From: Fredrik Strupe <fredrik@strupe.net>

According to Arm ARM, VQDMULL is only valid when U=0, while having

U=1 is unallocated.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>

Fixes: 695272dcb976 ("target-arm: Handle UNDEF cases for Neon 3-regs-different-widths")

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/translate.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)

{0, 0, 0, 0}, /* VMLSL */

{0, 0, 0, 9}, /* VQDMLSL */

{0, 0, 0, 0}, /* Integer VMULL */

- {0, 0, 0, 1}, /* VQDMULL */

+ {0, 0, 0, 9}, /* VQDMULL */

{0, 0, 0, 0xa}, /* Polynomial VMULL */

{0, 0, 0, 7}, /* Reserved: always UNDEF */

};

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

By using the TYPE_* definitions for devices, we can:

- quickly find where devices are used with 'git-grep'

- easily rename a device (one-line change).

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20200428154650.21991-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/mps2-tz.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/mps2-tz.c

+++ b/hw/arm/mps2-tz.c

@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)

exit(EXIT_FAILURE);

}

- sysbus_init_child_obj(OBJECT(machine), "iotkit", &mms->iotkit,

+ sysbus_init_child_obj(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,

sizeof(mms->iotkit), mmc->armsse_type);

iotkitdev = DEVICE(&mms->iotkit);

object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),

--

2.20.1

We define ARMMMUIdx_Stage2 as being an MMU index which uses a QEMU

TLB. However we never actually use the TLB -- all stage 2 lookups

are done by direct calls to get_phys_addr_lpae() followed by a

physical address load via address_space_ld*().

Remove Stage2 from the list of ARM MMU indexes which correspond to

real core MMU indexes, and instead put it in the set of "NOTLB" ARM

MMU indexes.

This allows us to drop NB_MMU_MODES to 11. It also means we can

safely add support for the ARMv8.3-TTS2UXN extension, which adds

permission bits to the stage 2 descriptors which define execute

permission separatel for EL0 and EL1; supporting that while keeping

Stage2 in a QEMU TLB would require us to use separate TLBs for

"Stage2 for an EL0 access" and "Stage2 for an EL1 access", which is a

lot of extra complication given we aren't even using the QEMU TLB.

In the process of updating the comment on our MMU index use,

fix a couple of other minor errors:

* NS EL2 EL2&0 was missing from the list in the comment

* some text hadn't been updated from when we bumped NB_MMU_MODES

above 8

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200330210400.11724-2-peter.maydell@linaro.org

---

target/arm/cpu-param.h | 2 +-

target/arm/cpu.h | 21 +++++---

target/arm/helper.c | 112 ++++-------------------------------------

3 files changed, 27 insertions(+), 108 deletions(-)

diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu-param.h

+++ b/target/arm/cpu-param.h

@@ -XXX,XX +XXX,XX @@

# define TARGET_PAGE_BITS_MIN 10

#endif

-#define NB_MMU_MODES 12

+#define NB_MMU_MODES 11

#endif

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);

* handling via the TLB. The only way to do a stage 1 translation without

* the immediate stage 2 translation is via the ATS or AT system insns,

* which can be slow-pathed and always do a page table walk.

+ * The only use of stage 2 translations is either as part of an s1+2

+ * lookup or when loading the descriptors during a stage 1 page table walk,

+ * and in both those cases we don't use the TLB.

* 4. we can also safely fold together the "32 bit EL3" and "64 bit EL3"

* translation regimes, because they map reasonably well to each other

* and they can't both be active at the same time.

@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);

* NS EL1 EL1&0 stage 1+2 (aka NS PL1)

* NS EL1 EL1&0 stage 1+2 +PAN

* NS EL0 EL2&0

+ * NS EL2 EL2&0

* NS EL2 EL2&0 +PAN

* NS EL2 (aka NS PL2)

* S EL0 EL1&0 (aka S PL0)

* S EL1 EL1&0 (not used if EL3 is 32 bit)

* S EL1 EL1&0 +PAN

* S EL3 (aka S PL1)

- * NS EL1&0 stage 2

*

- * for a total of 12 different mmu_idx.

+ * for a total of 11 different mmu_idx.

*

* R profile CPUs have an MPU, but can use the same set of MMU indexes

* as A profile. They only need to distinguish NS EL0 and NS EL1 (and

@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);

* are not quite the same -- different CPU types (most notably M profile

* vs A/R profile) would like to use MMU indexes with different semantics,

* but since we don't ever need to use all of those in a single CPU we

- * can avoid setting NB_MMU_MODES to more than 8. The lower bits of

+ * can avoid having to set NB_MMU_MODES to "total number of A profile MMU

+ * modes + total number of M profile MMU modes". The lower bits of

* ARMMMUIdx are the core TLB mmu index, and the higher bits are always

* the same for any particular CPU.

* Variables of type ARMMUIdx are always full values, and the core

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

ARMMMUIdx_SE10_1_PAN = 9 | ARM_MMU_IDX_A,

ARMMMUIdx_SE3 = 10 | ARM_MMU_IDX_A,

- ARMMMUIdx_Stage2 = 11 | ARM_MMU_IDX_A,

-

/*

* These are not allocated TLBs and are used only for AT system

* instructions or for the first stage of an S12 page table walk.

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {

ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,

ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,

ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,

+ /*

+ * Not allocated a TLB: used only for second stage of an S12 page

+ * table walk, or for descriptor loads during first stage of an S1

+ * page table walk. Note that if we ever want to have a TLB for this

+ * then various TLB flush insns which currently are no-ops or flush

+ * only stage 1 MMU indexes will need to change to flush stage 2.

+ */

+ ARMMMUIdx_Stage2 = 3 | ARM_MMU_IDX_NOTLB,

/*

* M-profile.

@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {

TO_CORE_BIT(SE10_1),

TO_CORE_BIT(SE10_1_PAN),

TO_CORE_BIT(SE3),

- TO_CORE_BIT(Stage2),

TO_CORE_BIT(MUser),

TO_CORE_BIT(MPriv),

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,

tlb_flush_by_mmuidx(cs,

ARMMMUIdxBit_E10_1 |

ARMMMUIdxBit_E10_1_PAN |

- ARMMMUIdxBit_E10_0 |

- ARMMMUIdxBit_Stage2);

+ ARMMMUIdxBit_E10_0);

}

static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,

tlb_flush_by_mmuidx_all_cpus_synced(cs,

ARMMMUIdxBit_E10_1 |

ARMMMUIdxBit_E10_1_PAN |

- ARMMMUIdxBit_E10_0 |

- ARMMMUIdxBit_Stage2);

+ ARMMMUIdxBit_E10_0);

}

-static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,

- uint64_t value)

-{

- /* Invalidate by IPA. This has to invalidate any structures that

- * contain only stage 2 translation information, but does not need

- * to apply to structures that contain combined stage 1 and stage 2

- * translation information.

- * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.

- */

- CPUState *cs = env_cpu(env);

- uint64_t pageaddr;

-

- if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {

- return;

- }

-

- pageaddr = sextract64(value << 12, 0, 40);

-

- tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);

-}

-

-static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,

- uint64_t value)

-{

- CPUState *cs = env_cpu(env);

- uint64_t pageaddr;

-

- if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {

- return;

- }

-

- pageaddr = sextract64(value << 12, 0, 40);

-

- tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,

- ARMMMUIdxBit_Stage2);

-}

static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,

uint64_t value)

@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,

tlb_flush_by_mmuidx(cs,

ARMMMUIdxBit_E10_1 |

ARMMMUIdxBit_E10_1_PAN |

- ARMMMUIdxBit_E10_0 |

- ARMMMUIdxBit_Stage2);

+ ARMMMUIdxBit_E10_0);

raw_write(env, ri, value);

}

}

@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)

return ARMMMUIdxBit_SE10_1 |

ARMMMUIdxBit_SE10_1_PAN |

ARMMMUIdxBit_SE10_0;

- } else if (arm_feature(env, ARM_FEATURE_EL2)) {

- return ARMMMUIdxBit_E10_1 |

- ARMMMUIdxBit_E10_1_PAN |

- ARMMMUIdxBit_E10_0 |

- ARMMMUIdxBit_Stage2;

} else {

return ARMMMUIdxBit_E10_1 |

ARMMMUIdxBit_E10_1_PAN |

@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,

ARMMMUIdxBit_SE3);

}

-static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,

- uint64_t value)

-{

- /* Invalidate by IPA. This has to invalidate any structures that

- * contain only stage 2 translation information, but does not need

- * to apply to structures that contain combined stage 1 and stage 2

- * translation information.

- * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.

- */

- ARMCPU *cpu = env_archcpu(env);

- CPUState *cs = CPU(cpu);

- uint64_t pageaddr;

-

- if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {

- return;

- }

-

- pageaddr = sextract64(value << 12, 0, 48);

-

- tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);

-}

-

-static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,

- uint64_t value)

-{

- CPUState *cs = env_cpu(env);

- uint64_t pageaddr;

-

- if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {

- return;

- }

-

- pageaddr = sextract64(value << 12, 0, 48);

-

- tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,

- ARMMMUIdxBit_Stage2);

-}

-

static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,

bool isread)

{

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

.writefn = tlbi_aa64_vae1_write },

{ .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,

- .access = PL2_W, .type = ARM_CP_NO_RAW,

- .writefn = tlbi_aa64_ipas2e1is_write },

+ .access = PL2_W, .type = ARM_CP_NOP },

{ .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,

- .access = PL2_W, .type = ARM_CP_NO_RAW,

- .writefn = tlbi_aa64_ipas2e1is_write },

+ .access = PL2_W, .type = ARM_CP_NOP },

{ .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,

.access = PL2_W, .type = ARM_CP_NO_RAW,

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

.writefn = tlbi_aa64_alle1is_write },

{ .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,

- .access = PL2_W, .type = ARM_CP_NO_RAW,

- .writefn = tlbi_aa64_ipas2e1_write },

+ .access = PL2_W, .type = ARM_CP_NOP },

{ .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,

- .access = PL2_W, .type = ARM_CP_NO_RAW,

- .writefn = tlbi_aa64_ipas2e1_write },

+ .access = PL2_W, .type = ARM_CP_NOP },

{ .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,

.opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,

.access = PL2_W, .type = ARM_CP_NO_RAW,

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {

.writefn = tlbimva_hyp_is_write },

{ .name = "TLBIIPAS2",

.cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,

- .type = ARM_CP_NO_RAW, .access = PL2_W,

- .writefn = tlbiipas2_write },

+ .type = ARM_CP_NOP, .access = PL2_W },

{ .name = "TLBIIPAS2IS",

.cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,

- .type = ARM_CP_NO_RAW, .access = PL2_W,

- .writefn = tlbiipas2_is_write },

+ .type = ARM_CP_NOP, .access = PL2_W },

{ .name = "TLBIIPAS2L",

.cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,

- .type = ARM_CP_NO_RAW, .access = PL2_W,

- .writefn = tlbiipas2_write },

+ .type = ARM_CP_NOP, .access = PL2_W },

{ .name = "TLBIIPAS2LIS",

.cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,

- .type = ARM_CP_NO_RAW, .access = PL2_W,

- .writefn = tlbiipas2_is_write },

+ .type = ARM_CP_NOP, .access = PL2_W },

/* 32 bit cache operations */

{ .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,

.type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_pou_access },

--

2.20.1

The access_type argument to get_phys_addr_lpae() is an MMUAccessType;

use the enum constant MMU_DATA_LOAD rather than a literal 0 when we

call it in S1_ptw_translate().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200330210400.11724-3-peter.maydell@linaro.org

---

target/arm/helper.c | 5 +++--

1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,

pcacheattrs = &cacheattrs;

}

- ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_Stage2, &s2pa,

- &txattrs, &s2prot, &s2size, fi, pcacheattrs);

+ ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,

+ &s2pa, &txattrs, &s2prot, &s2size, fi,

+ pcacheattrs);

if (ret) {

assert(fi->type != ARMFault_None);

fi->s2addr = addr;

--

2.20.1

The ARMv8.2-TTS2UXN feature extends the XN field in stage 2

translation table descriptors from just bit [54] to bits [54:53],

allowing stage 2 to control execution permissions separately for EL0

and EL1. Implement the new semantics of the XN field and enable

the feature for our 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200330210400.11724-5-peter.maydell@linaro.org

---

target/arm/cpu.h | 15 +++++++++++++++

target/arm/cpu.c | 1 +

target/arm/cpu64.c | 2 ++

target/arm/helper.c | 37 +++++++++++++++++++++++++++++++------

4 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)

return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;

}

+static inline bool isar_feature_aa32_tts2uxn(const ARMISARegisters *id)

+{

+ return FIELD_EX32(id->id_mmfr4, ID_MMFR4, XNX) != 0;

+}

+

/*

* 64-bit feature tests via id registers.

*/

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)

return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;

}

+static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;

+}

+

/*

* Feature tests for "does this exist in either 32-bit or 64-bit?"

*/

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)

return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);

}

+static inline bool isar_feature_any_tts2uxn(const ARMISARegisters *id)

+{

+ return isar_feature_aa64_tts2uxn(id) || isar_feature_aa32_tts2uxn(id);

+}

+

/*

* Forward to the above feature tests given an ARMCPU pointer.

*/

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)

t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */

t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */

t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */

+ t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */

cpu->isar.id_mmfr4 = t;

}

#endif

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu64.c

+++ b/target/arm/cpu64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);

t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2); /* ATS1E1 */

t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* VMID16 */

+ t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* TTS2UXN */

cpu->isar.id_aa64mmfr1 = t;

t = cpu->isar.id_aa64mmfr2;

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */

u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */

u = FIELD_DP32(u, ID_MMFR4, CNP, 1); /* TTCNP */

+ u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */

cpu->isar.id_mmfr4 = u;

u = cpu->isar.id_aa64dfr0;

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)

*

* @env: CPUARMState

* @s2ap: The 2-bit stage2 access permissions (S2AP)

- * @xn: XN (execute-never) bit

+ * @xn: XN (execute-never) bits

+ * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0

*/

-static int get_S2prot(CPUARMState *env, int s2ap, int xn)

+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)

{

int prot = 0;

@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn)

if (s2ap & 2) {

prot |= PAGE_WRITE;

}

- if (!xn) {

- if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {

+

+ if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {

+ switch (xn) {

+ case 0:

prot |= PAGE_EXEC;

+ break;

+ case 1:

+ if (s1_is_el0) {

+ prot |= PAGE_EXEC;

+ }

+ break;

+ case 2:

+ break;

+ case 3:

+ if (!s1_is_el0) {

+ prot |= PAGE_EXEC;

+ }

+ break;

+ default:

+ g_assert_not_reached();

+ }

+ } else {

+ if (!extract32(xn, 1, 1)) {

+ if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {

+ prot |= PAGE_EXEC;

+ }

}

}

return prot;

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,

}

ap = extract32(attrs, 4, 2);

- xn = extract32(attrs, 12, 1);

if (mmu_idx == ARMMMUIdx_Stage2) {

ns = true;

- *prot = get_S2prot(env, ap, xn);

+ xn = extract32(attrs, 11, 2);

+ *prot = get_S2prot(env, ap, xn, s1_is_el0);

} else {

ns = extract32(attrs, 3, 1);

+ xn = extract32(attrs, 12, 1);

pxn = extract32(attrs, 11, 1);

*prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);

}

--

2.20.1

In aarch64_max_initfn() we update both 32-bit and 64-bit ID

registers. The intended pattern is that for 64-bit ID registers we

use FIELD_DP64 and the uint64_t 't' register, while 32-bit ID

registers use FIELD_DP32 and the uint32_t 'u' register. For

ID_AA64DFR0 we accidentally used 'u', meaning that the top 32 bits of

this 64-bit ID register would end up always zero. Luckily at the

moment that's what they should be anyway, so this bug has no visible

effects.

Use the right-sized variable.

Fixes: 3bec78447a958d481991

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20200423110915.10527-1-peter.maydell@linaro.org

---

target/arm/cpu64.c | 6 +++---

1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu64.c

+++ b/target/arm/cpu64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */

cpu->isar.id_mmfr4 = u;

- u = cpu->isar.id_aa64dfr0;

- u = FIELD_DP64(u, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */

- cpu->isar.id_aa64dfr0 = u;

+ t = cpu->isar.id_aa64dfr0;

+ t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */

+ cpu->isar.id_aa64dfr0 = t;

u = cpu->isar.id_dfr0;

u = FIELD_DP32(u, ID_DFR0, PERFMON, 5); /* v8.4-PMU */

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

MIDR_EL1 is a 64-bit system register with the top 32-bit being RES0.

Represent it in QEMU's ARMCPU struct with a uint64_t, not a

uint32_t.

This fixes an error when compiling with -Werror=conversion

because we were manipulating the register value using a

local uint64_t variable:

target/arm/cpu64.c: In function ‘aarch64_max_initfn’:

target/arm/cpu64.c:628:21: error: conversion from ‘uint64_t’ {aka ‘long unsigned int’} to ‘uint32_t’ {aka ‘unsigned int’} may change value [-Werror=conversion]

628 | cpu->midr = t;

| ^

and future-proofs us against a possible future architecture

change using some of the top 32 bits.

Suggested-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>

Message-id: 20200428172634.29707-1-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.h | 2 +-

target/arm/cpu.c | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ struct ARMCPU {

uint64_t id_aa64dfr0;

uint64_t id_aa64dfr1;

} isar;

- uint32_t midr;

+ uint64_t midr;

uint32_t revidr;

uint32_t reset_fpsid;

uint32_t ctr;

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_cpus[] = {

static Property arm_cpu_properties[] = {

DEFINE_PROP_BOOL("start-powered-off", ARMCPU, start_powered_off, false),

DEFINE_PROP_UINT32("psci-conduit", ARMCPU, psci_conduit, 0),

- DEFINE_PROP_UINT32("midr", ARMCPU, midr, 0),

+ DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),

DEFINE_PROP_UINT64("mp-affinity", ARMCPU,

mp_affinity, ARM64_AFFINITY_INVALID),

DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Remove inclusion of arm_gicv3_common.h, this already gets

included via xlnx-versal.h.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-2-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/xlnx-versal.c | 1 -

1 file changed, 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@

#include "hw/arm/boot.h"

#include "kvm_arm.h"

#include "hw/misc/unimp.h"

-#include "hw/intc/arm_gicv3_common.h"

#include "hw/arm/xlnx-versal.h"

#include "hw/char/pl011.h"

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Move misplaced comment.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-3-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/xlnx-versal.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)

obj = object_new(XLNX_VERSAL_ACPU_TYPE);

if (!obj) {

- /* Secondary CPUs start in PSCI powered-down state */

error_report("Unable to create apu.cpu[%d] of type %s",

i, XLNX_VERSAL_ACPU_TYPE);

exit(EXIT_FAILURE);

@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)

object_property_set_int(obj, s->cfg.psci_conduit,

"psci-conduit", &error_abort);

if (i) {

+ /* Secondary CPUs start in PSCI powered-down state */

object_property_set_bool(obj, true,

"start-powered-off", &error_abort);

}

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Fix typo xlnx-ve -> xlnx-versal.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-4-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/xlnx-versal-virt.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal-virt.c

+++ b/hw/arm/xlnx-versal-virt.c

@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)

psci_conduit = QEMU_PSCI_CONDUIT_SMC;

}

- sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,

+ sysbus_init_child_obj(OBJECT(machine), "xlnx-versal", &s->soc,

sizeof(s->soc), TYPE_XLNX_VERSAL);

object_property_set_link(OBJECT(&s->soc), OBJECT(machine->ram),

"ddr", &error_abort);

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the UARTs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-5-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-versal.h | 3 ++-

hw/arm/xlnx-versal.c | 12 ++++++------

2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@

#include "hw/sysbus.h"

#include "hw/arm/boot.h"

#include "hw/intc/arm_gicv3.h"

+#include "hw/char/pl011.h"

#define TYPE_XLNX_VERSAL "xlnx-versal"

#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

MemoryRegion mr_ocm;

struct {

- SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];

+ PL011State uart[XLNX_VERSAL_NR_UARTS];

SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];

SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];

} iou;

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@

#include "kvm_arm.h"

#include "hw/misc/unimp.h"

#include "hw/arm/xlnx-versal.h"

-#include "hw/char/pl011.h"

#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")

#define GEM_REVISION 0x40070106

@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)

DeviceState *dev;

MemoryRegion *mr;

- dev = qdev_create(NULL, TYPE_PL011);

- s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);

+ sysbus_init_child_obj(OBJECT(s), name,

+ &s->lpd.iou.uart[i], sizeof(s->lpd.iou.uart[i]),

+ TYPE_PL011);

+ dev = DEVICE(&s->lpd.iou.uart[i]);

qdev_prop_set_chr(dev, "chardev", serial_hd(i));

- object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);

qdev_init_nofail(dev);

- mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);

+ mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);

memory_region_add_subregion(&s->mr_ps, addrs[i], mr);

- sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);

+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);

g_free(name);

}

}

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the GEMs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-6-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-versal.h | 3 ++-

hw/arm/xlnx-versal.c | 15 ++++++++-------

2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@

#include "hw/arm/boot.h"

#include "hw/intc/arm_gicv3.h"

#include "hw/char/pl011.h"

+#include "hw/net/cadence_gem.h"

#define TYPE_XLNX_VERSAL "xlnx-versal"

#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

struct {

PL011State uart[XLNX_VERSAL_NR_UARTS];

- SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];

+ CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];

SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];

} iou;

} lpd;

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)

DeviceState *dev;

MemoryRegion *mr;

- dev = qdev_create(NULL, "cadence_gem");

- s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);

- object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);

+ sysbus_init_child_obj(OBJECT(s), name,

+ &s->lpd.iou.gem[i], sizeof(s->lpd.iou.gem[i]),

+ TYPE_CADENCE_GEM);

+ dev = DEVICE(&s->lpd.iou.gem[i]);

if (nd->used) {

qemu_check_nic_model(nd, "cadence_gem");

qdev_set_nic_properties(dev, nd);

}

- object_property_set_int(OBJECT(s->lpd.iou.gem[i]),

+ object_property_set_int(OBJECT(dev),

2, "num-priority-queues",

&error_abort);

- object_property_set_link(OBJECT(s->lpd.iou.gem[i]),

+ object_property_set_link(OBJECT(dev),

OBJECT(&s->mr_ps), "dma",

&error_abort);

qdev_init_nofail(dev);

- mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);

+ mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);

memory_region_add_subregion(&s->mr_ps, addrs[i], mr);

- sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);

+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);

g_free(name);

}

}

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the ADMAs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-7-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-versal.h | 3 ++-

hw/arm/xlnx-versal.c | 14 +++++++-------

2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@

#include "hw/arm/boot.h"

#include "hw/intc/arm_gicv3.h"

#include "hw/char/pl011.h"

+#include "hw/dma/xlnx-zdma.h"

#include "hw/net/cadence_gem.h"

#define TYPE_XLNX_VERSAL "xlnx-versal"

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

struct {

PL011State uart[XLNX_VERSAL_NR_UARTS];

CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];

- SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];

+ XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];

} iou;

} lpd;

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_create_admas(Versal *s, qemu_irq *pic)

DeviceState *dev;

MemoryRegion *mr;

- dev = qdev_create(NULL, "xlnx.zdma");

- s->lpd.iou.adma[i] = SYS_BUS_DEVICE(dev);

- object_property_set_int(OBJECT(s->lpd.iou.adma[i]), 128, "bus-width",

- &error_abort);

- object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);

+ sysbus_init_child_obj(OBJECT(s), name,

+ &s->lpd.iou.adma[i], sizeof(s->lpd.iou.adma[i]),

+ TYPE_XLNX_ZDMA);

+ dev = DEVICE(&s->lpd.iou.adma[i]);

+ object_property_set_int(OBJECT(dev), 128, "bus-width", &error_abort);

qdev_init_nofail(dev);

- mr = sysbus_mmio_get_region(s->lpd.iou.adma[i], 0);

+ mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);

memory_region_add_subregion(&s->mr_ps,

MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);

- sysbus_connect_irq(s->lpd.iou.adma[i], 0, pic[VERSAL_ADMA_IRQ_0 + i]);

+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_ADMA_IRQ_0 + i]);

g_free(name);

}

}

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the APUs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Message-id: 20200427181649.26851-8-edgar.iglesias@gmail.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-versal.h | 2 +-

hw/arm/xlnx-versal-virt.c | 4 ++--

hw/arm/xlnx-versal.c | 19 +++++--------------

3 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

struct {

struct {

MemoryRegion mr;

- ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];

+ ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];

GICv3State gic;

} apu;

} fpd;

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal-virt.c

+++ b/hw/arm/xlnx-versal-virt.c

@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)

s->binfo.get_dtb = versal_virt_get_dtb;

s->binfo.modify_dtb = versal_virt_modify_dtb;

if (machine->kernel_filename) {

- arm_load_kernel(s->soc.fpd.apu.cpu[0], machine, &s->binfo);

+ arm_load_kernel(&s->soc.fpd.apu.cpu[0], machine, &s->binfo);

} else {

- AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],

+ AddressSpace *as = arm_boot_address_space(&s->soc.fpd.apu.cpu[0],

&s->binfo);

/* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).

* Offset things by 4K. */

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)

for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {

Object *obj;

- char *name;

-

- obj = object_new(XLNX_VERSAL_ACPU_TYPE);

- if (!obj) {

- error_report("Unable to create apu.cpu[%d] of type %s",

- i, XLNX_VERSAL_ACPU_TYPE);

- exit(EXIT_FAILURE);

- }

-

- name = g_strdup_printf("apu-cpu[%d]", i);

- object_property_add_child(OBJECT(s), name, obj, &error_fatal);

- g_free(name);

+ object_initialize_child(OBJECT(s), "apu-cpu[*]",

+ &s->fpd.apu.cpu[i], sizeof(s->fpd.apu.cpu[i]),

+ XLNX_VERSAL_ACPU_TYPE, &error_abort, NULL);