte = 0;
     bool cte_valid = false;
     bool result = false;
+    uint64_t rdbase;
 
     if (cmd == NONE) {
         devid = offset;
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
          * Current implementation only supports rdbase == procnum
          * Hence rdbase physical address is ignored
          */
+        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
+
+        if (rdbase > s->gicv3->num_cpu) {
+            return result;
+        }
+
+        if ((cmd == CLEAR) || (cmd == DISCARD)) {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
+        } else {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
+        }
+
         if (cmd == DISCARD) {
             IteEntry ite = {};
             /* remove mapping from interrupt translation table */
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
     MemTxResult res = MEMTX_OK;
     bool result = true;
     uint8_t cmd;
+    int i;
 
     if (!(s->ctlr & ITS_CTLR_ENABLED)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
+            /*
+             * Current implementation doesn't cache any ITS tables,
+             * but the calculated lpi priority information. We only
+             * need to trigger lpi priority re-calculation to be in
+             * sync with LPI config table or pending table changes.
+             */
+            for (i = 0; i < s->gicv3->num_cpu; i++) {
+                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
+            }
             break;
         default:
             break;
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         if (cs->gicr_typer & GICR_TYPER_PLPIS) {
             if (value & GICR_CTLR_ENABLE_LPIS) {
                 cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+                /* Check for any pending interr in pending table */
+                gicv3_redist_update_lpi(cs);
+                gicv3_redist_update(cs);
             } else {
                 cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
             }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
     return r;
 }
 
+static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
+{
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpict_baddr;
+    uint8_t lpite;
+    uint8_t prio;
+
+    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
+                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
+                       sizeof(lpite));
+
+    if (!(lpite & LPI_CTE_ENABLED)) {
+        return;
+    }
+
+    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
+        prio = lpite & LPI_PRIORITY_MASK;
+    } else {
+        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
+    }
+
+    if ((prio < cs->hpplpi.prio) ||
+        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
+        cs->hpplpi.irq = irq;
+        cs->hpplpi.prio = prio;
+        /* LPIs are always non-secure Grp1 interrupts */
+        cs->hpplpi.grp = GICV3_G1NS;
+    }
+}
+
+void gicv3_redist_update_lpi(GICv3CPUState *cs)
+{
+    /*
+     * This function scans the LPI pending table and for each pending
+     * LPI, reads the corresponding entry from LPI configuration table
+     * to extract the priority info and determine if the current LPI
+     * priority is lower than the last computed high priority lpi interrupt.
+     * If yes, replace current LPI as the new high priority lpi interrupt.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    uint32_t pendt_size = 0;
+    uint8_t pend;
+    int i, bit;
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+        !cs->gicr_pendbaser) {
+        return;
+    }
+
+    cs->hpplpi.prio = 0xff;
+
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    /* Determine the highest priority pending interrupt among LPIs */
+    pendt_size = (1ULL << (idbits + 1));
+
+    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
+        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
+                           sizeof(pend));
+
+        while (pend) {
+            bit = ctz32(pend);
+            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
+            pend &= ~(1 << bit);
+        }
+    }
+}
+
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
+{
+    /*
+     * This function updates the pending bit in lpi pending table for
+     * the irq being activated or deactivated.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    bool ispend = false;
+    uint8_t pend;
+
+    /*
+     * get the bit value corresponding to this irq in the
+     * lpi pending table
+     */
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    ispend = extract32(pend, irq % 8, 1);
+
+    /* no change in the value of pending bit, return */
+    if (ispend == level) {
+        return;
+    }
+    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
+
+    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    /*
+     * check if this LPI is better than the current hpplpi, if yes
+     * just set hpplpi.prio and .irq without doing a full rescan
+     */
+    if (level) {
+        gicv3_redist_check_lpi_priority(cs, irq);
+    } else {
+        if (irq == cs->hpplpi.irq) {
+            gicv3_redist_update_lpi(cs);
+        }
+    }
+}
+
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
+{
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
+         irq < GICV3_LPI_INTID_START) {
+        return;
+    }
+
+    /* set/clear the pending bit for this irq */
+    gicv3_redist_lpi_pending(cs, irq, level);
+
+    gicv3_redist_update(cs);
+}
+
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
 {
     /* Update redistributor state for a change in an external PPI input line */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added expected IORT files applicable with latest GICv3
ITS changes.Temporarily differences in these files are
okay.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
 tests/data/acpi/virt/IORT                   | 0
 tests/data/acpi/virt/IORT.memhp             | 0
 tests/data/acpi/virt/IORT.numamem           | 0
 tests/data/acpi/virt/IORT.pxb               | 0
 5 files changed, 4 insertions(+)
 create mode 100644 tests/data/acpi/virt/IORT
 create mode 100644 tests/data/acpi/virt/IORT.memhp
 create mode 100644 tests/data/acpi/virt/IORT.numamem
 create mode 100644 tests/data/acpi/virt/IORT.pxb

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,5 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/virt/IORT",
+"tests/data/acpi/virt/IORT.memhp",
+"tests/data/acpi/virt/IORT.numamem",
+"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
new file mode 100644
index XXXXXXX..XXXXXXX
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Included creation of ITS as part of virt platform GIC
initialization. This Emulated ITS model now co-exists with kvm
ITS and is enabled in absence of kvm irq kernel support in a
platform.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |  2 ++
 target/arm/kvm_arm.h  |  4 ++--
 hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     MachineClass parent;
     bool disallow_affinity_adjustment;
     bool no_its;
+    bool no_tcg_its;
     bool no_pmu;
     bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
     bool highmem;
     bool highmem_ecam;
     bool its;
+    bool tcg_its;
     bool virt;
     bool ras;
     bool mte;
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
         /* KVM implementation requires this capability */
         return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
     } else {
-        /* Software emulation is not implemented yet */
-        return NULL;
+        /* Software emulation based model */
+        return "arm-gicv3-its";
     }
 }
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
     const char *itsclass = its_class_name();
     DeviceState *dev;
 
+    if (!strcmp(itsclass, "arm-gicv3-its")) {
+        if (!vms->tcg_its) {
+            itsclass = NULL;
+        }
+    }
+
     if (!itsclass) {
         /* Do nothing if not supported */
         return;
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
     vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
 }
 
-static void create_gic(VirtMachineState *vms)
+static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
 {
     MachineState *ms = MACHINE(vms);
     /* We create a standalone GIC */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
                              nb_redist_regions);
         qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
 
+        if (!kvm_irqchip_in_kernel()) {
+            if (vms->tcg_its) {
+                object_property_set_link(OBJECT(vms->gic), "sysmem",
+                                         OBJECT(mem), &error_fatal);
+                qdev_prop_set_bit(vms->gic, "has-lpi", true);
+            }
+        }
+
         if (nb_redist_regions == 2) {
             uint32_t redist1_capacity =
                     vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
-    create_gic(vms);
+    create_gic(vms, sysmem);
 
     virt_cpu_post_init(vms, sysmem);
 
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
     } else {
         /* Default allows ITS instantiation */
         vms->its = true;
+
+        if (vmc->no_tcg_its) {
+            vms->tcg_its = false;
+        } else {
+            vms->tcg_its = true;
+        }
     }
 
     /* Default disallows iommu instantiation */
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
 
 static void virt_machine_6_1_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_6_2_options(mc);
     compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
+
+    /* qemu ITS was introduced with 6.2 */
+    vmc->no_tcg_its = true;
 }
 DEFINE_VIRT_MACHINE(6, 1)
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Updated expected IORT files applicable with latest GICv3
ITS changes.

Full diff of new file disassembly:

/*
 * Intel ACPI Component Architecture
 * AML/ASL+ Disassembler version 20180629 (64-bit version)
 * Copyright (c) 2000 - 2018 Intel Corporation
 *
 * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
 *
 * ACPI Data Table [IORT]
 *
 * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
 */

[000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
[004h 0004   4]                 Table Length : 0000007C
[008h 0008   1]                     Revision : 00
[009h 0009   1]                     Checksum : 07
[00Ah 0010   6]                       Oem ID : "BOCHS "
[010h 0016   8]                 Oem Table ID : "BXPC    "
[018h 0024   4]                 Oem Revision : 00000001
[01Ch 0028   4]              Asl Compiler ID : "BXPC"
[020h 0032   4]        Asl Compiler Revision : 00000001

[024h 0036   4]                   Node Count : 00000002
[028h 0040   4]                  Node Offset : 00000030
[02Ch 0044   4]                     Reserved : 00000000

[030h 0048   1]                         Type : 00
[031h 0049   2]                       Length : 0018
[033h 0051   1]                     Revision : 00
[034h 0052   4]                     Reserved : 00000000
[038h 0056   4]                Mapping Count : 00000000
[03Ch 0060   4]               Mapping Offset : 00000000

[040h 0064   4]                     ItsCount : 00000001
[044h 0068   4]                  Identifiers : 00000000

[048h 0072   1]                         Type : 02
[049h 0073   2]                       Length : 0034
[04Bh 0075   1]                     Revision : 00
[04Ch 0076   4]                     Reserved : 00000000
[050h 0080   4]                Mapping Count : 00000001
[054h 0084   4]               Mapping Offset : 00000020

[058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
[058h 0088   4]              Cache Coherency : 00000001
[05Ch 0092   1]        Hints (decoded below) : 00
                                   Transient : 0
                              Write Allocate : 0
                               Read Allocate : 0
                                    Override : 0
[05Dh 0093   2]                     Reserved : 0000
[05Fh 0095   1] Memory Flags (decoded below) : 03
                                   Coherency : 1
                            Device Attribute : 1
[060h 0096   4]                ATS Attribute : 00000000
[064h 0100   4]           PCI Segment Number : 00000000
[068h 0104   1]            Memory Size Limit : 00
[069h 0105   3]                     Reserved : 000000

[068h 0104   4]                   Input base : 00000000
[06Ch 0108   4]                     ID Count : 0000FFFF
[070h 0112   4]                  Output Base : 00000000
[074h 0116   4]             Output Reference : 00000030
[078h 0120   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

Raw Table Data: Length 124 (0x7C)

0000: 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
    0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
    0020: 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
    0030: 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
    0040: 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
    0050: 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
    0060: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
    0070: 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
 tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
 5 files changed, 4 deletions(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,5 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/virt/IORT",
-"tests/data/acpi/virt/IORT.memhp",
-"tests/data/acpi/virt/IORT.numamem",
-"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

-- 
2.20.1

In v8A, the PSTATE.IL bit is set for various kinds of illegal
exception return or mode-change attempts.  We already set PSTATE.IL
(or its AArch32 equivalent CPSR.IL) in all those cases, but we
weren't implementing the part of the behaviour where attempting to
execute an instruction with PSTATE.IL takes an immediate exception
with an appropriate syndrome value.

Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
to take an exception instead of whatever the instruction would have
been.

PSTATE.IL and CPSR.IL change only on exception entry, attempted
exception exit, and various AArch32 mode changes via cpsr_write().
These places generally already rebuild the hflags, so the only place
we need an extra rebuild_hflags call is in the illegal-return
codepath of the AArch64 exception_return helper.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Added missing returns; set IL bit in syndrome]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h           |  1 +
 target/arm/syndrome.h      |  5 +++++
 target/arm/translate.h     |  2 ++
 target/arm/helper-a64.c    |  1 +
 target/arm/helper.c        |  8 ++++++++
 target/arm/translate-a64.c | 11 +++++++++++
 target/arm/translate.c     | 21 +++++++++++++++++++++
 7 files changed, 49 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
 FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
 FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
            (cv << 24) | (cond << 20) | ti;
 }
 
+static inline uint32_t syn_illegalstate(void)
+{
+    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
+}
+
 #endif /* TARGET_ARM_SYNDROME_H */
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool hstr_active;
     /* True if memory operations require alignment */
     bool align_mem;
+    /* True if PSTATE.IL is set */
+    bool pstate_il;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ illegal_return:
     if (!arm_singlestep_active(env)) {
         env->pstate &= ~PSTATE_SS;
     }
+    helper_rebuild_hflags_a64(env, cur_el);
     qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                   "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
 }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
     }
 
+    if (env->uncached_cpsr & CPSR_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
     }
 
+    if (env->pstate & PSTATE_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
         /*
          * Set MTE_ACTIVE if any access may be Checked, and leave clear
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
     s->fp_access_checked = false;
     s->sve_access_checked = false;
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (dc_isar_feature(aa64_bti, s)) {
         if (s->base.num_insns == 1) {
             /*
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         return;
     }
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (cond == 0xf) {
         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
          * choose to UNDEF. In ARMv5 and above the space is used
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
         dc->vfp_enabled = 1;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     dc->insn = insn;
 
+    if (dc->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(dc));
+        return;
+    }
+
     if (dc->eci) {
         /*
          * For M-profile continuable instructions, ECI/ICI handling
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

It is confusing to have different exits from translation
for various conditions in separate functions.

Merge disas_a64_insn into its only caller.  Standardize
on the "s" name for the DisasContext, as the code from
disas_a64_insn had more instances.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
 1 file changed, 109 insertions(+), 115 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
     return false;
 }
 
-/* C3.1 A64 instruction index by encoding */
-static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-{
-    uint32_t insn;
-
-    s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
-    s->insn = insn;
-    s->base.pc_next += 4;
-
-    s->fp_access_checked = false;
-    s->sve_access_checked = false;
-
-    if (s->pstate_il) {
-        /*
-         * Illegal execution state. This has priority over BTI
-         * exceptions, but comes after instruction abort exceptions.
-         */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
-        return;
-    }
-
-    if (dc_isar_feature(aa64_bti, s)) {
-        if (s->base.num_insns == 1) {
-            /*
-             * At the first insn of the TB, compute s->guarded_page.
-             * We delayed computing this until successfully reading
-             * the first insn of the TB, above.  This (mostly) ensures
-             * that the softmmu tlb entry has been populated, and the
-             * page table GP bit is available.
-             *
-             * Note that we need to compute this even if btype == 0,
-             * because this value is used for BR instructions later
-             * where ENV is not available.
-             */
-            s->guarded_page = is_guarded_page(env, s);
-
-            /* First insn can have btype set to non-zero.  */
-            tcg_debug_assert(s->btype >= 0);
-
-            /*
-             * Note that the Branch Target Exception has fairly high
-             * priority -- below debugging exceptions but above most
-             * everything else.  This allows us to handle this now
-             * instead of waiting until the insn is otherwise decoded.
-             */
-            if (s->btype != 0
-                && s->guarded_page
-                && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                                   syn_btitrap(s->btype),
-                                   default_exception_el(s));
-                return;
-            }
-        } else {
-            /* Not the first insn: btype must be 0.  */
-            tcg_debug_assert(s->btype == 0);
-        }
-    }
-
-    switch (extract32(insn, 25, 4)) {
-    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
-        unallocated_encoding(s);
-        break;
-    case 0x2:
-        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
-            unallocated_encoding(s);
-        }
-        break;
-    case 0x8: case 0x9: /* Data processing - immediate */
-        disas_data_proc_imm(s, insn);
-        break;
-    case 0xa: case 0xb: /* Branch, exception generation and system insns */
-        disas_b_exc_sys(s, insn);
-        break;
-    case 0x4:
-    case 0x6:
-    case 0xc:
-    case 0xe:      /* Loads and stores */
-        disas_ldst(s, insn);
-        break;
-    case 0x5:
-    case 0xd:      /* Data processing - register */
-        disas_data_proc_reg(s, insn);
-        break;
-    case 0x7:
-    case 0xf:      /* Data processing - SIMD and floating point */
-        disas_data_proc_simd_fp(s, insn);
-        break;
-    default:
-        assert(FALSE); /* all 15 cases should be handled above */
-        break;
-    }
-
-    /* if we allocated any temporaries, free them here */
-    free_tmp_a64(s);
-
-    /*
-     * After execution of most insns, btype is reset to 0.
-     * Note that we set btype == -1 when the insn sets btype.
-     */
-    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
-        reset_btype(s);
-    }
-}
-
 static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                           CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 
 static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
-    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    DisasContext *s = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t insn;
 
-    if (dc->ss_active && !dc->pstate_ss) {
+    if (s->ss_active && !s->pstate_ss) {
         /* Singlestep state is Active-pending.
          * If we're in this state at the start of a TB then either
          *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * "did not step an insn" case, and so the syndrome ISV and EX
          * bits should be zero.
          */
-        assert(dc->base.num_insns == 1);
-        gen_swstep_exception(dc, 0, 0);
-        dc->base.is_jmp = DISAS_NORETURN;
-    } else {
-        disas_a64_insn(env, dc);
+        assert(s->base.num_insns == 1);
+        gen_swstep_exception(s, 0, 0);
+        s->base.is_jmp = DISAS_NORETURN;
+        return;
     }
 
-    translator_loop_temp_check(&dc->base);
+    s->pc_curr = s->base.pc_next;
+    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    s->insn = insn;
+    s->base.pc_next += 4;
+
+    s->fp_access_checked = false;
+    s->sve_access_checked = false;
+
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
+    if (dc_isar_feature(aa64_bti, s)) {
+        if (s->base.num_insns == 1) {
+            /*
+             * At the first insn of the TB, compute s->guarded_page.
+             * We delayed computing this until successfully reading
+             * the first insn of the TB, above.  This (mostly) ensures
+             * that the softmmu tlb entry has been populated, and the
+             * page table GP bit is available.
+             *
+             * Note that we need to compute this even if btype == 0,
+             * because this value is used for BR instructions later
+             * where ENV is not available.
+             */
+            s->guarded_page = is_guarded_page(env, s);
+
+            /* First insn can have btype set to non-zero.  */
+            tcg_debug_assert(s->btype >= 0);
+
+            /*
+             * Note that the Branch Target Exception has fairly high
+             * priority -- below debugging exceptions but above most
+             * everything else.  This allows us to handle this now
+             * instead of waiting until the insn is otherwise decoded.
+             */
+            if (s->btype != 0
+                && s->guarded_page
+                && !btype_destination_ok(insn, s->bt, s->btype)) {
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype),
+                                   default_exception_el(s));
+                return;
+            }
+        } else {
+            /* Not the first insn: btype must be 0.  */
+            tcg_debug_assert(s->btype == 0);
+        }
+    }
+
+    switch (extract32(insn, 25, 4)) {
+    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
+        unallocated_encoding(s);
+        break;
+    case 0x2:
+        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
+            unallocated_encoding(s);
+        }
+        break;
+    case 0x8: case 0x9: /* Data processing - immediate */
+        disas_data_proc_imm(s, insn);
+        break;
+    case 0xa: case 0xb: /* Branch, exception generation and system insns */
+        disas_b_exc_sys(s, insn);
+        break;
+    case 0x4:
+    case 0x6:
+    case 0xc:
+    case 0xe:      /* Loads and stores */
+        disas_ldst(s, insn);
+        break;
+    case 0x5:
+    case 0xd:      /* Data processing - register */
+        disas_data_proc_reg(s, insn);
+        break;
+    case 0x7:
+    case 0xf:      /* Data processing - SIMD and floating point */
+        disas_data_proc_simd_fp(s, insn);
+        break;
+    default:
+        assert(FALSE); /* all 15 cases should be handled above */
+        break;
+    }
+
+    /* if we allocated any temporaries, free them here */
+    free_tmp_a64(s);
+
+    /*
+     * After execution of most insns, btype is reset to 0.
+     * Note that we set btype == -1 when the insn sets btype.
+     */
+    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
+        reset_btype(s);
+    }
+
+    translator_loop_temp_check(&s->base);
 }
 
 static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-- 
2.20.1

By default, QEMU will allow devices to be plugged into a bus up to
the bus class's device count limit.  If the user creates a device on
the command line or via the monitor and doesn't explicitly specify
the bus to plug it in, QEMU will plug it into the first non-full bus
that it finds.

This is fine in most cases, but some machines have multiple buses of
a given type, some of which are dedicated to on-board devices and
some of which have an externally exposed connector for user-pluggable
devices. One example is I2C buses.

Provide a new function qbus_mark_full() so that a machine model can
mark this kind of "internal only" bus as 'full' after it has created
all the devices that should be plugged into that bus. The "find a
non-full bus" algorithm will then skip the internal-only bus when
looking for a place to plug in user-created devices.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
---
 include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
 softmmu/qdev-monitor.c |  7 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -XXX,XX +XXX,XX @@ struct BusState {
     HotplugHandler *hotplug_handler;
     int max_index;
     bool realized;
+    bool full;
     int num_children;
 
     /*
@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
    return bus->hotplug_handler;
 }
 
+/**
+ * qbus_mark_full: Mark this bus as full, so no more devices can be attached
+ * @bus: Bus to mark as full
+ *
+ * By default, QEMU will allow devices to be plugged into a bus up
+ * to the bus class's device count limit. Calling this function
+ * marks a particular bus as full, so that no more devices can be
+ * plugged into it. In particular this means that the bus will not
+ * be considered as a candidate for plugging in devices created by
+ * the user on the commandline or via the monitor.
+ * If a machine has multiple buses of a given type, such as I2C,
+ * where some of those buses in the real hardware are used only for
+ * internal devices and some are exposed via expansion ports, you
+ * can use this function to mark the internal-only buses as full
+ * after you have created all their internal devices. Then user
+ * created devices will appear on the expansion-port bus where
+ * guest software expects them.
+ */
+static inline void qbus_mark_full(BusState *bus)
+{
+    bus->full = true;
+}
+
 void device_listener_register(DeviceListener *listener);
 void device_listener_unregister(DeviceListener *listener);
 
diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
 
 static inline bool qbus_is_full(BusState *bus)
 {
-    BusClass *bus_class = BUS_GET_CLASS(bus);
+    BusClass *bus_class;
+
+    if (bus->full) {
+        return true;
+    }
+    bus_class = BUS_GET_CLASS(bus);
     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
 }
 
-- 
2.20.1

The mps2-tz boards use a data-driven structure to create the devices
that sit behind peripheral protection controllers.  Currently the
functions which create these devices are passed an 'opaque' pointer
which is always the address within the machine struct of the device
to create, and some "all devices need this" information like irqs and
addresses.

If a specific device needs more information than this, it is
currently not possible to pass that through from the PPCInfo
data structure. Add support for passing an extra data parameter,
so that we can more flexibly handle the needs of specific
device types. To provide some type-safety we make this extra
parameter a pointer to a union (which initially has no members).

In particular, we would like to be able to indicate which of the
i2c controllers are for on-board devices only and which are
connected to the external 'shield' expansion port; a subsequent
patch will use this mechanism for that purpose.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
     }
 }
 
+/* Union describing the device-specific extra data we pass to the devfn. */
+typedef union PPCExtraData {
+} PPCExtraData;
+
 /* Most of the devices in the AN505 FPGA image sit behind
  * Peripheral Protection Controllers. These data structures
  * define the layout of which devices sit behind which PPCs.
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
  */
 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
                                 const char *name, hwaddr size,
-                                const int *irqs);
+                                const int *irqs,
+                                const PPCExtraData *extradata);
 
 typedef struct PPCPortInfo {
     const char *name;
@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
     hwaddr addr;
     hwaddr size;
     int irqs[3]; /* currently no device needs more IRQ lines than this */
+    PPCExtraData extradata; /* to pass device-specific info to the devfn */
 } PPCPortInfo;
 
 typedef struct PPCInfo {
@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
                                     void *opaque,
                                     const char *name, hwaddr size,
-                                    const int *irqs)
+                                    const int *irqs,
+                                    const PPCExtraData *extradata)
 {
     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
      * and return a pointer to its MemoryRegion.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
 
 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
                                const char *name, hwaddr size,
-                               const int *irqs)
+                               const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is tx, rx, combined, in that order */
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     MPS2SCC *scc = opaque;
     DeviceState *sccdev;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
                                  const char *name, hwaddr size,
-                                 const int *irqs)
+                                 const int *irqs, const PPCExtraData *extradata)
 {
     MPS2FPGAIO *fpgaio = opaque;
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     SysBusDevice *s;
     NICInfo *nd = &nd_table[0];
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     /*
      * The AN524 makes the ethernet and USB share a PPC port.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     TZMPC *mpc = opaque;
     int i = mpc - &mms->mpc[0];
@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
 
 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
     PL080State *dma = opaque;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /*
      * The AN505 has five PL022 SPI controllers.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     ArmSbconI2CState *i2c = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     PL031State *pl031 = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
             }
 
             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
-                              pinfo->irqs);
+                              pinfo->irqs, &pinfo->extradata);
             portname = g_strdup_printf("port[%d]", port);
             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
                                      &error_fatal);
-- 
2.20.1

The various MPS2 boards have multiple I2C buses: typically a bus
dedicated to the audio configuration, one for the LCD touchscreen
controller, one for a DDR4 EEPROM, and two which are connected to the
external Shield expansion connector.  Mark the buses which are used
only for board-internal devices as 'full' so that if the user creates
i2c devices on the commandline without specifying a bus name then
they will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
 
 /* Union describing the device-specific extra data we pass to the devfn. */
 typedef union PPCExtraData {
+    bool i2c_internal;
 } PPCExtraData;
 
 /* Most of the devices in the AN505 FPGA image sit behind
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
     s = SYS_BUS_DEVICE(i2c);
     sysbus_realize(s, &error_fatal);
+
+    /*
+     * If this is an internal-use-only i2c bus, mark it full
+     * so that user-created i2c devices are not plugged into it.
+     * If we implement models of any on-board i2c devices that
+     * plug in to one of the internal-use-only buses, then we will
+     * need to create and plugging those in here before we mark the
+     * bus as full.
+     */
+    if (extradata->i2c_internal) {
+        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
+        qbus_mark_full(qbus);
+    }
+
     return sysbus_mmio_get_region(s, 0);
 }
 
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
-                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
-- 
2.20.1

The various MPS2 boards implemented in mps2.c have multiple I2C
buses: a bus dedicated to the audio configuration, one for the LCD
touchscreen controller, and two which are connected to the external
Shield expansion connector.  Mark the buses which are used only for
board-internal devices as 'full' so that if the user creates i2c
devices on the commandline without specifying a bus name then they
will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                          0x40023000,    /* Audio */
                                          0x40029000,    /* Shield0 */
                                          0x4002a000};   /* Shield1 */
-        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        DeviceState *dev;
+
+        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        if (i < 2) {
+            /*
+             * internal-only bus: mark it full to avoid user-created
+             * i2c devices being plugged into it.
+             */
+            BusState *qbus = qdev_get_child_bus(dev, "i2c");
+            qbus_mark_full(qbus);
+        }
     }
     create_unimplemented_device("i2s", 0x40024000, 0x400);
 
-- 
2.20.1