Series comparison

-[Qemu-devel] [PULL 0/6] target-arm queue
+[PULL 00/14] target-arm queue
-Last lot of patches for arm before softfreeze tomorrow...
+arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
 patches, which are somewhere between a bugfix and a new feature.
 thanks
 -- PMM
-The following changes since commit ef3a6af5e789ff078d1fef880f9dfb6adf18e8f1:
+The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
-  Merge remote-tracking branch 'remotes/kraxel/tags/vga-20181029-pull-request' into staging (2018-10-29 12:59:15 +0000)
+  Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181029
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
-for you to fetch changes up to 20cf5663734310a282e27b7389bc9f53ffe227e6:
+for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
-  tests/boot-serial-test: Add microbit board testcase (2018-10-29 15:19:48 +0000)
+  hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * microbit: Add the UART to our nRF51 SoC model
+ * hw/arm/smmuv3: Check 31st bit to see if CD is valid
- * Add a virtual Xilinx Versal board "xlnx-versal-virt"
+ * qemu-options.hx: Fix formatting of -machine memory-backend option
- * hw/arm/virt: Set VIRT_COMPAT_3_0 compat
+ * hw: aspeed_gpio: Fix memory size
  * hw/arm/nseries: Display hexadecimal value with '0x' prefix
  * Add sve-default-vector-length cpu property
  * docs: Update path that mentions deprecated.rst
  * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
  * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
  * target/arm: Report M-profile alignment faults correctly to the guest
  * target/arm: Add missing 'return's after calling v7m_exception_taken()
  * target/arm: Enforce that M-profile SP low 2 bits are always zero
 ----------------------------------------------------------------
-Edgar E. Iglesias (2):
+Joe Komlodi (1):
-      hw/arm: versal: Add a model of Xilinx Versal SoC
+      hw/arm/smmuv3: Check 31st bit to see if CD is valid
       hw/arm: versal: Add a virtual Xilinx Versal board
-Eric Auger (1):
+Joel Stanley (1):
-      hw/arm/virt: Set VIRT_COMPAT_3_0 compat
+      hw: aspeed_gpio: Fix memory size
-Julia Suvorova (3):
+Mao Zhongyi (1):
-      hw/char: Implement nRF51 SoC UART
+      docs: Update path that mentions deprecated.rst
       hw/arm/nrf51_soc: Connect UART to nRF51 SoC
       tests/boot-serial-test: Add microbit board testcase
- hw/arm/Makefile.objs                |   1 +
+Peter Maydell (7):
- hw/char/Makefile.objs               |   1 +
+      qemu-options.hx: Fix formatting of -machine memory-backend option
- include/hw/arm/nrf51_soc.h          |   3 +
+      target/arm: Enforce that M-profile SP low 2 bits are always zero
- include/hw/arm/xlnx-versal.h        | 122 +++++++++
+      target/arm: Add missing 'return's after calling v7m_exception_taken()
- include/hw/char/nrf51_uart.h        |  78 ++++++
+      target/arm: Report M-profile alignment faults correctly to the guest
- hw/arm/microbit.c                   |   2 +
+      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
- hw/arm/nrf51_soc.c                  |  20 ++
+      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
- hw/arm/virt.c                       |   4 +
+      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  hw/arm/xlnx-versal-virt.c           | 493 ++++++++++++++++++++++++++++++++++++
  hw/arm/xlnx-versal.c                | 323 +++++++++++++++++++++++
  hw/char/nrf51_uart.c                | 330 ++++++++++++++++++++++++
  tests/boot-serial-test.c            |  19 ++
  default-configs/aarch64-softmmu.mak |   1 +
  hw/char/trace-events                |   4 +
 files changed, 1401 insertions(+)
  create mode 100644 include/hw/arm/xlnx-versal.h
  create mode 100644 include/hw/char/nrf51_uart.h
  create mode 100644 hw/arm/xlnx-versal-virt.c
  create mode 100644 hw/arm/xlnx-versal.c
  create mode 100644 hw/char/nrf51_uart.c
+Philippe Mathieu-Daudé (1):
+      hw/arm/nseries: Display hexadecimal value with '0x' prefix
+Richard Henderson (3):
+      target/arm: Correctly bound length in sve_zcr_get_valid_len
+      target/arm: Export aarch64_sve_zcr_get_valid_len
+      target/arm: Add sve-default-vector-length cpu property
+ docs/system/arm/cpu-features.rst | 15 ++++++++++
+ configure                        |  2 +-
+ hw/arm/smmuv3-internal.h         |  2 +-
+ target/arm/cpu.h                 |  5 ++++
+ target/arm/internals.h           | 10 +++++++
+ hw/arm/nseries.c                 |  2 +-
+ hw/gpio/aspeed_gpio.c            |  3 +-
+ hw/intc/armv7m_nvic.c            | 40 +++++++++++++++++++--------
+ target/arm/cpu.c                 | 14 ++++++++--
+ target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++++++++++
+ target/arm/gdbstub.c             |  4 +++
+ target/arm/helper.c              |  8 ++++--
+ target/arm/m_helper.c            | 24 ++++++++++++----
+ target/arm/translate.c           |  3 ++
+ target/i386/cpu.c                |  2 +-
+ MAINTAINERS                      |  2 +-
+ qemu-options.hx                  | 30 +++++++++++---------
+files changed, 183 insertions(+), 43 deletions(-)

-[Qemu-devel] [PULL 3/6] hw/arm: versal: Add a virtual Xilinx Versal board
+[PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Joe Komlodi <joe.komlodi@xilinx.com>
-Add a virtual Xilinx Versal board.
+The bit to see if a CD is valid is the last bit of the first word of the CD.
-This board is based on the Xilinx Versal SoC. The exact
+Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
-details of what peripherals are attached to this board
+Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
 will remain in control of QEMU. QEMU will generate an
 FDT on the fly for Linux and other software to auto-discover
 peripherals.
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 [PMM: removed stray blank line at EOF]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs      |   2 +-
+ hw/arm/smmuv3-internal.h | 2 +-
- hw/arm/xlnx-versal-virt.c | 493 ++++++++++++++++++++++++++++++++++++++
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 494 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/xlnx-versal-virt.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/hw/arm/smmuv3-internal.h
-+++ b/hw/arm/Makefile.objs
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
+@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
- obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
- obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
+ /* CD fields */
- obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
--obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
+-#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
-+obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
++#define CD_VALID(x)   extract32((x)->word[0], 31, 1)
- obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
+ #define CD_ASID(x)    extract32((x)->word[1], 16, 16)
- obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
+ #define CD_TTB(x, sel)                                      \
- obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
+     ({                                                      \
 diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Xilinx Versal Virtual board.
 + *
 + * Copyright (c) 2018 Xilinx Inc.
 + * Written by Edgar E. Iglesias
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qemu/error-report.h"
 +#include "qapi/error.h"
 +#include "sysemu/device_tree.h"
 +#include "exec/address-spaces.h"
 +#include "hw/boards.h"
 +#include "hw/sysbus.h"
 +#include "hw/arm/sysbus-fdt.h"
 +#include "hw/arm/fdt.h"
 +#include "cpu.h"
 +#include "hw/arm/xlnx-versal.h"
 +
 +#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
 +#define XLNX_VERSAL_VIRT_MACHINE(obj) \
 +    OBJECT_CHECK(VersalVirt, (obj), TYPE_XLNX_VERSAL_VIRT_MACHINE)
 +
 +typedef struct VersalVirt {
 +    MachineState parent_obj;
 +
 +    Versal soc;
 +    MemoryRegion mr_ddr;
 +
 +    void *fdt;
 +    int fdt_size;
 +    struct {
 +        uint32_t gic;
 +        uint32_t ethernet_phy[2];
 +        uint32_t clk_125Mhz;
 +        uint32_t clk_25Mhz;
 +    } phandle;
 +    struct arm_boot_info binfo;
 +
 +    struct {
 +        bool secure;
 +    } cfg;
 +} VersalVirt;
 +
 +static void fdt_create(VersalVirt *s)
 +{
 +    MachineClass *mc = MACHINE_GET_CLASS(s);
 +    int i;
 +
 +    s->fdt = create_device_tree(&s->fdt_size);
 +    if (!s->fdt) {
 +        error_report("create_device_tree() failed");
 +        exit(1);
 +    }
 +
 +    /* Allocate all phandles.  */
 +    s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
 +    for (i = 0; i < ARRAY_SIZE(s->phandle.ethernet_phy); i++) {
 +        s->phandle.ethernet_phy[i] = qemu_fdt_alloc_phandle(s->fdt);
 +    }
 +    s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
 +    s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
 +
 +    /* Create /chosen node for load_dtb.  */
 +    qemu_fdt_add_subnode(s->fdt, "/chosen");
 +
 +    /* Header */
 +    qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
 +    qemu_fdt_setprop_cell(s->fdt, "/", "#size-cells", 0x2);
 +    qemu_fdt_setprop_cell(s->fdt, "/", "#address-cells", 0x2);
 +    qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
 +    qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
 +}
 +
 +static void fdt_add_clk_node(VersalVirt *s, const char *name,
 +                             unsigned int freq_hz, uint32_t phandle)
 +{
 +    qemu_fdt_add_subnode(s->fdt, name);
 +    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
 +    qemu_fdt_setprop_cell(s->fdt, name, "clock-frequency", freq_hz);
 +    qemu_fdt_setprop_cell(s->fdt, name, "#clock-cells", 0x0);
 +    qemu_fdt_setprop_string(s->fdt, name, "compatible", "fixed-clock");
 +    qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
 +}
 +
 +static void fdt_add_cpu_nodes(VersalVirt *s, uint32_t psci_conduit)
 +{
 +    int i;
 +
 +    qemu_fdt_add_subnode(s->fdt, "/cpus");
 +    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#size-cells", 0x0);
 +    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#address-cells", 1);
 +
 +    for (i = XLNX_VERSAL_NR_ACPUS - 1; i >= 0; i--) {
 +        char *name = g_strdup_printf("/cpus/cpu@%d", i);
 +        ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
 +
 +        qemu_fdt_add_subnode(s->fdt, name);
 +        qemu_fdt_setprop_cell(s->fdt, name, "reg", armcpu->mp_affinity);
 +        if (psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
 +            qemu_fdt_setprop_string(s->fdt, name, "enable-method", "psci");
 +        }
 +        qemu_fdt_setprop_string(s->fdt, name, "device_type", "cpu");
 +        qemu_fdt_setprop_string(s->fdt, name, "compatible",
 +                                armcpu->dtb_compatible);
 +        g_free(name);
 +    }
 +}
 +
 +static void fdt_add_gic_nodes(VersalVirt *s)
 +{
 +    char *nodename;
 +
 +    nodename = g_strdup_printf("/gic@%x", MM_GIC_APU_DIST_MAIN);
 +    qemu_fdt_add_subnode(s->fdt, nodename);
 +    qemu_fdt_setprop_cell(s->fdt, nodename, "phandle", s->phandle.gic);
 +    qemu_fdt_setprop_cells(s->fdt, nodename, "interrupts",
 +                           GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
 +                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 +    qemu_fdt_setprop(s->fdt, nodename, "interrupt-controller", NULL, 0);
 +    qemu_fdt_setprop_sized_cells(s->fdt, nodename, "reg",
 +                                 2, MM_GIC_APU_DIST_MAIN,
 +                                 2, MM_GIC_APU_DIST_MAIN_SIZE,
 +                                 2, MM_GIC_APU_REDIST_0,
 +                                 2, MM_GIC_APU_REDIST_0_SIZE);
 +    qemu_fdt_setprop_cell(s->fdt, nodename, "#interrupt-cells", 3);
 +    qemu_fdt_setprop_string(s->fdt, nodename, "compatible", "arm,gic-v3");
 +}
 +
 +static void fdt_add_timer_nodes(VersalVirt *s)
 +{
 +    const char compat[] = "arm,armv8-timer";
 +    uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
 +
 +    qemu_fdt_add_subnode(s->fdt, "/timer");
 +    qemu_fdt_setprop_cells(s->fdt, "/timer", "interrupts",
 +            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ, irqflags,
 +            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ, irqflags,
 +            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ, irqflags,
 +            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ, irqflags);
 +    qemu_fdt_setprop(s->fdt, "/timer", "compatible",
 +                     compat, sizeof(compat));
 +}
 +
 +static void fdt_add_uart_nodes(VersalVirt *s)
 +{
 +    uint64_t addrs[] = { MM_UART1, MM_UART0 };
 +    unsigned int irqs[] = { VERSAL_UART1_IRQ_0, VERSAL_UART0_IRQ_0 };
 +    const char compat[] = "arm,pl011\0arm,sbsa-uart";
 +    const char clocknames[] = "uartclk\0apb_pclk";
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
 +        char *name = g_strdup_printf("/uart@%" PRIx64, addrs[i]);
 +        qemu_fdt_add_subnode(s->fdt, name);
 +        qemu_fdt_setprop_cell(s->fdt, name, "current-speed", 115200);
 +        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
 +                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
 +        qemu_fdt_setprop(s->fdt, name, "clock-names",
 +                         clocknames, sizeof(clocknames));
 +
 +        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
 +                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
 +                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 +        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
 +                                     2, addrs[i], 2, 0x1000);
 +        qemu_fdt_setprop(s->fdt, name, "compatible",
 +                         compat, sizeof(compat));
 +        qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
 +
 +        if (addrs[i] == MM_UART0) {
 +            /* Select UART0.  */
 +            qemu_fdt_setprop_string(s->fdt, "/chosen", "stdout-path", name);
 +        }
 +        g_free(name);
 +    }
 +}
 +
 +static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
 +                                     uint32_t phandle)
 +{
 +    char *name = g_strdup_printf("%s/fixed-link", gemname);
 +
 +    qemu_fdt_add_subnode(s->fdt, name);
 +    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
 +    qemu_fdt_setprop_cells(s->fdt, name, "full-duplex");
 +    qemu_fdt_setprop_cell(s->fdt, name, "speed", 1000);
 +    g_free(name);
 +}
 +
 +static void fdt_add_gem_nodes(VersalVirt *s)
 +{
 +    uint64_t addrs[] = { MM_GEM1, MM_GEM0 };
 +    unsigned int irqs[] = { VERSAL_GEM1_IRQ_0, VERSAL_GEM0_IRQ_0 };
 +    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
 +    const char compat_gem[] = "cdns,zynqmp-gem\0cdns,gem";
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
 +        char *name = g_strdup_printf("/ethernet@%" PRIx64, addrs[i]);
 +        qemu_fdt_add_subnode(s->fdt, name);
 +
 +        fdt_add_fixed_link_nodes(s, name, s->phandle.ethernet_phy[i]);
 +        qemu_fdt_setprop_string(s->fdt, name, "phy-mode", "rgmii-id");
 +        qemu_fdt_setprop_cell(s->fdt, name, "phy-handle",
 +                              s->phandle.ethernet_phy[i]);
 +        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
 +                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz,
 +                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
 +        qemu_fdt_setprop(s->fdt, name, "clock-names",
 +                         clocknames, sizeof(clocknames));
 +        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
 +                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
 +                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
 +                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
 +                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 +        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
 +                                     2, addrs[i], 2, 0x1000);
 +        qemu_fdt_setprop(s->fdt, name, "compatible",
 +                         compat_gem, sizeof(compat_gem));
 +        qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 1);
 +        qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 0);
 +        g_free(name);
 +    }
 +}
 +
 +static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 +{
 +    Error *err = NULL;
 +    char **node_path;
 +    int n = 0;
 +
 +    node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    while (node_path[n]) {
 +        if (g_str_has_prefix(node_path[n], "/memory")) {
 +            qemu_fdt_nop_node(fdt, node_path[n]);
 +        }
 +        n++;
 +    }
 +    g_strfreev(node_path);
 +}
 +
 +static void fdt_add_memory_nodes(VersalVirt *s, void *fdt, uint64_t ram_size)
 +{
 +    /* Describes the various split DDR access regions.  */
 +    static const struct {
 +        uint64_t base;
 +        uint64_t size;
 +    } addr_ranges[] = {
 +        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
 +        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
 +        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
 +        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
 +    };
 +    uint64_t mem_reg_prop[8] = {0};
 +    uint64_t size = ram_size;
 +    Error *err = NULL;
 +    char *name;
 +    int i;
 +
 +    fdt_nop_memory_nodes(fdt, &err);
 +    if (err) {
 +        error_report_err(err);
 +        return;
 +    }
 +
 +    name = g_strdup_printf("/memory@%x", MM_TOP_DDR);
 +    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
 +        uint64_t mapsize;
 +
 +        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
 +
 +        mem_reg_prop[i * 2] = addr_ranges[i].base;
 +        mem_reg_prop[i * 2 + 1] = mapsize;
 +        size -= mapsize;
 +    }
 +    qemu_fdt_add_subnode(fdt, name);
 +    qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
 +
 +    switch (i) {
 +    case 1:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1]);
 +        break;
 +    case 2:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3]);
 +        break;
 +    case 3:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3],
 +                                     2, mem_reg_prop[4],
 +                                     2, mem_reg_prop[5]);
 +        break;
 +    case 4:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3],
 +                                     2, mem_reg_prop[4],
 +                                     2, mem_reg_prop[5],
 +                                     2, mem_reg_prop[6],
 +                                     2, mem_reg_prop[7]);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    g_free(name);
 +}
 +
 +static void versal_virt_modify_dtb(const struct arm_boot_info *binfo,
 +                                    void *fdt)
 +{
 +    VersalVirt *s = container_of(binfo, VersalVirt, binfo);
 +
 +    fdt_add_memory_nodes(s, fdt, binfo->ram_size);
 +}
 +
 +static void *versal_virt_get_dtb(const struct arm_boot_info *binfo,
 +                                  int *fdt_size)
 +{
 +    const VersalVirt *board = container_of(binfo, VersalVirt, binfo);
 +
 +    *fdt_size = board->fdt_size;
 +    return board->fdt;
 +}
 +
 +#define NUM_VIRTIO_TRANSPORT 32
 +static void create_virtio_regions(VersalVirt *s)
 +{
 +    int virtio_mmio_size = 0x200;
 +    int i;
 +
 +    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
 +        char *name = g_strdup_printf("virtio%d", i);;
 +        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
 +        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
 +        MemoryRegion *mr;
 +        DeviceState *dev;
 +        qemu_irq pic_irq;
 +
 +        pic_irq = qdev_get_gpio_in(DEVICE(&s->soc.fpd.apu.gic), irq);
 +        dev = qdev_create(NULL, "virtio-mmio");
 +        object_property_add_child(OBJECT(&s->soc), name, OBJECT(dev),
 +                                  &error_fatal);
 +        qdev_init_nofail(dev);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic_irq);
 +        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 +        memory_region_add_subregion(&s->soc.mr_ps, base, mr);
 +        sysbus_create_simple("virtio-mmio", base, pic_irq);
 +    }
 +
 +    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
 +        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
 +        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
 +        char *name = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
 +
 +        qemu_fdt_add_subnode(s->fdt, name);
 +        qemu_fdt_setprop(s->fdt, name, "dma-coherent", NULL, 0);
 +        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
 +                               GIC_FDT_IRQ_TYPE_SPI, irq,
 +                               GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
 +        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
 +                                     2, base, 2, virtio_mmio_size);
 +        qemu_fdt_setprop_string(s->fdt, name, "compatible", "virtio,mmio");
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_virt_init(MachineState *machine)
 +{
 +    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
 +    int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
 +
 +    /*
 +     * If the user provides an Operating System to be loaded, we expect them
 +     * to use the -kernel command line option.
 +     *
 +     * Users can load firmware or boot-loaders with the -device loader options.
 +     *
 +     * When loading an OS, we generate a dtb and let arm_load_kernel() select
 +     * where it gets loaded. This dtb will be passed to the kernel in x0.
 +     *
 +     * If there's no -kernel option, we generate a DTB and place it at 0x1000
 +     * for the bootloaders or firmware to pick up.
 +     *
 +     * If users want to provide their own DTB, they can use the -dtb option.
 +     * These dtb's will have their memory nodes modified to match QEMU's
 +     * selected ram_size option before they get passed to the kernel or fw.
 +     *
 +     * When loading an OS, we turn on QEMU's PSCI implementation with SMC
 +     * as the PSCI conduit. When there's no -kernel, we assume the user
 +     * provides EL3 firmware to handle PSCI.
 +     */
 +    if (machine->kernel_filename) {
 +        psci_conduit = QEMU_PSCI_CONDUIT_SMC;
 +    }
 +
 +    memory_region_allocate_system_memory(&s->mr_ddr, NULL, "ddr",
 +                                         machine->ram_size);
 +
 +    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
 +                          sizeof(s->soc), TYPE_XLNX_VERSAL);
 +    object_property_set_link(OBJECT(&s->soc), OBJECT(&s->mr_ddr),
 +                             "ddr", &error_abort);
 +    object_property_set_int(OBJECT(&s->soc), psci_conduit,
 +                            "psci-conduit", &error_abort);
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 +
 +    fdt_create(s);
 +    create_virtio_regions(s);
 +    fdt_add_gem_nodes(s);
 +    fdt_add_uart_nodes(s);
 +    fdt_add_gic_nodes(s);
 +    fdt_add_timer_nodes(s);
 +    fdt_add_cpu_nodes(s, psci_conduit);
 +    fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
 +    fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
 +
 +    /* Make the APU cpu address space visible to virtio and other
 +     * modules unaware of muliple address-spaces.  */
 +    memory_region_add_subregion_overlap(get_system_memory(),
 +                                        0, &s->soc.fpd.apu.mr, 0);
 +
 +    s->binfo.ram_size = machine->ram_size;
 +    s->binfo.kernel_filename = machine->kernel_filename;
 +    s->binfo.kernel_cmdline = machine->kernel_cmdline;
 +    s->binfo.initrd_filename = machine->initrd_filename;
 +    s->binfo.loader_start = 0x0;
 +    s->binfo.get_dtb = versal_virt_get_dtb;
 +    s->binfo.modify_dtb = versal_virt_modify_dtb;
 +    if (machine->kernel_filename) {
 +        arm_load_kernel(s->soc.fpd.apu.cpu[0], &s->binfo);
 +    } else {
 +        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
 +                                                  &s->binfo);
 +        /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
 +         * Offset things by 4K.  */
 +        s->binfo.loader_start = 0x1000;
 +        s->binfo.dtb_limit = 0x1000000;
 +        if (arm_load_dtb(s->binfo.loader_start,
 +                         &s->binfo, s->binfo.dtb_limit, as) < 0) {
 +            exit(EXIT_FAILURE);
 +        }
 +    }
 +}
 +
 +static void versal_virt_machine_instance_init(Object *obj)
 +{
 +}
 +
 +static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
 +    mc->desc = "Xilinx Versal Virtual development board";
 +    mc->init = versal_virt_init;
 +    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
 +    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
 +    mc->no_cdrom = true;
 +}
 +
 +static const TypeInfo versal_virt_machine_init_typeinfo = {
 +    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
 +    .parent     = TYPE_MACHINE,
 +    .class_init = versal_virt_machine_class_init,
 +    .instance_init = versal_virt_machine_instance_init,
 +    .instance_size = sizeof(VersalVirt),
 +};
 +
 +static void versal_virt_machine_init_register_types(void)
 +{
 +    type_register_static(&versal_virt_machine_init_typeinfo);
 +}
 +
 +type_init(versal_virt_machine_init_register_types)
 --
-.19.1
+.20.1

-New patch
+[PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option
+The documentation of the -machine memory-backend has some minor
+formatting errors:
+ * Misindentation of the initial line meant that the whole option
+   section is incorrectly indented in the HTML output compared to
+   the other -machine options
+ * The examples weren't indented, which meant that they were formatted
+   as plain run-on text including outputting the "::" as text.
+ * The a) b) list has no rst-format markup so it is rendered as
+   a single run-on paragraph
+Fix the formatting.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
+---
+ qemu-options.hx | 30 +++++++++++++++++-------------
+file changed, 17 insertions(+), 13 deletions(-)
+diff --git a/qemu-options.hx b/qemu-options.hx
+index XXXXXXX..XXXXXXX 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -XXX,XX +XXX,XX @@ SRST
+         Enables or disables ACPI Heterogeneous Memory Attribute Table
+         (HMAT) support. The default is off.
+-     ``memory-backend='id'``
++    ``memory-backend='id'``
+         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
+         Allows to use a memory backend as main RAM.
+         For example:
+         ::
+-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+-        -machine memory-backend=pc.ram
+-        -m 512M
++
++            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
++            -machine memory-backend=pc.ram
++            -m 512M
+         Migration compatibility note:
+-        a) as backend id one shall use value of 'default-ram-id', advertised by
+-        machine type (available via ``query-machines`` QMP command), if migration
+-        to/from old QEMU (<5.0) is expected.
+-        b) for machine types 4.0 and older, user shall
+-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+-        if migration to/from old QEMU (<5.0) is expected.
++
++        * as backend id one shall use value of 'default-ram-id', advertised by
++          machine type (available via ``query-machines`` QMP command), if migration
++          to/from old QEMU (<5.0) is expected.
++        * for machine types 4.0 and older, user shall
++          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
++          if migration to/from old QEMU (<5.0) is expected.
++
+         For example:
+         ::
+-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+-        -machine memory-backend=pc.ram
+-        -m 512M
++
++            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
++            -machine memory-backend=pc.ram
++            -m 512M
+ ERST
+ HXCOMM Deprecated by -machine
+--
+.20.1

-New patch
+[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero
+For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
+RES0H, which is to say that they must be hardwired to zero so that
+guest attempts to write non-zero values to them are ignored.
+Implement this behaviour by masking out the low bits:
+ * for writes to r13 by the gdbstub
+ * for writes to any of the various flavours of SP via MSR
+ * for writes to r13 via store_reg() in generated code
+Note that all the direct uses of cpu_R[] in translate.c are in places
+where the register is definitely not r13 (usually because that has
+been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
+UNDEF).
+All the other writes to regs[13] in C code are either:
+ * A-profile only code
+ * writes of values we can guarantee to be aligned, such as
+   - writes of previous-SP-value plus or minus a 4-aligned constant
+   - writes of the value in an SP limit register (which we already
+     enforce to be aligned)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
+---
+ target/arm/gdbstub.c   |  4 ++++
+ target/arm/m_helper.c  | 14 ++++++++------
+ target/arm/translate.c |  3 +++
+files changed, 15 insertions(+), 6 deletions(-)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/gdbstub.c
++++ b/target/arm/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+     if (n < 16) {
+         /* Core integer register.  */
++        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
++            /* M profile SP low bits are always 0 */
++            tmp &= ~3;
++        }
+         env->regs[n] = tmp;
+         return 4;
+     }
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_msp = val;
++            env->v7m.other_ss_msp = val & ~3;
+             return;
+         case 0x89: /* PSP_NS */
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_psp = val;
++            env->v7m.other_ss_psp = val & ~3;
+             return;
+         case 0x8a: /* MSPLIM_NS */
+             if (!env->v7m.secure) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
++            val &= ~0x3;
++
+             if (val < limit) {
+                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
+             }
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+         break;
+     case 8: /* MSP */
+         if (v7m_using_psp(env)) {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         } else {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         }
+         break;
+     case 9: /* PSP */
+         if (v7m_using_psp(env)) {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         } else {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         }
+         break;
+     case 10: /* MSPLIM */
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+          */
+         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
+         s->base.is_jmp = DISAS_JUMP;
++    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
++        /* For M-profile SP bits [1:0] are always zero */
++        tcg_gen_andi_i32(var, var, ~3);
+     }
+     tcg_gen_mov_i32(cpu_R[reg], var);
+     tcg_temp_free_i32(var);
+--
+.20.1

-New patch
+[PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken()
+In do_v7m_exception_exit(), we perform various checks as part of
+performing the exception return.  If one of these checks fails, the
+architecture requires that we take an appropriate exception on the
+existing stackframe.  We implement this by calling
+v7m_exception_taken() to set up to take the new exception, and then
+immediately returning from do_v7m_exception_exit() without proceeding
+any further with the unstack-and-exception-return process.
+In a couple of checks that are new in v8.1M, we forgot the "return"
+statement, with the effect that if bad code in the guest tripped over
+these checks we would set up to take a UsageFault exception but then
+blunder on trying to also unstack and return from the original
+exception, with the probable result that the guest would crash.
+Add the missing return statements.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
+---
+ target/arm/m_helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                         "stackframe: NSACR prevents clearing FPU registers\n");
+                     v7m_exception_taken(cpu, excret, true, false);
++                    return;
+                 } else if (!cpacr_pass) {
+                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                             exc_secure);
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                         "stackframe: CPACR prevents clearing FPU registers\n");
+                     v7m_exception_taken(cpu, excret, true, false);
++                    return;
+                 }
+             }
+             /* Clear s0..s15, FPSCR and VPR */
+--
+.20.1

-New patch
+[PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest
+For M-profile, we weren't reporting alignment faults triggered by the
+generic TCG code correctly to the guest.  These get passed into
+arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
+style exception.fsr value of 1.  We didn't check for this, and so
+they fell through into the default of "assume this is an MPU fault"
+and were reported to the guest as a data access violation MPU fault.
+Report these alignment faults as UsageFaults which set the UNALIGNED
+bit in the UFSR.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
+---
+ target/arm/m_helper.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
+         break;
+     case EXCP_UNALIGNED:
++        /* Unaligned faults reported by M-profile aware code */
+         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
+         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+         break;
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+             }
+             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+             break;
++        case 0x1: /* Alignment fault reported by generic code */
++            qemu_log_mask(CPU_LOG_INT,
++                          "...really UsageFault with UFSR.UNALIGNED\n");
++            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
++            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
++                                    env->v7m.secure);
++            break;
+         default:
+             /*
+              * All other FSR values are either MPU faults or "can't happen
+--
+.20.1

-New patch
+[PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+The ISCR.ISRPENDING bit is set when an external interrupt is pending.
+This is true whether that external interrupt is enabled or not.
+This means that we can't use 's->vectpending == 0' as a shortcut to
+"ISRPENDING is zero", because s->vectpending indicates only the
+highest priority pending enabled interrupt.
+Remove the incorrect optimization so that if there is no pending
+enabled interrupt we fall through to scanning through the whole
+interrupt array.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
+ {
+     int irq;
+-    /* We can shortcut if the highest priority pending interrupt
+-     * happens to be external or if there is nothing pending.
++    /*
++     * We can shortcut if the highest priority pending interrupt
++     * happens to be external; if not we need to check the whole
++     * vectors[] array.
+      */
+     if (s->vectpending > NVIC_FIRST_IRQ) {
+         return true;
+     }
+-    if (s->vectpending == 0) {
+-        return false;
+-    }
+     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
+         if (s->vectors[irq].pending) {
+--
+.20.1

-New patch
+[PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
+The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
+the register.  We were incorrectly masking it to 8 bits, so it would
+report the wrong value if the pending exception was greater than 256.
+Fix the bug.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+         /* VECTACTIVE */
+         val = cpu->env.v7m.exception;
+         /* VECTPENDING */
+-        val |= (s->vectpending & 0xff) << 12;
++        val |= (s->vectpending & 0x1ff) << 12;
+         /* ISRPENDING - set if any external IRQ is pending */
+         if (nvic_isrpending(s)) {
+             val |= (1 << 22);
+--
+.20.1

-New patch
+[PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
+In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
+the register is accessed NonSecure and the highest priority pending
+enabled exception (that would be returned in the VECTPENDING field)
+targets Secure, then the VECTPENDING field must read 1 rather than
+the exception number of the pending exception. Implement this.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
+file changed, 24 insertions(+), 7 deletions(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+     nvic_irq_update(s);
+ }
++static bool vectpending_targets_secure(NVICState *s)
++{
++    /* Return true if s->vectpending targets Secure state */
++    if (s->vectpending_is_s_banked) {
++        return true;
++    }
++    return !exc_is_banked(s->vectpending) &&
++        exc_targets_secure(s, s->vectpending);
++}
++
+ void armv7m_nvic_get_pending_irq_info(void *opaque,
+                                       int *pirq, bool *ptargets_secure)
+ {
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
+     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
+-    if (s->vectpending_is_s_banked) {
+-        targets_secure = true;
+-    } else {
+-        targets_secure = !exc_is_banked(pending) &&
+-            exc_targets_secure(s, pending);
+-    }
++    targets_secure = vectpending_targets_secure(s);
+     trace_nvic_get_pending_irq_info(pending, targets_secure);
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+         /* VECTACTIVE */
+         val = cpu->env.v7m.exception;
+         /* VECTPENDING */
+-        val |= (s->vectpending & 0x1ff) << 12;
++        if (s->vectpending) {
++            /*
++             * From v8.1M VECTPENDING must read as 1 if accessed as
++             * NonSecure and the highest priority pending and enabled
++             * exception targets Secure.
++             */
++            int vp = s->vectpending;
++            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
++                vectpending_targets_secure(s)) {
++                vp = 1;
++            }
++            val |= (vp & 0x1ff) << 12;
++        }
+         /* ISRPENDING - set if any external IRQ is pending */
+         if (nvic_isrpending(s)) {
+             val |= (1 << 22);
+--
+.20.1

-New patch
+[PULL 09/14] docs: Update path that mentions deprecated.rst
+From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+Missed in commit f3478392 "docs: Move deprecation, build
+and license info out of system/"
+Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure         | 2 +-
+ target/i386/cpu.c | 2 +-
+ MAINTAINERS       | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fi
+ if test -n "${deprecated_features}"; then
+     echo "Warning, deprecated features enabled."
+-    echo "Please see docs/system/deprecated.rst"
++    echo "Please see docs/about/deprecated.rst"
+     echo "  features: ${deprecated_features}"
+ fi
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
+  * none", but this is just for compatibility while libvirt isn't
+  * adapted to resolve CPU model versions before creating VMs.
+  * See "Runnability guarantee of CPU models" at
+- * docs/system/deprecated.rst.
++ * docs/about/deprecated.rst.
+  */
+ X86CPUVersion default_cpu_version = 1;
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
+ Incompatible changes
+ R: libvir-list@redhat.com
+-F: docs/system/deprecated.rst
++F: docs/about/deprecated.rst
+ Build System
+ ------------
+--
+.20.1

-[Qemu-devel] [PULL 6/6] tests/boot-serial-test: Add microbit board testcase
+[PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len
-From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-New mini-kernel test for nRF51 SoC UART.
+Currently, our only caller is sve_zcr_len_for_el, which has
 already masked the length extracted from ZCR_ELx, so the
 masking done here is a nop.  But we will shortly have uses
 from other locations, where the length will be unmasked.
-Signed-off-by: Julia Suvorova <jusual@mail.ru>
+Saturate the length to ARM_MAX_VQ instead of truncating to
-Acked-by: Thomas Huth <thuth@redhat.com>
+the low 4 bits.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/boot-serial-test.c | 19 +++++++++++++++++++
+ target/arm/helper.c | 4 +++-
-file changed, 19 insertions(+)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/boot-serial-test.c
+--- a/target/arm/helper.c
-+++ b/tests/boot-serial-test.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const uint8_t kernel_aarch64[] = {
+@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
-xfd, 0xff, 0xff, 0x17,                 /* b       -12 (loop) */
+ {
- };
+     uint32_t end_len;
-+static const uint8_t kernel_nrf51[] = {
+-    end_len = start_len &= 0xf;
-+    0x00, 0x00, 0x00, 0x00,                 /* Stack top address */
++    start_len = MIN(start_len, ARM_MAX_VQ - 1);
-+    0x09, 0x00, 0x00, 0x00,                 /* Reset handler address */
++    end_len = start_len;
 +    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get ENABLE */
 +    0x04, 0x21,                             /* movs r1, #4 */
 +    0x11, 0x60,                             /* str  r1, [r2] */
 +    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get STARTTX */
 +    0x01, 0x21,                             /* movs r1, #1 */
 +    0x11, 0x60,                             /* str  r1, [r2] */
 +    0x03, 0x4a,                             /* ldr  r2, [pc, #12] Get TXD */
 +    0x54, 0x21,                             /* movs r1, 'T' */
 +    0x11, 0x60,                             /* str  r1, [r2] */
 +    0xfe, 0xe7,                             /* b    . */
 +    0x00, 0x25, 0x00, 0x40,                 /* 0x40002500 = UART ENABLE */
 +    0x08, 0x20, 0x00, 0x40,                 /* 0x40002008 = UART STARTTX */
 +    0x1c, 0x25, 0x00, 0x40                  /* 0x4000251c = UART TXD */
 +};
 +
- typedef struct testdef {
+     if (!test_bit(start_len, cpu->sve_vq_map)) {
-     const char *arch;       /* Target architecture */
+         end_len = find_last_bit(cpu->sve_vq_map, start_len);
-     const char *machine;    /* Name of the machine */
+         assert(end_len < start_len);
@@ -XXX,XX +XXX,XX @@ static testdef_t tests[] = {
      { "hppa", "hppa", "", "SeaBIOS wants SYSTEM HALT" },
      { "aarch64", "virt", "-cpu cortex-a57", "TT", sizeof(kernel_aarch64),
        kernel_aarch64 },
 +    { "arm", "microbit", "", "T", sizeof(kernel_nrf51), kernel_nrf51 },
      { NULL }
  };
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 5/6] hw/arm/nrf51_soc: Connect UART to nRF51 SoC
+[PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len
-From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Wire up nRF51 UART in the corresponding SoC.
+Rename from sve_zcr_get_valid_len and make accessible
 from outside of helper.c.
-Signed-off-by: Julia Suvorova <jusual@mail.ru>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/nrf51_soc.h |  3 +++
+ target/arm/internals.h | 10 ++++++++++
- hw/arm/microbit.c          |  2 ++
+ target/arm/helper.c    |  4 ++--
- hw/arm/nrf51_soc.c         | 20 ++++++++++++++++++++
+files changed, 12 insertions(+), 2 deletions(-)
 files changed, 25 insertions(+)
-diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/nrf51_soc.h
+--- a/target/arm/internals.h
-+++ b/include/hw/arm/nrf51_soc.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
+ void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
- #include "hw/sysbus.h"
+ #endif /* CONFIG_TCG */
- #include "hw/arm/armv7m.h"
-+#include "hw/char/nrf51_uart.h"
++/**
++ * aarch64_sve_zcr_get_valid_len:
- #define TYPE_NRF51_SOC "nrf51-soc"
++ * @cpu: cpu context
- #define NRF51_SOC(obj) \
++ * @start_len: maximum len to consider
-@@ -XXX,XX +XXX,XX @@ typedef struct NRF51State {
++ *
-     /*< public >*/
++ * Return the maximum supported sve vector length <= @start_len.
-     ARMv7MState cpu;
++ * Note that both @start_len and the return value are in units
++ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
-+    NRF51UARTState uart;
++ */
-+
++uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
-     MemoryRegion iomem;
-     MemoryRegion sram;
+ enum arm_fprounding {
-     MemoryRegion flash;
+     FPROUNDING_TIEEVEN,
-diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/microbit.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/microbit.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
- #include "qapi/error.h"
+     return 0;
- #include "hw/boards.h"
+ }
- #include "hw/arm/arm.h"
-+#include "sysemu/sysemu.h"
+-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
- #include "exec/address-spaces.h"
++uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
  #include "hw/arm/nrf51_soc.h"
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
      sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
                            TYPE_NRF51_SOC);
 +    qdev_prop_set_chr(DEVICE(&s->nrf51), "serial0", serial_hd(0));
      object_property_set_link(soc, OBJECT(system_memory), "memory",
                               &error_fatal);
      object_property_set_bool(soc, true, "realized", &error_fatal);
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nrf51_soc.c
 +++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
  #define NRF51822_FLASH_SIZE     (256 * 1024)
  #define NRF51822_SRAM_SIZE      (16 * 1024)
 +#define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
 +
  static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
  {
-     NRF51State *s = NRF51_SOC(dev_soc);
+     uint32_t end_len;
-+    MemoryRegion *mr;
-     Error *err = NULL;
+@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
+         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
      if (!s->board_memory) {
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
      }
-     memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
+-    return sve_zcr_get_valid_len(cpu, zcr_len);
-+    /* UART */
++    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 +    object_property_set_bool(OBJECT(&s->uart), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
 +    memory_region_add_subregion_overlap(&s->container, UART_BASE, mr, 0);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->cpu),
 +                       BASE_TO_IRQ(UART_BASE)));
 +
      create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
      create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
      create_unimplemented_device("nrf51_soc.private",
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
      qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
                           ARM_CPU_TYPE_NAME("cortex-m0"));
      qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
 +
 +    sysbus_init_child_obj(obj, "uart", &s->uart, sizeof(s->uart),
 +                           TYPE_NRF51_UART);
 +    object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev",
 +                              &error_abort);
  }
- static Property nrf51_soc_properties[] = {
+ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 4/6] hw/char: Implement nRF51 SoC UART
+[PULL 12/14] target/arm: Add sve-default-vector-length cpu property
-From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Not implemented: CTS/NCTS, PSEL*.
+Mirror the behavour of /proc/sys/abi/sve_default_vector_length
 under the real linux kernel.  We have no way of passing along
 a real default across exec like the kernel can, but this is a
 decent way of adjusting the startup vector length of a process.
-Signed-off-by: Julia Suvorova <jusual@mail.ru>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
 [PMM: tweaked docs formatting, document -1 special-case,
  added fixup patch from RTH mentioning QEMU's maximum veclen.]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/Makefile.objs        |   1 +
+ docs/system/arm/cpu-features.rst | 15 ++++++++
- include/hw/char/nrf51_uart.h |  78 +++++++++
+ target/arm/cpu.h                 |  5 +++
- hw/char/nrf51_uart.c         | 330 +++++++++++++++++++++++++++++++++++
+ target/arm/cpu.c                 | 14 ++++++--
- hw/char/trace-events         |   4 +
+ target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
-files changed, 413 insertions(+)
+files changed, 92 insertions(+), 2 deletions(-)
  create mode 100644 include/hw/char/nrf51_uart.h
  create mode 100644 hw/char/nrf51_uart.c
-diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/Makefile.objs
+--- a/docs/system/arm/cpu-features.rst
-+++ b/hw/char/Makefile.objs
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
- common-obj-$(CONFIG_IPACK) += ipoctal232.o
+ lengths is to explicitly enable each desired length.  Therefore only
- common-obj-$(CONFIG_ESCC) += escc.o
+ example's (1), (4), and (6) exhibit recommended uses of the properties.
-+common-obj-$(CONFIG_NRF51_SOC) += nrf51_uart.o
- common-obj-$(CONFIG_PARALLEL) += parallel.o
++SVE User-mode Default Vector Length Property
- common-obj-$(CONFIG_PARALLEL) += parallel-isa.o
++--------------------------------------------
  common-obj-$(CONFIG_PL011) += pl011.o
 diff --git a/include/hw/char/nrf51_uart.h b/include/hw/char/nrf51_uart.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/char/nrf51_uart.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * nRF51 SoC UART emulation
 + *
 + * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
-+#ifndef NRF51_UART_H
++For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
-+#define NRF51_UART_H
++defined to mirror the Linux kernel parameter file
 +``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
 +is in units of bytes and must be between 16 and 8192.
 +If not specified, the default vector length is 64.
 +
-+#include "hw/sysbus.h"
++If the default length is larger than the maximum vector length enabled,
-+#include "chardev/char-fe.h"
++the actual vector length will be reduced.  Note that the maximum vector
-+#include "hw/registerfields.h"
++length supported by QEMU is 256.
 +
-+#define UART_FIFO_LENGTH 6
++If this property is set to ``-1`` then the default vector length
-+#define UART_BASE 0x40002000
++is set to the maximum possible length.
-+#define UART_SIZE 0x1000
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      /* Used to set the maximum vector length the cpu will support.  */
      uint32_t sve_max_vq;
 +#ifdef CONFIG_USER_ONLY
 +    /* Used to set the default vector length at process start. */
 +    uint32_t sve_default_vq;
 +#endif
 +
-+#define TYPE_NRF51_UART "nrf51_soc.uart"
+     /*
-+#define NRF51_UART(obj) OBJECT_CHECK(NRF51UARTState, (obj), TYPE_NRF51_UART)
+      * In sve_vq_map each set bit is a supported vector length of
       * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
          env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
          /* with reasonable vector length */
          if (cpu_isar_feature(aa64_sve, cpu)) {
 -            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
 +            env->vfp.zcr_el[1] =
 +                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
          }
          /*
           * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
      QLIST_INIT(&cpu->pre_el_change_hooks);
      QLIST_INIT(&cpu->el_change_hooks);
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_USER_ONLY
 +# ifdef TARGET_AARCH64
 +    /*
 +     * The linux kernel defaults to 512-bit vectors, when sve is supported.
 +     * See documentation for /proc/sys/abi/sve_default_vector_length, and
 +     * our corresponding sve-default-vector-length cpu property.
 +     */
 +    cpu->sve_default_vq = 4;
 +# endif
 +#else
      /* Our inbound IRQ and FIQ lines */
      if (kvm_enabled()) {
          /* VIRQ and VFIQ are unused with KVM but we add them to maintain
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
      cpu->isar.id_aa64pfr0 = t;
  }
 +#ifdef CONFIG_USER_ONLY
 +/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t default_len, default_vq, remainder;
 +
-+REG32(UART_STARTRX, 0x000)
++    if (!visit_type_int32(v, name, &default_len, errp)) {
 +REG32(UART_STOPRX, 0x004)
 +REG32(UART_STARTTX, 0x008)
 +REG32(UART_STOPTX, 0x00C)
 +REG32(UART_SUSPEND, 0x01C)
 +
 +REG32(UART_CTS, 0x100)
 +REG32(UART_NCTS, 0x104)
 +REG32(UART_RXDRDY, 0x108)
 +REG32(UART_TXDRDY, 0x11C)
 +REG32(UART_ERROR, 0x124)
 +REG32(UART_RXTO, 0x144)
 +
 +REG32(UART_INTEN, 0x300)
 +    FIELD(UART_INTEN, CTS, 0, 1)
 +    FIELD(UART_INTEN, NCTS, 1, 1)
 +    FIELD(UART_INTEN, RXDRDY, 2, 1)
 +    FIELD(UART_INTEN, TXDRDY, 7, 1)
 +    FIELD(UART_INTEN, ERROR, 9, 1)
 +    FIELD(UART_INTEN, RXTO, 17, 1)
 +REG32(UART_INTENSET, 0x304)
 +REG32(UART_INTENCLR, 0x308)
 +REG32(UART_ERRORSRC, 0x480)
 +REG32(UART_ENABLE, 0x500)
 +REG32(UART_PSELRTS, 0x508)
 +REG32(UART_PSELTXD, 0x50C)
 +REG32(UART_PSELCTS, 0x510)
 +REG32(UART_PSELRXD, 0x514)
 +REG32(UART_RXD, 0x518)
 +REG32(UART_TXD, 0x51C)
 +REG32(UART_BAUDRATE, 0x524)
 +REG32(UART_CONFIG, 0x56C)
 +
 +typedef struct NRF51UARTState {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion iomem;
 +    CharBackend chr;
 +    qemu_irq irq;
 +    guint watch_tag;
 +
 +    uint8_t rx_fifo[UART_FIFO_LENGTH];
 +    unsigned int rx_fifo_pos;
 +    unsigned int rx_fifo_len;
 +
 +    uint32_t reg[0x56C];
 +
 +    bool rx_started;
 +    bool tx_started;
 +    bool pending_tx_byte;
 +    bool enabled;
 +} NRF51UARTState;
 +
 +#endif
 diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/char/nrf51_uart.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * nRF51 SoC UART emulation
 + *
 + * See nRF51 Series Reference Manual, "29 Universal Asynchronous
 + * Receiver/Transmitter" for hardware specifications:
 + * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf
 + *
 + * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/char/nrf51_uart.h"
 +#include "trace.h"
 +
 +static void nrf51_uart_update_irq(NRF51UARTState *s)
 +{
 +    bool irq = false;
 +
 +    irq |= (s->reg[R_UART_RXDRDY] &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXDRDY_MASK));
 +    irq |= (s->reg[R_UART_TXDRDY] &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_TXDRDY_MASK));
 +    irq |= (s->reg[R_UART_ERROR]  &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_ERROR_MASK));
 +    irq |= (s->reg[R_UART_RXTO]   &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXTO_MASK));
 +
 +    qemu_set_irq(s->irq, irq);
 +}
 +
 +static uint64_t uart_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    uint64_t r;
 +
 +    if (!s->enabled) {
 +        return 0;
 +    }
 +
 +    switch (addr) {
 +    case A_UART_RXD:
 +        r = s->rx_fifo[s->rx_fifo_pos];
 +        if (s->rx_started && s->rx_fifo_len) {
 +            s->rx_fifo_pos = (s->rx_fifo_pos + 1) % UART_FIFO_LENGTH;
 +            s->rx_fifo_len--;
 +            if (s->rx_fifo_len) {
 +                s->reg[R_UART_RXDRDY] = 1;
 +                nrf51_uart_update_irq(s);
 +            }
 +            qemu_chr_fe_accept_input(&s->chr);
 +        }
 +        break;
 +    case A_UART_INTENSET:
 +    case A_UART_INTENCLR:
 +    case A_UART_INTEN:
 +        r = s->reg[R_UART_INTEN];
 +        break;
 +    default:
 +        r = s->reg[addr / 4];
 +        break;
 +    }
 +
 +    trace_nrf51_uart_read(addr, r, size);
 +
 +    return r;
 +}
 +
 +static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    int r;
 +    uint8_t c = s->reg[R_UART_TXD];
 +
 +    s->watch_tag = 0;
 +
 +    r = qemu_chr_fe_write(&s->chr, &c, 1);
 +    if (r <= 0) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +        if (!s->watch_tag) {
 +            /* The hardware has no transmit error reporting,
 +             * so silently drop the byte
 +             */
 +            goto buffer_drained;
 +        }
 +        return FALSE;
 +    }
 +
 +buffer_drained:
 +    s->reg[R_UART_TXDRDY] = 1;
 +    s->pending_tx_byte = false;
 +    return FALSE;
 +}
 +
 +static void uart_cancel_transmit(NRF51UARTState *s)
 +{
 +    if (s->watch_tag) {
 +        g_source_remove(s->watch_tag);
 +        s->watch_tag = 0;
 +    }
 +}
 +
 +static void uart_write(void *opaque, hwaddr addr,
 +                       uint64_t value, unsigned int size)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    trace_nrf51_uart_write(addr, value, size);
 +
 +    if (!s->enabled && (addr != A_UART_ENABLE)) {
 +        return;
 +    }
 +
-+    switch (addr) {
++    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
-+    case A_UART_TXD:
++    if (default_len == -1) {
-+        if (!s->pending_tx_byte && s->tx_started) {
++        cpu->sve_default_vq = ARM_MAX_VQ;
 +            s->reg[R_UART_TXD] = value;
 +            s->pending_tx_byte = true;
 +            uart_transmit(NULL, G_IO_OUT, s);
 +        }
 +        break;
 +    case A_UART_INTEN:
 +        s->reg[R_UART_INTEN] = value;
 +        break;
 +    case A_UART_INTENSET:
 +        s->reg[R_UART_INTEN] |= value;
 +        break;
 +    case A_UART_INTENCLR:
 +        s->reg[R_UART_INTEN] &= ~value;
 +        break;
 +    case A_UART_TXDRDY ... A_UART_RXTO:
 +        s->reg[addr / 4] = value;
 +        break;
 +    case A_UART_ERRORSRC:
 +        s->reg[addr / 4] &= ~value;
 +        break;
 +    case A_UART_RXD:
 +        break;
 +    case A_UART_RXDRDY:
 +        if (value == 0) {
 +            s->reg[R_UART_RXDRDY] = 0;
 +        }
 +        break;
 +    case A_UART_STARTTX:
 +        if (value == 1) {
 +            s->tx_started = true;
 +        }
 +        break;
 +    case A_UART_STARTRX:
 +        if (value == 1) {
 +            s->rx_started = true;
 +        }
 +        break;
 +    case A_UART_ENABLE:
 +        if (value) {
 +            if (value == 4) {
 +                s->enabled = true;
 +            }
 +            break;
 +        }
 +        s->enabled = false;
 +        value = 1;
 +        /* fall through */
 +    case A_UART_SUSPEND:
 +    case A_UART_STOPTX:
 +        if (value == 1) {
 +            s->tx_started = false;
 +        }
 +        /* fall through */
 +    case A_UART_STOPRX:
 +        if (addr != A_UART_STOPTX && value == 1) {
 +            s->rx_started = false;
 +            s->reg[R_UART_RXTO] = 1;
 +        }
 +        break;
 +    default:
 +        s->reg[addr / 4] = value;
 +        break;
 +    }
 +    nrf51_uart_update_irq(s);
 +}
 +
 +static const MemoryRegionOps uart_ops = {
 +    .read =  uart_read,
 +    .write = uart_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void nrf51_uart_reset(DeviceState *dev)
 +{
 +    NRF51UARTState *s = NRF51_UART(dev);
 +
 +    s->pending_tx_byte = 0;
 +
 +    uart_cancel_transmit(s);
 +
 +    memset(s->reg, 0, sizeof(s->reg));
 +
 +    s->reg[R_UART_PSELRTS] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELTXD] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELCTS] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELRXD] = 0xFFFFFFFF;
 +    s->reg[R_UART_BAUDRATE] = 0x4000000;
 +
 +    s->rx_fifo_len = 0;
 +    s->rx_fifo_pos = 0;
 +    s->rx_started = false;
 +    s->tx_started = false;
 +    s->enabled = false;
 +}
 +
 +static void uart_receive(void *opaque, const uint8_t *buf, int size)
 +{
 +
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    int i;
 +
 +    if (size == 0 || s->rx_fifo_len >= UART_FIFO_LENGTH) {
 +        return;
 +    }
 +
-+    for (i = 0; i < size; i++) {
++    default_vq = default_len / 16;
-+        uint32_t pos = (s->rx_fifo_pos + s->rx_fifo_len) % UART_FIFO_LENGTH;
++    remainder = default_len % 16;
-+        s->rx_fifo[pos] = buf[i];
++
-+        s->rx_fifo_len++;
++    /*
 +     * Note that the 512 max comes from include/uapi/asm/sve_context.h
 +     * and is the maximum architectural width of ZCR_ELx.LEN.
 +     */
 +    if (remainder || default_vq < 1 || default_vq > 512) {
 +        error_setg(errp, "cannot set sve-default-vector-length");
 +        if (remainder) {
 +            error_append_hint(errp, "Vector length not a multiple of 16\n");
 +        } else if (default_vq < 1) {
 +            error_append_hint(errp, "Vector length smaller than 16\n");
 +        } else {
 +            error_append_hint(errp, "Vector length larger than %d\n",
 +                              512 * 16);
 +        }
 +        return;
 +    }
 +
-+    s->reg[R_UART_RXDRDY] = 1;
++    cpu->sve_default_vq = default_vq;
 +    nrf51_uart_update_irq(s);
 +}
 +
-+static int uart_can_receive(void *opaque)
++static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
-+    NRF51UARTState *s = NRF51_UART(opaque);
++    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t value = cpu->sve_default_vq * 16;
 +
-+    return s->rx_started ? (UART_FIFO_LENGTH - s->rx_fifo_len) : 0;
++    visit_type_int32(v, name, &value, errp);
 +}
++#endif
 +
-+static void uart_event(void *opaque, int event)
+ void aarch64_add_sve_properties(Object *obj)
-+{
+ {
-+    NRF51UARTState *s = NRF51_UART(opaque);
+     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
          object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                              cpu_arm_set_sve_vq, NULL, NULL);
      }
 +
-+    if (event == CHR_EVENT_BREAK) {
++#ifdef CONFIG_USER_ONLY
-+        s->reg[R_UART_ERRORSRC] |= 3;
++    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
-+        s->reg[R_UART_ERROR] = 1;
++    object_property_add(obj, "sve-default-vector-length", "int32",
-+        nrf51_uart_update_irq(s);
++                        cpu_arm_get_sve_default_vec_len,
-+    }
++                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
-+}
++#endif
-+
+ }
-+static void nrf51_uart_realize(DeviceState *dev, Error **errp)
-+{
+ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
 +    NRF51UARTState *s = NRF51_UART(dev);
 +
 +    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
 +                             uart_event, NULL, s, NULL, true);
 +}
 +
 +static void nrf51_uart_init(Object *obj)
 +{
 +    NRF51UARTState *s = NRF51_UART(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &uart_ops, s,
 +                          "nrf51_soc.uart", UART_SIZE);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
 +static int nrf51_uart_post_load(void *opaque, int version_id)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    if (s->pending_tx_byte) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +    }
 +
 +    return 0;
 +}
 +
 +static const VMStateDescription nrf51_uart_vmstate = {
 +    .name = "nrf51_soc.uart",
 +    .post_load = nrf51_uart_post_load,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(reg, NRF51UARTState, 0x56C),
 +        VMSTATE_UINT8_ARRAY(rx_fifo, NRF51UARTState, UART_FIFO_LENGTH),
 +        VMSTATE_UINT32(rx_fifo_pos, NRF51UARTState),
 +        VMSTATE_UINT32(rx_fifo_len, NRF51UARTState),
 +        VMSTATE_BOOL(rx_started, NRF51UARTState),
 +        VMSTATE_BOOL(tx_started, NRF51UARTState),
 +        VMSTATE_BOOL(pending_tx_byte, NRF51UARTState),
 +        VMSTATE_BOOL(enabled, NRF51UARTState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property nrf51_uart_properties[] = {
 +    DEFINE_PROP_CHR("chardev", NRF51UARTState, chr),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void nrf51_uart_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = nrf51_uart_reset;
 +    dc->realize = nrf51_uart_realize;
 +    dc->props = nrf51_uart_properties;
 +    dc->vmsd = &nrf51_uart_vmstate;
 +}
 +
 +static const TypeInfo nrf51_uart_info = {
 +    .name = TYPE_NRF51_UART,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(NRF51UARTState),
 +    .instance_init = nrf51_uart_init,
 +    .class_init = nrf51_uart_class_init
 +};
 +
 +static void nrf51_uart_register_types(void)
 +{
 +    type_register_static(&nrf51_uart_info);
 +}
 +
 +type_init(nrf51_uart_register_types)
 diff --git a/hw/char/trace-events b/hw/char/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/trace-events
 +++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backe
  cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
  cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
  cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
 +
 +# hw/char/nrf51_uart.c
 +nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 +nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 1/6] hw/arm/virt: Set VIRT_COMPAT_3_0 compat
+[PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix
-From: Eric Auger <eric.auger@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We are missing the VIRT_COMPAT_3_0 definition and setting.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Let's add them.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210726150953.1218690-1-f4bug@amsat.org
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20181024085602.16611-1-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 4 ++++
+ hw/arm/nseries.c | 2 +-
-file changed, 4 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/hw/arm/nseries.c
-+++ b/hw/arm/virt.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_3_1_options(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
- }
+     default:
- DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
+     bad_cmd:
+         qemu_log_mask(LOG_GUEST_ERROR,
-+#define VIRT_COMPAT_3_0 \
+-                      "%s: unknown command %02x\n", __func__, s->cmd);
-+    HW_COMPAT_3_0
++                      "%s: unknown command 0x%02x\n", __func__, s->cmd);
-+
+         break;
- static void virt_3_0_instance_init(Object *obj)
+     }
  {
      virt_3_1_instance_init(obj);
@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
  static void virt_machine_3_0_options(MachineClass *mc)
  {
      virt_machine_3_1_options(mc);
 +    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_3_0);
  }
  DEFINE_VIRT_MACHINE(3, 0)
 --
-.19.1
+.20.1

-[Qemu-devel] [PULL 2/6] hw/arm: versal: Add a model of Xilinx Versal SoC
+[PULL 14/14] hw: aspeed_gpio: Fix memory size
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Joel Stanley <joel@jms.id.au>
-Add a model of Xilinx Versal SoC.
+The macro used to calculate the maximum memory size of the MMIO region
 had a mistake, causing all GPIO models to create a mapping of 0x9D8.
 The intent was to have it be 0x9D8 - 0x800.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+region set aside for the GPIO controller.
 On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
 regions would overlap. Worse was the 1.8V controller would map over the
 top of the following peripheral, which happens to be the RTC.
 The mmio region used by each device is a maximum of 2KB, so avoid the
 calculations and hard code this as the maximum.
 Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20210713065854.134634-2-joel@jms.id.au
 [PMM: fix autocorrect error in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                |   1 +
+ hw/gpio/aspeed_gpio.c | 3 +--
- include/hw/arm/xlnx-versal.h        | 122 +++++++++++
+file changed, 1 insertion(+), 2 deletions(-)
  hw/arm/xlnx-versal.c                | 323 ++++++++++++++++++++++++++++
  default-configs/aarch64-softmmu.mak |   1 +
 files changed, 447 insertions(+)
  create mode 100644 include/hw/arm/xlnx-versal.h
  create mode 100644 hw/arm/xlnx-versal.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/hw/gpio/aspeed_gpio.c
-+++ b/hw/arm/Makefile.objs
++++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
  obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 +obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/xlnx-versal.h
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #define GPIO_1_8V_MEM_SIZE            0x9D8
-+ * Model of the Xilinx Versal
+ #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
-+ *
+                                       GPIO_1_8V_REG_OFFSET) >> 2)
-+ * Copyright (c) 2018 Xilinx Inc.
+-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
-+ * Written by Edgar E. Iglesias
-+ *
+ static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
-+ * This program is free software; you can redistribute it and/or modify
+ {
-+ * it under the terms of the GNU General Public License version 2 or
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
-+ * (at your option) any later version.
+     }
-+ */
-+
+     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-+#ifndef XLNX_VERSAL_H
+-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
-+#define XLNX_VERSAL_H
++            TYPE_ASPEED_GPIO, 0x800);
-+
-+#include "hw/sysbus.h"
+     sysbus_init_mmio(sbd, &s->iomem);
-+#include "hw/arm/arm.h"
+ }
 +#include "hw/intc/arm_gicv3.h"
 +
 +#define TYPE_XLNX_VERSAL "xlnx-versal"
 +#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
 +
 +#define XLNX_VERSAL_NR_ACPUS   2
 +#define XLNX_VERSAL_NR_UARTS   2
 +#define XLNX_VERSAL_NR_GEMS    2
 +#define XLNX_VERSAL_NR_IRQS    256
 +
 +typedef struct Versal {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    struct {
 +        struct {
 +            MemoryRegion mr;
 +            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
 +            GICv3State gic;
 +        } apu;
 +    } fpd;
 +
 +    MemoryRegion mr_ps;
 +
 +    struct {
 +        /* 4 ranges to access DDR.  */
 +        MemoryRegion mr_ddr_ranges[4];
 +    } noc;
 +
 +    struct {
 +        MemoryRegion mr_ocm;
 +
 +        struct {
 +            SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
 +            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
 +        } iou;
 +    } lpd;
 +
 +    struct {
 +        MemoryRegion *mr_ddr;
 +        uint32_t psci_conduit;
 +    } cfg;
 +} Versal;
 +
 +/* Memory-map and IRQ definitions. Copied a subset from
 + * auto-generated files.  */
 +
 +#define VERSAL_GIC_MAINT_IRQ        9
 +#define VERSAL_TIMER_VIRT_IRQ       11
 +#define VERSAL_TIMER_S_EL1_IRQ      13
 +#define VERSAL_TIMER_NS_EL1_IRQ     14
 +#define VERSAL_TIMER_NS_EL2_IRQ     10
 +
 +#define VERSAL_UART0_IRQ_0         18
 +#define VERSAL_UART1_IRQ_0         19
 +#define VERSAL_GEM0_IRQ_0          56
 +#define VERSAL_GEM0_WAKE_IRQ_0     57
 +#define VERSAL_GEM1_IRQ_0          58
 +#define VERSAL_GEM1_WAKE_IRQ_0     59
 +
 +/* Architecturally eserved IRQs suitable for virtualization.  */
 +#define VERSAL_RSVD_HIGH_IRQ_FIRST 160
 +#define VERSAL_RSVD_HIGH_IRQ_LAST  255
 +
 +#define MM_TOP_RSVD                 0xa0000000U
 +#define MM_TOP_RSVD_SIZE            0x4000000
 +#define MM_GIC_APU_DIST_MAIN        0xf9000000U
 +#define MM_GIC_APU_DIST_MAIN_SIZE   0x10000
 +#define MM_GIC_APU_REDIST_0         0xf9080000U
 +#define MM_GIC_APU_REDIST_0_SIZE    0x80000
 +
 +#define MM_UART0                    0xff000000U
 +#define MM_UART0_SIZE               0x10000
 +#define MM_UART1                    0xff010000U
 +#define MM_UART1_SIZE               0x10000
 +
 +#define MM_GEM0                     0xff0c0000U
 +#define MM_GEM0_SIZE                0x10000
 +#define MM_GEM1                     0xff0d0000U
 +#define MM_GEM1_SIZE                0x10000
 +
 +#define MM_OCM                      0xfffc0000U
 +#define MM_OCM_SIZE                 0x40000
 +
 +#define MM_TOP_DDR                  0x0
 +#define MM_TOP_DDR_SIZE             0x80000000U
 +#define MM_TOP_DDR_2                0x800000000ULL
 +#define MM_TOP_DDR_2_SIZE           0x800000000ULL
 +#define MM_TOP_DDR_3                0xc000000000ULL
 +#define MM_TOP_DDR_3_SIZE           0x4000000000ULL
 +#define MM_TOP_DDR_4                0x10000000000ULL
 +#define MM_TOP_DDR_4_SIZE           0xb780000000ULL
 +
 +#define MM_PSM_START                0xffc80000U
 +#define MM_PSM_END                  0xffcf0000U
 +
 +#define MM_CRL                      0xff5e0000U
 +#define MM_CRL_SIZE                 0x300000
 +#define MM_IOU_SCNTR                0xff130000U
 +#define MM_IOU_SCNTR_SIZE           0x10000
 +#define MM_IOU_SCNTRS               0xff140000U
 +#define MM_IOU_SCNTRS_SIZE          0x10000
 +#define MM_FPD_CRF                  0xfd1a0000U
 +#define MM_FPD_CRF_SIZE             0x140000
 +#endif
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Xilinx Versal SoC model.
 + *
 + * Copyright (c) 2018 Xilinx Inc.
 + * Written by Edgar E. Iglesias
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "qemu-common.h"
 +#include "qemu/log.h"
 +#include "hw/sysbus.h"
 +#include "net/net.h"
 +#include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
 +#include "hw/arm/arm.h"
 +#include "kvm_arm.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/intc/arm_gicv3_common.h"
 +#include "hw/arm/xlnx-versal.h"
 +
 +#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 +#define GEM_REVISION        0x40070106
 +
 +static void versal_create_apu_cpus(Versal *s)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
 +        Object *obj;
 +        char *name;
 +
 +        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
 +        if (!obj) {
 +            /* Secondary CPUs start in PSCI powered-down state */
 +            error_report("Unable to create apu.cpu[%d] of type %s",
 +                         i, XLNX_VERSAL_ACPU_TYPE);
 +            exit(EXIT_FAILURE);
 +        }
 +
 +        name = g_strdup_printf("apu-cpu[%d]", i);
 +        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
 +        g_free(name);
 +
 +        object_property_set_int(obj, s->cfg.psci_conduit,
 +                                "psci-conduit", &error_abort);
 +        if (i) {
 +            object_property_set_bool(obj, true,
 +                                     "start-powered-off", &error_abort);
 +        }
 +
 +        object_property_set_int(obj, ARRAY_SIZE(s->fpd.apu.cpu),
 +                                "core-count", &error_abort);
 +        object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
 +                                 &error_abort);
 +        object_property_set_bool(obj, true, "realized", &error_fatal);
 +        s->fpd.apu.cpu[i] = ARM_CPU(obj);
 +    }
 +}
 +
 +static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
 +{
 +    static const uint64_t addrs[] = {
 +        MM_GIC_APU_DIST_MAIN,
 +        MM_GIC_APU_REDIST_0
 +    };
 +    SysBusDevice *gicbusdev;
 +    DeviceState *gicdev;
 +    int nr_apu_cpus = ARRAY_SIZE(s->fpd.apu.cpu);
 +    int i;
 +
 +    sysbus_init_child_obj(OBJECT(s), "apu-gic",
 +                          &s->fpd.apu.gic, sizeof(s->fpd.apu.gic),
 +                          gicv3_class_name());
 +    gicbusdev = SYS_BUS_DEVICE(&s->fpd.apu.gic);
 +    gicdev = DEVICE(&s->fpd.apu.gic);
 +    qdev_prop_set_uint32(gicdev, "revision", 3);
 +    qdev_prop_set_uint32(gicdev, "num-cpu", 2);
 +    qdev_prop_set_uint32(gicdev, "num-irq", XLNX_VERSAL_NR_IRQS + 32);
 +    qdev_prop_set_uint32(gicdev, "len-redist-region-count", 1);
 +    qdev_prop_set_uint32(gicdev, "redist-region-count[0]", 2);
 +    qdev_prop_set_bit(gicdev, "has-security-extensions", true);
 +
 +    object_property_set_bool(OBJECT(&s->fpd.apu.gic), true, "realized",
 +                                    &error_fatal);
 +
 +    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
 +        MemoryRegion *mr;
 +
 +        mr = sysbus_mmio_get_region(gicbusdev, i);
 +        memory_region_add_subregion(&s->fpd.apu.mr, addrs[i], mr);
 +    }
 +
 +    for (i = 0; i < nr_apu_cpus; i++) {
 +        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
 +        int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
 +        qemu_irq maint_irq;
 +        int ti;
 +        /* Mapping from the output timer irq lines from the CPU to the
 +         * GIC PPI inputs.
 +         */
 +        const int timer_irq[] = {
 +            [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
 +            [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
 +            [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
 +            [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
 +        };
 +
 +        for (ti = 0; ti < ARRAY_SIZE(timer_irq); ti++) {
 +            qdev_connect_gpio_out(cpudev, ti,
 +                                  qdev_get_gpio_in(gicdev,
 +                                                   ppibase + timer_irq[ti]));
 +        }
 +        maint_irq = qdev_get_gpio_in(gicdev,
 +                                        ppibase + VERSAL_GIC_MAINT_IRQ);
 +        qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
 +                                    0, maint_irq);
 +        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
 +        sysbus_connect_irq(gicbusdev, i + nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
 +        sysbus_connect_irq(gicbusdev, i + 2 * nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
 +        sysbus_connect_irq(gicbusdev, i + 3 * nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
 +    }
 +
 +    for (i = 0; i < XLNX_VERSAL_NR_IRQS; i++) {
 +        pic[i] = qdev_get_gpio_in(gicdev, i);
 +    }
 +}
 +
 +static void versal_create_uarts(Versal *s, qemu_irq *pic)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
 +        static const int irqs[] = { VERSAL_UART0_IRQ_0, VERSAL_UART1_IRQ_0};
 +        static const uint64_t addrs[] = { MM_UART0, MM_UART1 };
 +        char *name = g_strdup_printf("uart%d", i);
 +        DeviceState *dev;
 +        MemoryRegion *mr;
 +
 +        dev = qdev_create(NULL, "pl011");
 +        s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
 +        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
 +        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +        qdev_init_nofail(dev);
 +
 +        mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
 +        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
 +
 +        sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_create_gems(Versal *s, qemu_irq *pic)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
 +        static const int irqs[] = { VERSAL_GEM0_IRQ_0, VERSAL_GEM1_IRQ_0};
 +        static const uint64_t addrs[] = { MM_GEM0, MM_GEM1 };
 +        char *name = g_strdup_printf("gem%d", i);
 +        NICInfo *nd = &nd_table[i];
 +        DeviceState *dev;
 +        MemoryRegion *mr;
 +
 +        dev = qdev_create(NULL, "cadence_gem");
 +        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
 +        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +        if (nd->used) {
 +            qemu_check_nic_model(nd, "cadence_gem");
 +            qdev_set_nic_properties(dev, nd);
 +        }
 +        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
 +                                2, "num-priority-queues",
 +                                &error_abort);
 +        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
 +                                 OBJECT(&s->mr_ps), "dma",
 +                                 &error_abort);
 +        qdev_init_nofail(dev);
 +
 +        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
 +        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
 +
 +        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
 +        g_free(name);
 +    }
 +}
 +
 +/* This takes the board allocated linear DDR memory and creates aliases
 + * for each split DDR range/aperture on the Versal address map.
 + */
 +static void versal_map_ddr(Versal *s)
 +{
 +    uint64_t size = memory_region_size(s->cfg.mr_ddr);
 +    /* Describes the various split DDR access regions.  */
 +    static const struct {
 +        uint64_t base;
 +        uint64_t size;
 +    } addr_ranges[] = {
 +        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
 +        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
 +        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
 +        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
 +    };
 +    uint64_t offset = 0;
 +    int i;
 +
 +    assert(ARRAY_SIZE(addr_ranges) == ARRAY_SIZE(s->noc.mr_ddr_ranges));
 +    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
 +        char *name;
 +        uint64_t mapsize;
 +
 +        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
 +        name = g_strdup_printf("noc-ddr-range%d", i);
 +        /* Create the MR alias.  */
 +        memory_region_init_alias(&s->noc.mr_ddr_ranges[i], OBJECT(s),
 +                                 name, s->cfg.mr_ddr,
 +                                 offset, mapsize);
 +
 +        /* Map it onto the NoC MR.  */
 +        memory_region_add_subregion(&s->mr_ps, addr_ranges[i].base,
 +                                    &s->noc.mr_ddr_ranges[i]);
 +        offset += mapsize;
 +        size -= mapsize;
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_unimp_area(Versal *s, const char *name,
 +                                MemoryRegion *mr,
 +                                hwaddr base, hwaddr size)
 +{
 +    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
 +    MemoryRegion *mr_dev;
 +
 +    qdev_prop_set_string(dev, "name", name);
 +    qdev_prop_set_uint64(dev, "size", size);
 +    object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +    qdev_init_nofail(dev);
 +
 +    mr_dev = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 +    memory_region_add_subregion(mr, base, mr_dev);
 +}
 +
 +static void versal_unimp(Versal *s)
 +{
 +    versal_unimp_area(s, "psm", &s->mr_ps,
 +                        MM_PSM_START, MM_PSM_END - MM_PSM_START);
 +    versal_unimp_area(s, "crl", &s->mr_ps,
 +                        MM_CRL, MM_CRL_SIZE);
 +    versal_unimp_area(s, "crf", &s->mr_ps,
 +                        MM_FPD_CRF, MM_FPD_CRF_SIZE);
 +    versal_unimp_area(s, "iou-scntr", &s->mr_ps,
 +                        MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
 +    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 +                        MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
 +}
 +
 +static void versal_realize(DeviceState *dev, Error **errp)
 +{
 +    Versal *s = XLNX_VERSAL(dev);
 +    qemu_irq pic[XLNX_VERSAL_NR_IRQS];
 +
 +    versal_create_apu_cpus(s);
 +    versal_create_apu_gic(s, pic);
 +    versal_create_uarts(s, pic);
 +    versal_create_gems(s, pic);
 +    versal_map_ddr(s);
 +    versal_unimp(s);
 +
 +    /* Create the On Chip Memory (OCM).  */
 +    memory_region_init_ram(&s->lpd.mr_ocm, OBJECT(s), "ocm",
 +                           MM_OCM_SIZE, &error_fatal);
 +
 +    memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
 +    memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
 +}
 +
 +static void versal_init(Object *obj)
 +{
 +    Versal *s = XLNX_VERSAL(obj);
 +
 +    memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
 +    memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
 +}
 +
 +static Property versal_properties[] = {
 +    DEFINE_PROP_LINK("ddr", Versal, cfg.mr_ddr, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("psci-conduit", Versal, cfg.psci_conduit, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static void versal_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = versal_realize;
 +    dc->props = versal_properties;
 +    /* No VMSD since we haven't got any top-level SoC state to save.  */
 +}
 +
 +static const TypeInfo versal_info = {
 +    .name = TYPE_XLNX_VERSAL,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Versal),
 +    .instance_init = versal_init,
 +    .class_init = versal_class_init,
 +};
 +
 +static void versal_register_types(void)
 +{
 +    type_register_static(&versal_info);
 +}
 +
 +type_init(versal_register_types);
 diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/aarch64-softmmu.mak
 +++ b/default-configs/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
  CONFIG_DPCD=y
  CONFIG_XLNX_ZYNQMP=y
  CONFIG_XLNX_ZYNQMP_ARM=y
 +CONFIG_XLNX_VERSAL=y
  CONFIG_ARM_SMMUV3=y
 --
-.19.1
+.20.1

Last lot of patches for arm before softfreeze tomorrow...

thanks
-- PMM

The following changes since commit ef3a6af5e789ff078d1fef880f9dfb6adf18e8f1:

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20181029-pull-request' into staging (2018-10-29 12:59:15 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181029

for you to fetch changes up to 20cf5663734310a282e27b7389bc9f53ffe227e6:

tests/boot-serial-test: Add microbit board testcase (2018-10-29 15:19:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * microbit: Add the UART to our nRF51 SoC model
 * Add a virtual Xilinx Versal board "xlnx-versal-virt"
 * hw/arm/virt: Set VIRT_COMPAT_3_0 compat

----------------------------------------------------------------
Edgar E. Iglesias (2):
      hw/arm: versal: Add a model of Xilinx Versal SoC
      hw/arm: versal: Add a virtual Xilinx Versal board

Eric Auger (1):
      hw/arm/virt: Set VIRT_COMPAT_3_0 compat

Julia Suvorova (3):
      hw/char: Implement nRF51 SoC UART
      hw/arm/nrf51_soc: Connect UART to nRF51 SoC
      tests/boot-serial-test: Add microbit board testcase

hw/arm/Makefile.objs                |   1 +
 hw/char/Makefile.objs               |   1 +
 include/hw/arm/nrf51_soc.h          |   3 +
 include/hw/arm/xlnx-versal.h        | 122 +++++++++
 include/hw/char/nrf51_uart.h        |  78 ++++++
 hw/arm/microbit.c                   |   2 +
 hw/arm/nrf51_soc.c                  |  20 ++
 hw/arm/virt.c                       |   4 +
 hw/arm/xlnx-versal-virt.c           | 493 ++++++++++++++++++++++++++++++++++++
 hw/arm/xlnx-versal.c                | 323 +++++++++++++++++++++++
 hw/char/nrf51_uart.c                | 330 ++++++++++++++++++++++++
 tests/boot-serial-test.c            |  19 ++
 default-configs/aarch64-softmmu.mak |   1 +
 hw/char/trace-events                |   4 +
 14 files changed, 1401 insertions(+)
 create mode 100644 include/hw/arm/xlnx-versal.h
 create mode 100644 include/hw/char/nrf51_uart.h
 create mode 100644 hw/arm/xlnx-versal-virt.c
 create mode 100644 hw/arm/xlnx-versal.c
 create mode 100644 hw/char/nrf51_uart.c

From: Eric Auger <eric.auger@redhat.com>

We are missing the VIRT_COMPAT_3_0 definition and setting.
Let's add them.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20181024085602.16611-1-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_3_1_options(MachineClass *mc)
 }
 DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
 
+#define VIRT_COMPAT_3_0 \
+    HW_COMPAT_3_0
+
 static void virt_3_0_instance_init(Object *obj)
 {
     virt_3_1_instance_init(obj);
@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
 static void virt_machine_3_0_options(MachineClass *mc)
 {
     virt_machine_3_1_options(mc);
+    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_3_0);
 }
 DEFINE_VIRT_MACHINE(3, 0)
 
-- 
2.19.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of Xilinx Versal SoC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                |   1 +
 include/hw/arm/xlnx-versal.h        | 122 +++++++++++
 hw/arm/xlnx-versal.c                | 323 ++++++++++++++++++++++++++++
 default-configs/aarch64-softmmu.mak |   1 +
 4 files changed, 447 insertions(+)
 create mode 100644 include/hw/arm/xlnx-versal.h
 create mode 100644 hw/arm/xlnx-versal.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
+obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Model of the Xilinx Versal
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#ifndef XLNX_VERSAL_H
+#define XLNX_VERSAL_H
+
+#include "hw/sysbus.h"
+#include "hw/arm/arm.h"
+#include "hw/intc/arm_gicv3.h"
+
+#define TYPE_XLNX_VERSAL "xlnx-versal"
+#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
+
+#define XLNX_VERSAL_NR_ACPUS   2
+#define XLNX_VERSAL_NR_UARTS   2
+#define XLNX_VERSAL_NR_GEMS    2
+#define XLNX_VERSAL_NR_IRQS    256
+
+typedef struct Versal {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    struct {
+        struct {
+            MemoryRegion mr;
+            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
+            GICv3State gic;
+        } apu;
+    } fpd;
+
+    MemoryRegion mr_ps;
+
+    struct {
+        /* 4 ranges to access DDR.  */
+        MemoryRegion mr_ddr_ranges[4];
+    } noc;
+
+    struct {
+        MemoryRegion mr_ocm;
+
+        struct {
+            SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
+            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
+        } iou;
+    } lpd;
+
+    struct {
+        MemoryRegion *mr_ddr;
+        uint32_t psci_conduit;
+    } cfg;
+} Versal;
+
+/* Memory-map and IRQ definitions. Copied a subset from
+ * auto-generated files.  */
+
+#define VERSAL_GIC_MAINT_IRQ        9
+#define VERSAL_TIMER_VIRT_IRQ       11
+#define VERSAL_TIMER_S_EL1_IRQ      13
+#define VERSAL_TIMER_NS_EL1_IRQ     14
+#define VERSAL_TIMER_NS_EL2_IRQ     10
+
+#define VERSAL_UART0_IRQ_0         18
+#define VERSAL_UART1_IRQ_0         19
+#define VERSAL_GEM0_IRQ_0          56
+#define VERSAL_GEM0_WAKE_IRQ_0     57
+#define VERSAL_GEM1_IRQ_0          58
+#define VERSAL_GEM1_WAKE_IRQ_0     59
+
+/* Architecturally eserved IRQs suitable for virtualization.  */
+#define VERSAL_RSVD_HIGH_IRQ_FIRST 160
+#define VERSAL_RSVD_HIGH_IRQ_LAST  255
+
+#define MM_TOP_RSVD                 0xa0000000U
+#define MM_TOP_RSVD_SIZE            0x4000000
+#define MM_GIC_APU_DIST_MAIN        0xf9000000U
+#define MM_GIC_APU_DIST_MAIN_SIZE   0x10000
+#define MM_GIC_APU_REDIST_0         0xf9080000U
+#define MM_GIC_APU_REDIST_0_SIZE    0x80000
+
+#define MM_UART0                    0xff000000U
+#define MM_UART0_SIZE               0x10000
+#define MM_UART1                    0xff010000U
+#define MM_UART1_SIZE               0x10000
+
+#define MM_GEM0                     0xff0c0000U
+#define MM_GEM0_SIZE                0x10000
+#define MM_GEM1                     0xff0d0000U
+#define MM_GEM1_SIZE                0x10000
+
+#define MM_OCM                      0xfffc0000U
+#define MM_OCM_SIZE                 0x40000
+
+#define MM_TOP_DDR                  0x0
+#define MM_TOP_DDR_SIZE             0x80000000U
+#define MM_TOP_DDR_2                0x800000000ULL
+#define MM_TOP_DDR_2_SIZE           0x800000000ULL
+#define MM_TOP_DDR_3                0xc000000000ULL
+#define MM_TOP_DDR_3_SIZE           0x4000000000ULL
+#define MM_TOP_DDR_4                0x10000000000ULL
+#define MM_TOP_DDR_4_SIZE           0xb780000000ULL
+
+#define MM_PSM_START                0xffc80000U
+#define MM_PSM_END                  0xffcf0000U
+
+#define MM_CRL                      0xff5e0000U
+#define MM_CRL_SIZE                 0x300000
+#define MM_IOU_SCNTR                0xff130000U
+#define MM_IOU_SCNTR_SIZE           0x10000
+#define MM_IOU_SCNTRS               0xff140000U
+#define MM_IOU_SCNTRS_SIZE          0x10000
+#define MM_FPD_CRF                  0xfd1a0000U
+#define MM_FPD_CRF_SIZE             0x140000
+#endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Versal SoC model.
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "hw/sysbus.h"
+#include "net/net.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
+#include "hw/arm/arm.h"
+#include "kvm_arm.h"
+#include "hw/misc/unimp.h"
+#include "hw/intc/arm_gicv3_common.h"
+#include "hw/arm/xlnx-versal.h"
+
+#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+#define GEM_REVISION        0x40070106
+
+static void versal_create_apu_cpus(Versal *s)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
+        Object *obj;
+        char *name;
+
+        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
+        if (!obj) {
+            /* Secondary CPUs start in PSCI powered-down state */
+            error_report("Unable to create apu.cpu[%d] of type %s",
+                         i, XLNX_VERSAL_ACPU_TYPE);
+            exit(EXIT_FAILURE);
+        }
+
+        name = g_strdup_printf("apu-cpu[%d]", i);
+        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
+        g_free(name);
+
+        object_property_set_int(obj, s->cfg.psci_conduit,
+                                "psci-conduit", &error_abort);
+        if (i) {
+            object_property_set_bool(obj, true,
+                                     "start-powered-off", &error_abort);
+        }
+
+        object_property_set_int(obj, ARRAY_SIZE(s->fpd.apu.cpu),
+                                "core-count", &error_abort);
+        object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
+                                 &error_abort);
+        object_property_set_bool(obj, true, "realized", &error_fatal);
+        s->fpd.apu.cpu[i] = ARM_CPU(obj);
+    }
+}
+
+static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+{
+    static const uint64_t addrs[] = {
+        MM_GIC_APU_DIST_MAIN,
+        MM_GIC_APU_REDIST_0
+    };
+    SysBusDevice *gicbusdev;
+    DeviceState *gicdev;
+    int nr_apu_cpus = ARRAY_SIZE(s->fpd.apu.cpu);
+    int i;
+
+    sysbus_init_child_obj(OBJECT(s), "apu-gic",
+                          &s->fpd.apu.gic, sizeof(s->fpd.apu.gic),
+                          gicv3_class_name());
+    gicbusdev = SYS_BUS_DEVICE(&s->fpd.apu.gic);
+    gicdev = DEVICE(&s->fpd.apu.gic);
+    qdev_prop_set_uint32(gicdev, "revision", 3);
+    qdev_prop_set_uint32(gicdev, "num-cpu", 2);
+    qdev_prop_set_uint32(gicdev, "num-irq", XLNX_VERSAL_NR_IRQS + 32);
+    qdev_prop_set_uint32(gicdev, "len-redist-region-count", 1);
+    qdev_prop_set_uint32(gicdev, "redist-region-count[0]", 2);
+    qdev_prop_set_bit(gicdev, "has-security-extensions", true);
+
+    object_property_set_bool(OBJECT(&s->fpd.apu.gic), true, "realized",
+                                    &error_fatal);
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        MemoryRegion *mr;
+
+        mr = sysbus_mmio_get_region(gicbusdev, i);
+        memory_region_add_subregion(&s->fpd.apu.mr, addrs[i], mr);
+    }
+
+    for (i = 0; i < nr_apu_cpus; i++) {
+        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
+        int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
+        qemu_irq maint_irq;
+        int ti;
+        /* Mapping from the output timer irq lines from the CPU to the
+         * GIC PPI inputs.
+         */
+        const int timer_irq[] = {
+            [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
+            [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
+            [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
+            [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
+        };
+
+        for (ti = 0; ti < ARRAY_SIZE(timer_irq); ti++) {
+            qdev_connect_gpio_out(cpudev, ti,
+                                  qdev_get_gpio_in(gicdev,
+                                                   ppibase + timer_irq[ti]));
+        }
+        maint_irq = qdev_get_gpio_in(gicdev,
+                                        ppibase + VERSAL_GIC_MAINT_IRQ);
+        qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
+                                    0, maint_irq);
+        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
+        sysbus_connect_irq(gicbusdev, i + nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
+        sysbus_connect_irq(gicbusdev, i + 2 * nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
+        sysbus_connect_irq(gicbusdev, i + 3 * nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
+    }
+
+    for (i = 0; i < XLNX_VERSAL_NR_IRQS; i++) {
+        pic[i] = qdev_get_gpio_in(gicdev, i);
+    }
+}
+
+static void versal_create_uarts(Versal *s, qemu_irq *pic)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
+        static const int irqs[] = { VERSAL_UART0_IRQ_0, VERSAL_UART1_IRQ_0};
+        static const uint64_t addrs[] = { MM_UART0, MM_UART1 };
+        char *name = g_strdup_printf("uart%d", i);
+        DeviceState *dev;
+        MemoryRegion *mr;
+
+        dev = qdev_create(NULL, "pl011");
+        s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+        qdev_init_nofail(dev);
+
+        mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
+        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+
+        sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
+        g_free(name);
+    }
+}
+
+static void versal_create_gems(Versal *s, qemu_irq *pic)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
+        static const int irqs[] = { VERSAL_GEM0_IRQ_0, VERSAL_GEM1_IRQ_0};
+        static const uint64_t addrs[] = { MM_GEM0, MM_GEM1 };
+        char *name = g_strdup_printf("gem%d", i);
+        NICInfo *nd = &nd_table[i];
+        DeviceState *dev;
+        MemoryRegion *mr;
+
+        dev = qdev_create(NULL, "cadence_gem");
+        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
+        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+        if (nd->used) {
+            qemu_check_nic_model(nd, "cadence_gem");
+            qdev_set_nic_properties(dev, nd);
+        }
+        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
+                                2, "num-priority-queues",
+                                &error_abort);
+        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
+                                 OBJECT(&s->mr_ps), "dma",
+                                 &error_abort);
+        qdev_init_nofail(dev);
+
+        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
+        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+
+        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
+        g_free(name);
+    }
+}
+
+/* This takes the board allocated linear DDR memory and creates aliases
+ * for each split DDR range/aperture on the Versal address map.
+ */
+static void versal_map_ddr(Versal *s)
+{
+    uint64_t size = memory_region_size(s->cfg.mr_ddr);
+    /* Describes the various split DDR access regions.  */
+    static const struct {
+        uint64_t base;
+        uint64_t size;
+    } addr_ranges[] = {
+        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
+        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
+        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
+        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
+    };
+    uint64_t offset = 0;
+    int i;
+
+    assert(ARRAY_SIZE(addr_ranges) == ARRAY_SIZE(s->noc.mr_ddr_ranges));
+    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
+        char *name;
+        uint64_t mapsize;
+
+        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
+        name = g_strdup_printf("noc-ddr-range%d", i);
+        /* Create the MR alias.  */
+        memory_region_init_alias(&s->noc.mr_ddr_ranges[i], OBJECT(s),
+                                 name, s->cfg.mr_ddr,
+                                 offset, mapsize);
+
+        /* Map it onto the NoC MR.  */
+        memory_region_add_subregion(&s->mr_ps, addr_ranges[i].base,
+                                    &s->noc.mr_ddr_ranges[i]);
+        offset += mapsize;
+        size -= mapsize;
+        g_free(name);
+    }
+}
+
+static void versal_unimp_area(Versal *s, const char *name,
+                                MemoryRegion *mr,
+                                hwaddr base, hwaddr size)
+{
+    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
+    MemoryRegion *mr_dev;
+
+    qdev_prop_set_string(dev, "name", name);
+    qdev_prop_set_uint64(dev, "size", size);
+    object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+    qdev_init_nofail(dev);
+
+    mr_dev = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_add_subregion(mr, base, mr_dev);
+}
+
+static void versal_unimp(Versal *s)
+{
+    versal_unimp_area(s, "psm", &s->mr_ps,
+                        MM_PSM_START, MM_PSM_END - MM_PSM_START);
+    versal_unimp_area(s, "crl", &s->mr_ps,
+                        MM_CRL, MM_CRL_SIZE);
+    versal_unimp_area(s, "crf", &s->mr_ps,
+                        MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "iou-scntr", &s->mr_ps,
+                        MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
+    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
+                        MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
+}
+
+static void versal_realize(DeviceState *dev, Error **errp)
+{
+    Versal *s = XLNX_VERSAL(dev);
+    qemu_irq pic[XLNX_VERSAL_NR_IRQS];
+
+    versal_create_apu_cpus(s);
+    versal_create_apu_gic(s, pic);
+    versal_create_uarts(s, pic);
+    versal_create_gems(s, pic);
+    versal_map_ddr(s);
+    versal_unimp(s);
+
+    /* Create the On Chip Memory (OCM).  */
+    memory_region_init_ram(&s->lpd.mr_ocm, OBJECT(s), "ocm",
+                           MM_OCM_SIZE, &error_fatal);
+
+    memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
+    memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
+}
+
+static void versal_init(Object *obj)
+{
+    Versal *s = XLNX_VERSAL(obj);
+
+    memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
+    memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
+}
+
+static Property versal_properties[] = {
+    DEFINE_PROP_LINK("ddr", Versal, cfg.mr_ddr, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("psci-conduit", Versal, cfg.psci_conduit, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void versal_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = versal_realize;
+    dc->props = versal_properties;
+    /* No VMSD since we haven't got any top-level SoC state to save.  */
+}
+
+static const TypeInfo versal_info = {
+    .name = TYPE_XLNX_VERSAL,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Versal),
+    .instance_init = versal_init,
+    .class_init = versal_class_init,
+};
+
+static void versal_register_types(void)
+{
+    type_register_static(&versal_info);
+}
+
+type_init(versal_register_types);
diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/aarch64-softmmu.mak
+++ b/default-configs/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
 CONFIG_DPCD=y
 CONFIG_XLNX_ZYNQMP=y
 CONFIG_XLNX_ZYNQMP_ARM=y
+CONFIG_XLNX_VERSAL=y
 CONFIG_ARM_SMMUV3=y
-- 
2.19.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a virtual Xilinx Versal board.

This board is based on the Xilinx Versal SoC. The exact
details of what peripherals are attached to this board
will remain in control of QEMU. QEMU will generate an
FDT on the fly for Linux and other software to auto-discover
peripherals.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
[PMM: removed stray blank line at EOF]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs      |   2 +-
 hw/arm/xlnx-versal-virt.c | 493 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 494 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/xlnx-versal-virt.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
-obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
+obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Versal Virtual board.
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "sysemu/device_tree.h"
+#include "exec/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/sysbus.h"
+#include "hw/arm/sysbus-fdt.h"
+#include "hw/arm/fdt.h"
+#include "cpu.h"
+#include "hw/arm/xlnx-versal.h"
+
+#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
+#define XLNX_VERSAL_VIRT_MACHINE(obj) \
+    OBJECT_CHECK(VersalVirt, (obj), TYPE_XLNX_VERSAL_VIRT_MACHINE)
+
+typedef struct VersalVirt {
+    MachineState parent_obj;
+
+    Versal soc;
+    MemoryRegion mr_ddr;
+
+    void *fdt;
+    int fdt_size;
+    struct {
+        uint32_t gic;
+        uint32_t ethernet_phy[2];
+        uint32_t clk_125Mhz;
+        uint32_t clk_25Mhz;
+    } phandle;
+    struct arm_boot_info binfo;
+
+    struct {
+        bool secure;
+    } cfg;
+} VersalVirt;
+
+static void fdt_create(VersalVirt *s)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(s);
+    int i;
+
+    s->fdt = create_device_tree(&s->fdt_size);
+    if (!s->fdt) {
+        error_report("create_device_tree() failed");
+        exit(1);
+    }
+
+    /* Allocate all phandles.  */
+    s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
+    for (i = 0; i < ARRAY_SIZE(s->phandle.ethernet_phy); i++) {
+        s->phandle.ethernet_phy[i] = qemu_fdt_alloc_phandle(s->fdt);
+    }
+    s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
+    s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
+
+    /* Create /chosen node for load_dtb.  */
+    qemu_fdt_add_subnode(s->fdt, "/chosen");
+
+    /* Header */
+    qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
+    qemu_fdt_setprop_cell(s->fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_setprop_cell(s->fdt, "/", "#address-cells", 0x2);
+    qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
+    qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
+}
+
+static void fdt_add_clk_node(VersalVirt *s, const char *name,
+                             unsigned int freq_hz, uint32_t phandle)
+{
+    qemu_fdt_add_subnode(s->fdt, name);
+    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
+    qemu_fdt_setprop_cell(s->fdt, name, "clock-frequency", freq_hz);
+    qemu_fdt_setprop_cell(s->fdt, name, "#clock-cells", 0x0);
+    qemu_fdt_setprop_string(s->fdt, name, "compatible", "fixed-clock");
+    qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
+}
+
+static void fdt_add_cpu_nodes(VersalVirt *s, uint32_t psci_conduit)
+{
+    int i;
+
+    qemu_fdt_add_subnode(s->fdt, "/cpus");
+    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#size-cells", 0x0);
+    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#address-cells", 1);
+
+    for (i = XLNX_VERSAL_NR_ACPUS - 1; i >= 0; i--) {
+        char *name = g_strdup_printf("/cpus/cpu@%d", i);
+        ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
+
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop_cell(s->fdt, name, "reg", armcpu->mp_affinity);
+        if (psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
+            qemu_fdt_setprop_string(s->fdt, name, "enable-method", "psci");
+        }
+        qemu_fdt_setprop_string(s->fdt, name, "device_type", "cpu");
+        qemu_fdt_setprop_string(s->fdt, name, "compatible",
+                                armcpu->dtb_compatible);
+        g_free(name);
+    }
+}
+
+static void fdt_add_gic_nodes(VersalVirt *s)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/gic@%x", MM_GIC_APU_DIST_MAIN);
+    qemu_fdt_add_subnode(s->fdt, nodename);
+    qemu_fdt_setprop_cell(s->fdt, nodename, "phandle", s->phandle.gic);
+    qemu_fdt_setprop_cells(s->fdt, nodename, "interrupts",
+                           GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop(s->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_sized_cells(s->fdt, nodename, "reg",
+                                 2, MM_GIC_APU_DIST_MAIN,
+                                 2, MM_GIC_APU_DIST_MAIN_SIZE,
+                                 2, MM_GIC_APU_REDIST_0,
+                                 2, MM_GIC_APU_REDIST_0_SIZE);
+    qemu_fdt_setprop_cell(s->fdt, nodename, "#interrupt-cells", 3);
+    qemu_fdt_setprop_string(s->fdt, nodename, "compatible", "arm,gic-v3");
+}
+
+static void fdt_add_timer_nodes(VersalVirt *s)
+{
+    const char compat[] = "arm,armv8-timer";
+    uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
+
+    qemu_fdt_add_subnode(s->fdt, "/timer");
+    qemu_fdt_setprop_cells(s->fdt, "/timer", "interrupts",
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ, irqflags);
+    qemu_fdt_setprop(s->fdt, "/timer", "compatible",
+                     compat, sizeof(compat));
+}
+
+static void fdt_add_uart_nodes(VersalVirt *s)
+{
+    uint64_t addrs[] = { MM_UART1, MM_UART0 };
+    unsigned int irqs[] = { VERSAL_UART1_IRQ_0, VERSAL_UART0_IRQ_0 };
+    const char compat[] = "arm,pl011\0arm,sbsa-uart";
+    const char clocknames[] = "uartclk\0apb_pclk";
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        char *name = g_strdup_printf("/uart@%" PRIx64, addrs[i]);
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop_cell(s->fdt, name, "current-speed", 115200);
+        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
+        qemu_fdt_setprop(s->fdt, name, "clock-names",
+                         clocknames, sizeof(clocknames));
+
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, addrs[i], 2, 0x1000);
+        qemu_fdt_setprop(s->fdt, name, "compatible",
+                         compat, sizeof(compat));
+        qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
+
+        if (addrs[i] == MM_UART0) {
+            /* Select UART0.  */
+            qemu_fdt_setprop_string(s->fdt, "/chosen", "stdout-path", name);
+        }
+        g_free(name);
+    }
+}
+
+static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
+                                     uint32_t phandle)
+{
+    char *name = g_strdup_printf("%s/fixed-link", gemname);
+
+    qemu_fdt_add_subnode(s->fdt, name);
+    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
+    qemu_fdt_setprop_cells(s->fdt, name, "full-duplex");
+    qemu_fdt_setprop_cell(s->fdt, name, "speed", 1000);
+    g_free(name);
+}
+
+static void fdt_add_gem_nodes(VersalVirt *s)
+{
+    uint64_t addrs[] = { MM_GEM1, MM_GEM0 };
+    unsigned int irqs[] = { VERSAL_GEM1_IRQ_0, VERSAL_GEM0_IRQ_0 };
+    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
+    const char compat_gem[] = "cdns,zynqmp-gem\0cdns,gem";
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        char *name = g_strdup_printf("/ethernet@%" PRIx64, addrs[i]);
+        qemu_fdt_add_subnode(s->fdt, name);
+
+        fdt_add_fixed_link_nodes(s, name, s->phandle.ethernet_phy[i]);
+        qemu_fdt_setprop_string(s->fdt, name, "phy-mode", "rgmii-id");
+        qemu_fdt_setprop_cell(s->fdt, name, "phy-handle",
+                              s->phandle.ethernet_phy[i]);
+        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz,
+                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
+        qemu_fdt_setprop(s->fdt, name, "clock-names",
+                         clocknames, sizeof(clocknames));
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, addrs[i], 2, 0x1000);
+        qemu_fdt_setprop(s->fdt, name, "compatible",
+                         compat_gem, sizeof(compat_gem));
+        qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 1);
+        qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 0);
+        g_free(name);
+    }
+}
+
+static void fdt_nop_memory_nodes(void *fdt, Error **errp)
+{
+    Error *err = NULL;
+    char **node_path;
+    int n = 0;
+
+    node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    while (node_path[n]) {
+        if (g_str_has_prefix(node_path[n], "/memory")) {
+            qemu_fdt_nop_node(fdt, node_path[n]);
+        }
+        n++;
+    }
+    g_strfreev(node_path);
+}
+
+static void fdt_add_memory_nodes(VersalVirt *s, void *fdt, uint64_t ram_size)
+{
+    /* Describes the various split DDR access regions.  */
+    static const struct {
+        uint64_t base;
+        uint64_t size;
+    } addr_ranges[] = {
+        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
+        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
+        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
+        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
+    };
+    uint64_t mem_reg_prop[8] = {0};
+    uint64_t size = ram_size;
+    Error *err = NULL;
+    char *name;
+    int i;
+
+    fdt_nop_memory_nodes(fdt, &err);
+    if (err) {
+        error_report_err(err);
+        return;
+    }
+
+    name = g_strdup_printf("/memory@%x", MM_TOP_DDR);
+    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
+        uint64_t mapsize;
+
+        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
+
+        mem_reg_prop[i * 2] = addr_ranges[i].base;
+        mem_reg_prop[i * 2 + 1] = mapsize;
+        size -= mapsize;
+    }
+    qemu_fdt_add_subnode(fdt, name);
+    qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
+
+    switch (i) {
+    case 1:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1]);
+        break;
+    case 2:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3]);
+        break;
+    case 3:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3],
+                                     2, mem_reg_prop[4],
+                                     2, mem_reg_prop[5]);
+        break;
+    case 4:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3],
+                                     2, mem_reg_prop[4],
+                                     2, mem_reg_prop[5],
+                                     2, mem_reg_prop[6],
+                                     2, mem_reg_prop[7]);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    g_free(name);
+}
+
+static void versal_virt_modify_dtb(const struct arm_boot_info *binfo,
+                                    void *fdt)
+{
+    VersalVirt *s = container_of(binfo, VersalVirt, binfo);
+
+    fdt_add_memory_nodes(s, fdt, binfo->ram_size);
+}
+
+static void *versal_virt_get_dtb(const struct arm_boot_info *binfo,
+                                  int *fdt_size)
+{
+    const VersalVirt *board = container_of(binfo, VersalVirt, binfo);
+
+    *fdt_size = board->fdt_size;
+    return board->fdt;
+}
+
+#define NUM_VIRTIO_TRANSPORT 32
+static void create_virtio_regions(VersalVirt *s)
+{
+    int virtio_mmio_size = 0x200;
+    int i;
+
+    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
+        char *name = g_strdup_printf("virtio%d", i);;
+        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
+        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
+        MemoryRegion *mr;
+        DeviceState *dev;
+        qemu_irq pic_irq;
+
+        pic_irq = qdev_get_gpio_in(DEVICE(&s->soc.fpd.apu.gic), irq);
+        dev = qdev_create(NULL, "virtio-mmio");
+        object_property_add_child(OBJECT(&s->soc), name, OBJECT(dev),
+                                  &error_fatal);
+        qdev_init_nofail(dev);
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic_irq);
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+        memory_region_add_subregion(&s->soc.mr_ps, base, mr);
+        sysbus_create_simple("virtio-mmio", base, pic_irq);
+    }
+
+    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
+        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
+        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
+        char *name = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
+
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop(s->fdt, name, "dma-coherent", NULL, 0);
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irq,
+                               GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, base, 2, virtio_mmio_size);
+        qemu_fdt_setprop_string(s->fdt, name, "compatible", "virtio,mmio");
+        g_free(name);
+    }
+}
+
+static void versal_virt_init(MachineState *machine)
+{
+    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
+    int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
+
+    /*
+     * If the user provides an Operating System to be loaded, we expect them
+     * to use the -kernel command line option.
+     *
+     * Users can load firmware or boot-loaders with the -device loader options.
+     *
+     * When loading an OS, we generate a dtb and let arm_load_kernel() select
+     * where it gets loaded. This dtb will be passed to the kernel in x0.
+     *
+     * If there's no -kernel option, we generate a DTB and place it at 0x1000
+     * for the bootloaders or firmware to pick up.
+     *
+     * If users want to provide their own DTB, they can use the -dtb option.
+     * These dtb's will have their memory nodes modified to match QEMU's
+     * selected ram_size option before they get passed to the kernel or fw.
+     *
+     * When loading an OS, we turn on QEMU's PSCI implementation with SMC
+     * as the PSCI conduit. When there's no -kernel, we assume the user
+     * provides EL3 firmware to handle PSCI.
+     */
+    if (machine->kernel_filename) {
+        psci_conduit = QEMU_PSCI_CONDUIT_SMC;
+    }
+
+    memory_region_allocate_system_memory(&s->mr_ddr, NULL, "ddr",
+                                         machine->ram_size);
+
+    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
+                          sizeof(s->soc), TYPE_XLNX_VERSAL);
+    object_property_set_link(OBJECT(&s->soc), OBJECT(&s->mr_ddr),
+                             "ddr", &error_abort);
+    object_property_set_int(OBJECT(&s->soc), psci_conduit,
+                            "psci-conduit", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+
+    fdt_create(s);
+    create_virtio_regions(s);
+    fdt_add_gem_nodes(s);
+    fdt_add_uart_nodes(s);
+    fdt_add_gic_nodes(s);
+    fdt_add_timer_nodes(s);
+    fdt_add_cpu_nodes(s, psci_conduit);
+    fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
+    fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
+
+    /* Make the APU cpu address space visible to virtio and other
+     * modules unaware of muliple address-spaces.  */
+    memory_region_add_subregion_overlap(get_system_memory(),
+                                        0, &s->soc.fpd.apu.mr, 0);
+
+    s->binfo.ram_size = machine->ram_size;
+    s->binfo.kernel_filename = machine->kernel_filename;
+    s->binfo.kernel_cmdline = machine->kernel_cmdline;
+    s->binfo.initrd_filename = machine->initrd_filename;
+    s->binfo.loader_start = 0x0;
+    s->binfo.get_dtb = versal_virt_get_dtb;
+    s->binfo.modify_dtb = versal_virt_modify_dtb;
+    if (machine->kernel_filename) {
+        arm_load_kernel(s->soc.fpd.apu.cpu[0], &s->binfo);
+    } else {
+        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
+                                                  &s->binfo);
+        /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
+         * Offset things by 4K.  */
+        s->binfo.loader_start = 0x1000;
+        s->binfo.dtb_limit = 0x1000000;
+        if (arm_load_dtb(s->binfo.loader_start,
+                         &s->binfo, s->binfo.dtb_limit, as) < 0) {
+            exit(EXIT_FAILURE);
+        }
+    }
+}
+
+static void versal_virt_machine_instance_init(Object *obj)
+{
+}
+
+static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Xilinx Versal Virtual development board";
+    mc->init = versal_virt_init;
+    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->no_cdrom = true;
+}
+
+static const TypeInfo versal_virt_machine_init_typeinfo = {
+    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
+    .parent     = TYPE_MACHINE,
+    .class_init = versal_virt_machine_class_init,
+    .instance_init = versal_virt_machine_instance_init,
+    .instance_size = sizeof(VersalVirt),
+};
+
+static void versal_virt_machine_init_register_types(void)
+{
+    type_register_static(&versal_virt_machine_init_typeinfo);
+}
+
+type_init(versal_virt_machine_init_register_types)
-- 
2.19.1

From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>

Not implemented: CTS/NCTS, PSEL*.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/Makefile.objs        |   1 +
 include/hw/char/nrf51_uart.h |  78 +++++++++
 hw/char/nrf51_uart.c         | 330 +++++++++++++++++++++++++++++++++++
 hw/char/trace-events         |   4 +
 4 files changed, 413 insertions(+)
 create mode 100644 include/hw/char/nrf51_uart.h
 create mode 100644 hw/char/nrf51_uart.c

diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Makefile.objs
+++ b/hw/char/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_IPACK) += ipoctal232.o
 common-obj-$(CONFIG_ESCC) += escc.o
+common-obj-$(CONFIG_NRF51_SOC) += nrf51_uart.o
 common-obj-$(CONFIG_PARALLEL) += parallel.o
 common-obj-$(CONFIG_PARALLEL) += parallel-isa.o
 common-obj-$(CONFIG_PL011) += pl011.o
diff --git a/include/hw/char/nrf51_uart.h b/include/hw/char/nrf51_uart.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/char/nrf51_uart.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * nRF51 SoC UART emulation
+ *
+ * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#ifndef NRF51_UART_H
+#define NRF51_UART_H
+
+#include "hw/sysbus.h"
+#include "chardev/char-fe.h"
+#include "hw/registerfields.h"
+
+#define UART_FIFO_LENGTH 6
+#define UART_BASE 0x40002000
+#define UART_SIZE 0x1000
+
+#define TYPE_NRF51_UART "nrf51_soc.uart"
+#define NRF51_UART(obj) OBJECT_CHECK(NRF51UARTState, (obj), TYPE_NRF51_UART)
+
+REG32(UART_STARTRX, 0x000)
+REG32(UART_STOPRX, 0x004)
+REG32(UART_STARTTX, 0x008)
+REG32(UART_STOPTX, 0x00C)
+REG32(UART_SUSPEND, 0x01C)
+
+REG32(UART_CTS, 0x100)
+REG32(UART_NCTS, 0x104)
+REG32(UART_RXDRDY, 0x108)
+REG32(UART_TXDRDY, 0x11C)
+REG32(UART_ERROR, 0x124)
+REG32(UART_RXTO, 0x144)
+
+REG32(UART_INTEN, 0x300)
+    FIELD(UART_INTEN, CTS, 0, 1)
+    FIELD(UART_INTEN, NCTS, 1, 1)
+    FIELD(UART_INTEN, RXDRDY, 2, 1)
+    FIELD(UART_INTEN, TXDRDY, 7, 1)
+    FIELD(UART_INTEN, ERROR, 9, 1)
+    FIELD(UART_INTEN, RXTO, 17, 1)
+REG32(UART_INTENSET, 0x304)
+REG32(UART_INTENCLR, 0x308)
+REG32(UART_ERRORSRC, 0x480)
+REG32(UART_ENABLE, 0x500)
+REG32(UART_PSELRTS, 0x508)
+REG32(UART_PSELTXD, 0x50C)
+REG32(UART_PSELCTS, 0x510)
+REG32(UART_PSELRXD, 0x514)
+REG32(UART_RXD, 0x518)
+REG32(UART_TXD, 0x51C)
+REG32(UART_BAUDRATE, 0x524)
+REG32(UART_CONFIG, 0x56C)
+
+typedef struct NRF51UARTState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    CharBackend chr;
+    qemu_irq irq;
+    guint watch_tag;
+
+    uint8_t rx_fifo[UART_FIFO_LENGTH];
+    unsigned int rx_fifo_pos;
+    unsigned int rx_fifo_len;
+
+    uint32_t reg[0x56C];
+
+    bool rx_started;
+    bool tx_started;
+    bool pending_tx_byte;
+    bool enabled;
+} NRF51UARTState;
+
+#endif
diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/char/nrf51_uart.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * nRF51 SoC UART emulation
+ *
+ * See nRF51 Series Reference Manual, "29 Universal Asynchronous
+ * Receiver/Transmitter" for hardware specifications:
+ * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf
+ *
+ * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/char/nrf51_uart.h"
+#include "trace.h"
+
+static void nrf51_uart_update_irq(NRF51UARTState *s)
+{
+    bool irq = false;
+
+    irq |= (s->reg[R_UART_RXDRDY] &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXDRDY_MASK));
+    irq |= (s->reg[R_UART_TXDRDY] &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_TXDRDY_MASK));
+    irq |= (s->reg[R_UART_ERROR]  &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_ERROR_MASK));
+    irq |= (s->reg[R_UART_RXTO]   &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXTO_MASK));
+
+    qemu_set_irq(s->irq, irq);
+}
+
+static uint64_t uart_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+    uint64_t r;
+
+    if (!s->enabled) {
+        return 0;
+    }
+
+    switch (addr) {
+    case A_UART_RXD:
+        r = s->rx_fifo[s->rx_fifo_pos];
+        if (s->rx_started && s->rx_fifo_len) {
+            s->rx_fifo_pos = (s->rx_fifo_pos + 1) % UART_FIFO_LENGTH;
+            s->rx_fifo_len--;
+            if (s->rx_fifo_len) {
+                s->reg[R_UART_RXDRDY] = 1;
+                nrf51_uart_update_irq(s);
+            }
+            qemu_chr_fe_accept_input(&s->chr);
+        }
+        break;
+    case A_UART_INTENSET:
+    case A_UART_INTENCLR:
+    case A_UART_INTEN:
+        r = s->reg[R_UART_INTEN];
+        break;
+    default:
+        r = s->reg[addr / 4];
+        break;
+    }
+
+    trace_nrf51_uart_read(addr, r, size);
+
+    return r;
+}
+
+static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+    int r;
+    uint8_t c = s->reg[R_UART_TXD];
+
+    s->watch_tag = 0;
+
+    r = qemu_chr_fe_write(&s->chr, &c, 1);
+    if (r <= 0) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+        if (!s->watch_tag) {
+            /* The hardware has no transmit error reporting,
+             * so silently drop the byte
+             */
+            goto buffer_drained;
+        }
+        return FALSE;
+    }
+
+buffer_drained:
+    s->reg[R_UART_TXDRDY] = 1;
+    s->pending_tx_byte = false;
+    return FALSE;
+}
+
+static void uart_cancel_transmit(NRF51UARTState *s)
+{
+    if (s->watch_tag) {
+        g_source_remove(s->watch_tag);
+        s->watch_tag = 0;
+    }
+}
+
+static void uart_write(void *opaque, hwaddr addr,
+                       uint64_t value, unsigned int size)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    trace_nrf51_uart_write(addr, value, size);
+
+    if (!s->enabled && (addr != A_UART_ENABLE)) {
+        return;
+    }
+
+    switch (addr) {
+    case A_UART_TXD:
+        if (!s->pending_tx_byte && s->tx_started) {
+            s->reg[R_UART_TXD] = value;
+            s->pending_tx_byte = true;
+            uart_transmit(NULL, G_IO_OUT, s);
+        }
+        break;
+    case A_UART_INTEN:
+        s->reg[R_UART_INTEN] = value;
+        break;
+    case A_UART_INTENSET:
+        s->reg[R_UART_INTEN] |= value;
+        break;
+    case A_UART_INTENCLR:
+        s->reg[R_UART_INTEN] &= ~value;
+        break;
+    case A_UART_TXDRDY ... A_UART_RXTO:
+        s->reg[addr / 4] = value;
+        break;
+    case A_UART_ERRORSRC:
+        s->reg[addr / 4] &= ~value;
+        break;
+    case A_UART_RXD:
+        break;
+    case A_UART_RXDRDY:
+        if (value == 0) {
+            s->reg[R_UART_RXDRDY] = 0;
+        }
+        break;
+    case A_UART_STARTTX:
+        if (value == 1) {
+            s->tx_started = true;
+        }
+        break;
+    case A_UART_STARTRX:
+        if (value == 1) {
+            s->rx_started = true;
+        }
+        break;
+    case A_UART_ENABLE:
+        if (value) {
+            if (value == 4) {
+                s->enabled = true;
+            }
+            break;
+        }
+        s->enabled = false;
+        value = 1;
+        /* fall through */
+    case A_UART_SUSPEND:
+    case A_UART_STOPTX:
+        if (value == 1) {
+            s->tx_started = false;
+        }
+        /* fall through */
+    case A_UART_STOPRX:
+        if (addr != A_UART_STOPTX && value == 1) {
+            s->rx_started = false;
+            s->reg[R_UART_RXTO] = 1;
+        }
+        break;
+    default:
+        s->reg[addr / 4] = value;
+        break;
+    }
+    nrf51_uart_update_irq(s);
+}
+
+static const MemoryRegionOps uart_ops = {
+    .read =  uart_read,
+    .write = uart_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void nrf51_uart_reset(DeviceState *dev)
+{
+    NRF51UARTState *s = NRF51_UART(dev);
+
+    s->pending_tx_byte = 0;
+
+    uart_cancel_transmit(s);
+
+    memset(s->reg, 0, sizeof(s->reg));
+
+    s->reg[R_UART_PSELRTS] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELTXD] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELCTS] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELRXD] = 0xFFFFFFFF;
+    s->reg[R_UART_BAUDRATE] = 0x4000000;
+
+    s->rx_fifo_len = 0;
+    s->rx_fifo_pos = 0;
+    s->rx_started = false;
+    s->tx_started = false;
+    s->enabled = false;
+}
+
+static void uart_receive(void *opaque, const uint8_t *buf, int size)
+{
+
+    NRF51UARTState *s = NRF51_UART(opaque);
+    int i;
+
+    if (size == 0 || s->rx_fifo_len >= UART_FIFO_LENGTH) {
+        return;
+    }
+
+    for (i = 0; i < size; i++) {
+        uint32_t pos = (s->rx_fifo_pos + s->rx_fifo_len) % UART_FIFO_LENGTH;
+        s->rx_fifo[pos] = buf[i];
+        s->rx_fifo_len++;
+    }
+
+    s->reg[R_UART_RXDRDY] = 1;
+    nrf51_uart_update_irq(s);
+}
+
+static int uart_can_receive(void *opaque)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    return s->rx_started ? (UART_FIFO_LENGTH - s->rx_fifo_len) : 0;
+}
+
+static void uart_event(void *opaque, int event)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    if (event == CHR_EVENT_BREAK) {
+        s->reg[R_UART_ERRORSRC] |= 3;
+        s->reg[R_UART_ERROR] = 1;
+        nrf51_uart_update_irq(s);
+    }
+}
+
+static void nrf51_uart_realize(DeviceState *dev, Error **errp)
+{
+    NRF51UARTState *s = NRF51_UART(dev);
+
+    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
+                             uart_event, NULL, s, NULL, true);
+}
+
+static void nrf51_uart_init(Object *obj)
+{
+    NRF51UARTState *s = NRF51_UART(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &uart_ops, s,
+                          "nrf51_soc.uart", UART_SIZE);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static int nrf51_uart_post_load(void *opaque, int version_id)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    if (s->pending_tx_byte) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription nrf51_uart_vmstate = {
+    .name = "nrf51_soc.uart",
+    .post_load = nrf51_uart_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(reg, NRF51UARTState, 0x56C),
+        VMSTATE_UINT8_ARRAY(rx_fifo, NRF51UARTState, UART_FIFO_LENGTH),
+        VMSTATE_UINT32(rx_fifo_pos, NRF51UARTState),
+        VMSTATE_UINT32(rx_fifo_len, NRF51UARTState),
+        VMSTATE_BOOL(rx_started, NRF51UARTState),
+        VMSTATE_BOOL(tx_started, NRF51UARTState),
+        VMSTATE_BOOL(pending_tx_byte, NRF51UARTState),
+        VMSTATE_BOOL(enabled, NRF51UARTState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property nrf51_uart_properties[] = {
+    DEFINE_PROP_CHR("chardev", NRF51UARTState, chr),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void nrf51_uart_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = nrf51_uart_reset;
+    dc->realize = nrf51_uart_realize;
+    dc->props = nrf51_uart_properties;
+    dc->vmsd = &nrf51_uart_vmstate;
+}
+
+static const TypeInfo nrf51_uart_info = {
+    .name = TYPE_NRF51_UART,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(NRF51UARTState),
+    .instance_init = nrf51_uart_init,
+    .class_init = nrf51_uart_class_init
+};
+
+static void nrf51_uart_register_types(void)
+{
+    type_register_static(&nrf51_uart_info);
+}
+
+type_init(nrf51_uart_register_types)
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backe
 cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
 cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
 cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
+
+# hw/char/nrf51_uart.c
+nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
+nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
-- 
2.19.1

From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>

Wire up nRF51 UART in the corresponding SoC.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/nrf51_soc.h |  3 +++
 hw/arm/microbit.c          |  2 ++
 hw/arm/nrf51_soc.c         | 20 ++++++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/nrf51_soc.h
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/armv7m.h"
+#include "hw/char/nrf51_uart.h"
 
 #define TYPE_NRF51_SOC "nrf51-soc"
 #define NRF51_SOC(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct NRF51State {
     /*< public >*/
     ARMv7MState cpu;
 
+    NRF51UARTState uart;
+
     MemoryRegion iomem;
     MemoryRegion sram;
     MemoryRegion flash;
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/boards.h"
 #include "hw/arm/arm.h"
+#include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
 #include "hw/arm/nrf51_soc.h"
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
 
     sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
                           TYPE_NRF51_SOC);
+    qdev_prop_set_chr(DEVICE(&s->nrf51), "serial0", serial_hd(0));
     object_property_set_link(soc, OBJECT(system_memory), "memory",
                              &error_fatal);
     object_property_set_bool(soc, true, "realized", &error_fatal);
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #define NRF51822_FLASH_SIZE     (256 * 1024)
 #define NRF51822_SRAM_SIZE      (16 * 1024)
 
+#define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
+
 static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
 {
     NRF51State *s = NRF51_SOC(dev_soc);
+    MemoryRegion *mr;
     Error *err = NULL;
 
     if (!s->board_memory) {
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
 
+    /* UART */
+    object_property_set_bool(OBJECT(&s->uart), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
+    memory_region_add_subregion_overlap(&s->container, UART_BASE, mr, 0);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
+                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       BASE_TO_IRQ(UART_BASE)));
+
     create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
     create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
     create_unimplemented_device("nrf51_soc.private",
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
     qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
                          ARM_CPU_TYPE_NAME("cortex-m0"));
     qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+
+    sysbus_init_child_obj(obj, "uart", &s->uart, sizeof(s->uart),
+                           TYPE_NRF51_UART);
+    object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev",
+                              &error_abort);
 }
 
 static Property nrf51_soc_properties[] = {
-- 
2.19.1

From: Julia Suvorova via Qemu-devel <qemu-devel@nongnu.org>

New mini-kernel test for nRF51 SoC UART.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/boot-serial-test.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/boot-serial-test.c
+++ b/tests/boot-serial-test.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t kernel_aarch64[] = {
     0xfd, 0xff, 0xff, 0x17,                 /* b       -12 (loop) */
 };
 
+static const uint8_t kernel_nrf51[] = {
+    0x00, 0x00, 0x00, 0x00,                 /* Stack top address */
+    0x09, 0x00, 0x00, 0x00,                 /* Reset handler address */
+    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get ENABLE */
+    0x04, 0x21,                             /* movs r1, #4 */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get STARTTX */
+    0x01, 0x21,                             /* movs r1, #1 */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0x03, 0x4a,                             /* ldr  r2, [pc, #12] Get TXD */
+    0x54, 0x21,                             /* movs r1, 'T' */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0xfe, 0xe7,                             /* b    . */
+    0x00, 0x25, 0x00, 0x40,                 /* 0x40002500 = UART ENABLE */
+    0x08, 0x20, 0x00, 0x40,                 /* 0x40002008 = UART STARTTX */
+    0x1c, 0x25, 0x00, 0x40                  /* 0x4000251c = UART TXD */
+};
+
 typedef struct testdef {
     const char *arch;       /* Target architecture */
     const char *machine;    /* Name of the machine */
@@ -XXX,XX +XXX,XX @@ static testdef_t tests[] = {
     { "hppa", "hppa", "", "SeaBIOS wants SYSTEM HALT" },
     { "aarch64", "virt", "-cpu cortex-a57", "TT", sizeof(kernel_aarch64),
       kernel_aarch64 },
+    { "arm", "microbit", "", "T", sizeof(kernel_nrf51), kernel_nrf51 },
 
     { NULL }
 };
-- 
2.19.1

arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
patches, which are somewhere between a bugfix and a new feature.

thanks
-- PMM

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Check 31st bit to see if CD is valid
 * qemu-options.hx: Fix formatting of -machine memory-backend option
 * hw: aspeed_gpio: Fix memory size
 * hw/arm/nseries: Display hexadecimal value with '0x' prefix
 * Add sve-default-vector-length cpu property
 * docs: Update path that mentions deprecated.rst
 * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
 * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
 * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
 * target/arm: Report M-profile alignment faults correctly to the guest
 * target/arm: Add missing 'return's after calling v7m_exception_taken()
 * target/arm: Enforce that M-profile SP low 2 bits are always zero

----------------------------------------------------------------
Joe Komlodi (1):
      hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):
      hw: aspeed_gpio: Fix memory size

Mao Zhongyi (1):
      docs: Update path that mentions deprecated.rst

Peter Maydell (7):
      qemu-options.hx: Fix formatting of -machine memory-backend option
      target/arm: Enforce that M-profile SP low 2 bits are always zero
      target/arm: Add missing 'return's after calling v7m_exception_taken()
      target/arm: Report M-profile alignment faults correctly to the guest
      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

Philippe Mathieu-Daudé (1):
      hw/arm/nseries: Display hexadecimal value with '0x' prefix

Richard Henderson (3):
      target/arm: Correctly bound length in sve_zcr_get_valid_len
      target/arm: Export aarch64_sve_zcr_get_valid_len
      target/arm: Add sve-default-vector-length cpu property

The documentation of the -machine memory-backend has some minor
formatting errors:
 * Misindentation of the initial line meant that the whole option
   section is incorrectly indented in the HTML output compared to
   the other -machine options
 * The examples weren't indented, which meant that they were formatted
   as plain run-on text including outputting the "::" as text.
 * The a) b) list has no rst-format markup so it is rendered as
   a single run-on paragraph

Fix the formatting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
---
 qemu-options.hx | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
-     ``memory-backend='id'``
+    ``memory-backend='id'``
         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
         Allows to use a memory backend as main RAM.
 
         For example:
         ::
-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+            -machine memory-backend=pc.ram
+            -m 512M
 
         Migration compatibility note:
-        a) as backend id one shall use value of 'default-ram-id', advertised by
-        machine type (available via ``query-machines`` QMP command), if migration
-        to/from old QEMU (<5.0) is expected.
-        b) for machine types 4.0 and older, user shall
-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-        if migration to/from old QEMU (<5.0) is expected.
+
+        * as backend id one shall use value of 'default-ram-id', advertised by
+          machine type (available via ``query-machines`` QMP command), if migration
+          to/from old QEMU (<5.0) is expected.
+        * for machine types 4.0 and older, user shall
+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+          if migration to/from old QEMU (<5.0) is expected.
+
         For example:
         ::
-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+            -machine memory-backend=pc.ram
+            -m 512M
 ERST
 
 HXCOMM Deprecated by -machine
-- 
2.20.1

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:
 * for writes to r13 by the gdbstub
 * for writes to any of the various flavours of SP via MSR
 * for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).

All the other writes to regs[13] in C code are either:
 * A-profile only code
 * writes of values we can guarantee to be aligned, such as
   - writes of previous-SP-value plus or minus a 4-aligned constant
   - writes of the value in an SP limit register (which we already
     enforce to be aligned)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
 target/arm/gdbstub.c   |  4 ++++
 target/arm/m_helper.c  | 14 ++++++++------
 target/arm/translate.c |  3 +++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 16) {
         /* Core integer register.  */
+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+            /* M profile SP low bits are always 0 */
+            tmp &= ~3;
+        }
         env->regs[n] = tmp;
         return 4;
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_msp = val;
+            env->v7m.other_ss_msp = val & ~3;
             return;
         case 0x89: /* PSP_NS */
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_psp = val;
+            env->v7m.other_ss_psp = val & ~3;
             return;
         case 0x8a: /* MSPLIM_NS */
             if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
 
             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 
+            val &= ~0x3;
+
             if (val < limit) {
                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
             }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         break;
     case 8: /* MSP */
         if (v7m_using_psp(env)) {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         } else {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         }
         break;
     case 9: /* PSP */
         if (v7m_using_psp(env)) {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         } else {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         }
         break;
     case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
          */
         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
         s->base.is_jmp = DISAS_JUMP;
+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* For M-profile SP bits [1:0] are always zero */
+        tcg_gen_andi_i32(var, var, ~3);
     }
     tcg_gen_mov_i32(cpu_R[reg], var);
     tcg_temp_free_i32(var);
-- 
2.20.1

In do_v7m_exception_exit(), we perform various checks as part of
performing the exception return.  If one of these checks fails, the
architecture requires that we take an appropriate exception on the
existing stackframe.  We implement this by calling
v7m_exception_taken() to set up to take the new exception, and then
immediately returning from do_v7m_exception_exit() without proceeding
any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"
statement, with the effect that if bad code in the guest tripped over
these checks we would set up to take a UsageFault exception but then
blunder on trying to also unstack and return from the original
exception, with the probable result that the guest would crash.

Add the missing return statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: NSACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 } else if (!cpacr_pass) {
                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                             exc_secure);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: CPACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 }
             }
             /* Clear s0..s15, FPSCR and VPR */
-- 
2.20.1

For M-profile, we weren't reporting alignment faults triggered by the
generic TCG code correctly to the guest.  These get passed into
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
style exception.fsr value of 1.  We didn't check for this, and so
they fell through into the default of "assume this is an MPU fault"
and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED
bit in the UFSR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
         break;
     case EXCP_UNALIGNED:
+        /* Unaligned faults reported by M-profile aware code */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
         break;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
             break;
+        case 0x1: /* Alignment fault reported by generic code */
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really UsageFault with UFSR.UNALIGNED\n");
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            break;
         default:
             /*
              * All other FSR values are either MPU faults or "can't happen
-- 
2.20.1

The ISCR.ISRPENDING bit is set when an external interrupt is pending.
This is true whether that external interrupt is enabled or not.
This means that we can't use 's->vectpending == 0' as a shortcut to
"ISRPENDING is zero", because s->vectpending indicates only the
highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending
enabled interrupt we fall through to scanning through the whole
interrupt array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
 {
     int irq;
 
-    /* We can shortcut if the highest priority pending interrupt
-     * happens to be external or if there is nothing pending.
+    /*
+     * We can shortcut if the highest priority pending interrupt
+     * happens to be external; if not we need to check the whole
+     * vectors[] array.
      */
     if (s->vectpending > NVIC_FIRST_IRQ) {
         return true;
     }
-    if (s->vectpending == 0) {
-        return false;
-    }
 
     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
         if (s->vectors[irq].pending) {
-- 
2.20.1

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
the register.  We were incorrectly masking it to 8 bits, so it would
report the wrong value if the pending exception was greater than 256.
Fix the bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0xff) << 12;
+        val |= (s->vectpending & 0x1ff) << 12;
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
the register is accessed NonSecure and the highest priority pending
enabled exception (that would be returned in the VECTPENDING field)
targets Secure, then the VECTPENDING field must read 1 rather than
the exception number of the pending exception. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
+static bool vectpending_targets_secure(NVICState *s)
+{
+    /* Return true if s->vectpending targets Secure state */
+    if (s->vectpending_is_s_banked) {
+        return true;
+    }
+    return !exc_is_banked(s->vectpending) &&
+        exc_targets_secure(s, s->vectpending);
+}
+
 void armv7m_nvic_get_pending_irq_info(void *opaque,
                                       int *pirq, bool *ptargets_secure)
 {
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
 
     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
 
-    if (s->vectpending_is_s_banked) {
-        targets_secure = true;
-    } else {
-        targets_secure = !exc_is_banked(pending) &&
-            exc_targets_secure(s, pending);
-    }
+    targets_secure = vectpending_targets_secure(s);
 
     trace_nvic_get_pending_irq_info(pending, targets_secure);
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0x1ff) << 12;
+        if (s->vectpending) {
+            /*
+             * From v8.1M VECTPENDING must read as 1 if accessed as
+             * NonSecure and the highest priority pending and enabled
+             * exception targets Secure.
+             */
+            int vp = s->vectpending;
+            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
+                vectpending_targets_secure(s)) {
+                vp = 1;
+            }
+            val |= (vp & 0x1ff) << 12;
+        }
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>

Missed in commit f3478392 "docs: Move deprecation, build
and license info out of system/"

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure         | 2 +-
 target/i386/cpu.c | 2 +-
 MAINTAINERS       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 
 if test -n "${deprecated_features}"; then
     echo "Warning, deprecated features enabled."
-    echo "Please see docs/system/deprecated.rst"
+    echo "Please see docs/about/deprecated.rst"
     echo "  features: ${deprecated_features}"
 fi
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
  * none", but this is just for compatibility while libvirt isn't
  * adapted to resolve CPU model versions before creating VMs.
  * See "Runnability guarantee of CPU models" at
- * docs/system/deprecated.rst.
+ * docs/about/deprecated.rst.
  */
 X86CPUVersion default_cpu_version = 1;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
 
 Incompatible changes
 R: libvir-list@redhat.com
-F: docs/system/deprecated.rst
+F: docs/about/deprecated.rst
 
 Build System
 ------------
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Currently, our only caller is sve_zcr_len_for_el, which has
already masked the length extracted from ZCR_ELx, so the
masking done here is a nop.  But we will shortly have uses
from other locations, where the length will be unmasked.

Saturate the length to ARM_MAX_VQ instead of truncating to
the low 4 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
-    end_len = start_len &= 0xf;
+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+    end_len = start_len;
+
     if (!test_bit(start_len, cpu->sve_vq_map)) {
         end_len = find_last_bit(cpu->sve_vq_map, start_len);
         assert(end_len < start_len);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from sve_zcr_get_valid_len and make accessible
from outside of helper.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 #endif /* CONFIG_TCG */
 
+/**
+ * aarch64_sve_zcr_get_valid_len:
+ * @cpu: cpu context
+ * @start_len: maximum len to consider
+ *
+ * Return the maximum supported sve vector length <= @start_len.
+ * Note that both @start_len and the return value are in units
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
+ */
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
 
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    return sve_zcr_get_valid_len(cpu, zcr_len);
+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the behavour of /proc/sys/abi/sve_default_vector_length
under the real linux kernel.  We have no way of passing along
a real default across exec like the kernel can, but this is a
decent way of adjusting the startup vector length of a process.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
[PMM: tweaked docs formatting, document -1 special-case,
 added fixup patch from RTH mentioning QEMU's maximum veclen.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 15 ++++++++
 target/arm/cpu.h                 |  5 +++
 target/arm/cpu.c                 | 14 ++++++--
 target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SVE User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 64.
+
+If the default length is larger than the maximum vector length enabled,
+the actual vector length will be reduced.  Note that the maximum vector
+length supported by QEMU is 256.
+
+If this property is set to ``-1`` then the default vector length
+is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
 
+#ifdef CONFIG_USER_ONLY
+    /* Used to set the default vector length at process start. */
+    uint32_t sve_default_vq;
+#endif
+
     /*
      * In sve_vq_map each set bit is a supported vector length of
      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         /* with reasonable vector length */
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+            env->vfp.zcr_el[1] =
+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
          * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+# ifdef TARGET_AARCH64
+    /*
+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+     * our corresponding sve-default-vector-length cpu property.
+     */
+    cpu->sve_default_vq = 4;
+# endif
+#else
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+#ifdef CONFIG_USER_ONLY
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t default_len, default_vq, remainder;
+
+    if (!visit_type_int32(v, name, &default_len, errp)) {
+        return;
+    }
+
+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+    if (default_len == -1) {
+        cpu->sve_default_vq = ARM_MAX_VQ;
+        return;
+    }
+
+    default_vq = default_len / 16;
+    remainder = default_len % 16;
+
+    /*
+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     */
+    if (remainder || default_vq < 1 || default_vq > 512) {
+        error_setg(errp, "cannot set sve-default-vector-length");
+        if (remainder) {
+            error_append_hint(errp, "Vector length not a multiple of 16\n");
+        } else if (default_vq < 1) {
+            error_append_hint(errp, "Vector length smaller than 16\n");
+        } else {
+            error_append_hint(errp, "Vector length larger than %d\n",
+                              512 * 16);
+        }
+        return;
+    }
+
+    cpu->sve_default_vq = default_vq;
+}
+
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t value = cpu->sve_default_vq * 16;
+
+    visit_type_int32(v, name, &value, errp);
+}
+#endif
+
 void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
         object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                             cpu_arm_set_sve_vq, NULL, NULL);
     }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+    object_property_add(obj, "sve-default-vector-length", "int32",
+                        cpu_arm_get_sve_default_vec_len,
+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+#endif
 }
 
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The macro used to calculate the maximum memory size of the MMIO region
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
The intent was to have it be 0x9D8 - 0x800.

This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
region set aside for the GPIO controller.

On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
regions would overlap. Worse was the 1.8V controller would map over the
top of the following peripheral, which happens to be the RTC.

The mmio region used by each device is a maximum of 2KB, so avoid the
calculations and hard code this as the maximum.

Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210713065854.134634-2-joel@jms.id.au
[PMM: fix autocorrect error in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_1_8V_MEM_SIZE            0x9D8
 #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
                                       GPIO_1_8V_REG_OFFSET) >> 2)
-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+            TYPE_ASPEED_GPIO, 0x800);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.20.1