Series comparison

-[PULL 00/30] target-arm queue
+[Qemu-devel] [PULL v3 00/10] target-arm queue
-Hi; this is the latest target-arm queue. Most of the patches
+This is a respin of my pull request from earlier this week:
-here are RTH's FEAT_HAFDBS finally landing. I've also included
+ * versal board compile failure fixed
-the RNG-seed randomization patches from Jason, as well as a few
+ * a few new patches:
-more minor things. The patches include a couple of regression
+  - MAINTAINERS file fix
-fixes:
+  - use ARRAY_SIZE macro in xilinx_zynq
- * the resettable patch fixes a SCSI reset regression
+  - avoid an array overrun in strongarm GPIO irq handling
- * the 'do not re-randomize on snapshot load' patches fix
+  - fix an assert running KVM on an aarch64-only host
    record-and-replay regressions
-thanks
+The following changes since commit 69e2d03843412b9c076515b3aa9a71db161b6a1a:
 -- PMM
-The following changes since commit e750a7ace492f0b450653d4ad368a77d6f660fb8:
+  Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-sf1' into staging (2018-11-02 13:16:13 +0000)
   Merge tag 'pull-9p-20221024' of https://github.com/cschoenebeck/qemu into staging (2022-10-24 14:27:12 -0400)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221025
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181102
-for you to fetch changes up to e2114f701c78f76246e4b1872639dad94a6bdd21:
+for you to fetch changes up to 6f16da53ffe4567c0353f85055df04860eb4e6fc:
-  rx: re-randomize rng-seed on reboot (2022-10-25 17:32:24 +0100)
+  hw/arm: versal: Add a virtual Xilinx Versal board (2018-11-02 14:11:31 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Implement FEAT_E0PD
+ * microbit: Add the UART to our nRF51 SoC model
- * Implement FEAT_HAFDBS
+ * Add a virtual Xilinx Versal board "xlnx-versal-virt"
- * honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+ * hw/arm/virt: Set VIRT_COMPAT_3_0 compat
- * hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+ * MAINTAINERS: Remove bouncing email in ARM ACPI
- * hw/core/resettable: fix reset level counting
+ * strongarm: mask off high[31:28] bits from dir and state registers
- * hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
+ * target/arm: Conditionalize some asserts on aarch32 support
- * imx: reload cmp timer outside of the reload ptimer transaction
+ * hw/arm/xilinx_zynq: Use the ARRAY_SIZE macro
  * x86: do not re-randomize RNG seed on snapshot load
  * m68k/virt: do not re-randomize RNG seed on snapshot load
  * m68k/q800: do not re-randomize RNG seed on snapshot load
  * arm: re-randomize rng-seed on reboot
  * riscv: re-randomize rng-seed on reboot
  * mips/boston: re-randomize rng-seed on reboot
  * openrisc: re-randomize rng-seed on reboot
  * rx: re-randomize rng-seed on reboot
 ----------------------------------------------------------------
-Ake Koomsin (1):
+Edgar E. Iglesias (2):
-      target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+      hw/arm: versal: Add a model of Xilinx Versal SoC
       hw/arm: versal: Add a virtual Xilinx Versal board
-Axel Heider (1):
+Eric Auger (1):
-      target/imx: reload cmp timer outside of the reload ptimer transaction
+      hw/arm/virt: Set VIRT_COMPAT_3_0 compat
-Damien Hedde (1):
+Julia Suvorova (3):
-      hw/core/resettable: fix reset level counting
+      hw/char: Implement nRF51 SoC UART
       hw/arm/nrf51_soc: Connect UART to nRF51 SoC
       tests/boot-serial-test: Add microbit board testcase
-Jason A. Donenfeld (10):
+Philippe Mathieu-Daudé (2):
-      reset: allow registering handlers that aren't called by snapshot loading
+      MAINTAINERS: Remove bouncing email in ARM ACPI
-      device-tree: add re-randomization helper function
+      hw/arm/xilinx_zynq: Use the ARRAY_SIZE macro
       x86: do not re-randomize RNG seed on snapshot load
       arm: re-randomize rng-seed on reboot
       riscv: re-randomize rng-seed on reboot
       m68k/virt: do not re-randomize RNG seed on snapshot load
       m68k/q800: do not re-randomize RNG seed on snapshot load
       mips/boston: re-randomize rng-seed on reboot
       openrisc: re-randomize rng-seed on reboot
       rx: re-randomize rng-seed on reboot
-Jean-Philippe Brucker (1):
+Prasad J Pandit (1):
-      hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+      strongarm: mask off high[31:28] bits from dir and state registers
-Peter Maydell (2):
+Richard Henderson (1):
-      target/arm: Implement FEAT_E0PD
+      target/arm: Conditionalize some asserts on aarch32 support
       hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
-Richard Henderson (14):
+ hw/arm/Makefile.objs                |   1 +
-      target/arm: Introduce regime_is_stage2
+ hw/char/Makefile.objs               |   1 +
-      target/arm: Add ptw_idx to S1Translate
+ include/hw/arm/nrf51_soc.h          |   3 +
-      target/arm: Add isar predicates for FEAT_HAFDBS
+ include/hw/arm/xlnx-versal.h        | 122 +++++++++
-      target/arm: Extract HA and HD in aa64_va_parameters
+ include/hw/char/nrf51_uart.h        |  78 ++++++
-      target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
+ target/arm/cpu.h                    |   5 +
-      target/arm: Add ARMFault_UnsuppAtomicUpdate
+ hw/arm/microbit.c                   |   2 +
-      target/arm: Remove loop from get_phys_addr_lpae
+ hw/arm/nrf51_soc.c                  |  20 ++
-      target/arm: Fix fault reporting in get_phys_addr_lpae
+ hw/arm/strongarm.c                  |   4 +-
-      target/arm: Don't shift attrs in get_phys_addr_lpae
+ hw/arm/virt.c                       |   4 +
-      target/arm: Consider GP an attribute in get_phys_addr_lpae
+ hw/arm/xilinx_zynq.c                |   2 +-
-      target/arm: Tidy merging of attributes from descriptor and table
+ hw/arm/xlnx-versal-virt.c           | 494 ++++++++++++++++++++++++++++++++++++
-      target/arm: Implement FEAT_HAFDBS, access flag portion
+ hw/arm/xlnx-versal.c                | 323 +++++++++++++++++++++++
-      target/arm: Implement FEAT_HAFDBS, dirty bit portion
+ hw/char/nrf51_uart.c                | 330 ++++++++++++++++++++++++
-      target/arm: Use the max page size in a 2-stage ptw
+ target/arm/cpu.c                    |  15 +-
  tests/boot-serial-test.c            |  19 ++
  MAINTAINERS                         |   1 -
  default-configs/aarch64-softmmu.mak |   1 +
  hw/char/trace-events                |   4 +
 files changed, 1423 insertions(+), 6 deletions(-)
  create mode 100644 include/hw/arm/xlnx-versal.h
  create mode 100644 include/hw/char/nrf51_uart.h
  create mode 100644 hw/arm/xlnx-versal-virt.c
  create mode 100644 hw/arm/xlnx-versal.c
  create mode 100644 hw/char/nrf51_uart.c
- docs/devel/reset.rst          |   8 +-
- docs/system/arm/emulation.rst |   2 +
- qapi/run-state.json           |   6 +-
- include/hw/boards.h           |   2 +-
- include/sysemu/device_tree.h  |   9 +
- include/sysemu/reset.h        |   5 +-
- target/arm/cpu.h              |  15 ++
- target/arm/internals.h        |  30 +++
- hw/arm/aspeed.c               |   4 +-
- hw/arm/boot.c                 |   2 +
- hw/arm/mps2-tz.c              |   4 +-
- hw/arm/virt.c                 |   5 +-
- hw/core/reset.c               |  17 +-
- hw/core/resettable.c          |   3 +-
- hw/hppa/machine.c             |   4 +-
- hw/hyperv/hyperv.c            |   2 +-
- hw/i386/microvm.c             |   4 +-
- hw/i386/pc.c                  |   6 +-
- hw/i386/x86.c                 |   2 +-
- hw/m68k/q800.c                |  33 ++-
- hw/m68k/virt.c                |  20 +-
- hw/mips/boston.c              |   3 +
- hw/openrisc/boot.c            |   3 +
- hw/ppc/pegasos2.c             |   4 +-
- hw/ppc/pnv.c                  |   4 +-
- hw/ppc/spapr.c                |   4 +-
- hw/riscv/boot.c               |   3 +
- hw/rx/rx-gdbsim.c             |   3 +
- hw/s390x/s390-virtio-ccw.c    |   4 +-
- hw/timer/imx_epit.c           |   9 +-
- migration/savevm.c            |   2 +-
- softmmu/device_tree.c         |  21 ++
- softmmu/runstate.c            |  11 +-
- target/arm/cpu.c              |  24 +-
- target/arm/cpu64.c            |   2 +
- target/arm/helper.c           |  31 ++-
- target/arm/ptw.c              | 524 +++++++++++++++++++++++++++---------------
-files changed, 572 insertions(+), 263 deletions(-)

-[PULL 01/30] target/arm: Implement FEAT_E0PD
+Deleted patch
-FEAT_E0PD adds new bits E0PD0 and E0PD1 to TCR_EL1, which allow the
-OS to forbid EL0 access to half of the address space.  Since this is
-an EL0-specific variation on the existing TCR_ELx.{EPD0,EPD1}, we can
-implement it entirely in aa64_va_parameters().
-This requires moving the existing regime_is_user() to internals.h
-so that the code in helper.c can get at it.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20221021160131.3531787-1-peter.maydell@linaro.org
----
- docs/system/arm/emulation.rst |  1 +
- target/arm/cpu.h              |  5 +++++
- target/arm/internals.h        | 19 +++++++++++++++++++
- target/arm/cpu64.c            |  1 +
- target/arm/helper.c           |  9 +++++++++
- target/arm/ptw.c              | 19 -------------------
-files changed, 35 insertions(+), 19 deletions(-)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_Debugv8p4 (Debug changes for v8.4)
- - FEAT_DotProd (Advanced SIMD dot product instructions)
- - FEAT_DoubleFault (Double Fault Extension)
-+- FEAT_E0PD (Preventing EL0 access to halves of address maps)
- - FEAT_ETS (Enhanced Translation Synchronization)
- - FEAT_FCMA (Floating-point complex number instructions)
- - FEAT_FHM (Floating-point half-precision multiplication instructions)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_lva(const ARMISARegisters *id)
-     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, VARANGE) != 0;
- }
-+static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
-+{
-+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
-+}
-+
- static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
- {
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
-     }
- }
-+static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
-+{
-+    switch (mmu_idx) {
-+    case ARMMMUIdx_E20_0:
-+    case ARMMMUIdx_Stage1_E0:
-+    case ARMMMUIdx_MUser:
-+    case ARMMMUIdx_MSUser:
-+    case ARMMMUIdx_MUserNegPri:
-+    case ARMMMUIdx_MSUserNegPri:
-+        return true;
-+    default:
-+        return false;
-+    case ARMMMUIdx_E10_0:
-+    case ARMMMUIdx_E10_1:
-+    case ARMMMUIdx_E10_1_PAN:
-+        g_assert_not_reached();
-+    }
-+}
-+
- /* Return the SCTLR value which controls this address translation regime */
- static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
- {
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     t = FIELD_DP64(t, ID_AA64MMFR2, FWB, 1);      /* FEAT_S2FWB */
-     t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1);      /* FEAT_TTL */
-     t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2);      /* FEAT_BBM at level 2 */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1);     /* FEAT_E0PD */
-     cpu->isar.id_aa64mmfr2 = t;
-     t = cpu->isar.id_aa64zfr0;
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-         ps = extract32(tcr, 16, 3);
-         ds = extract64(tcr, 32, 1);
-     } else {
-+        bool e0pd;
-+
-         /*
-          * Bit 55 is always between the two regions, and is canonical for
-          * determining if address tagging is enabled.
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-             epd = extract32(tcr, 7, 1);
-             sh = extract32(tcr, 12, 2);
-             hpd = extract64(tcr, 41, 1);
-+            e0pd = extract64(tcr, 55, 1);
-         } else {
-             tsz = extract32(tcr, 16, 6);
-             gran = tg1_to_gran_size(extract32(tcr, 30, 2));
-             epd = extract32(tcr, 23, 1);
-             sh = extract32(tcr, 28, 2);
-             hpd = extract64(tcr, 42, 1);
-+            e0pd = extract64(tcr, 56, 1);
-         }
-         ps = extract64(tcr, 32, 3);
-         ds = extract64(tcr, 59, 1);
-+
-+        if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
-+            regime_is_user(env, mmu_idx)) {
-+            epd = true;
-+        }
-     }
-     gran = sanitize_gran_size(cpu, gran, stage2);
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
-     return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
- }
--static bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
--{
--    switch (mmu_idx) {
--    case ARMMMUIdx_E20_0:
--    case ARMMMUIdx_Stage1_E0:
--    case ARMMMUIdx_MUser:
--    case ARMMMUIdx_MSUser:
--    case ARMMMUIdx_MUserNegPri:
--    case ARMMMUIdx_MSUserNegPri:
--        return true;
--    default:
--        return false;
--    case ARMMMUIdx_E10_0:
--    case ARMMMUIdx_E10_1:
--    case ARMMMUIdx_E10_1_PAN:
--        g_assert_not_reached();
--    }
--}
--
- /* Return the TTBR associated with this translation regime */
- static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
- {
---
-.25.1

-[PULL 02/30] hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+[Qemu-devel] [PULL 01/10] hw/arm/virt: Set VIRT_COMPAT_3_0 compat
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+From: Eric Auger <eric.auger@redhat.com>
-The "PCI Bus Binding to: IEEE Std 1275-1994" defines the compatible
+We are missing the VIRT_COMPAT_3_0 definition and setting.
-string for a PCIe bus or endpoint as "pci<vendorid>,<deviceid>" or
+Let's add them.
 similar. Since the initial binding for PCI virtio-iommu didn't follow
 this rule, it was modified to accept both strings and ensure backward
 compatibility. Also, the unit-name for the node should be
 "device,function".
-Fix corresponding dt-validate and dtc warnings:
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-  pcie@10000000: virtio_iommu@16:compatible: ['virtio,pci-iommu'] does not contain items matching the given schema
+Message-id: 20181024085602.16611-1-eric.auger@redhat.com
   pcie@10000000: Unevaluated properties are not allowed (... 'virtio_iommu@16' were unexpected)
   From schema: linux/Documentation/devicetree/bindings/pci/host-generic-pci.yaml
   virtio_iommu@16: compatible: 'oneOf' conditional failed, one must be fixed:
         ['virtio,pci-iommu'] is too short
         'pci1af4,1057' was expected
   From schema: dtschema/schemas/pci/pci-bus.yaml
   Warning (pci_device_reg): /pcie@10000000/virtio_iommu@16: PCI unit address format error, expected "2,0"
 Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 5 +++--
+ hw/arm/virt.c | 4 ++++
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 4 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_smmu(const VirtMachineState *vms,
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_3_1_options(MachineClass *mc)
+ }
- static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)
+ DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
 +#define VIRT_COMPAT_3_0 \
 +    HW_COMPAT_3_0
 +
  static void virt_3_0_instance_init(Object *obj)
  {
--    const char compat[] = "virtio,pci-iommu";
+     virt_3_1_instance_init(obj);
-+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
+@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
-     uint16_t bdf = vms->virtio_iommu_bdf;
+ static void virt_machine_3_0_options(MachineClass *mc)
-     MachineState *ms = MACHINE(vms);
+ {
-     char *node;
+     virt_machine_3_1_options(mc);
++    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_3_0);
-     vms->iommu_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+ }
+ DEFINE_VIRT_MACHINE(3, 0)
--    node = g_strdup_printf("%s/virtio_iommu@%d", vms->pciehb_nodename, bdf);
 +    node = g_strdup_printf("%s/virtio_iommu@%x,%x", vms->pciehb_nodename,
 +                           PCI_SLOT(bdf), PCI_FUNC(bdf));
      qemu_fdt_add_subnode(ms->fdt, node);
      qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
      qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg",
 --
-.25.1
+.19.1

-[PULL 03/30] target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+Deleted patch
-From: Ake Koomsin <ake@igel.co.jp>
-An exception targeting EL2 from lower EL is actually maskable when
-HCR_E2H and HCR_TGE are both set. This applies to both secure and
-non-secure Security state.
-We can remove the conditions that try to suppress masking of
-interrupts when we are Secure and the exception targets EL2 and
-Secure EL2 is disabled.  This is OK because in that situation
-arm_phys_excp_target_el() will never return 2 as the target EL.  The
-'not if secure' check in this function was originally written before
-arm_hcr_el2_eff(), and back then the target EL returned by
-arm_phys_excp_target_el() could be 2 even if we were in Secure
-EL0/EL1; but it is no longer needed.
-Signed-off-by: Ake Koomsin <ake@igel.co.jp>
-Message-id: 20221017092432.546881-1-ake@igel.co.jp
-[PMM: Add commit message paragraph explaining why it's OK to
- remove the checks on secure and SCR_EEL2]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c | 24 +++++++++++++++++-------
-file changed, 17 insertions(+), 7 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-     if ((target_el > cur_el) && (target_el != 1)) {
-         /* Exceptions targeting a higher EL may not be maskable */
-         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
--            /*
--             * 64-bit masking rules are simple: exceptions to EL3
--             * can't be masked, and exceptions to EL2 can only be
--             * masked from Secure state. The HCR and SCR settings
--             * don't affect the masking logic, only the interrupt routing.
--             */
--            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
-+            switch (target_el) {
-+            case 2:
-+                /*
-+                 * According to ARM DDI 0487H.a, an interrupt can be masked
-+                 * when HCR_E2H and HCR_TGE are both set regardless of the
-+                 * current Security state. Note that we need to revisit this
-+                 * part again once we need to support NMI.
-+                 */
-+                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
-+                        unmasked = true;
-+                }
-+                break;
-+            case 3:
-+                /* Interrupt cannot be masked when the target EL is 3 */
-                 unmasked = true;
-+                break;
-+            default:
-+                g_assert_not_reached();
-             }
-         } else {
-             /*
---
-.25.1

-[PULL 12/30] target/arm: Add ARMFault_UnsuppAtomicUpdate
+[Qemu-devel] [PULL 02/10] hw/char: Implement nRF51 SoC UART
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Julia Suvorova <jusual@mail.ru>
-This fault type is to be used with FEAT_HAFDBS when
+Not implemented: CTS/NCTS, PSEL*.
 the guest enables hw updates, but places the tables
 in memory where atomic updates are unsupported.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Julia Suvorova <jusual@mail.ru>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20221024051851.3074715-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 4 ++++
+ hw/char/Makefile.objs        |   1 +
-file changed, 4 insertions(+)
+ include/hw/char/nrf51_uart.h |  78 +++++++++
  hw/char/nrf51_uart.c         | 330 +++++++++++++++++++++++++++++++++++
  hw/char/trace-events         |   4 +
 files changed, 413 insertions(+)
  create mode 100644 include/hw/char/nrf51_uart.h
  create mode 100644 hw/char/nrf51_uart.c
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/char/Makefile.objs
-+++ b/target/arm/internals.h
++++ b/hw/char/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
+@@ -XXX,XX +XXX,XX @@
-     ARMFault_AsyncExternal,
+ common-obj-$(CONFIG_IPACK) += ipoctal232.o
-     ARMFault_Debug,
+ common-obj-$(CONFIG_ESCC) += escc.o
-     ARMFault_TLBConflict,
++common-obj-$(CONFIG_NRF51_SOC) += nrf51_uart.o
-+    ARMFault_UnsuppAtomicUpdate,
+ common-obj-$(CONFIG_PARALLEL) += parallel.o
-     ARMFault_Lockdown,
+ common-obj-$(CONFIG_PARALLEL) += parallel-isa.o
-     ARMFault_Exclusive,
+ common-obj-$(CONFIG_PL011) += pl011.o
-     ARMFault_ICacheMaint,
+diff --git a/include/hw/char/nrf51_uart.h b/include/hw/char/nrf51_uart.h
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
+new file mode 100644
-     case ARMFault_TLBConflict:
+index XXXXXXX..XXXXXXX
-         fsc = 0x30;
+--- /dev/null
-         break;
++++ b/include/hw/char/nrf51_uart.h
-+    case ARMFault_UnsuppAtomicUpdate:
+@@ -XXX,XX +XXX,XX @@
-+        fsc = 0x31;
++/*
-+        break;
++ * nRF51 SoC UART emulation
-     case ARMFault_Lockdown:
++ *
-         fsc = 0x34;
++ * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
-         break;
++ *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#ifndef NRF51_UART_H
 +#define NRF51_UART_H
 +
 +#include "hw/sysbus.h"
 +#include "chardev/char-fe.h"
 +#include "hw/registerfields.h"
 +
 +#define UART_FIFO_LENGTH 6
 +#define UART_BASE 0x40002000
 +#define UART_SIZE 0x1000
 +
 +#define TYPE_NRF51_UART "nrf51_soc.uart"
 +#define NRF51_UART(obj) OBJECT_CHECK(NRF51UARTState, (obj), TYPE_NRF51_UART)
 +
 +REG32(UART_STARTRX, 0x000)
 +REG32(UART_STOPRX, 0x004)
 +REG32(UART_STARTTX, 0x008)
 +REG32(UART_STOPTX, 0x00C)
 +REG32(UART_SUSPEND, 0x01C)
 +
 +REG32(UART_CTS, 0x100)
 +REG32(UART_NCTS, 0x104)
 +REG32(UART_RXDRDY, 0x108)
 +REG32(UART_TXDRDY, 0x11C)
 +REG32(UART_ERROR, 0x124)
 +REG32(UART_RXTO, 0x144)
 +
 +REG32(UART_INTEN, 0x300)
 +    FIELD(UART_INTEN, CTS, 0, 1)
 +    FIELD(UART_INTEN, NCTS, 1, 1)
 +    FIELD(UART_INTEN, RXDRDY, 2, 1)
 +    FIELD(UART_INTEN, TXDRDY, 7, 1)
 +    FIELD(UART_INTEN, ERROR, 9, 1)
 +    FIELD(UART_INTEN, RXTO, 17, 1)
 +REG32(UART_INTENSET, 0x304)
 +REG32(UART_INTENCLR, 0x308)
 +REG32(UART_ERRORSRC, 0x480)
 +REG32(UART_ENABLE, 0x500)
 +REG32(UART_PSELRTS, 0x508)
 +REG32(UART_PSELTXD, 0x50C)
 +REG32(UART_PSELCTS, 0x510)
 +REG32(UART_PSELRXD, 0x514)
 +REG32(UART_RXD, 0x518)
 +REG32(UART_TXD, 0x51C)
 +REG32(UART_BAUDRATE, 0x524)
 +REG32(UART_CONFIG, 0x56C)
 +
 +typedef struct NRF51UARTState {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion iomem;
 +    CharBackend chr;
 +    qemu_irq irq;
 +    guint watch_tag;
 +
 +    uint8_t rx_fifo[UART_FIFO_LENGTH];
 +    unsigned int rx_fifo_pos;
 +    unsigned int rx_fifo_len;
 +
 +    uint32_t reg[0x56C];
 +
 +    bool rx_started;
 +    bool tx_started;
 +    bool pending_tx_byte;
 +    bool enabled;
 +} NRF51UARTState;
 +
 +#endif
 diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/char/nrf51_uart.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * nRF51 SoC UART emulation
 + *
 + * See nRF51 Series Reference Manual, "29 Universal Asynchronous
 + * Receiver/Transmitter" for hardware specifications:
 + * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf
 + *
 + * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/char/nrf51_uart.h"
 +#include "trace.h"
 +
 +static void nrf51_uart_update_irq(NRF51UARTState *s)
 +{
 +    bool irq = false;
 +
 +    irq |= (s->reg[R_UART_RXDRDY] &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXDRDY_MASK));
 +    irq |= (s->reg[R_UART_TXDRDY] &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_TXDRDY_MASK));
 +    irq |= (s->reg[R_UART_ERROR]  &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_ERROR_MASK));
 +    irq |= (s->reg[R_UART_RXTO]   &&
 +            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXTO_MASK));
 +
 +    qemu_set_irq(s->irq, irq);
 +}
 +
 +static uint64_t uart_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    uint64_t r;
 +
 +    if (!s->enabled) {
 +        return 0;
 +    }
 +
 +    switch (addr) {
 +    case A_UART_RXD:
 +        r = s->rx_fifo[s->rx_fifo_pos];
 +        if (s->rx_started && s->rx_fifo_len) {
 +            s->rx_fifo_pos = (s->rx_fifo_pos + 1) % UART_FIFO_LENGTH;
 +            s->rx_fifo_len--;
 +            if (s->rx_fifo_len) {
 +                s->reg[R_UART_RXDRDY] = 1;
 +                nrf51_uart_update_irq(s);
 +            }
 +            qemu_chr_fe_accept_input(&s->chr);
 +        }
 +        break;
 +    case A_UART_INTENSET:
 +    case A_UART_INTENCLR:
 +    case A_UART_INTEN:
 +        r = s->reg[R_UART_INTEN];
 +        break;
 +    default:
 +        r = s->reg[addr / 4];
 +        break;
 +    }
 +
 +    trace_nrf51_uart_read(addr, r, size);
 +
 +    return r;
 +}
 +
 +static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    int r;
 +    uint8_t c = s->reg[R_UART_TXD];
 +
 +    s->watch_tag = 0;
 +
 +    r = qemu_chr_fe_write(&s->chr, &c, 1);
 +    if (r <= 0) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +        if (!s->watch_tag) {
 +            /* The hardware has no transmit error reporting,
 +             * so silently drop the byte
 +             */
 +            goto buffer_drained;
 +        }
 +        return FALSE;
 +    }
 +
 +buffer_drained:
 +    s->reg[R_UART_TXDRDY] = 1;
 +    s->pending_tx_byte = false;
 +    return FALSE;
 +}
 +
 +static void uart_cancel_transmit(NRF51UARTState *s)
 +{
 +    if (s->watch_tag) {
 +        g_source_remove(s->watch_tag);
 +        s->watch_tag = 0;
 +    }
 +}
 +
 +static void uart_write(void *opaque, hwaddr addr,
 +                       uint64_t value, unsigned int size)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    trace_nrf51_uart_write(addr, value, size);
 +
 +    if (!s->enabled && (addr != A_UART_ENABLE)) {
 +        return;
 +    }
 +
 +    switch (addr) {
 +    case A_UART_TXD:
 +        if (!s->pending_tx_byte && s->tx_started) {
 +            s->reg[R_UART_TXD] = value;
 +            s->pending_tx_byte = true;
 +            uart_transmit(NULL, G_IO_OUT, s);
 +        }
 +        break;
 +    case A_UART_INTEN:
 +        s->reg[R_UART_INTEN] = value;
 +        break;
 +    case A_UART_INTENSET:
 +        s->reg[R_UART_INTEN] |= value;
 +        break;
 +    case A_UART_INTENCLR:
 +        s->reg[R_UART_INTEN] &= ~value;
 +        break;
 +    case A_UART_TXDRDY ... A_UART_RXTO:
 +        s->reg[addr / 4] = value;
 +        break;
 +    case A_UART_ERRORSRC:
 +        s->reg[addr / 4] &= ~value;
 +        break;
 +    case A_UART_RXD:
 +        break;
 +    case A_UART_RXDRDY:
 +        if (value == 0) {
 +            s->reg[R_UART_RXDRDY] = 0;
 +        }
 +        break;
 +    case A_UART_STARTTX:
 +        if (value == 1) {
 +            s->tx_started = true;
 +        }
 +        break;
 +    case A_UART_STARTRX:
 +        if (value == 1) {
 +            s->rx_started = true;
 +        }
 +        break;
 +    case A_UART_ENABLE:
 +        if (value) {
 +            if (value == 4) {
 +                s->enabled = true;
 +            }
 +            break;
 +        }
 +        s->enabled = false;
 +        value = 1;
 +        /* fall through */
 +    case A_UART_SUSPEND:
 +    case A_UART_STOPTX:
 +        if (value == 1) {
 +            s->tx_started = false;
 +        }
 +        /* fall through */
 +    case A_UART_STOPRX:
 +        if (addr != A_UART_STOPTX && value == 1) {
 +            s->rx_started = false;
 +            s->reg[R_UART_RXTO] = 1;
 +        }
 +        break;
 +    default:
 +        s->reg[addr / 4] = value;
 +        break;
 +    }
 +    nrf51_uart_update_irq(s);
 +}
 +
 +static const MemoryRegionOps uart_ops = {
 +    .read =  uart_read,
 +    .write = uart_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +};
 +
 +static void nrf51_uart_reset(DeviceState *dev)
 +{
 +    NRF51UARTState *s = NRF51_UART(dev);
 +
 +    s->pending_tx_byte = 0;
 +
 +    uart_cancel_transmit(s);
 +
 +    memset(s->reg, 0, sizeof(s->reg));
 +
 +    s->reg[R_UART_PSELRTS] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELTXD] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELCTS] = 0xFFFFFFFF;
 +    s->reg[R_UART_PSELRXD] = 0xFFFFFFFF;
 +    s->reg[R_UART_BAUDRATE] = 0x4000000;
 +
 +    s->rx_fifo_len = 0;
 +    s->rx_fifo_pos = 0;
 +    s->rx_started = false;
 +    s->tx_started = false;
 +    s->enabled = false;
 +}
 +
 +static void uart_receive(void *opaque, const uint8_t *buf, int size)
 +{
 +
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +    int i;
 +
 +    if (size == 0 || s->rx_fifo_len >= UART_FIFO_LENGTH) {
 +        return;
 +    }
 +
 +    for (i = 0; i < size; i++) {
 +        uint32_t pos = (s->rx_fifo_pos + s->rx_fifo_len) % UART_FIFO_LENGTH;
 +        s->rx_fifo[pos] = buf[i];
 +        s->rx_fifo_len++;
 +    }
 +
 +    s->reg[R_UART_RXDRDY] = 1;
 +    nrf51_uart_update_irq(s);
 +}
 +
 +static int uart_can_receive(void *opaque)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    return s->rx_started ? (UART_FIFO_LENGTH - s->rx_fifo_len) : 0;
 +}
 +
 +static void uart_event(void *opaque, int event)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    if (event == CHR_EVENT_BREAK) {
 +        s->reg[R_UART_ERRORSRC] |= 3;
 +        s->reg[R_UART_ERROR] = 1;
 +        nrf51_uart_update_irq(s);
 +    }
 +}
 +
 +static void nrf51_uart_realize(DeviceState *dev, Error **errp)
 +{
 +    NRF51UARTState *s = NRF51_UART(dev);
 +
 +    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
 +                             uart_event, NULL, s, NULL, true);
 +}
 +
 +static void nrf51_uart_init(Object *obj)
 +{
 +    NRF51UARTState *s = NRF51_UART(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &uart_ops, s,
 +                          "nrf51_soc.uart", UART_SIZE);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
 +static int nrf51_uart_post_load(void *opaque, int version_id)
 +{
 +    NRF51UARTState *s = NRF51_UART(opaque);
 +
 +    if (s->pending_tx_byte) {
 +        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
 +                                             uart_transmit, s);
 +    }
 +
 +    return 0;
 +}
 +
 +static const VMStateDescription nrf51_uart_vmstate = {
 +    .name = "nrf51_soc.uart",
 +    .post_load = nrf51_uart_post_load,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(reg, NRF51UARTState, 0x56C),
 +        VMSTATE_UINT8_ARRAY(rx_fifo, NRF51UARTState, UART_FIFO_LENGTH),
 +        VMSTATE_UINT32(rx_fifo_pos, NRF51UARTState),
 +        VMSTATE_UINT32(rx_fifo_len, NRF51UARTState),
 +        VMSTATE_BOOL(rx_started, NRF51UARTState),
 +        VMSTATE_BOOL(tx_started, NRF51UARTState),
 +        VMSTATE_BOOL(pending_tx_byte, NRF51UARTState),
 +        VMSTATE_BOOL(enabled, NRF51UARTState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property nrf51_uart_properties[] = {
 +    DEFINE_PROP_CHR("chardev", NRF51UARTState, chr),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void nrf51_uart_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = nrf51_uart_reset;
 +    dc->realize = nrf51_uart_realize;
 +    dc->props = nrf51_uart_properties;
 +    dc->vmsd = &nrf51_uart_vmstate;
 +}
 +
 +static const TypeInfo nrf51_uart_info = {
 +    .name = TYPE_NRF51_UART,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(NRF51UARTState),
 +    .instance_init = nrf51_uart_init,
 +    .class_init = nrf51_uart_class_init
 +};
 +
 +static void nrf51_uart_register_types(void)
 +{
 +    type_register_static(&nrf51_uart_info);
 +}
 +
 +type_init(nrf51_uart_register_types)
 diff --git a/hw/char/trace-events b/hw/char/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/trace-events
 +++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backe
  cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
  cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
  cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
 +
 +# hw/char/nrf51_uart.c
 +nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 +nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
 --
-.25.1
+.19.1

-[PULL 07/30] target/arm: Introduce regime_is_stage2
+[Qemu-devel] [PULL 03/10] hw/arm/nrf51_soc: Connect UART to nRF51 SoC
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Julia Suvorova <jusual@mail.ru>
-Reduce the amount of typing required for this check.
+Wire up nRF51 UART in the corresponding SoC.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Julia Suvorova <jusual@mail.ru>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20221024051851.3074715-2-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h |  5 +++++
+ include/hw/arm/nrf51_soc.h |  3 +++
- target/arm/helper.c    | 14 +++++---------
+ hw/arm/microbit.c          |  2 ++
- target/arm/ptw.c       | 14 ++++++--------
+ hw/arm/nrf51_soc.c         | 20 ++++++++++++++++++++
-files changed, 16 insertions(+), 17 deletions(-)
+files changed, 25 insertions(+)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/include/hw/arm/nrf51_soc.h
-+++ b/target/arm/internals.h
++++ b/include/hw/arm/nrf51_soc.h
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/arm/armv7m.h"
 +#include "hw/char/nrf51_uart.h"
  #define TYPE_NRF51_SOC "nrf51-soc"
  #define NRF51_SOC(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct NRF51State {
      /*< public >*/
      ARMv7MState cpu;
 +    NRF51UARTState uart;
 +
      MemoryRegion iomem;
      MemoryRegion sram;
      MemoryRegion flash;
 diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/microbit.c
 +++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/boards.h"
  #include "hw/arm/arm.h"
 +#include "sysemu/sysemu.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/nrf51_soc.h"
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
      sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
                            TYPE_NRF51_SOC);
 +    qdev_prop_set_chr(DEVICE(&s->nrf51), "serial0", serial_hd(0));
      object_property_set_link(soc, OBJECT(system_memory), "memory",
                               &error_fatal);
      object_property_set_bool(soc, true, "realized", &error_fatal);
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nrf51_soc.c
 +++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
  #define NRF51822_FLASH_SIZE     (256 * 1024)
  #define NRF51822_SRAM_SIZE      (16 * 1024)
 +#define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
 +
  static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
  {
      NRF51State *s = NRF51_SOC(dev_soc);
 +    MemoryRegion *mr;
      Error *err = NULL;
      if (!s->board_memory) {
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
      }
+     memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
++    /* UART */
++    object_property_set_bool(OBJECT(&s->uart), true, "realized", &err);
++    if (err) {
++        error_propagate(errp, err);
++        return;
++    }
++    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
++    memory_region_add_subregion_overlap(&s->container, UART_BASE, mr, 0);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
++                       qdev_get_gpio_in(DEVICE(&s->cpu),
++                       BASE_TO_IRQ(UART_BASE)));
++
+     create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
+     create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
+     create_unimplemented_device("nrf51_soc.private",
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
+     qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
+                          ARM_CPU_TYPE_NAME("cortex-m0"));
+     qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
++
++    sysbus_init_child_obj(obj, "uart", &s->uart, sizeof(s->uart),
++                           TYPE_NRF51_UART);
++    object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev",
++                              &error_abort);
  }
-+static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
+ static Property nrf51_soc_properties[] = {
 +{
 +    return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 +}
 +
  /* Return the exception level which controls this address translation regime */
  static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
  {
      if (regime_has_2_ranges(mmu_idx)) {
          return extract64(tcr, 37, 2);
 -    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    } else if (regime_is_stage2(mmu_idx)) {
          return 0; /* VTCR_EL2 */
      } else {
          /* Replicate the single TBI bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
  {
      if (regime_has_2_ranges(mmu_idx)) {
          return extract64(tcr, 51, 2);
 -    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    } else if (regime_is_stage2(mmu_idx)) {
          return 0; /* VTCR_EL2 */
      } else {
          /* Replicate the single TBID bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
      int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
      ARMGranuleSize gran;
      ARMCPU *cpu = env_archcpu(env);
 -    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 +    bool stage2 = regime_is_stage2(mmu_idx);
      if (!regime_has_2_ranges(mmu_idx)) {
          select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          }
          ds = false;
      } else if (ds) {
 -        switch (mmu_idx) {
 -        case ARMMMUIdx_Stage2:
 -        case ARMMMUIdx_Stage2_S:
 +        if (regime_is_stage2(mmu_idx)) {
              if (gran == Gran16K) {
                  ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
              } else {
                  ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
              }
 -            break;
 -        default:
 +        } else {
              if (gran == Gran16K) {
                  ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
              } else {
                  ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
              }
 -            break;
          }
          if (ds) {
              min_tsz = 12;
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
      bool have_wxn;
      int wxn = 0;
 -    assert(mmu_idx != ARMMMUIdx_Stage2);
 -    assert(mmu_idx != ARMMMUIdx_Stage2_S);
 +    assert(!regime_is_stage2(mmu_idx));
      user_rw = simple_ap_to_rw_prot_is_user(ap, true);
      if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          goto do_fault;
      }
 -    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
 +    if (!regime_is_stage2(mmu_idx)) {
          /*
           * The starting level depends on the virtual address size (which can
           * be up to 48 bits) and the translation granule size. It indicates
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          attrs = extract64(descriptor, 2, 10)
              | (extract64(descriptor, 52, 12) << 10);
 -        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +        if (regime_is_stage2(mmu_idx)) {
              /* Stage 2 table descriptors do not include any attribute fields */
              break;
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      ap = extract32(attrs, 4, 2);
 -    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    if (regime_is_stage2(mmu_idx)) {
          ns = mmu_idx == ARMMMUIdx_Stage2;
          xn = extract32(attrs, 11, 2);
          result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          result->f.guarded = guarded;
      }
 -    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    if (regime_is_stage2(mmu_idx)) {
          result->cacheattrs.is_s2_format = true;
          result->cacheattrs.attrs = extract32(attrs, 0, 4);
      } else {
@@ -XXX,XX +XXX,XX @@ do_fault:
      fi->type = fault_type;
      fi->level = level;
      /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
 -    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
 -                               mmu_idx == ARMMMUIdx_Stage2_S);
 +    fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
      fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
      return true;
  }
 --
-.25.1
+.19.1

-[PULL 10/30] target/arm: Extract HA and HD in aa64_va_parameters
+[Qemu-devel] [PULL 04/10] tests/boot-serial-test: Add microbit board testcase
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Julia Suvorova <jusual@mail.ru>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+New mini-kernel test for nRF51 SoC UART.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Julia Suvorova <jusual@mail.ru>
-Message-id: 20221024051851.3074715-5-richard.henderson@linaro.org
+Acked-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 2 ++
+ tests/boot-serial-test.c | 19 +++++++++++++++++++
- target/arm/helper.c    | 8 +++++++-
+file changed, 19 insertions(+)
 files changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/tests/boot-serial-test.c
-+++ b/target/arm/internals.h
++++ b/tests/boot-serial-test.c
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
+@@ -XXX,XX +XXX,XX @@ static const uint8_t kernel_aarch64[] = {
-     bool hpd        : 1;
+xfd, 0xff, 0xff, 0x17,                 /* b       -12 (loop) */
-     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
+ };
-     bool ds         : 1;
-+    bool ha         : 1;
++static const uint8_t kernel_nrf51[] = {
-+    bool hd         : 1;
++    0x00, 0x00, 0x00, 0x00,                 /* Stack top address */
-     ARMGranuleSize gran : 2;
++    0x09, 0x00, 0x00, 0x00,                 /* Reset handler address */
- } ARMVAParameters;
++    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get ENABLE */
++    0x04, 0x21,                             /* movs r1, #4 */
-diff --git a/target/arm/helper.c b/target/arm/helper.c
++    0x11, 0x60,                             /* str  r1, [r2] */
-index XXXXXXX..XXXXXXX 100644
++    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get STARTTX */
---- a/target/arm/helper.c
++    0x01, 0x21,                             /* movs r1, #1 */
-+++ b/target/arm/helper.c
++    0x11, 0x60,                             /* str  r1, [r2] */
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
++    0x03, 0x4a,                             /* ldr  r2, [pc, #12] Get TXD */
-                                    ARMMMUIdx mmu_idx, bool data)
++    0x54, 0x21,                             /* movs r1, 'T' */
- {
++    0x11, 0x60,                             /* str  r1, [r2] */
-     uint64_t tcr = regime_tcr(env, mmu_idx);
++    0xfe, 0xe7,                             /* b    . */
--    bool epd, hpd, tsz_oob, ds;
++    0x00, 0x25, 0x00, 0x40,                 /* 0x40002500 = UART ENABLE */
-+    bool epd, hpd, tsz_oob, ds, ha, hd;
++    0x08, 0x20, 0x00, 0x40,                 /* 0x40002008 = UART STARTTX */
-     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
++    0x1c, 0x25, 0x00, 0x40                  /* 0x4000251c = UART TXD */
-     ARMGranuleSize gran;
++};
-     ARMCPU *cpu = env_archcpu(env);
++
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ typedef struct testdef {
-         epd = false;
+     const char *arch;       /* Target architecture */
-         sh = extract32(tcr, 12, 2);
+     const char *machine;    /* Name of the machine */
-         ps = extract32(tcr, 16, 3);
+@@ -XXX,XX +XXX,XX @@ static testdef_t tests[] = {
-+        ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu);
+     { "hppa", "hppa", "", "SeaBIOS wants SYSTEM HALT" },
-+        hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu);
+     { "aarch64", "virt", "-cpu cortex-a57", "TT", sizeof(kernel_aarch64),
-         ds = extract64(tcr, 32, 1);
+       kernel_aarch64 },
-     } else {
++    { "arm", "microbit", "", "T", sizeof(kernel_nrf51), kernel_nrf51 },
-         bool e0pd;
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+     { NULL }
-             e0pd = extract64(tcr, 56, 1);
+ };
          }
          ps = extract64(tcr, 32, 3);
 +        ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu);
 +        hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu);
          ds = extract64(tcr, 59, 1);
          if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          .hpd = hpd,
          .tsz_oob = tsz_oob,
          .ds = ds,
 +        .ha = ha,
 +        .hd = ha && hd,
          .gran = gran,
      };
  }
 --
-.25.1
+.19.1

-[PULL 04/30] hw/core/resettable: fix reset level counting
+[Qemu-devel] [PULL 05/10] MAINTAINERS: Remove bouncing email in ARM ACPI
-From: Damien Hedde <damien.hedde@greensocs.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The code for handling the reset level count in the Resettable code
+Shannon Zhao's email at Huawei is bouncing: remove it.
 has two issues:
-The reset count is only decremented for the 1->0 case.  This means
+    X-Failed-Recipients: zhaoshenglong@huawei.com
-that if there's ever a nested reset that takes the count to 2 then it
+    ** Address not found **
-will never again be decremented.  Eventually the count will exceed
+    Your message wasn't delivered to zhaoshenglong@huawei.com because the address couldn't be found, or is unable to receive mail.
 the '50' limit in resettable_phase_enter() and QEMU will trip over
 the assertion failure.  The repro case in issue 1266 is an example of
 this that happens now the SCSI subsystem uses three-phase reset.
-Secondly, the count is decremented only after the exit phase handler
+Note that the section still contains his personal email (see e59f13d76bb).
 is called.  Moving the reset count decrement from "just after" to
 "just before" calling the exit phase handler allows
 resettable_is_in_reset() to return false during the handler
 execution.
-This simplifies reset handling in resettable devices.  Typically, a
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-function that updates the device state will just need to read the
+Acked-by: Shannon Zhao <shannon.zhaosl@gmail.com>
-current reset state and not anymore treat the "in a reset-exit
+Message-id: 20181029195931.8747-1-philmd@redhat.com
 transition" as a special case.
 Note that the semantics change to the *_is_in_reset() functions
 will have no effect on the current codebase, because only two
 devices (hw/char/cadence_uart.c and hw/misc/zynq_sclr.c) currently
 call those functions, and in neither case do they do it from the
 device's exit phase methed.
 Fixes: 4a5fc890 ("scsi: Use device_cold_reset() and bus_cold_reset()")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1266
 Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20221020142749.3357951-1-peter.maydell@linaro.org
 Buglink: https://bugs.launchpad.net/qemu/+bug/1905297
 Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
 [PMM: adjust the docs paragraph changed to get the name of the
  'enter' phase right and to clarify exactly when the count is
  adjusted; rewrite the commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/devel/reset.rst | 8 +++++---
+ MAINTAINERS | 1 -
- hw/core/resettable.c | 3 +--
+file changed, 1 deletion(-)
 files changed, 6 insertions(+), 5 deletions(-)
-diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/reset.rst
+--- a/MAINTAINERS
-+++ b/docs/devel/reset.rst
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ Polling the reset state
+@@ -XXX,XX +XXX,XX @@ F: hw/*/xlnx*.c
- Resettable interface provides the ``resettable_is_in_reset()`` function.
+ F: include/hw/*/xlnx*.h
- This function returns true if the object parameter is currently under reset.
+ ARM ACPI Subsystem
--An object is under reset from the beginning of the *init* phase to the end of
+-M: Shannon Zhao <zhaoshenglong@huawei.com>
--the *exit* phase. During all three phases, the function will return that the
+ M: Shannon Zhao <shannon.zhaosl@gmail.com>
--object is in reset.
+ L: qemu-arm@nongnu.org
-+An object is under reset from the beginning of the *enter* phase (before
+ S: Maintained
 +either its children or its own enter method is called) to the *exit*
 +phase. During *enter* and *hold* phase only, the function will return that the
 +object is in reset. The state is changed after the *exit* is propagated to
 +its children and just before calling the object's own *exit* method.
  This function may be used if the object behavior has to be adapted
  while in reset state. For example if a device has an irq input,
 diff --git a/hw/core/resettable.c b/hw/core/resettable.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/resettable.c
 +++ b/hw/core/resettable.c
@@ -XXX,XX +XXX,XX @@ static void resettable_phase_exit(Object *obj, void *opaque, ResetType type)
      resettable_child_foreach(rc, obj, resettable_phase_exit, NULL, type);
      assert(s->count > 0);
 -    if (s->count == 1) {
 +    if (--s->count == 0) {
          trace_resettable_phase_exit_exec(obj, obj_typename, !!rc->phases.exit);
          if (rc->phases.exit && !resettable_get_tr_func(rc, obj)) {
              rc->phases.exit(obj);
          }
 -        s->count = 0;
      }
      s->exit_phase_in_progress = false;
      trace_resettable_phase_exit_end(obj, obj_typename, s->count);
 --
-.25.1
+.19.1

-[PULL 05/30] hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
+Deleted patch
-The semantic difference between the deprecated device_legacy_reset()
-function and the newer device_cold_reset() function is that the new
-function resets both the device itself and any qbuses it owns,
-whereas the legacy function resets just the device itself and nothing
-else.  In hyperv_synic_reset() we reset a SynICState, which has no
-qbuses, so for this purpose the two functions behave identically and
-we can stop using the deprecated one.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
-Message-id: 20221013171817.1447562-1-peter.maydell@linaro.org
----
- hw/hyperv/hyperv.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/hyperv/hyperv.c
-+++ b/hw/hyperv/hyperv.c
-@@ -XXX,XX +XXX,XX @@ void hyperv_synic_reset(CPUState *cs)
-     SynICState *synic = get_synic(cs);
-     if (synic) {
--        device_legacy_reset(DEVICE(synic));
-+        device_cold_reset(DEVICE(synic));
-     }
- }
---
-.25.1

-[PULL 06/30] target/imx: reload cmp timer outside of the reload ptimer transaction
+Deleted patch
-From: Axel Heider <axel.heider@hensoldt.net>
-When running seL4 tests (https://docs.sel4.systems/projects/sel4test)
-on the sabrelight platform, the timer tests fail. The arm/imx6 EPIT
-timer interrupt does not fire properly, instead of a e.g. second in
-can take up to a minute to finally see the interrupt.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1263
-Signed-off-by: Axel Heider <axel.heider@hensoldt.net>
-Message-id: 166663118138.13362.1229967229046092876-0@git.sr.ht
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/imx_epit.c | 9 +++++++--
-file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_epit.c
-+++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
-             /* If IOVW bit is set then set the timer value */
-             ptimer_set_count(s->timer_reload, s->lr);
-         }
--
-+        /*
-+         * Commit the change to s->timer_reload, so it can propagate. Otherwise
-+         * the timer interrupt may not fire properly. The commit must happen
-+         * before calling imx_epit_reload_compare_timer(), which reads
-+         * s->timer_reload internally again.
-+         */
-+        ptimer_transaction_commit(s->timer_reload);
-         imx_epit_reload_compare_timer(s);
-         ptimer_transaction_commit(s->timer_cmp);
--        ptimer_transaction_commit(s->timer_reload);
-         break;
-     case 3: /* CMP */
---
-.25.1

-[PULL 24/30] arm: re-randomize rng-seed on reboot
+[Qemu-devel] [PULL 06/10] strongarm: mask off high[31:28] bits from dir and state registers
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Prasad J Pandit <pjp@fedoraproject.org>
-When the system reboots, the rng-seed that the FDT has should be
+The high[31:28] bits of 'direction' and 'state' registers of
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
+SA-1100/SA-1110 device are reserved. Setting them may lead to
-the ROM region at this point, we add a hook right after the ROM has been
+OOB 's->handler[]' array access issue. Mask off [31:28] bits to
-added, so that we have a pointer to that copy of the FDT.
+avoid it.
-Cc: Peter Maydell <peter.maydell@linaro.org>
+Reported-by: Moguofang <moguofang@huawei.com>
-Cc: qemu-arm@nongnu.org
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Message-id: 20181030114635.31232-1-ppandit@redhat.com
 Message-id: 20221025004327.568476-5-Jason@zx2c4.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/boot.c | 2 ++
+ hw/arm/strongarm.c | 4 ++--
-file changed, 2 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/strongarm.c
-+++ b/hw/arm/boot.c
++++ b/hw/arm/strongarm.c
-@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
+@@ -XXX,XX +XXX,XX @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,
-      * the DTB is copied again upon reset, even if addr points into RAM.
-      */
+     switch (offset) {
-     rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
+     case GPDR:        /* GPIO Pin-Direction registers */
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+-        s->dir = value;
-+                                       rom_ptr_for_as(as, addr, size));
++        s->dir = value & 0x0fffffff;
+         strongarm_gpio_handler_update(s);
-     g_free(fdt);
+         break;
      case GPSR:        /* GPIO Pin-Output Set registers */
 -        s->olevel |= value;
 +        s->olevel |= value & 0x0fffffff;
          strongarm_gpio_handler_update(s);
          break;
 --
-.25.1
+.19.1

-[PULL 08/30] target/arm: Add ptw_idx to S1Translate
+[Qemu-devel] [PULL 07/10] hw/arm/xilinx_zynq: Use the ARRAY_SIZE macro
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Hoist the computation of the mmu_idx for the ptw up to
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-get_phys_addr_with_struct and get_phys_addr_twostage.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-This removes the duplicate check for stage2 disabled
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-from the middle of the walk, performing it only once.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20221024051851.3074715-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 71 ++++++++++++++++++++++++++++++++++++------------
+ hw/arm/xilinx_zynq.c | 2 +-
-file changed, 54 insertions(+), 17 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/hw/arm/xilinx_zynq.c
-+++ b/target/arm/ptw.c
++++ b/hw/arm/xilinx_zynq.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)
+     busdev = SYS_BUS_DEVICE(dev);
- typedef struct S1Translate {
+     sysbus_mmio_map(busdev, 0, 0xF8003000);
-     ARMMMUIdx in_mmu_idx;
+     sysbus_connect_irq(busdev, 0, pic[45-IRQ_OFFSET]); /* abort irq line */
-+    ARMMMUIdx in_ptw_idx;
+-    for (n = 0; n < 8; ++n) { /* event irqs */
-     bool in_secure;
++    for (n = 0; n < ARRAY_SIZE(dma_irqs); ++n) { /* event irqs */
-     bool in_debug;
+         sysbus_connect_irq(busdev, n + 1, pic[dma_irqs[n] - IRQ_OFFSET]);
      bool out_secure;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
  {
      bool is_secure = ptw->in_secure;
      ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
 -    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 -    bool s2_phys = false;
 +    ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
      uint8_t pte_attrs;
      bool pte_secure;
 -    if (!arm_mmu_idx_is_stage1_of_2(mmu_idx)
 -        || regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
 -        s2_mmu_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
 -        s2_phys = true;
 -    }
 -
      if (unlikely(ptw->in_debug)) {
          /*
           * From gdbstub, do not use softmmu so that we don't modify the
           * state of the cpu at all, including softmmu tlb contents.
           */
 -        if (s2_phys) {
 -            ptw->out_phys = addr;
 -            pte_attrs = 0;
 -            pte_secure = is_secure;
 -        } else {
 +        if (regime_is_stage2(s2_mmu_idx)) {
              S1Translate s2ptw = {
                  .in_mmu_idx = s2_mmu_idx,
 +                .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
                  .in_secure = is_secure,
                  .in_debug = true,
              };
              GetPhysAddrResult s2 = { };
 +
              if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
                                      false, &s2, fi)) {
                  goto fail;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
              ptw->out_phys = s2.f.phys_addr;
              pte_attrs = s2.cacheattrs.attrs;
              pte_secure = s2.f.attrs.secure;
 +        } else {
 +            /* Regime is physical. */
 +            ptw->out_phys = addr;
 +            pte_attrs = 0;
 +            pte_secure = is_secure;
          }
          ptw->out_host = NULL;
      } else {
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          pte_secure = full->attrs.secure;
      }
--    if (!s2_phys) {
-+    if (regime_is_stage2(s2_mmu_idx)) {
-         uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         descaddr |= (address >> (stride * (4 - level))) & indexmask;
-         descaddr &= ~7ULL;
-         nstable = extract32(tableattrs, 4, 1);
--        ptw->in_secure = !nstable;
-+        if (!nstable) {
-+            /*
-+             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-+             * Assert that the non-secure idx are even, and relative order.
-+             */
-+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-+            ptw->in_ptw_idx &= ~1;
-+            ptw->in_secure = false;
-+        }
-         descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
-         if (fi->type != ARMFault_None) {
-             goto do_fault;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
-     ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-+    ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
-     ptw->in_secure = s2walk_secure;
-     /*
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-                                       ARMMMUFaultInfo *fi)
- {
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
--    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
-     bool is_secure = ptw->in_secure;
-+    ARMMMUIdx s1_mmu_idx;
--    if (mmu_idx != s1_mmu_idx) {
-+    switch (mmu_idx) {
-+    case ARMMMUIdx_Phys_S:
-+    case ARMMMUIdx_Phys_NS:
-+        /* Checking Phys early avoids special casing later vs regime_el. */
-+        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
-+                                      is_secure, result, fi);
-+
-+    case ARMMMUIdx_Stage1_E0:
-+    case ARMMMUIdx_Stage1_E1:
-+    case ARMMMUIdx_Stage1_E1_PAN:
-+        /* First stage lookup uses second stage for ptw. */
-+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-+        break;
-+
-+    case ARMMMUIdx_E10_0:
-+        s1_mmu_idx = ARMMMUIdx_Stage1_E0;
-+        goto do_twostage;
-+    case ARMMMUIdx_E10_1:
-+        s1_mmu_idx = ARMMMUIdx_Stage1_E1;
-+        goto do_twostage;
-+    case ARMMMUIdx_E10_1_PAN:
-+        s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
-+    do_twostage:
-         /*
-          * Call ourselves recursively to do the stage 1 and then stage 2
-          * translations if mmu_idx is a two-stage regime, and EL2 present.
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-             return get_phys_addr_twostage(env, ptw, address, access_type,
-                                           result, fi);
-         }
-+        /* fall through */
-+
-+    default:
-+        /* Single stage and second stage uses physical for ptw. */
-+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
-+        break;
-     }
-     /*
 --
-.25.1
+.19.1

-[PULL 09/30] target/arm: Add isar predicates for FEAT_HAFDBS
+[Qemu-devel] [PULL 08/10] target/arm: Conditionalize some asserts on aarch32 support
 From: Richard Henderson <richard.henderson@linaro.org>
-The MMFR1 field may indicate support for hardware update of
+When populating id registers from kvm, on a host that doesn't support
-access flag alone, or access flag and dirty bit.
+aarch32 mode at all, neither arm_div nor jazelle will be supported either.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20181102102025.3546-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 10 ++++++++++
+ target/arm/cpu.h |  5 +++++
-file changed, 10 insertions(+)
+ target/arm/cpu.c | 15 +++++++++++++--
 files changed, 18 insertions(+), 2 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
-     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
  }
-+static inline bool isar_feature_aa64_hafs(const ARMISARegisters *id)
++static inline bool isar_feature_aa64_aa32(const ARMISARegisters *id)
 +{
-+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) != 0;
++    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL0) >= 2;
 +}
 +
-+static inline bool isar_feature_aa64_hdbs(const ARMISARegisters *id)
+ static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
-+{
+ {
-+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) >= 2;
+     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
-+}
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      CPUARMState *env = &cpu->env;
      int pagebits;
      Error *local_err = NULL;
 +    bool no_aa32 = false;
      /* If we needed to query the host kernel for the CPU features
       * then it's possible that might have failed in the initfn, but
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
              set_feature(env, ARM_FEATURE_V7VE);
          }
      }
 +
- static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
++    /*
- {
++     * There exist AArch64 cpus without AArch32 support.  When KVM
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
++     * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
 +     * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
 +     */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +        no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
 +    }
 +
      if (arm_feature(env, ARM_FEATURE_V7VE)) {
          /* v7 Virtualization Extensions. In real hardware this implies
           * EL2 and also the presence of the Security Extensions.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
           * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
           * Security Extensions is ARM_FEATURE_EL3.
           */
 -        assert(cpu_isar_feature(arm_div, cpu));
 +        assert(no_aa32 || cpu_isar_feature(arm_div, cpu));
          set_feature(env, ARM_FEATURE_LPAE);
          set_feature(env, ARM_FEATURE_V7);
      }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V6)) {
          set_feature(env, ARM_FEATURE_V5);
          if (!arm_feature(env, ARM_FEATURE_M)) {
 -            assert(cpu_isar_feature(jazelle, cpu));
 +            assert(no_aa32 || cpu_isar_feature(jazelle, cpu));
              set_feature(env, ARM_FEATURE_AUXCR);
          }
      }
 --
-.25.1
+.19.1

-[PULL 11/30] target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Separate S1 translation from the actual lookup.
-Will enable lpae hardware updates.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-6-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 41 ++++++++++++++++++++++-------------------
-file changed, 22 insertions(+), 19 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
- }
- /* All loads done in the course of a page table walk go through here. */
--static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
-+static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
-                             ARMMMUFaultInfo *fi)
- {
-     CPUState *cs = env_cpu(env);
-     uint32_t data;
--    if (!S1_ptw_translate(env, ptw, addr, fi)) {
--        /* Failure. */
--        assert(fi->s1ptw);
--        return 0;
--    }
--
-     if (likely(ptw->out_host)) {
-         /* Page tables are in RAM, and we have the host address. */
-         if (ptw->out_be) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
-     return data;
- }
--static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
-+static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
-                             ARMMMUFaultInfo *fi)
- {
-     CPUState *cs = env_cpu(env);
-     uint64_t data;
--    if (!S1_ptw_translate(env, ptw, addr, fi)) {
--        /* Failure. */
--        assert(fi->s1ptw);
--        return 0;
--    }
--
-     if (likely(ptw->out_host)) {
-         /* Page tables are in RAM, and we have the host address. */
-         if (ptw->out_be) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
-         fi->type = ARMFault_Translation;
-         goto do_fault;
-     }
--    desc = arm_ldl_ptw(env, ptw, table, fi);
-+    if (!S1_ptw_translate(env, ptw, table, fi)) {
-+        goto do_fault;
-+    }
-+    desc = arm_ldl_ptw(env, ptw, fi);
-     if (fi->type != ARMFault_None) {
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
-             /* Fine pagetable.  */
-             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
-         }
--        desc = arm_ldl_ptw(env, ptw, table, fi);
-+        if (!S1_ptw_translate(env, ptw, table, fi)) {
-+            goto do_fault;
-+        }
-+        desc = arm_ldl_ptw(env, ptw, fi);
-         if (fi->type != ARMFault_None) {
-             goto do_fault;
-         }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-         fi->type = ARMFault_Translation;
-         goto do_fault;
-     }
--    desc = arm_ldl_ptw(env, ptw, table, fi);
-+    if (!S1_ptw_translate(env, ptw, table, fi)) {
-+        goto do_fault;
-+    }
-+    desc = arm_ldl_ptw(env, ptw, fi);
-     if (fi->type != ARMFault_None) {
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-         ns = extract32(desc, 3, 1);
-         /* Lookup l2 entry.  */
-         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
--        desc = arm_ldl_ptw(env, ptw, table, fi);
-+        if (!S1_ptw_translate(env, ptw, table, fi)) {
-+            goto do_fault;
-+        }
-+        desc = arm_ldl_ptw(env, ptw, fi);
-         if (fi->type != ARMFault_None) {
-             goto do_fault;
-         }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-             ptw->in_ptw_idx &= ~1;
-             ptw->in_secure = false;
-         }
--        descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
-+        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-+            goto do_fault;
-+        }
-+        descriptor = arm_ldq_ptw(env, ptw, fi);
-         if (fi->type != ARMFault_None) {
-             goto do_fault;
-         }
---
-.25.1

-[PULL 13/30] target/arm: Remove loop from get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The unconditional loop was used both to iterate over levels
-and to control parsing of attributes.  Use an explicit goto
-in both cases.
-While this appears less clean for iterating over levels, we
-will need to jump back into the middle of this loop for
-atomic updates, which is even uglier.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-8-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 192 +++++++++++++++++++++++------------------------
-file changed, 96 insertions(+), 96 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
-     bool guarded = false;
-+    uint64_t descriptor;
-+    bool nstable;
-     /* TODO: This code does not support shareability levels. */
-     if (aarch64) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-      * bits at each step.
-      */
-     tableattrs = is_secure ? 0 : (1 << 4);
--    for (;;) {
--        uint64_t descriptor;
--        bool nstable;
--
--        descaddr |= (address >> (stride * (4 - level))) & indexmask;
--        descaddr &= ~7ULL;
--        nstable = extract32(tableattrs, 4, 1);
--        if (!nstable) {
--            /*
--             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
--             * Assert that the non-secure idx are even, and relative order.
--             */
--            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
--            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
--            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
--            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
--            ptw->in_ptw_idx &= ~1;
--            ptw->in_secure = false;
--        }
--        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
--            goto do_fault;
--        }
--        descriptor = arm_ldq_ptw(env, ptw, fi);
--        if (fi->type != ARMFault_None) {
--            goto do_fault;
--        }
--
--        if (!(descriptor & 1) ||
--            (!(descriptor & 2) && (level == 3))) {
--            /* Invalid, or the Reserved level 3 encoding */
--            goto do_fault;
--        }
--
--        descaddr = descriptor & descaddrmask;
-+ next_level:
-+    descaddr |= (address >> (stride * (4 - level))) & indexmask;
-+    descaddr &= ~7ULL;
-+    nstable = extract32(tableattrs, 4, 1);
-+    if (!nstable) {
-         /*
--         * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
--         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
--         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
--         * raise AddressSizeFault.
-+         * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-+         * Assert that the non-secure idx are even, and relative order.
-          */
--        if (outputsize > 48) {
--            if (param.ds) {
--                descaddr |= extract64(descriptor, 8, 2) << 50;
--            } else {
--                descaddr |= extract64(descriptor, 12, 4) << 48;
--            }
--        } else if (descaddr >> outputsize) {
--            fault_type = ARMFault_AddressSize;
--            goto do_fault;
--        }
--
--        if ((descriptor & 2) && (level < 3)) {
--            /*
--             * Table entry. The top five bits are attributes which may
--             * propagate down through lower levels of the table (and
--             * which are all arranged so that 0 means "no effect", so
--             * we can gather them up by ORing in the bits at each level).
--             */
--            tableattrs |= extract64(descriptor, 59, 5);
--            level++;
--            indexmask = indexmask_grainsize;
--            continue;
--        }
--        /*
--         * Block entry at level 1 or 2, or page entry at level 3.
--         * These are basically the same thing, although the number
--         * of bits we pull in from the vaddr varies. Note that although
--         * descaddrmask masks enough of the low bits of the descriptor
--         * to give a correct page or table address, the address field
--         * in a block descriptor is smaller; so we need to explicitly
--         * clear the lower bits here before ORing in the low vaddr bits.
--         */
--        page_size = (1ULL << ((stride * (4 - level)) + 3));
--        descaddr &= ~(hwaddr)(page_size - 1);
--        descaddr |= (address & (page_size - 1));
--        /* Extract attributes from the descriptor */
--        attrs = extract64(descriptor, 2, 10)
--            | (extract64(descriptor, 52, 12) << 10);
--
--        if (regime_is_stage2(mmu_idx)) {
--            /* Stage 2 table descriptors do not include any attribute fields */
--            break;
--        }
--        /* Merge in attributes from table descriptors */
--        attrs |= nstable << 3; /* NS */
--        guarded = extract64(descriptor, 50, 1);  /* GP */
--        if (param.hpd) {
--            /* HPD disables all the table attributes except NSTable.  */
--            break;
--        }
--        attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
--        /*
--         * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
--         * means "force PL1 access only", which means forcing AP[1] to 0.
--         */
--        attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
--        attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
--        break;
-+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-+        ptw->in_ptw_idx &= ~1;
-+        ptw->in_secure = false;
-     }
-+    if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-+        goto do_fault;
-+    }
-+    descriptor = arm_ldq_ptw(env, ptw, fi);
-+    if (fi->type != ARMFault_None) {
-+        goto do_fault;
-+    }
-+
-+    if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
-+        /* Invalid, or the Reserved level 3 encoding */
-+        goto do_fault;
-+    }
-+
-+    descaddr = descriptor & descaddrmask;
-+
-+    /*
-+     * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
-+     * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
-+     * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
-+     * raise AddressSizeFault.
-+     */
-+    if (outputsize > 48) {
-+        if (param.ds) {
-+            descaddr |= extract64(descriptor, 8, 2) << 50;
-+        } else {
-+            descaddr |= extract64(descriptor, 12, 4) << 48;
-+        }
-+    } else if (descaddr >> outputsize) {
-+        fault_type = ARMFault_AddressSize;
-+        goto do_fault;
-+    }
-+
-+    if ((descriptor & 2) && (level < 3)) {
-+        /*
-+         * Table entry. The top five bits are attributes which may
-+         * propagate down through lower levels of the table (and
-+         * which are all arranged so that 0 means "no effect", so
-+         * we can gather them up by ORing in the bits at each level).
-+         */
-+        tableattrs |= extract64(descriptor, 59, 5);
-+        level++;
-+        indexmask = indexmask_grainsize;
-+        goto next_level;
-+    }
-+
-+    /*
-+     * Block entry at level 1 or 2, or page entry at level 3.
-+     * These are basically the same thing, although the number
-+     * of bits we pull in from the vaddr varies. Note that although
-+     * descaddrmask masks enough of the low bits of the descriptor
-+     * to give a correct page or table address, the address field
-+     * in a block descriptor is smaller; so we need to explicitly
-+     * clear the lower bits here before ORing in the low vaddr bits.
-+     */
-+    page_size = (1ULL << ((stride * (4 - level)) + 3));
-+    descaddr &= ~(hwaddr)(page_size - 1);
-+    descaddr |= (address & (page_size - 1));
-+    /* Extract attributes from the descriptor */
-+    attrs = extract64(descriptor, 2, 10)
-+        | (extract64(descriptor, 52, 12) << 10);
-+
-+    if (regime_is_stage2(mmu_idx)) {
-+        /* Stage 2 table descriptors do not include any attribute fields */
-+        goto skip_attrs;
-+    }
-+    /* Merge in attributes from table descriptors */
-+    attrs |= nstable << 3; /* NS */
-+    guarded = extract64(descriptor, 50, 1);  /* GP */
-+    if (param.hpd) {
-+        /* HPD disables all the table attributes except NSTable.  */
-+        goto skip_attrs;
-+    }
-+    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-+    /*
-+     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-+     * means "force PL1 access only", which means forcing AP[1] to 0.
-+     */
-+    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-+    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-+ skip_attrs:
-+
-     /*
-      * Here descaddr is the final physical address, and attributes
-      * are all in attrs.
---
-.25.1

-[PULL 14/30] target/arm: Fix fault reporting in get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Always overriding fi->type was incorrect, as we would not properly
-propagate the fault type from S1_ptw_translate, or arm_ldq_ptw.
-Simplify things by providing a new label for a translation fault.
-For other faults, store into fi directly.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20221024051851.3074715-9-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 31 +++++++++++++------------------
-file changed, 13 insertions(+), 18 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     ARMCPU *cpu = env_archcpu(env);
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-     bool is_secure = ptw->in_secure;
--    /* Read an LPAE long-descriptor translation table. */
--    ARMFaultType fault_type = ARMFault_Translation;
-     uint32_t level;
-     ARMVAParameters param;
-     uint64_t ttbr;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-          * so our choice is to always raise the fault.
-          */
-         if (param.tsz_oob) {
--            fault_type = ARMFault_Translation;
--            goto do_fault;
-+            goto do_translation_fault;
-         }
-         addrsize = 64 - 8 * param.tbi;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                                            addrsize - inputsize);
-         if (-top_bits != param.select) {
-             /* The gap between the two regions is a Translation fault */
--            fault_type = ARMFault_Translation;
--            goto do_fault;
-+            goto do_translation_fault;
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-          * Translation table walk disabled => Translation fault on TLB miss
-          * Note: This is always 0 on 64-bit EL2 and EL3.
-          */
--        goto do_fault;
-+        goto do_translation_fault;
-     }
-     if (!regime_is_stage2(mmu_idx)) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         if (param.ds && stride == 9 && sl2) {
-             if (sl0 != 0) {
-                 level = 0;
--                fault_type = ARMFault_Translation;
--                goto do_fault;
-+                goto do_translation_fault;
-             }
-             startlevel = -1;
-         } else if (!aarch64 || stride == 9) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
-                                 inputsize, stride, outputsize);
-         if (!ok) {
--            fault_type = ARMFault_Translation;
--            goto do_fault;
-+            goto do_translation_fault;
-         }
-         level = startlevel;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         descaddr |= extract64(ttbr, 2, 4) << 48;
-     } else if (descaddr >> outputsize) {
-         level = 0;
--        fault_type = ARMFault_AddressSize;
-+        fi->type = ARMFault_AddressSize;
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
-         /* Invalid, or the Reserved level 3 encoding */
--        goto do_fault;
-+        goto do_translation_fault;
-     }
-     descaddr = descriptor & descaddrmask;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-             descaddr |= extract64(descriptor, 12, 4) << 48;
-         }
-     } else if (descaddr >> outputsize) {
--        fault_type = ARMFault_AddressSize;
-+        fi->type = ARMFault_AddressSize;
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-      * Here descaddr is the final physical address, and attributes
-      * are all in attrs.
-      */
--    fault_type = ARMFault_AccessFlag;
-     if ((attrs & (1 << 8)) == 0) {
-         /* Access flag */
-+        fi->type = ARMFault_AccessFlag;
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
-     }
--    fault_type = ARMFault_Permission;
-     if (!(result->f.prot & (1 << access_type))) {
-+        fi->type = ARMFault_Permission;
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     result->f.lg_page_size = ctz64(page_size);
-     return false;
--do_fault:
--    fi->type = fault_type;
-+ do_translation_fault:
-+    fi->type = ARMFault_Translation;
-+ do_fault:
-     fi->level = level;
-     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
-     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
---
-.25.1

-[PULL 15/30] target/arm: Don't shift attrs in get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Leave the upper and lower attributes in the place they originate
-from in the descriptor.  Shifting them around is confusing, since
-one cannot read the bit numbers out of the manual.  Also, new
-attributes have been added which would alter the shifts.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20221024051851.3074715-10-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 31 +++++++++++++++----------------
-file changed, 15 insertions(+), 16 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     hwaddr descaddr, indexmask, indexmask_grainsize;
-     uint32_t tableattrs;
-     target_ulong page_size;
--    uint32_t attrs;
-+    uint64_t attrs;
-     int32_t stride;
-     int addrsize, inputsize, outputsize;
-     uint64_t tcr = regime_tcr(env, mmu_idx);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     descaddr &= ~(hwaddr)(page_size - 1);
-     descaddr |= (address & (page_size - 1));
-     /* Extract attributes from the descriptor */
--    attrs = extract64(descriptor, 2, 10)
--        | (extract64(descriptor, 52, 12) << 10);
-+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
-     if (regime_is_stage2(mmu_idx)) {
-         /* Stage 2 table descriptors do not include any attribute fields */
-         goto skip_attrs;
-     }
-     /* Merge in attributes from table descriptors */
--    attrs |= nstable << 3; /* NS */
-+    attrs |= nstable << 5; /* NS */
-     guarded = extract64(descriptor, 50, 1);  /* GP */
-     if (param.hpd) {
-         /* HPD disables all the table attributes except NSTable.  */
-         goto skip_attrs;
-     }
--    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-+    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-     /*
-      * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-      * means "force PL1 access only", which means forcing AP[1] to 0.
-      */
--    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
--    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-+    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
-+    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
-  skip_attrs:
-     /*
-      * Here descaddr is the final physical address, and attributes
-      * are all in attrs.
-      */
--    if ((attrs & (1 << 8)) == 0) {
-+    if ((attrs & (1 << 10)) == 0) {
-         /* Access flag */
-         fi->type = ARMFault_AccessFlag;
-         goto do_fault;
-     }
--    ap = extract32(attrs, 4, 2);
-+    ap = extract32(attrs, 6, 2);
-     if (regime_is_stage2(mmu_idx)) {
-         ns = mmu_idx == ARMMMUIdx_Stage2;
--        xn = extract32(attrs, 11, 2);
-+        xn = extract64(attrs, 53, 2);
-         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-     } else {
--        ns = extract32(attrs, 3, 1);
--        xn = extract32(attrs, 12, 1);
--        pxn = extract32(attrs, 11, 1);
-+        ns = extract32(attrs, 5, 1);
-+        xn = extract64(attrs, 54, 1);
-+        pxn = extract64(attrs, 53, 1);
-         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (regime_is_stage2(mmu_idx)) {
-         result->cacheattrs.is_s2_format = true;
--        result->cacheattrs.attrs = extract32(attrs, 0, 4);
-+        result->cacheattrs.attrs = extract32(attrs, 2, 4);
-     } else {
-         /* Index into MAIR registers for cache attributes */
--        uint8_t attrindx = extract32(attrs, 0, 3);
-+        uint8_t attrindx = extract32(attrs, 2, 3);
-         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
-         assert(attrindx <= 7);
-         result->cacheattrs.is_s2_format = false;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (param.ds) {
-         result->cacheattrs.shareability = param.sh;
-     } else {
--        result->cacheattrs.shareability = extract32(attrs, 6, 2);
-+        result->cacheattrs.shareability = extract32(attrs, 8, 2);
-     }
-     result->f.phys_addr = descaddr;
---
-.25.1

-[PULL 16/30] target/arm: Consider GP an attribute in get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Both GP and DBM are in the upper attribute block.
-Extend the computation of attrs to include them,
-then simplify the setting of guarded.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20221024051851.3074715-11-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 6 ++----
-file changed, 2 insertions(+), 4 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     uint32_t el = regime_el(env, mmu_idx);
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
--    bool guarded = false;
-     uint64_t descriptor;
-     bool nstable;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     descaddr &= ~(hwaddr)(page_size - 1);
-     descaddr |= (address & (page_size - 1));
-     /* Extract attributes from the descriptor */
--    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
-+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-     if (regime_is_stage2(mmu_idx)) {
-         /* Stage 2 table descriptors do not include any attribute fields */
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     }
-     /* Merge in attributes from table descriptors */
-     attrs |= nstable << 5; /* NS */
--    guarded = extract64(descriptor, 50, 1);  /* GP */
-     if (param.hpd) {
-         /* HPD disables all the table attributes except NSTable.  */
-         goto skip_attrs;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-     if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
--        result->f.guarded = guarded;
-+        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-     }
-     if (regime_is_stage2(mmu_idx)) {
---
-.25.1

-[PULL 17/30] target/arm: Tidy merging of attributes from descriptor and table
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Replace some gotos with some nested if statements.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20221024051851.3074715-12-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 34 ++++++++++++++++------------------
-file changed, 16 insertions(+), 18 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     page_size = (1ULL << ((stride * (4 - level)) + 3));
-     descaddr &= ~(hwaddr)(page_size - 1);
-     descaddr |= (address & (page_size - 1));
--    /* Extract attributes from the descriptor */
--    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
--    if (regime_is_stage2(mmu_idx)) {
--        /* Stage 2 table descriptors do not include any attribute fields */
--        goto skip_attrs;
--    }
--    /* Merge in attributes from table descriptors */
--    attrs |= nstable << 5; /* NS */
--    if (param.hpd) {
--        /* HPD disables all the table attributes except NSTable.  */
--        goto skip_attrs;
--    }
--    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-     /*
--     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
--     * means "force PL1 access only", which means forcing AP[1] to 0.
-+     * Extract attributes from the descriptor, and apply table descriptors.
-+     * Stage 2 table descriptors do not include any attribute fields.
-+     * HPD disables all the table attributes except NSTable.
-      */
--    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
--    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
-- skip_attrs:
-+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-+    if (!regime_is_stage2(mmu_idx)) {
-+        attrs |= nstable << 5; /* NS */
-+        if (!param.hpd) {
-+            attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-+            /*
-+             * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-+             * means "force PL1 access only", which means forcing AP[1] to 0.
-+             */
-+            attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
-+            attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
-+        }
-+    }
-     /*
-      * Here descaddr is the final physical address, and attributes
---
-.25.1

-[PULL 18/30] target/arm: Implement FEAT_HAFDBS, access flag portion
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Perform the atomic update for hardware management of the access flag.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-13-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/emulation.rst |   1 +
- target/arm/cpu64.c            |   1 +
- target/arm/ptw.c              | 176 +++++++++++++++++++++++++++++-----
-files changed, 156 insertions(+), 22 deletions(-)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_FlagM (Flag manipulation instructions v2)
- - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
- - FEAT_GTG (Guest translation granule size)
-+- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
- - FEAT_HCX (Support for the HCRX_EL2 register)
- - FEAT_HPDS (Hierarchical permission disables)
- - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->isar.id_aa64mmfr0 = t;
-     t = cpu->isar.id_aa64mmfr1;
-+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
-     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
-     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
-     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
-     bool in_secure;
-     bool in_debug;
-     bool out_secure;
-+    bool out_rw;
-     bool out_be;
-+    hwaddr out_virt;
-     hwaddr out_phys;
-     void *out_host;
- } S1Translate;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-     uint8_t pte_attrs;
-     bool pte_secure;
-+    ptw->out_virt = addr;
-+
-     if (unlikely(ptw->in_debug)) {
-         /*
-          * From gdbstub, do not use softmmu so that we don't modify the
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-             pte_secure = is_secure;
-         }
-         ptw->out_host = NULL;
-+        ptw->out_rw = false;
-     } else {
-         CPUTLBEntryFull *full;
-         int flags;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-             goto fail;
-         }
-         ptw->out_phys = full->phys_addr;
-+        ptw->out_rw = full->prot & PROT_WRITE;
-         pte_attrs = full->pte_attrs;
-         pte_secure = full->attrs.secure;
-     }
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
-                             ARMMMUFaultInfo *fi)
- {
-     CPUState *cs = env_cpu(env);
-+    void *host = ptw->out_host;
-     uint32_t data;
--    if (likely(ptw->out_host)) {
-+    if (likely(host)) {
-         /* Page tables are in RAM, and we have the host address. */
-+        data = qatomic_read((uint32_t *)host);
-         if (ptw->out_be) {
--            data = ldl_be_p(ptw->out_host);
-+            data = be32_to_cpu(data);
-         } else {
--            data = ldl_le_p(ptw->out_host);
-+            data = le32_to_cpu(data);
-         }
-     } else {
-         /* Page tables are in MMIO. */
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
-                             ARMMMUFaultInfo *fi)
- {
-     CPUState *cs = env_cpu(env);
-+    void *host = ptw->out_host;
-     uint64_t data;
--    if (likely(ptw->out_host)) {
-+    if (likely(host)) {
-         /* Page tables are in RAM, and we have the host address. */
-+#ifdef CONFIG_ATOMIC64
-+        data = qatomic_read__nocheck((uint64_t *)host);
-         if (ptw->out_be) {
--            data = ldq_be_p(ptw->out_host);
-+            data = be64_to_cpu(data);
-         } else {
--            data = ldq_le_p(ptw->out_host);
-+            data = le64_to_cpu(data);
-         }
-+#else
-+        if (ptw->out_be) {
-+            data = ldq_be_p(host);
-+        } else {
-+            data = ldq_le_p(host);
-+        }
-+#endif
-     } else {
-         /* Page tables are in MMIO. */
-         MemTxAttrs attrs = { .secure = ptw->out_secure };
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
-     return data;
- }
-+static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
-+                             uint64_t new_val, S1Translate *ptw,
-+                             ARMMMUFaultInfo *fi)
-+{
-+    uint64_t cur_val;
-+    void *host = ptw->out_host;
-+
-+    if (unlikely(!host)) {
-+        fi->type = ARMFault_UnsuppAtomicUpdate;
-+        fi->s1ptw = true;
-+        return 0;
-+    }
-+
-+    /*
-+     * Raising a stage2 Protection fault for an atomic update to a read-only
-+     * page is delayed until it is certain that there is a change to make.
-+     */
-+    if (unlikely(!ptw->out_rw)) {
-+        int flags;
-+        void *discard;
-+
-+        env->tlb_fi = fi;
-+        flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE,
-+                                   arm_to_core_mmu_idx(ptw->in_ptw_idx),
-+                                   true, &discard, 0);
-+        env->tlb_fi = NULL;
-+
-+        if (unlikely(flags & TLB_INVALID_MASK)) {
-+            assert(fi->type != ARMFault_None);
-+            fi->s2addr = ptw->out_virt;
-+            fi->stage2 = true;
-+            fi->s1ptw = true;
-+            fi->s1ns = !ptw->in_secure;
-+            return 0;
-+        }
-+
-+        /* In case CAS mismatches and we loop, remember writability. */
-+        ptw->out_rw = true;
-+    }
-+
-+#ifdef CONFIG_ATOMIC64
-+    if (ptw->out_be) {
-+        old_val = cpu_to_be64(old_val);
-+        new_val = cpu_to_be64(new_val);
-+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
-+        cur_val = be64_to_cpu(cur_val);
-+    } else {
-+        old_val = cpu_to_le64(old_val);
-+        new_val = cpu_to_le64(new_val);
-+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
-+        cur_val = le64_to_cpu(cur_val);
-+    }
-+#else
-+    /*
-+     * We can't support the full 64-bit atomic cmpxchg on the host.
-+     * Because this is only used for FEAT_HAFDBS, which is only for AA64,
-+     * we know that TCG_OVERSIZED_GUEST is set, which means that we are
-+     * running in round-robin mode and could only race with dma i/o.
-+     */
-+#ifndef TCG_OVERSIZED_GUEST
-+# error "Unexpected configuration"
-+#endif
-+    bool locked = qemu_mutex_iothread_locked();
-+    if (!locked) {
-+       qemu_mutex_lock_iothread();
-+    }
-+    if (ptw->out_be) {
-+        cur_val = ldq_be_p(host);
-+        if (cur_val == old_val) {
-+            stq_be_p(host, new_val);
-+        }
-+    } else {
-+        cur_val = ldq_le_p(host);
-+        if (cur_val == old_val) {
-+            stq_le_p(host, new_val);
-+        }
-+    }
-+    if (!locked) {
-+        qemu_mutex_unlock_iothread();
-+    }
-+#endif
-+
-+    return cur_val;
-+}
-+
- static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
-                                      uint32_t *table, uint32_t address)
- {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     uint32_t el = regime_el(env, mmu_idx);
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
--    uint64_t descriptor;
-+    uint64_t descriptor, new_descriptor;
-     bool nstable;
-     /* TODO: This code does not support shareability levels. */
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (fi->type != ARMFault_None) {
-         goto do_fault;
-     }
-+    new_descriptor = descriptor;
-+ restart_atomic_update:
-     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
-         /* Invalid, or the Reserved level 3 encoding */
-         goto do_translation_fault;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-      * to give a correct page or table address, the address field
-      * in a block descriptor is smaller; so we need to explicitly
-      * clear the lower bits here before ORing in the low vaddr bits.
-+     *
-+     * Afterward, descaddr is the final physical address.
-      */
-     page_size = (1ULL << ((stride * (4 - level)) + 3));
-     descaddr &= ~(hwaddr)(page_size - 1);
-     descaddr |= (address & (page_size - 1));
-+    if (likely(!ptw->in_debug)) {
-+        /*
-+         * Access flag.
-+         * If HA is enabled, prepare to update the descriptor below.
-+         * Otherwise, pass the access fault on to software.
-+         */
-+        if (!(descriptor & (1 << 10))) {
-+            if (param.ha) {
-+                new_descriptor |= 1 << 10; /* AF */
-+            } else {
-+                fi->type = ARMFault_AccessFlag;
-+                goto do_fault;
-+            }
-+        }
-+    }
-+
-     /*
--     * Extract attributes from the descriptor, and apply table descriptors.
--     * Stage 2 table descriptors do not include any attribute fields.
--     * HPD disables all the table attributes except NSTable.
-+     * Extract attributes from the (modified) descriptor, and apply
-+     * table descriptors. Stage 2 table descriptors do not include
-+     * any attribute fields. HPD disables all the table attributes
-+     * except NSTable.
-      */
--    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-+    attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-     if (!regime_is_stage2(mmu_idx)) {
-         attrs |= nstable << 5; /* NS */
-         if (!param.hpd) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         }
-     }
--    /*
--     * Here descaddr is the final physical address, and attributes
--     * are all in attrs.
--     */
--    if ((attrs & (1 << 10)) == 0) {
--        /* Access flag */
--        fi->type = ARMFault_AccessFlag;
--        goto do_fault;
--    }
--
-     ap = extract32(attrs, 6, 2);
--
-     if (regime_is_stage2(mmu_idx)) {
-         ns = mmu_idx == ARMMMUIdx_Stage2;
-         xn = extract64(attrs, 53, 2);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         goto do_fault;
-     }
-+    /* If FEAT_HAFDBS has made changes, update the PTE. */
-+    if (new_descriptor != descriptor) {
-+        new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
-+        if (fi->type != ARMFault_None) {
-+            goto do_fault;
-+        }
-+        /*
-+         * I_YZSVV says that if the in-memory descriptor has changed,
-+         * then we must use the information in that new value
-+         * (which might include a different output address, different
-+         * attributes, or generate a fault).
-+         * Restart the handling of the descriptor value from scratch.
-+         */
-+        if (new_descriptor != descriptor) {
-+            descriptor = new_descriptor;
-+            goto restart_atomic_update;
-+        }
-+    }
-+
-     if (ns) {
-         /*
-          * The NS bit will (as required by the architecture) have no effect if
---
-.25.1

-[PULL 19/30] target/arm: Implement FEAT_HAFDBS, dirty bit portion
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Perform the atomic update for hardware management of the dirty bit.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-14-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu64.c |  2 +-
- target/arm/ptw.c   | 16 ++++++++++++++++
-files changed, 17 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->isar.id_aa64mmfr0 = t;
-     t = cpu->isar.id_aa64mmfr1;
--    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
-     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
-     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
-     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                 goto do_fault;
-             }
-         }
-+
-+        /*
-+         * Dirty Bit.
-+         * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
-+         * bit for writeback. The actual write protection test may still be
-+         * overridden by tableattrs, to be merged below.
-+         */
-+        if (param.hd
-+            && extract64(descriptor, 51, 1)  /* DBM */
-+            && access_type == MMU_DATA_STORE) {
-+            if (regime_is_stage2(mmu_idx)) {
-+                new_descriptor |= 1ull << 7;    /* set S2AP[1] */
-+            } else {
-+                new_descriptor &= ~(1ull << 7); /* clear AP[2] */
-+            }
-+        }
-     }
-     /*
---
-.25.1

-[PULL 20/30] target/arm: Use the max page size in a 2-stage ptw
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-We had only been reporting the stage2 page size.  This causes
-problems if stage1 is using a larger page size (16k, 2M, etc),
-but stage2 is using a smaller page size, because cputlb does
-not set large_page_{addr,mask} properly.
-Fix by using the max of the two page sizes.
-Reported-by: Marc Zyngier <maz@kernel.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-15-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 11 ++++++++++-
-file changed, 10 insertions(+), 1 deletion(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-                                    ARMMMUFaultInfo *fi)
- {
-     hwaddr ipa;
--    int s1_prot;
-+    int s1_prot, s1_lgpgsz;
-     bool is_secure = ptw->in_secure;
-     bool ret, ipa_secure, s2walk_secure;
-     ARMCacheAttrs cacheattrs1;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-      * Save the stage1 results so that we may merge prot and cacheattrs later.
-      */
-     s1_prot = result->f.prot;
-+    s1_lgpgsz = result->f.lg_page_size;
-     cacheattrs1 = result->cacheattrs;
-     memset(result, 0, sizeof(*result));
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-         return ret;
-     }
-+    /*
-+     * Use the maximum of the S1 & S2 page size, so that invalidation
-+     * of pages > TARGET_PAGE_SIZE works correctly.
-+     */
-+    if (result->f.lg_page_size < s1_lgpgsz) {
-+        result->f.lg_page_size = s1_lgpgsz;
-+    }
-+
-     /* Combine the S1 and S2 cache attributes. */
-     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
-     if (hcr & HCR_DC) {
---
-.25.1

-[PULL 28/30] mips/boston: re-randomize rng-seed on reboot
+[Qemu-devel] [PULL 09/10] hw/arm: versal: Add a model of Xilinx Versal SoC
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-When the system reboots, the rng-seed that the FDT has should be
+Add a model of Xilinx Versal SoC.
 re-randomized, so that the new boot gets a new seed. Since the FDT is in
 the ROM region at this point, we add a hook right after the ROM has been
 added, so that we have a pointer to that copy of the FDT.
-Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Cc: Paul Burton <paulburton@kernel.org>
+Message-id: 20181102131913.1535-2-edgar.iglesias@xilinx.com
 Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 Message-id: 20221025004327.568476-9-Jason@zx2c4.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/mips/boston.c | 3 +++
+ hw/arm/Makefile.objs                |   1 +
-file changed, 3 insertions(+)
+ include/hw/arm/xlnx-versal.h        | 122 +++++++++++
  hw/arm/xlnx-versal.c                | 323 ++++++++++++++++++++++++++++
  default-configs/aarch64-softmmu.mak |   1 +
 files changed, 447 insertions(+)
  create mode 100644 include/hw/arm/xlnx-versal.h
  create mode 100644 hw/arm/xlnx-versal.c
-diff --git a/hw/mips/boston.c b/hw/mips/boston.c
+diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/boston.c
+--- a/hw/arm/Makefile.objs
-+++ b/hw/mips/boston.c
++++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
  obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 +obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/xlnx-versal.h
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/sysemu.h"
++/*
- #include "sysemu/qtest.h"
++ * Model of the Xilinx Versal
- #include "sysemu/runstate.h"
++ *
-+#include "sysemu/reset.h"
++ * Copyright (c) 2018 Xilinx Inc.
++ * Written by Edgar E. Iglesias
- #include <libfdt.h>
++ *
- #include "qom/object.h"
++ * This program is free software; you can redistribute it and/or modify
-@@ -XXX,XX +XXX,XX @@ static void boston_mach_init(MachineState *machine)
++ * it under the terms of the GNU General Public License version 2 or
-             /* Calculate real fdt size after filter */
++ * (at your option) any later version.
-             dt_size = fdt_totalsize(dtb_load_data);
++ */
-             rom_add_blob_fixed("dtb", dtb_load_data, dt_size, dtb_paddr);
++
-+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
++#ifndef XLNX_VERSAL_H
-+                                rom_ptr(dtb_paddr, dt_size));
++#define XLNX_VERSAL_H
-         } else {
++
-             /* Try to load file as FIT */
++#include "hw/sysbus.h"
-             fit_err = load_fit(&boston_fit_loader, machine->kernel_filename, s);
++#include "hw/arm/arm.h"
 +#include "hw/intc/arm_gicv3.h"
 +
 +#define TYPE_XLNX_VERSAL "xlnx-versal"
 +#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
 +
 +#define XLNX_VERSAL_NR_ACPUS   2
 +#define XLNX_VERSAL_NR_UARTS   2
 +#define XLNX_VERSAL_NR_GEMS    2
 +#define XLNX_VERSAL_NR_IRQS    256
 +
 +typedef struct Versal {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    struct {
 +        struct {
 +            MemoryRegion mr;
 +            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
 +            GICv3State gic;
 +        } apu;
 +    } fpd;
 +
 +    MemoryRegion mr_ps;
 +
 +    struct {
 +        /* 4 ranges to access DDR.  */
 +        MemoryRegion mr_ddr_ranges[4];
 +    } noc;
 +
 +    struct {
 +        MemoryRegion mr_ocm;
 +
 +        struct {
 +            SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
 +            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
 +        } iou;
 +    } lpd;
 +
 +    struct {
 +        MemoryRegion *mr_ddr;
 +        uint32_t psci_conduit;
 +    } cfg;
 +} Versal;
 +
 +/* Memory-map and IRQ definitions. Copied a subset from
 + * auto-generated files.  */
 +
 +#define VERSAL_GIC_MAINT_IRQ        9
 +#define VERSAL_TIMER_VIRT_IRQ       11
 +#define VERSAL_TIMER_S_EL1_IRQ      13
 +#define VERSAL_TIMER_NS_EL1_IRQ     14
 +#define VERSAL_TIMER_NS_EL2_IRQ     10
 +
 +#define VERSAL_UART0_IRQ_0         18
 +#define VERSAL_UART1_IRQ_0         19
 +#define VERSAL_GEM0_IRQ_0          56
 +#define VERSAL_GEM0_WAKE_IRQ_0     57
 +#define VERSAL_GEM1_IRQ_0          58
 +#define VERSAL_GEM1_WAKE_IRQ_0     59
 +
 +/* Architecturally eserved IRQs suitable for virtualization.  */
 +#define VERSAL_RSVD_HIGH_IRQ_FIRST 160
 +#define VERSAL_RSVD_HIGH_IRQ_LAST  255
 +
 +#define MM_TOP_RSVD                 0xa0000000U
 +#define MM_TOP_RSVD_SIZE            0x4000000
 +#define MM_GIC_APU_DIST_MAIN        0xf9000000U
 +#define MM_GIC_APU_DIST_MAIN_SIZE   0x10000
 +#define MM_GIC_APU_REDIST_0         0xf9080000U
 +#define MM_GIC_APU_REDIST_0_SIZE    0x80000
 +
 +#define MM_UART0                    0xff000000U
 +#define MM_UART0_SIZE               0x10000
 +#define MM_UART1                    0xff010000U
 +#define MM_UART1_SIZE               0x10000
 +
 +#define MM_GEM0                     0xff0c0000U
 +#define MM_GEM0_SIZE                0x10000
 +#define MM_GEM1                     0xff0d0000U
 +#define MM_GEM1_SIZE                0x10000
 +
 +#define MM_OCM                      0xfffc0000U
 +#define MM_OCM_SIZE                 0x40000
 +
 +#define MM_TOP_DDR                  0x0
 +#define MM_TOP_DDR_SIZE             0x80000000U
 +#define MM_TOP_DDR_2                0x800000000ULL
 +#define MM_TOP_DDR_2_SIZE           0x800000000ULL
 +#define MM_TOP_DDR_3                0xc000000000ULL
 +#define MM_TOP_DDR_3_SIZE           0x4000000000ULL
 +#define MM_TOP_DDR_4                0x10000000000ULL
 +#define MM_TOP_DDR_4_SIZE           0xb780000000ULL
 +
 +#define MM_PSM_START                0xffc80000U
 +#define MM_PSM_END                  0xffcf0000U
 +
 +#define MM_CRL                      0xff5e0000U
 +#define MM_CRL_SIZE                 0x300000
 +#define MM_IOU_SCNTR                0xff130000U
 +#define MM_IOU_SCNTR_SIZE           0x10000
 +#define MM_IOU_SCNTRS               0xff140000U
 +#define MM_IOU_SCNTRS_SIZE          0x10000
 +#define MM_FPD_CRF                  0xfd1a0000U
 +#define MM_FPD_CRF_SIZE             0x140000
 +#endif
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Xilinx Versal SoC model.
 + *
 + * Copyright (c) 2018 Xilinx Inc.
 + * Written by Edgar E. Iglesias
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 or
 + * (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "qemu-common.h"
 +#include "qemu/log.h"
 +#include "hw/sysbus.h"
 +#include "net/net.h"
 +#include "sysemu/sysemu.h"
 +#include "sysemu/kvm.h"
 +#include "hw/arm/arm.h"
 +#include "kvm_arm.h"
 +#include "hw/misc/unimp.h"
 +#include "hw/intc/arm_gicv3_common.h"
 +#include "hw/arm/xlnx-versal.h"
 +
 +#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 +#define GEM_REVISION        0x40070106
 +
 +static void versal_create_apu_cpus(Versal *s)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
 +        Object *obj;
 +        char *name;
 +
 +        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
 +        if (!obj) {
 +            /* Secondary CPUs start in PSCI powered-down state */
 +            error_report("Unable to create apu.cpu[%d] of type %s",
 +                         i, XLNX_VERSAL_ACPU_TYPE);
 +            exit(EXIT_FAILURE);
 +        }
 +
 +        name = g_strdup_printf("apu-cpu[%d]", i);
 +        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
 +        g_free(name);
 +
 +        object_property_set_int(obj, s->cfg.psci_conduit,
 +                                "psci-conduit", &error_abort);
 +        if (i) {
 +            object_property_set_bool(obj, true,
 +                                     "start-powered-off", &error_abort);
 +        }
 +
 +        object_property_set_int(obj, ARRAY_SIZE(s->fpd.apu.cpu),
 +                                "core-count", &error_abort);
 +        object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
 +                                 &error_abort);
 +        object_property_set_bool(obj, true, "realized", &error_fatal);
 +        s->fpd.apu.cpu[i] = ARM_CPU(obj);
 +    }
 +}
 +
 +static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
 +{
 +    static const uint64_t addrs[] = {
 +        MM_GIC_APU_DIST_MAIN,
 +        MM_GIC_APU_REDIST_0
 +    };
 +    SysBusDevice *gicbusdev;
 +    DeviceState *gicdev;
 +    int nr_apu_cpus = ARRAY_SIZE(s->fpd.apu.cpu);
 +    int i;
 +
 +    sysbus_init_child_obj(OBJECT(s), "apu-gic",
 +                          &s->fpd.apu.gic, sizeof(s->fpd.apu.gic),
 +                          gicv3_class_name());
 +    gicbusdev = SYS_BUS_DEVICE(&s->fpd.apu.gic);
 +    gicdev = DEVICE(&s->fpd.apu.gic);
 +    qdev_prop_set_uint32(gicdev, "revision", 3);
 +    qdev_prop_set_uint32(gicdev, "num-cpu", 2);
 +    qdev_prop_set_uint32(gicdev, "num-irq", XLNX_VERSAL_NR_IRQS + 32);
 +    qdev_prop_set_uint32(gicdev, "len-redist-region-count", 1);
 +    qdev_prop_set_uint32(gicdev, "redist-region-count[0]", 2);
 +    qdev_prop_set_bit(gicdev, "has-security-extensions", true);
 +
 +    object_property_set_bool(OBJECT(&s->fpd.apu.gic), true, "realized",
 +                                    &error_fatal);
 +
 +    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
 +        MemoryRegion *mr;
 +
 +        mr = sysbus_mmio_get_region(gicbusdev, i);
 +        memory_region_add_subregion(&s->fpd.apu.mr, addrs[i], mr);
 +    }
 +
 +    for (i = 0; i < nr_apu_cpus; i++) {
 +        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
 +        int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
 +        qemu_irq maint_irq;
 +        int ti;
 +        /* Mapping from the output timer irq lines from the CPU to the
 +         * GIC PPI inputs.
 +         */
 +        const int timer_irq[] = {
 +            [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
 +            [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
 +            [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
 +            [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
 +        };
 +
 +        for (ti = 0; ti < ARRAY_SIZE(timer_irq); ti++) {
 +            qdev_connect_gpio_out(cpudev, ti,
 +                                  qdev_get_gpio_in(gicdev,
 +                                                   ppibase + timer_irq[ti]));
 +        }
 +        maint_irq = qdev_get_gpio_in(gicdev,
 +                                        ppibase + VERSAL_GIC_MAINT_IRQ);
 +        qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
 +                                    0, maint_irq);
 +        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
 +        sysbus_connect_irq(gicbusdev, i + nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
 +        sysbus_connect_irq(gicbusdev, i + 2 * nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
 +        sysbus_connect_irq(gicbusdev, i + 3 * nr_apu_cpus,
 +                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
 +    }
 +
 +    for (i = 0; i < XLNX_VERSAL_NR_IRQS; i++) {
 +        pic[i] = qdev_get_gpio_in(gicdev, i);
 +    }
 +}
 +
 +static void versal_create_uarts(Versal *s, qemu_irq *pic)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
 +        static const int irqs[] = { VERSAL_UART0_IRQ_0, VERSAL_UART1_IRQ_0};
 +        static const uint64_t addrs[] = { MM_UART0, MM_UART1 };
 +        char *name = g_strdup_printf("uart%d", i);
 +        DeviceState *dev;
 +        MemoryRegion *mr;
 +
 +        dev = qdev_create(NULL, "pl011");
 +        s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
 +        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
 +        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +        qdev_init_nofail(dev);
 +
 +        mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
 +        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
 +
 +        sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_create_gems(Versal *s, qemu_irq *pic)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
 +        static const int irqs[] = { VERSAL_GEM0_IRQ_0, VERSAL_GEM1_IRQ_0};
 +        static const uint64_t addrs[] = { MM_GEM0, MM_GEM1 };
 +        char *name = g_strdup_printf("gem%d", i);
 +        NICInfo *nd = &nd_table[i];
 +        DeviceState *dev;
 +        MemoryRegion *mr;
 +
 +        dev = qdev_create(NULL, "cadence_gem");
 +        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
 +        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +        if (nd->used) {
 +            qemu_check_nic_model(nd, "cadence_gem");
 +            qdev_set_nic_properties(dev, nd);
 +        }
 +        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
 +                                2, "num-priority-queues",
 +                                &error_abort);
 +        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
 +                                 OBJECT(&s->mr_ps), "dma",
 +                                 &error_abort);
 +        qdev_init_nofail(dev);
 +
 +        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
 +        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
 +
 +        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
 +        g_free(name);
 +    }
 +}
 +
 +/* This takes the board allocated linear DDR memory and creates aliases
 + * for each split DDR range/aperture on the Versal address map.
 + */
 +static void versal_map_ddr(Versal *s)
 +{
 +    uint64_t size = memory_region_size(s->cfg.mr_ddr);
 +    /* Describes the various split DDR access regions.  */
 +    static const struct {
 +        uint64_t base;
 +        uint64_t size;
 +    } addr_ranges[] = {
 +        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
 +        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
 +        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
 +        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
 +    };
 +    uint64_t offset = 0;
 +    int i;
 +
 +    assert(ARRAY_SIZE(addr_ranges) == ARRAY_SIZE(s->noc.mr_ddr_ranges));
 +    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
 +        char *name;
 +        uint64_t mapsize;
 +
 +        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
 +        name = g_strdup_printf("noc-ddr-range%d", i);
 +        /* Create the MR alias.  */
 +        memory_region_init_alias(&s->noc.mr_ddr_ranges[i], OBJECT(s),
 +                                 name, s->cfg.mr_ddr,
 +                                 offset, mapsize);
 +
 +        /* Map it onto the NoC MR.  */
 +        memory_region_add_subregion(&s->mr_ps, addr_ranges[i].base,
 +                                    &s->noc.mr_ddr_ranges[i]);
 +        offset += mapsize;
 +        size -= mapsize;
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_unimp_area(Versal *s, const char *name,
 +                                MemoryRegion *mr,
 +                                hwaddr base, hwaddr size)
 +{
 +    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
 +    MemoryRegion *mr_dev;
 +
 +    qdev_prop_set_string(dev, "name", name);
 +    qdev_prop_set_uint64(dev, "size", size);
 +    object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
 +    qdev_init_nofail(dev);
 +
 +    mr_dev = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 +    memory_region_add_subregion(mr, base, mr_dev);
 +}
 +
 +static void versal_unimp(Versal *s)
 +{
 +    versal_unimp_area(s, "psm", &s->mr_ps,
 +                        MM_PSM_START, MM_PSM_END - MM_PSM_START);
 +    versal_unimp_area(s, "crl", &s->mr_ps,
 +                        MM_CRL, MM_CRL_SIZE);
 +    versal_unimp_area(s, "crf", &s->mr_ps,
 +                        MM_FPD_CRF, MM_FPD_CRF_SIZE);
 +    versal_unimp_area(s, "iou-scntr", &s->mr_ps,
 +                        MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
 +    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 +                        MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
 +}
 +
 +static void versal_realize(DeviceState *dev, Error **errp)
 +{
 +    Versal *s = XLNX_VERSAL(dev);
 +    qemu_irq pic[XLNX_VERSAL_NR_IRQS];
 +
 +    versal_create_apu_cpus(s);
 +    versal_create_apu_gic(s, pic);
 +    versal_create_uarts(s, pic);
 +    versal_create_gems(s, pic);
 +    versal_map_ddr(s);
 +    versal_unimp(s);
 +
 +    /* Create the On Chip Memory (OCM).  */
 +    memory_region_init_ram(&s->lpd.mr_ocm, OBJECT(s), "ocm",
 +                           MM_OCM_SIZE, &error_fatal);
 +
 +    memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
 +    memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
 +}
 +
 +static void versal_init(Object *obj)
 +{
 +    Versal *s = XLNX_VERSAL(obj);
 +
 +    memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
 +    memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
 +}
 +
 +static Property versal_properties[] = {
 +    DEFINE_PROP_LINK("ddr", Versal, cfg.mr_ddr, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("psci-conduit", Versal, cfg.psci_conduit, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
 +static void versal_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = versal_realize;
 +    dc->props = versal_properties;
 +    /* No VMSD since we haven't got any top-level SoC state to save.  */
 +}
 +
 +static const TypeInfo versal_info = {
 +    .name = TYPE_XLNX_VERSAL,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Versal),
 +    .instance_init = versal_init,
 +    .class_init = versal_class_init,
 +};
 +
 +static void versal_register_types(void)
 +{
 +    type_register_static(&versal_info);
 +}
 +
 +type_init(versal_register_types);
 diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/aarch64-softmmu.mak
 +++ b/default-configs/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
  CONFIG_DPCD=y
  CONFIG_XLNX_ZYNQMP=y
  CONFIG_XLNX_ZYNQMP_ARM=y
 +CONFIG_XLNX_VERSAL=y
  CONFIG_ARM_SMMUV3=y
 --
-.25.1
+.19.1

-[PULL 21/30] reset: allow registering handlers that aren't called by snapshot loading
+[Qemu-devel] [PULL 10/10] hw/arm: versal: Add a virtual Xilinx Versal board
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Snapshot loading only expects to call deterministic handlers, not
+Add a virtual Xilinx Versal board.
 non-deterministic ones. So introduce a way of registering handlers that
 won't be called when reseting for snapshots.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+This board is based on the Xilinx Versal SoC. The exact
-Message-id: 20221025004327.568476-2-Jason@zx2c4.com
+details of what peripherals are attached to this board
-[PMM: updated json doc comment with Markus' text; fixed
+will remain in control of QEMU. QEMU will generate an
- checkpatch style nit]
+FDT on the fly for Linux and other software to auto-discover
 peripherals.
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20181102131913.1535-3-edgar.iglesias@xilinx.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- qapi/run-state.json        |  6 +++++-
+ hw/arm/Makefile.objs      |   2 +-
- include/hw/boards.h        |  2 +-
+ hw/arm/xlnx-versal-virt.c | 494 ++++++++++++++++++++++++++++++++++++++
- include/sysemu/reset.h     |  5 ++++-
+files changed, 495 insertions(+), 1 deletion(-)
- hw/arm/aspeed.c            |  4 ++--
+ create mode 100644 hw/arm/xlnx-versal-virt.c
  hw/arm/mps2-tz.c           |  4 ++--
  hw/core/reset.c            | 17 ++++++++++++++++-
  hw/hppa/machine.c          |  4 ++--
  hw/i386/microvm.c          |  4 ++--
  hw/i386/pc.c               |  6 +++---
  hw/ppc/pegasos2.c          |  4 ++--
  hw/ppc/pnv.c               |  4 ++--
  hw/ppc/spapr.c             |  4 ++--
  hw/s390x/s390-virtio-ccw.c |  4 ++--
  migration/savevm.c         |  2 +-
  softmmu/runstate.c         | 11 ++++++++---
 files changed, 54 insertions(+), 27 deletions(-)
-diff --git a/qapi/run-state.json b/qapi/run-state.json
+diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/run-state.json
+--- a/hw/arm/Makefile.objs
-+++ b/qapi/run-state.json
++++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
  obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 -obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
 +obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/xlnx-versal-virt.c
 @@ -XXX,XX +XXX,XX @@
- #                   ignores --no-reboot. This is useful for sanitizing
++/*
- #                   hypercalls on s390 that are used during kexec/kdump/boot
++ * Xilinx Versal Virtual board.
- #
++ *
-+# @snapshot-load: A snapshot is being loaded by the record & replay
++ * Copyright (c) 2018 Xilinx Inc.
-+#                 subsystem. This value is used only within QEMU.  It
++ * Written by Edgar E. Iglesias
-+#                 doesn't occur in QMP. (since 7.2)
++ *
-+#
++ * This program is free software; you can redistribute it and/or modify
- ##
++ * it under the terms of the GNU General Public License version 2 or
- { 'enum': 'ShutdownCause',
++ * (at your option) any later version.
-   # Beware, shutdown_caused_by_guest() depends on enumeration order
++ */
-   'data': [ 'none', 'host-error', 'host-qmp-quit', 'host-qmp-system-reset',
++
-             'host-signal', 'host-ui', 'guest-shutdown', 'guest-reset',
++#include "qemu/osdep.h"
--            'guest-panic', 'subsystem-reset'] }
++#include "qemu/log.h"
-+            'guest-panic', 'subsystem-reset', 'snapshot-load'] }
++#include "qemu/error-report.h"
++#include "qapi/error.h"
- ##
++#include "sysemu/device_tree.h"
- # @StatusInfo:
++#include "exec/address-spaces.h"
-diff --git a/include/hw/boards.h b/include/hw/boards.h
++#include "hw/boards.h"
-index XXXXXXX..XXXXXXX 100644
++#include "hw/sysbus.h"
---- a/include/hw/boards.h
++#include "hw/arm/sysbus-fdt.h"
-+++ b/include/hw/boards.h
++#include "hw/arm/fdt.h"
-@@ -XXX,XX +XXX,XX @@ struct MachineClass {
++#include "cpu.h"
-     const char *deprecation_reason;
++#include "hw/arm/xlnx-versal.h"
++
-     void (*init)(MachineState *state);
++#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
--    void (*reset)(MachineState *state);
++#define XLNX_VERSAL_VIRT_MACHINE(obj) \
-+    void (*reset)(MachineState *state, ShutdownCause reason);
++    OBJECT_CHECK(VersalVirt, (obj), TYPE_XLNX_VERSAL_VIRT_MACHINE)
-     void (*wakeup)(MachineState *state);
++
-     int (*kvm_type)(MachineState *machine, const char *arg);
++typedef struct VersalVirt {
++    MachineState parent_obj;
-diff --git a/include/sysemu/reset.h b/include/sysemu/reset.h
++
-index XXXXXXX..XXXXXXX 100644
++    Versal soc;
---- a/include/sysemu/reset.h
++    MemoryRegion mr_ddr;
-+++ b/include/sysemu/reset.h
++
-@@ -XXX,XX +XXX,XX @@
++    void *fdt;
- #ifndef QEMU_SYSEMU_RESET_H
++    int fdt_size;
- #define QEMU_SYSEMU_RESET_H
++    struct {
++        uint32_t gic;
-+#include "qapi/qapi-events-run-state.h"
++        uint32_t ethernet_phy[2];
-+
++        uint32_t clk_125Mhz;
- typedef void QEMUResetHandler(void *opaque);
++        uint32_t clk_25Mhz;
++    } phandle;
- void qemu_register_reset(QEMUResetHandler *func, void *opaque);
++    struct arm_boot_info binfo;
-+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque);
++
- void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
++    struct {
--void qemu_devices_reset(void);
++        bool secure;
-+void qemu_devices_reset(ShutdownCause reason);
++    } cfg;
++} VersalVirt;
- #endif
++
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
++static void fdt_create(VersalVirt *s)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/hw/arm/aspeed.c
++    MachineClass *mc = MACHINE_GET_CLASS(s);
-+++ b/hw/arm/aspeed.c
++    int i;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
++
-         aspeed_soc_num_cpus(amc->soc_name);
++    s->fdt = create_device_tree(&s->fdt_size);
- }
++    if (!s->fdt) {
++        error_report("create_device_tree() failed");
--static void fby35_reset(MachineState *state)
++        exit(1);
-+static void fby35_reset(MachineState *state, ShutdownCause reason)
++    }
- {
++
-     AspeedMachineState *bmc = ASPEED_MACHINE(state);
++    /* Allocate all phandles.  */
-     AspeedGPIOState *gpio = &bmc->soc.gpio;
++    s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
++    for (i = 0; i < ARRAY_SIZE(s->phandle.ethernet_phy); i++) {
--    qemu_devices_reset();
++        s->phandle.ethernet_phy[i] = qemu_fdt_alloc_phandle(s->fdt);
-+    qemu_devices_reset(reason);
++    }
++    s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
-     /* Board ID: 7 (Class-1, 4 slots) */
++    s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
-     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
++
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
++    /* Create /chosen node for load_dtb.  */
-index XXXXXXX..XXXXXXX 100644
++    qemu_fdt_add_subnode(s->fdt, "/chosen");
---- a/hw/arm/mps2-tz.c
++
-+++ b/hw/arm/mps2-tz.c
++    /* Header */
-@@ -XXX,XX +XXX,XX @@ static void mps2_set_remap(Object *obj, const char *value, Error **errp)
++    qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
-     }
++    qemu_fdt_setprop_cell(s->fdt, "/", "#size-cells", 0x2);
- }
++    qemu_fdt_setprop_cell(s->fdt, "/", "#address-cells", 0x2);
++    qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
--static void mps2_machine_reset(MachineState *machine)
++    qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
-+static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
++}
- {
++
-     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
++static void fdt_add_clk_node(VersalVirt *s, const char *name,
++                             unsigned int freq_hz, uint32_t phandle)
-@@ -XXX,XX +XXX,XX @@ static void mps2_machine_reset(MachineState *machine)
++{
-      * reset see the correct mapping.
++    qemu_fdt_add_subnode(s->fdt, name);
-      */
++    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
-     remap_memory(mms, mms->remap);
++    qemu_fdt_setprop_cell(s->fdt, name, "clock-frequency", freq_hz);
--    qemu_devices_reset();
++    qemu_fdt_setprop_cell(s->fdt, name, "#clock-cells", 0x0);
-+    qemu_devices_reset(reason);
++    qemu_fdt_setprop_string(s->fdt, name, "compatible", "fixed-clock");
- }
++    qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
++}
- static void mps2tz_class_init(ObjectClass *oc, void *data)
++
-diff --git a/hw/core/reset.c b/hw/core/reset.c
++static void fdt_add_cpu_nodes(VersalVirt *s, uint32_t psci_conduit)
-index XXXXXXX..XXXXXXX 100644
++{
---- a/hw/core/reset.c
++    int i;
-+++ b/hw/core/reset.c
++
-@@ -XXX,XX +XXX,XX @@ typedef struct QEMUResetEntry {
++    qemu_fdt_add_subnode(s->fdt, "/cpus");
-     QTAILQ_ENTRY(QEMUResetEntry) entry;
++    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#size-cells", 0x0);
-     QEMUResetHandler *func;
++    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#address-cells", 1);
-     void *opaque;
++
-+    bool skip_on_snapshot_load;
++    for (i = XLNX_VERSAL_NR_ACPUS - 1; i >= 0; i--) {
- } QEMUResetEntry;
++        char *name = g_strdup_printf("/cpus/cpu@%d", i);
++        ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
- static QTAILQ_HEAD(, QEMUResetEntry) reset_handlers =
++
-@@ -XXX,XX +XXX,XX @@ void qemu_register_reset(QEMUResetHandler *func, void *opaque)
++        qemu_fdt_add_subnode(s->fdt, name);
-     QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
++        qemu_fdt_setprop_cell(s->fdt, name, "reg", armcpu->mp_affinity);
- }
++        if (psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
++            qemu_fdt_setprop_string(s->fdt, name, "enable-method", "psci");
 +void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque)
 +{
 +    QEMUResetEntry *re = g_new0(QEMUResetEntry, 1);
 +
 +    re->func = func;
 +    re->opaque = opaque;
 +    re->skip_on_snapshot_load = true;
 +    QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
 +}
 +
  void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
  {
      QEMUResetEntry *re;
@@ -XXX,XX +XXX,XX @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
      }
  }
 -void qemu_devices_reset(void)
 +void qemu_devices_reset(ShutdownCause reason)
  {
      QEMUResetEntry *re, *nre;
      /* reset all devices */
      QTAILQ_FOREACH_SAFE(re, &reset_handlers, entry, nre) {
 +        if (reason == SHUTDOWN_CAUSE_SNAPSHOT_LOAD &&
 +            re->skip_on_snapshot_load) {
 +            continue;
 +        }
-         re->func(re->opaque);
++        qemu_fdt_setprop_string(s->fdt, name, "device_type", "cpu");
-     }
++        qemu_fdt_setprop_string(s->fdt, name, "compatible",
- }
++                                armcpu->dtb_compatible);
-diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
++        g_free(name);
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/hw/hppa/machine.c
++}
-+++ b/hw/hppa/machine.c
++
-@@ -XXX,XX +XXX,XX @@ static void machine_hppa_init(MachineState *machine)
++static void fdt_add_gic_nodes(VersalVirt *s)
-     cpu[0]->env.gr[19] = FW_CFG_IO_BASE;
++{
- }
++    char *nodename;
++
--static void hppa_machine_reset(MachineState *ms)
++    nodename = g_strdup_printf("/gic@%x", MM_GIC_APU_DIST_MAIN);
-+static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
++    qemu_fdt_add_subnode(s->fdt, nodename);
- {
++    qemu_fdt_setprop_cell(s->fdt, nodename, "phandle", s->phandle.gic);
-     unsigned int smp_cpus = ms->smp.cpus;
++    qemu_fdt_setprop_cells(s->fdt, nodename, "interrupts",
-     int i;
++                           GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
++                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
--    qemu_devices_reset();
++    qemu_fdt_setprop(s->fdt, nodename, "interrupt-controller", NULL, 0);
-+    qemu_devices_reset(reason);
++    qemu_fdt_setprop_sized_cells(s->fdt, nodename, "reg",
++                                 2, MM_GIC_APU_DIST_MAIN,
-     /* Start all CPUs at the firmware entry point.
++                                 2, MM_GIC_APU_DIST_MAIN_SIZE,
-      *  Monarch CPU will initialize firmware, secondary CPUs
++                                 2, MM_GIC_APU_REDIST_0,
-diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
++                                 2, MM_GIC_APU_REDIST_0_SIZE);
-index XXXXXXX..XXXXXXX 100644
++    qemu_fdt_setprop_cell(s->fdt, nodename, "#interrupt-cells", 3);
---- a/hw/i386/microvm.c
++    qemu_fdt_setprop_string(s->fdt, nodename, "compatible", "arm,gic-v3");
-+++ b/hw/i386/microvm.c
++}
-@@ -XXX,XX +XXX,XX @@ static void microvm_machine_state_init(MachineState *machine)
++
-     microvm_devices_init(mms);
++static void fdt_add_timer_nodes(VersalVirt *s)
- }
++{
++    const char compat[] = "arm,armv8-timer";
--static void microvm_machine_reset(MachineState *machine)
++    uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
-+static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
++
- {
++    qemu_fdt_add_subnode(s->fdt, "/timer");
-     MicrovmMachineState *mms = MICROVM_MACHINE(machine);
++    qemu_fdt_setprop_cells(s->fdt, "/timer", "interrupts",
-     CPUState *cs;
++            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ, irqflags,
-@@ -XXX,XX +XXX,XX @@ static void microvm_machine_reset(MachineState *machine)
++            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ, irqflags,
-         mms->kernel_cmdline_fixed = true;
++            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ, irqflags,
-     }
++            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ, irqflags);
++    qemu_fdt_setprop(s->fdt, "/timer", "compatible",
--    qemu_devices_reset();
++                     compat, sizeof(compat));
-+    qemu_devices_reset(reason);
++}
++
-     CPU_FOREACH(cs) {
++static void fdt_add_uart_nodes(VersalVirt *s)
-         cpu = X86_CPU(cs);
++{
-diff --git a/hw/i386/pc.c b/hw/i386/pc.c
++    uint64_t addrs[] = { MM_UART1, MM_UART0 };
-index XXXXXXX..XXXXXXX 100644
++    unsigned int irqs[] = { VERSAL_UART1_IRQ_0, VERSAL_UART0_IRQ_0 };
---- a/hw/i386/pc.c
++    const char compat[] = "arm,pl011\0arm,sbsa-uart";
-+++ b/hw/i386/pc.c
++    const char clocknames[] = "uartclk\0apb_pclk";
-@@ -XXX,XX +XXX,XX @@ static void pc_machine_initfn(Object *obj)
++    int i;
-     cxl_machine_init(obj, &pcms->cxl_devices_state);
++
- }
++    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
++        char *name = g_strdup_printf("/uart@%" PRIx64, addrs[i]);
--static void pc_machine_reset(MachineState *machine)
++        qemu_fdt_add_subnode(s->fdt, name);
-+static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
++        qemu_fdt_setprop_cell(s->fdt, name, "current-speed", 115200);
- {
++        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-     CPUState *cs;
++                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
-     X86CPU *cpu;
++        qemu_fdt_setprop(s->fdt, name, "clock-names",
++                         clocknames, sizeof(clocknames));
--    qemu_devices_reset();
++
-+    qemu_devices_reset(reason);
++        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
++                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-     /* Reset APIC after devices have been reset to cancel
++                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-      * any changes that qemu_devices_reset() might have done.
++        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-@@ -XXX,XX +XXX,XX @@ static void pc_machine_reset(MachineState *machine)
++                                     2, addrs[i], 2, 0x1000);
- static void pc_machine_wakeup(MachineState *machine)
++        qemu_fdt_setprop(s->fdt, name, "compatible",
- {
++                         compat, sizeof(compat));
-     cpu_synchronize_all_states();
++        qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
--    pc_machine_reset(machine);
++
-+    pc_machine_reset(machine, SHUTDOWN_CAUSE_NONE);
++        if (addrs[i] == MM_UART0) {
-     cpu_synchronize_all_post_reset();
++            /* Select UART0.  */
- }
++            qemu_fdt_setprop_string(s->fdt, "/chosen", "stdout-path", name);
++        }
-diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
++        g_free(name);
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/hw/ppc/pegasos2.c
++}
-+++ b/hw/ppc/pegasos2.c
++
-@@ -XXX,XX +XXX,XX @@ static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
++static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
-     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
++                                     uint32_t phandle)
- }
++{
++    char *name = g_strdup_printf("%s/fixed-link", gemname);
--static void pegasos2_machine_reset(MachineState *machine)
++
-+static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
++    qemu_fdt_add_subnode(s->fdt, name);
- {
++    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
-     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
++    qemu_fdt_setprop(s->fdt, name, "full-duplex", NULL, 0);
-     void *fdt;
++    qemu_fdt_setprop_cell(s->fdt, name, "speed", 1000);
-     uint64_t d[2];
++    g_free(name);
-     int sz;
++}
++
--    qemu_devices_reset();
++static void fdt_add_gem_nodes(VersalVirt *s)
-+    qemu_devices_reset(reason);
++{
-     if (!pm->vof) {
++    uint64_t addrs[] = { MM_GEM1, MM_GEM0 };
-         return; /* Firmware should set up machine so nothing to do */
++    unsigned int irqs[] = { VERSAL_GEM1_IRQ_0, VERSAL_GEM0_IRQ_0 };
-     }
++    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
-diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
++    const char compat_gem[] = "cdns,zynqmp-gem\0cdns,gem";
-index XXXXXXX..XXXXXXX 100644
++    int i;
---- a/hw/ppc/pnv.c
++
-+++ b/hw/ppc/pnv.c
++    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
-@@ -XXX,XX +XXX,XX @@ static void pnv_powerdown_notify(Notifier *n, void *opaque)
++        char *name = g_strdup_printf("/ethernet@%" PRIx64, addrs[i]);
-     }
++        qemu_fdt_add_subnode(s->fdt, name);
- }
++
++        fdt_add_fixed_link_nodes(s, name, s->phandle.ethernet_phy[i]);
--static void pnv_reset(MachineState *machine)
++        qemu_fdt_setprop_string(s->fdt, name, "phy-mode", "rgmii-id");
-+static void pnv_reset(MachineState *machine, ShutdownCause reason)
++        qemu_fdt_setprop_cell(s->fdt, name, "phy-handle",
- {
++                              s->phandle.ethernet_phy[i]);
-     PnvMachineState *pnv = PNV_MACHINE(machine);
++        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-     IPMIBmc *bmc;
++                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz,
-     void *fdt;
++                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
++        qemu_fdt_setprop(s->fdt, name, "clock-names",
--    qemu_devices_reset();
++                         clocknames, sizeof(clocknames));
-+    qemu_devices_reset(reason);
++        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
++                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-     /*
++                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-      * The machine should provide by default an internal BMC simulator.
++                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
++                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-index XXXXXXX..XXXXXXX 100644
++        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
---- a/hw/ppc/spapr.c
++                                     2, addrs[i], 2, 0x1000);
-+++ b/hw/ppc/spapr.c
++        qemu_fdt_setprop(s->fdt, name, "compatible",
-@@ -XXX,XX +XXX,XX @@ void spapr_check_mmu_mode(bool guest_radix)
++                         compat_gem, sizeof(compat_gem));
-     }
++        qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 1);
- }
++        qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 0);
++        g_free(name);
--static void spapr_machine_reset(MachineState *machine)
++    }
-+static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
++}
- {
++
-     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
++static void fdt_nop_memory_nodes(void *fdt, Error **errp)
-     PowerPCCPU *first_ppc_cpu;
++{
-@@ -XXX,XX +XXX,XX @@ static void spapr_machine_reset(MachineState *machine)
++    Error *err = NULL;
-         spapr_setup_hpt(spapr);
++    char **node_path;
-     }
++    int n = 0;
++
--    qemu_devices_reset();
++    node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
-+    qemu_devices_reset(reason);
++    if (err) {
++        error_propagate(errp, err);
-     spapr_ovec_cleanup(spapr->ov5_cas);
++        return;
-     spapr->ov5_cas = spapr_ovec_new();
++    }
-diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
++    while (node_path[n]) {
-index XXXXXXX..XXXXXXX 100644
++        if (g_str_has_prefix(node_path[n], "/memory")) {
---- a/hw/s390x/s390-virtio-ccw.c
++            qemu_fdt_nop_node(fdt, node_path[n]);
-+++ b/hw/s390x/s390-virtio-ccw.c
++        }
-@@ -XXX,XX +XXX,XX @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
++        n++;
-     s390_pv_prep_reset();
++    }
- }
++    g_strfreev(node_path);
++}
--static void s390_machine_reset(MachineState *machine)
++
-+static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
++static void fdt_add_memory_nodes(VersalVirt *s, void *fdt, uint64_t ram_size)
- {
++{
-     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
++    /* Describes the various split DDR access regions.  */
-     enum s390_reset reset_type;
++    static const struct {
-@@ -XXX,XX +XXX,XX @@ static void s390_machine_reset(MachineState *machine)
++        uint64_t base;
-             s390_machine_unprotect(ms);
++        uint64_t size;
-         }
++    } addr_ranges[] = {
++        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
--        qemu_devices_reset();
++        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
-+        qemu_devices_reset(reason);
++        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
-         s390_crypto_reset();
++        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
++    };
-         /* configure and start the ipl CPU only */
++    uint64_t mem_reg_prop[8] = {0};
-diff --git a/migration/savevm.c b/migration/savevm.c
++    uint64_t size = ram_size;
-index XXXXXXX..XXXXXXX 100644
++    Error *err = NULL;
---- a/migration/savevm.c
++    char *name;
-+++ b/migration/savevm.c
++    int i;
-@@ -XXX,XX +XXX,XX @@ bool load_snapshot(const char *name, const char *vmstate,
++
-         goto err_drain;
++    fdt_nop_memory_nodes(fdt, &err);
-     }
++    if (err) {
++        error_report_err(err);
--    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
++        return;
-+    qemu_system_reset(SHUTDOWN_CAUSE_SNAPSHOT_LOAD);
++    }
-     mis->from_src_file = f;
++
++    name = g_strdup_printf("/memory@%x", MM_TOP_DDR);
-     if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
++    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
-diff --git a/softmmu/runstate.c b/softmmu/runstate.c
++        uint64_t mapsize;
-index XXXXXXX..XXXXXXX 100644
++
---- a/softmmu/runstate.c
++        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
-+++ b/softmmu/runstate.c
++
-@@ -XXX,XX +XXX,XX @@ void qemu_system_reset(ShutdownCause reason)
++        mem_reg_prop[i * 2] = addr_ranges[i].base;
-     cpu_synchronize_all_states();
++        mem_reg_prop[i * 2 + 1] = mapsize;
++        size -= mapsize;
-     if (mc && mc->reset) {
++    }
--        mc->reset(current_machine);
++    qemu_fdt_add_subnode(fdt, name);
-+        mc->reset(current_machine, reason);
++    qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
-     } else {
++
--        qemu_devices_reset();
++    switch (i) {
-+        qemu_devices_reset(reason);
++    case 1:
-     }
++        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
--    if (reason && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
++                                     2, mem_reg_prop[0],
-+    switch (reason) {
++                                     2, mem_reg_prop[1]);
-+    case SHUTDOWN_CAUSE_NONE:
++        break;
-+    case SHUTDOWN_CAUSE_SUBSYSTEM_RESET:
++    case 2:
-+    case SHUTDOWN_CAUSE_SNAPSHOT_LOAD:
++        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3]);
 +        break;
 +    case 3:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3],
 +                                     2, mem_reg_prop[4],
 +                                     2, mem_reg_prop[5]);
 +        break;
 +    case 4:
 +        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
 +                                     2, mem_reg_prop[0],
 +                                     2, mem_reg_prop[1],
 +                                     2, mem_reg_prop[2],
 +                                     2, mem_reg_prop[3],
 +                                     2, mem_reg_prop[4],
 +                                     2, mem_reg_prop[5],
 +                                     2, mem_reg_prop[6],
 +                                     2, mem_reg_prop[7]);
 +        break;
 +    default:
-         qapi_event_send_reset(shutdown_caused_by_guest(reason), reason);
++        g_assert_not_reached();
-     }
++    }
-     cpu_synchronize_all_post_reset();
++    g_free(name);
 +}
 +
 +static void versal_virt_modify_dtb(const struct arm_boot_info *binfo,
 +                                    void *fdt)
 +{
 +    VersalVirt *s = container_of(binfo, VersalVirt, binfo);
 +
 +    fdt_add_memory_nodes(s, fdt, binfo->ram_size);
 +}
 +
 +static void *versal_virt_get_dtb(const struct arm_boot_info *binfo,
 +                                  int *fdt_size)
 +{
 +    const VersalVirt *board = container_of(binfo, VersalVirt, binfo);
 +
 +    *fdt_size = board->fdt_size;
 +    return board->fdt;
 +}
 +
 +#define NUM_VIRTIO_TRANSPORT 32
 +static void create_virtio_regions(VersalVirt *s)
 +{
 +    int virtio_mmio_size = 0x200;
 +    int i;
 +
 +    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
 +        char *name = g_strdup_printf("virtio%d", i);;
 +        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
 +        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
 +        MemoryRegion *mr;
 +        DeviceState *dev;
 +        qemu_irq pic_irq;
 +
 +        pic_irq = qdev_get_gpio_in(DEVICE(&s->soc.fpd.apu.gic), irq);
 +        dev = qdev_create(NULL, "virtio-mmio");
 +        object_property_add_child(OBJECT(&s->soc), name, OBJECT(dev),
 +                                  &error_fatal);
 +        qdev_init_nofail(dev);
 +        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic_irq);
 +        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
 +        memory_region_add_subregion(&s->soc.mr_ps, base, mr);
 +        sysbus_create_simple("virtio-mmio", base, pic_irq);
 +    }
 +
 +    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
 +        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
 +        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
 +        char *name = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
 +
 +        qemu_fdt_add_subnode(s->fdt, name);
 +        qemu_fdt_setprop(s->fdt, name, "dma-coherent", NULL, 0);
 +        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
 +                               GIC_FDT_IRQ_TYPE_SPI, irq,
 +                               GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
 +        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
 +                                     2, base, 2, virtio_mmio_size);
 +        qemu_fdt_setprop_string(s->fdt, name, "compatible", "virtio,mmio");
 +        g_free(name);
 +    }
 +}
 +
 +static void versal_virt_init(MachineState *machine)
 +{
 +    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
 +    int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
 +
 +    /*
 +     * If the user provides an Operating System to be loaded, we expect them
 +     * to use the -kernel command line option.
 +     *
 +     * Users can load firmware or boot-loaders with the -device loader options.
 +     *
 +     * When loading an OS, we generate a dtb and let arm_load_kernel() select
 +     * where it gets loaded. This dtb will be passed to the kernel in x0.
 +     *
 +     * If there's no -kernel option, we generate a DTB and place it at 0x1000
 +     * for the bootloaders or firmware to pick up.
 +     *
 +     * If users want to provide their own DTB, they can use the -dtb option.
 +     * These dtb's will have their memory nodes modified to match QEMU's
 +     * selected ram_size option before they get passed to the kernel or fw.
 +     *
 +     * When loading an OS, we turn on QEMU's PSCI implementation with SMC
 +     * as the PSCI conduit. When there's no -kernel, we assume the user
 +     * provides EL3 firmware to handle PSCI.
 +     */
 +    if (machine->kernel_filename) {
 +        psci_conduit = QEMU_PSCI_CONDUIT_SMC;
 +    }
 +
 +    memory_region_allocate_system_memory(&s->mr_ddr, NULL, "ddr",
 +                                         machine->ram_size);
 +
 +    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
 +                          sizeof(s->soc), TYPE_XLNX_VERSAL);
 +    object_property_set_link(OBJECT(&s->soc), OBJECT(&s->mr_ddr),
 +                             "ddr", &error_abort);
 +    object_property_set_int(OBJECT(&s->soc), psci_conduit,
 +                            "psci-conduit", &error_abort);
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 +
 +    fdt_create(s);
 +    create_virtio_regions(s);
 +    fdt_add_gem_nodes(s);
 +    fdt_add_uart_nodes(s);
 +    fdt_add_gic_nodes(s);
 +    fdt_add_timer_nodes(s);
 +    fdt_add_cpu_nodes(s, psci_conduit);
 +    fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
 +    fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
 +
 +    /* Make the APU cpu address space visible to virtio and other
 +     * modules unaware of muliple address-spaces.  */
 +    memory_region_add_subregion_overlap(get_system_memory(),
 +                                        0, &s->soc.fpd.apu.mr, 0);
 +
 +    s->binfo.ram_size = machine->ram_size;
 +    s->binfo.kernel_filename = machine->kernel_filename;
 +    s->binfo.kernel_cmdline = machine->kernel_cmdline;
 +    s->binfo.initrd_filename = machine->initrd_filename;
 +    s->binfo.loader_start = 0x0;
 +    s->binfo.get_dtb = versal_virt_get_dtb;
 +    s->binfo.modify_dtb = versal_virt_modify_dtb;
 +    if (machine->kernel_filename) {
 +        arm_load_kernel(s->soc.fpd.apu.cpu[0], &s->binfo);
 +    } else {
 +        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
 +                                                  &s->binfo);
 +        /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
 +         * Offset things by 4K.  */
 +        s->binfo.loader_start = 0x1000;
 +        s->binfo.dtb_limit = 0x1000000;
 +        if (arm_load_dtb(s->binfo.loader_start,
 +                         &s->binfo, s->binfo.dtb_limit, as) < 0) {
 +            exit(EXIT_FAILURE);
 +        }
 +    }
 +}
 +
 +static void versal_virt_machine_instance_init(Object *obj)
 +{
 +}
 +
 +static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
 +    mc->desc = "Xilinx Versal Virtual development board";
 +    mc->init = versal_virt_init;
 +    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
 +    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
 +    mc->no_cdrom = true;
 +}
 +
 +static const TypeInfo versal_virt_machine_init_typeinfo = {
 +    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
 +    .parent     = TYPE_MACHINE,
 +    .class_init = versal_virt_machine_class_init,
 +    .instance_init = versal_virt_machine_instance_init,
 +    .instance_size = sizeof(VersalVirt),
 +};
 +
 +static void versal_virt_machine_init_register_types(void)
 +{
 +    type_register_static(&versal_virt_machine_init_typeinfo);
 +}
 +
 +type_init(versal_virt_machine_init_register_types)
 +
 --
-.25.1
+.19.1

-[PULL 22/30] device-tree: add re-randomization helper function
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-When the system reboots, the rng-seed that the FDT has should be
-re-randomized, so that the new boot gets a new seed. Several
-architectures require this functionality, so export a function for
-injecting a new seed into the given FDT.
-Cc: Alistair Francis <alistair.francis@wdc.com>
-Cc: David Gibson <david@gibson.dropbear.id.au>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20221025004327.568476-3-Jason@zx2c4.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/sysemu/device_tree.h |  9 +++++++++
- softmmu/device_tree.c        | 21 +++++++++++++++++++++
-files changed, 30 insertions(+)
-diff --git a/include/sysemu/device_tree.h b/include/sysemu/device_tree.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/device_tree.h
-+++ b/include/sysemu/device_tree.h
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_setprop_sized_cells_from_array(void *fdt,
-                                                 qdt_tmp);                 \
-     })
-+
-+/**
-+ * qemu_fdt_randomize_seeds:
-+ * @fdt: device tree blob
-+ *
-+ * Re-randomize all "rng-seed" properties with new seeds.
-+ */
-+void qemu_fdt_randomize_seeds(void *fdt);
-+
- #define FDT_PCI_RANGE_RELOCATABLE          0x80000000
- #define FDT_PCI_RANGE_PREFETCHABLE         0x40000000
- #define FDT_PCI_RANGE_ALIASED              0x20000000
-diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/device_tree.c
-+++ b/softmmu/device_tree.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/option.h"
- #include "qemu/bswap.h"
- #include "qemu/cutils.h"
-+#include "qemu/guest-random.h"
- #include "sysemu/device_tree.h"
- #include "hw/loader.h"
- #include "hw/boards.h"
-@@ -XXX,XX +XXX,XX @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
-     info_report("dtb dumped to %s", filename);
- }
-+
-+void qemu_fdt_randomize_seeds(void *fdt)
-+{
-+    int noffset, poffset, len;
-+    const char *name;
-+    uint8_t *data;
-+
-+    for (noffset = fdt_next_node(fdt, 0, NULL);
-+         noffset >= 0;
-+         noffset = fdt_next_node(fdt, noffset, NULL)) {
-+        for (poffset = fdt_first_property_offset(fdt, noffset);
-+             poffset >= 0;
-+             poffset = fdt_next_property_offset(fdt, poffset)) {
-+            data = (uint8_t *)fdt_getprop_by_offset(fdt, poffset, &name, &len);
-+            if (!data || strcmp(name, "rng-seed"))
-+                continue;
-+            qemu_guest_getrandom_nofail(data, len);
-+        }
-+    }
-+}
---
-.25.1

-[PULL 23/30] x86: do not re-randomize RNG seed on snapshot load
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Snapshot loading is supposed to be deterministic, so we shouldn't
-re-randomize the various seeds used.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Message-id: 20221025004327.568476-4-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/i386/x86.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/i386/x86.c b/hw/i386/x86.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/x86.c
-+++ b/hw/i386/x86.c
-@@ -XXX,XX +XXX,XX @@ void x86_load_linux(X86MachineState *x86ms,
-         setup_data->type = cpu_to_le32(SETUP_RNG_SEED);
-         setup_data->len = cpu_to_le32(RNG_SEED_LENGTH);
-         qemu_guest_getrandom_nofail(setup_data->data, RNG_SEED_LENGTH);
--        qemu_register_reset(reset_rng_seed, setup_data);
-+        qemu_register_reset_nosnapshotload(reset_rng_seed, setup_data);
-         fw_cfg_add_bytes_callback(fw_cfg, FW_CFG_KERNEL_DATA, reset_rng_seed, NULL,
-                                   setup_data, kernel, kernel_size, true);
-     } else {
---
-.25.1

-[PULL 25/30] riscv: re-randomize rng-seed on reboot
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-When the system reboots, the rng-seed that the FDT has should be
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
-the ROM region at this point, we add a hook right after the ROM has been
-added, so that we have a pointer to that copy of the FDT.
-Cc: Palmer Dabbelt <palmer@dabbelt.com>
-Cc: Alistair Francis <alistair.francis@wdc.com>
-Cc: Bin Meng <bin.meng@windriver.com>
-Cc: qemu-riscv@nongnu.org
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20221025004327.568476-6-Jason@zx2c4.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/riscv/boot.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/riscv/boot.c
-+++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/device_tree.h"
- #include "sysemu/qtest.h"
- #include "sysemu/kvm.h"
-+#include "sysemu/reset.h"
- #include <libfdt.h>
-@@ -XXX,XX +XXX,XX @@ uint64_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
-     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
-                           &address_space_memory);
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
-+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
-     return fdt_addr;
- }
---
-.25.1

-[PULL 26/30] m68k/virt: do not re-randomize RNG seed on snapshot load
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Snapshot loading is supposed to be deterministic, so we shouldn't
-re-randomize the various seeds used.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Message-id: 20221025004327.568476-7-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/m68k/virt.c | 20 +++++++++++---------
-file changed, 11 insertions(+), 9 deletions(-)
-diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/virt.c
-+++ b/hw/m68k/virt.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     M68kCPU *cpu;
-     hwaddr initial_pc;
-     hwaddr initial_stack;
--    struct bi_record *rng_seed;
- } ResetInfo;
- static void main_cpu_reset(void *opaque)
-@@ -XXX,XX +XXX,XX @@ static void main_cpu_reset(void *opaque)
-     M68kCPU *cpu = reset_info->cpu;
-     CPUState *cs = CPU(cpu);
--    if (reset_info->rng_seed) {
--        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
--            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
--    }
--
-     cpu_reset(cs);
-     cpu->env.aregs[7] = reset_info->initial_stack;
-     cpu->env.pc = reset_info->initial_pc;
- }
-+static void rerandomize_rng_seed(void *opaque)
-+{
-+    struct bi_record *rng_seed = opaque;
-+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
-+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
-+}
-+
- static void virt_init(MachineState *machine)
- {
-     M68kCPU *cpu = NULL;
-@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
-         BOOTINFO0(param_ptr, BI_LAST);
-         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
-                               parameters_base, cs->as);
--        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
--                                              param_ptr - param_blob) +
--                               (param_rng_seed - param_blob);
-+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
-+                            rom_ptr_for_as(cs->as, parameters_base,
-+                                           param_ptr - param_blob) +
-+                            (param_rng_seed - param_blob));
-         g_free(param_blob);
-     }
- }
---
-.25.1

-[PULL 27/30] m68k/q800: do not re-randomize RNG seed on snapshot load
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-Snapshot loading is supposed to be deterministic, so we shouldn't
-re-randomize the various seeds used.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Message-id: 20221025004327.568476-8-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/m68k/q800.c | 33 +++++++++++++--------------------
-file changed, 13 insertions(+), 20 deletions(-)
-diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/q800.c
-+++ b/hw/m68k/q800.c
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo glue_info = {
-     },
- };
--typedef struct {
--    M68kCPU *cpu;
--    struct bi_record *rng_seed;
--} ResetInfo;
--
- static void main_cpu_reset(void *opaque)
- {
--    ResetInfo *reset_info = opaque;
--    M68kCPU *cpu = reset_info->cpu;
-+    M68kCPU *cpu = opaque;
-     CPUState *cs = CPU(cpu);
--    if (reset_info->rng_seed) {
--        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
--            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
--    }
--
-     cpu_reset(cs);
-     cpu->env.aregs[7] = ldl_phys(cs->as, 0);
-     cpu->env.pc = ldl_phys(cs->as, 4);
- }
-+static void rerandomize_rng_seed(void *opaque)
-+{
-+    struct bi_record *rng_seed = opaque;
-+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
-+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
-+}
-+
- static uint8_t fake_mac_rom[] = {
-, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
-     NubusBus *nubus;
-     DeviceState *glue;
-     DriveInfo *dinfo;
--    ResetInfo *reset_info;
-     uint8_t rng_seed[32];
-     linux_boot = (kernel_filename != NULL);
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
-         exit(1);
-     }
--    reset_info = g_new0(ResetInfo, 1);
--
-     /* init CPUs */
-     cpu = M68K_CPU(cpu_create(machine->cpu_type));
--    reset_info->cpu = cpu;
--    qemu_register_reset(main_cpu_reset, reset_info);
-+    qemu_register_reset(main_cpu_reset, cpu);
-     /* RAM */
-     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
-         BOOTINFO0(param_ptr, BI_LAST);
-         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
-                               parameters_base, cs->as);
--        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
--                                              param_ptr - param_blob) +
--                               (param_rng_seed - param_blob);
-+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
-+                            rom_ptr_for_as(cs->as, parameters_base,
-+                                           param_ptr - param_blob) +
-+                            (param_rng_seed - param_blob));
-         g_free(param_blob);
-     } else {
-         uint8_t *ptr;
---
-.25.1

-[PULL 29/30] openrisc: re-randomize rng-seed on reboot
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-When the system reboots, the rng-seed that the FDT has should be
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
-the ROM region at this point, we add a hook right after the ROM has been
-added, so that we have a pointer to that copy of the FDT.
-Cc: Stafford Horne <shorne@gmail.com>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Message-id: 20221025004327.568476-11-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/openrisc/boot.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/openrisc/boot.c
-+++ b/hw/openrisc/boot.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/openrisc/boot.h"
- #include "sysemu/device_tree.h"
- #include "sysemu/qtest.h"
-+#include "sysemu/reset.h"
- #include <libfdt.h>
-@@ -XXX,XX +XXX,XX @@ uint32_t openrisc_load_fdt(void *fdt, hwaddr load_start,
-     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
-                           &address_space_memory);
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
-+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
-     return fdt_addr;
- }
---
-.25.1

-[PULL 30/30] rx: re-randomize rng-seed on reboot
+Deleted patch
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-When the system reboots, the rng-seed that the FDT has should be
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
-the ROM region at this point, we add a hook right after the ROM has been
-added, so that we have a pointer to that copy of the FDT.
-Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
-Message-id: 20221025004327.568476-12-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/rx/rx-gdbsim.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/rx/rx-gdbsim.c
-+++ b/hw/rx/rx-gdbsim.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/rx/rx62n.h"
- #include "sysemu/qtest.h"
- #include "sysemu/device_tree.h"
-+#include "sysemu/reset.h"
- #include "hw/boards.h"
- #include "qom/object.h"
-@@ -XXX,XX +XXX,XX @@ static void rx_gdbsim_init(MachineState *machine)
-             dtb_offset = ROUND_DOWN(machine->ram_size - dtb_size, 16);
-             rom_add_blob_fixed("dtb", dtb, dtb_size,
-                                SDRAM_BASE + dtb_offset);
-+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
-+                                rom_ptr(SDRAM_BASE + dtb_offset, dtb_size));
-             /* Set dtb address to R1 */
-             RX_CPU(first_cpu)->env.regs[1] = SDRAM_BASE + dtb_offset;
-         }
---
-.25.1

Hi; this is the latest target-arm queue. Most of the patches
here are RTH's FEAT_HAFDBS finally landing. I've also included
the RNG-seed randomization patches from Jason, as well as a few
more minor things. The patches include a couple of regression
fixes:
 * the resettable patch fixes a SCSI reset regression
 * the 'do not re-randomize on snapshot load' patches fix
   record-and-replay regressions

thanks
-- PMM

The following changes since commit e750a7ace492f0b450653d4ad368a77d6f660fb8:

Merge tag 'pull-9p-20221024' of https://github.com/cschoenebeck/qemu into staging (2022-10-24 14:27:12 -0400)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221025

for you to fetch changes up to e2114f701c78f76246e4b1872639dad94a6bdd21:

rx: re-randomize rng-seed on reboot (2022-10-25 17:32:24 +0100)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_E0PD
 * Implement FEAT_HAFDBS
 * honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
 * hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
 * hw/core/resettable: fix reset level counting
 * hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
 * imx: reload cmp timer outside of the reload ptimer transaction
 * x86: do not re-randomize RNG seed on snapshot load
 * m68k/virt: do not re-randomize RNG seed on snapshot load
 * m68k/q800: do not re-randomize RNG seed on snapshot load
 * arm: re-randomize rng-seed on reboot
 * riscv: re-randomize rng-seed on reboot
 * mips/boston: re-randomize rng-seed on reboot
 * openrisc: re-randomize rng-seed on reboot
 * rx: re-randomize rng-seed on reboot

----------------------------------------------------------------
Ake Koomsin (1):
      target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()

Axel Heider (1):
      target/imx: reload cmp timer outside of the reload ptimer transaction

Damien Hedde (1):
      hw/core/resettable: fix reset level counting

Jason A. Donenfeld (10):
      reset: allow registering handlers that aren't called by snapshot loading
      device-tree: add re-randomization helper function
      x86: do not re-randomize RNG seed on snapshot load
      arm: re-randomize rng-seed on reboot
      riscv: re-randomize rng-seed on reboot
      m68k/virt: do not re-randomize RNG seed on snapshot load
      m68k/q800: do not re-randomize RNG seed on snapshot load
      mips/boston: re-randomize rng-seed on reboot
      openrisc: re-randomize rng-seed on reboot
      rx: re-randomize rng-seed on reboot

Jean-Philippe Brucker (1):
      hw/arm/virt: Fix devicetree warnings about the virtio-iommu node

Peter Maydell (2):
      target/arm: Implement FEAT_E0PD
      hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()

Richard Henderson (14):
      target/arm: Introduce regime_is_stage2
      target/arm: Add ptw_idx to S1Translate
      target/arm: Add isar predicates for FEAT_HAFDBS
      target/arm: Extract HA and HD in aa64_va_parameters
      target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
      target/arm: Add ARMFault_UnsuppAtomicUpdate
      target/arm: Remove loop from get_phys_addr_lpae
      target/arm: Fix fault reporting in get_phys_addr_lpae
      target/arm: Don't shift attrs in get_phys_addr_lpae
      target/arm: Consider GP an attribute in get_phys_addr_lpae
      target/arm: Tidy merging of attributes from descriptor and table
      target/arm: Implement FEAT_HAFDBS, access flag portion
      target/arm: Implement FEAT_HAFDBS, dirty bit portion
      target/arm: Use the max page size in a 2-stage ptw

FEAT_E0PD adds new bits E0PD0 and E0PD1 to TCR_EL1, which allow the
OS to forbid EL0 access to half of the address space.  Since this is
an EL0-specific variation on the existing TCR_ELx.{EPD0,EPD1}, we can
implement it entirely in aa64_va_parameters().

This requires moving the existing regime_is_user() to internals.h
so that the code in helper.c can get at it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221021160131.3531787-1-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpu.h              |  5 +++++
 target/arm/internals.h        | 19 +++++++++++++++++++
 target/arm/cpu64.c            |  1 +
 target/arm/helper.c           |  9 +++++++++
 target/arm/ptw.c              | 19 -------------------
 6 files changed, 35 insertions(+), 19 deletions(-)

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

The "PCI Bus Binding to: IEEE Std 1275-1994" defines the compatible
string for a PCIe bus or endpoint as "pci<vendorid>,<deviceid>" or
similar. Since the initial binding for PCI virtio-iommu didn't follow
this rule, it was modified to accept both strings and ensure backward
compatibility. Also, the unit-name for the node should be
"device,function".

Fix corresponding dt-validate and dtc warnings:

pcie@10000000: virtio_iommu@16:compatible: ['virtio,pci-iommu'] does not contain items matching the given schema
  pcie@10000000: Unevaluated properties are not allowed (... 'virtio_iommu@16' were unexpected)
  From schema: linux/Documentation/devicetree/bindings/pci/host-generic-pci.yaml
  virtio_iommu@16: compatible: 'oneOf' conditional failed, one must be fixed:
        ['virtio,pci-iommu'] is too short
        'pci1af4,1057' was expected
  From schema: dtschema/schemas/pci/pci-bus.yaml

Warning (pci_device_reg): /pcie@10000000/virtio_iommu@16: PCI unit address format error, expected "2,0"

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_smmu(const VirtMachineState *vms,
 
 static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)
 {
-    const char compat[] = "virtio,pci-iommu";
+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
     uint16_t bdf = vms->virtio_iommu_bdf;
     MachineState *ms = MACHINE(vms);
     char *node;
 
     vms->iommu_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 
-    node = g_strdup_printf("%s/virtio_iommu@%d", vms->pciehb_nodename, bdf);
+    node = g_strdup_printf("%s/virtio_iommu@%x,%x", vms->pciehb_nodename,
+                           PCI_SLOT(bdf), PCI_FUNC(bdf));
     qemu_fdt_add_subnode(ms->fdt, node);
     qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
     qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg",
-- 
2.25.1

From: Ake Koomsin <ake@igel.co.jp>

An exception targeting EL2 from lower EL is actually maskable when
HCR_E2H and HCR_TGE are both set. This applies to both secure and
non-secure Security state.

We can remove the conditions that try to suppress masking of
interrupts when we are Secure and the exception targets EL2 and
Secure EL2 is disabled.  This is OK because in that situation
arm_phys_excp_target_el() will never return 2 as the target EL.  The
'not if secure' check in this function was originally written before
arm_hcr_el2_eff(), and back then the target EL returned by
arm_phys_excp_target_el() could be 2 even if we were in Secure
EL0/EL1; but it is no longer needed.

Signed-off-by: Ake Koomsin <ake@igel.co.jp>
Message-id: 20221017092432.546881-1-ake@igel.co.jp
[PMM: Add commit message paragraph explaining why it's OK to
 remove the checks on secure and SCR_EEL2]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
     if ((target_el > cur_el) && (target_el != 1)) {
         /* Exceptions targeting a higher EL may not be maskable */
         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
-            /*
-             * 64-bit masking rules are simple: exceptions to EL3
-             * can't be masked, and exceptions to EL2 can only be
-             * masked from Secure state. The HCR and SCR settings
-             * don't affect the masking logic, only the interrupt routing.
-             */
-            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
+            switch (target_el) {
+            case 2:
+                /*
+                 * According to ARM DDI 0487H.a, an interrupt can be masked
+                 * when HCR_E2H and HCR_TGE are both set regardless of the
+                 * current Security state. Note that we need to revisit this
+                 * part again once we need to support NMI.
+                 */
+                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+                        unmasked = true;
+                }
+                break;
+            case 3:
+                /* Interrupt cannot be masked when the target EL is 3 */
                 unmasked = true;
+                break;
+            default:
+                g_assert_not_reached();
             }
         } else {
             /*
-- 
2.25.1

From: Damien Hedde <damien.hedde@greensocs.com>

The code for handling the reset level count in the Resettable code
has two issues:

The reset count is only decremented for the 1->0 case.  This means
that if there's ever a nested reset that takes the count to 2 then it
will never again be decremented.  Eventually the count will exceed
the '50' limit in resettable_phase_enter() and QEMU will trip over
the assertion failure.  The repro case in issue 1266 is an example of
this that happens now the SCSI subsystem uses three-phase reset.

Secondly, the count is decremented only after the exit phase handler
is called.  Moving the reset count decrement from "just after" to
"just before" calling the exit phase handler allows
resettable_is_in_reset() to return false during the handler
execution.

This simplifies reset handling in resettable devices.  Typically, a
function that updates the device state will just need to read the
current reset state and not anymore treat the "in a reset-exit
transition" as a special case.

Note that the semantics change to the *_is_in_reset() functions
will have no effect on the current codebase, because only two
devices (hw/char/cadence_uart.c and hw/misc/zynq_sclr.c) currently
call those functions, and in neither case do they do it from the
device's exit phase methed.

Fixes: 4a5fc890 ("scsi: Use device_cold_reset() and bus_cold_reset()")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1266
Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20221020142749.3357951-1-peter.maydell@linaro.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1905297
Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
[PMM: adjust the docs paragraph changed to get the name of the
 'enter' phase right and to clarify exactly when the count is
 adjusted; rewrite the commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/devel/reset.rst | 8 +++++---
 hw/core/resettable.c | 3 +--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/reset.rst
+++ b/docs/devel/reset.rst
@@ -XXX,XX +XXX,XX @@ Polling the reset state
 Resettable interface provides the ``resettable_is_in_reset()`` function.
 This function returns true if the object parameter is currently under reset.
 
-An object is under reset from the beginning of the *init* phase to the end of
-the *exit* phase. During all three phases, the function will return that the
-object is in reset.
+An object is under reset from the beginning of the *enter* phase (before
+either its children or its own enter method is called) to the *exit*
+phase. During *enter* and *hold* phase only, the function will return that the
+object is in reset. The state is changed after the *exit* is propagated to
+its children and just before calling the object's own *exit* method.
 
 This function may be used if the object behavior has to be adapted
 while in reset state. For example if a device has an irq input,
diff --git a/hw/core/resettable.c b/hw/core/resettable.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/resettable.c
+++ b/hw/core/resettable.c
@@ -XXX,XX +XXX,XX @@ static void resettable_phase_exit(Object *obj, void *opaque, ResetType type)
     resettable_child_foreach(rc, obj, resettable_phase_exit, NULL, type);
 
     assert(s->count > 0);
-    if (s->count == 1) {
+    if (--s->count == 0) {
         trace_resettable_phase_exit_exec(obj, obj_typename, !!rc->phases.exit);
         if (rc->phases.exit && !resettable_get_tr_func(rc, obj)) {
             rc->phases.exit(obj);
         }
-        s->count = 0;
     }
     s->exit_phase_in_progress = false;
     trace_resettable_phase_exit_end(obj, obj_typename, s->count);
-- 
2.25.1

The semantic difference between the deprecated device_legacy_reset()
function and the newer device_cold_reset() function is that the new
function resets both the device itself and any qbuses it owns,
whereas the legacy function resets just the device itself and nothing
else.  In hyperv_synic_reset() we reset a SynICState, which has no
qbuses, so for this purpose the two functions behave identically and
we can stop using the deprecated one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-id: 20221013171817.1447562-1-peter.maydell@linaro.org
---
 hw/hyperv/hyperv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -XXX,XX +XXX,XX @@ void hyperv_synic_reset(CPUState *cs)
     SynICState *synic = get_synic(cs);
 
     if (synic) {
-        device_legacy_reset(DEVICE(synic));
+        device_cold_reset(DEVICE(synic));
     }
 }
 
-- 
2.25.1

From: Axel Heider <axel.heider@hensoldt.net>

When running seL4 tests (https://docs.sel4.systems/projects/sel4test)
on the sabrelight platform, the timer tests fail. The arm/imx6 EPIT
timer interrupt does not fire properly, instead of a e.g. second in
can take up to a minute to finally see the interrupt.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1263

Signed-off-by: Axel Heider <axel.heider@hensoldt.net>
Message-id: 166663118138.13362.1229967229046092876-0@git.sr.ht
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/imx_epit.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
             /* If IOVW bit is set then set the timer value */
             ptimer_set_count(s->timer_reload, s->lr);
         }
-
+        /*
+         * Commit the change to s->timer_reload, so it can propagate. Otherwise
+         * the timer interrupt may not fire properly. The commit must happen
+         * before calling imx_epit_reload_compare_timer(), which reads
+         * s->timer_reload internally again.
+         */
+        ptimer_transaction_commit(s->timer_reload);
         imx_epit_reload_compare_timer(s);
         ptimer_transaction_commit(s->timer_cmp);
-        ptimer_transaction_commit(s->timer_reload);
         break;
 
     case 3: /* CMP */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reduce the amount of typing required for this check.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  5 +++++
 target/arm/helper.c    | 14 +++++---------
 target/arm/ptw.c       | 14 ++++++--------
 3 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
     }
 }
 
+static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
+{
+    return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
+}
+
 /* Return the exception level which controls this address translation regime */
 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 37, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    } else if (regime_is_stage2(mmu_idx)) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBI bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 51, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    } else if (regime_is_stage2(mmu_idx)) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBID bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
-    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
+    bool stage2 = regime_is_stage2(mmu_idx);
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         }
         ds = false;
     } else if (ds) {
-        switch (mmu_idx) {
-        case ARMMMUIdx_Stage2:
-        case ARMMMUIdx_Stage2_S:
+        if (regime_is_stage2(mmu_idx)) {
             if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
             }
-            break;
-        default:
+        } else {
             if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
             }
-            break;
         }
         if (ds) {
             min_tsz = 12;
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
     bool have_wxn;
     int wxn = 0;
 
-    assert(mmu_idx != ARMMMUIdx_Stage2);
-    assert(mmu_idx != ARMMMUIdx_Stage2_S);
+    assert(!regime_is_stage2(mmu_idx));
 
     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
     if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         goto do_fault;
     }
 
-    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
+    if (!regime_is_stage2(mmu_idx)) {
         /*
          * The starting level depends on the virtual address size (which can
          * be up to 48 bits) and the translation granule size. It indicates
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         attrs = extract64(descriptor, 2, 10)
             | (extract64(descriptor, 52, 12) << 10);
 
-        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+        if (regime_is_stage2(mmu_idx)) {
             /* Stage 2 table descriptors do not include any attribute fields */
             break;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     ap = extract32(attrs, 4, 2);
 
-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract32(attrs, 11, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.guarded = guarded;
     }
 
-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 0, 4);
     } else {
@@ -XXX,XX +XXX,XX @@ do_fault:
     fi->type = fault_type;
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
-    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
-                               mmu_idx == ARMMMUIdx_Stage2_S);
+    fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
     fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
     return true;
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Hoist the computation of the mmu_idx for the ptw up to
get_phys_addr_with_struct and get_phys_addr_twostage.
This removes the duplicate check for stage2 disabled
from the middle of the walk, performing it only once.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 71 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 54 insertions(+), 17 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 
 typedef struct S1Translate {
     ARMMMUIdx in_mmu_idx;
+    ARMMMUIdx in_ptw_idx;
     bool in_secure;
     bool in_debug;
     bool out_secure;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 {
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-    bool s2_phys = false;
+    ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
     uint8_t pte_attrs;
     bool pte_secure;
 
-    if (!arm_mmu_idx_is_stage1_of_2(mmu_idx)
-        || regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
-        s2_mmu_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
-        s2_phys = true;
-    }
-
     if (unlikely(ptw->in_debug)) {
         /*
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
-        if (s2_phys) {
-            ptw->out_phys = addr;
-            pte_attrs = 0;
-            pte_secure = is_secure;
-        } else {
+        if (regime_is_stage2(s2_mmu_idx)) {
             S1Translate s2ptw = {
                 .in_mmu_idx = s2_mmu_idx,
+                .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
                 .in_secure = is_secure,
                 .in_debug = true,
             };
             GetPhysAddrResult s2 = { };
+
             if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
                                     false, &s2, fi)) {
                 goto fail;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             ptw->out_phys = s2.f.phys_addr;
             pte_attrs = s2.cacheattrs.attrs;
             pte_secure = s2.f.attrs.secure;
+        } else {
+            /* Regime is physical. */
+            ptw->out_phys = addr;
+            pte_attrs = 0;
+            pte_secure = is_secure;
         }
         ptw->out_host = NULL;
     } else {
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         pte_secure = full->attrs.secure;
     }
 
-    if (!s2_phys) {
+    if (regime_is_stage2(s2_mmu_idx)) {
         uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
 
         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddr |= (address >> (stride * (4 - level))) & indexmask;
         descaddr &= ~7ULL;
         nstable = extract32(tableattrs, 4, 1);
-        ptw->in_secure = !nstable;
+        if (!nstable) {
+            /*
+             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
+             * Assert that the non-secure idx are even, and relative order.
+             */
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
+            ptw->in_ptw_idx &= ~1;
+            ptw->in_secure = false;
+        }
         descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 
     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+    ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
     ptw->in_secure = s2walk_secure;
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                       ARMMMUFaultInfo *fi)
 {
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
     bool is_secure = ptw->in_secure;
+    ARMMMUIdx s1_mmu_idx;
 
-    if (mmu_idx != s1_mmu_idx) {
+    switch (mmu_idx) {
+    case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+        /* Checking Phys early avoids special casing later vs regime_el. */
+        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
+                                      is_secure, result, fi);
+
+    case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E1:
+    case ARMMMUIdx_Stage1_E1_PAN:
+        /* First stage lookup uses second stage for ptw. */
+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+        break;
+
+    case ARMMMUIdx_E10_0:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E0;
+        goto do_twostage;
+    case ARMMMUIdx_E10_1:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E1;
+        goto do_twostage;
+    case ARMMMUIdx_E10_1_PAN:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
+    do_twostage:
         /*
          * Call ourselves recursively to do the stage 1 and then stage 2
          * translations if mmu_idx is a two-stage regime, and EL2 present.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
             return get_phys_addr_twostage(env, ptw, address, access_type,
                                           result, fi);
         }
+        /* fall through */
+
+    default:
+        /* Single stage and second stage uses physical for ptw. */
+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
+        break;
     }
 
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The MMFR1 field may indicate support for hardware update of
access flag alone, or access flag and dirty bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 ++
 target/arm/helper.c    | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
     bool hpd        : 1;
     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
     bool ds         : 1;
+    bool ha         : 1;
+    bool hd         : 1;
     ARMGranuleSize gran : 2;
 } ARMVAParameters;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    bool epd, hpd, tsz_oob, ds;
+    bool epd, hpd, tsz_oob, ds, ha, hd;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         epd = false;
         sh = extract32(tcr, 12, 2);
         ps = extract32(tcr, 16, 3);
+        ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu);
+        hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu);
         ds = extract64(tcr, 32, 1);
     } else {
         bool e0pd;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             e0pd = extract64(tcr, 56, 1);
         }
         ps = extract64(tcr, 32, 3);
+        ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu);
+        hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu);
         ds = extract64(tcr, 59, 1);
 
         if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .hpd = hpd,
         .tsz_oob = tsz_oob,
         .ds = ds,
+        .ha = ha,
+        .hd = ha && hd,
         .gran = gran,
     };
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Separate S1 translation from the actual lookup.
Will enable lpae hardware updates.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 }
 
 /* All loads done in the course of a page table walk go through here. */
-static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
     uint32_t data;
 
-    if (!S1_ptw_translate(env, ptw, addr, fi)) {
-        /* Failure. */
-        assert(fi->s1ptw);
-        return 0;
-    }
-
     if (likely(ptw->out_host)) {
         /* Page tables are in RAM, and we have the host address. */
         if (ptw->out_be) {
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
     return data;
 }
 
-static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
     uint64_t data;
 
-    if (!S1_ptw_translate(env, ptw, addr, fi)) {
-        /* Failure. */
-        assert(fi->s1ptw);
-        return 0;
-    }
-
     if (likely(ptw->out_host)) {
         /* Page tables are in RAM, and we have the host address. */
         if (ptw->out_be) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
         fi->type = ARMFault_Translation;
         goto do_fault;
     }
-    desc = arm_ldl_ptw(env, ptw, table, fi);
+    if (!S1_ptw_translate(env, ptw, table, fi)) {
+        goto do_fault;
+    }
+    desc = arm_ldl_ptw(env, ptw, fi);
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
             /* Fine pagetable.  */
             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
         }
-        desc = arm_ldl_ptw(env, ptw, table, fi);
+        if (!S1_ptw_translate(env, ptw, table, fi)) {
+            goto do_fault;
+        }
+        desc = arm_ldl_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         fi->type = ARMFault_Translation;
         goto do_fault;
     }
-    desc = arm_ldl_ptw(env, ptw, table, fi);
+    if (!S1_ptw_translate(env, ptw, table, fi)) {
+        goto do_fault;
+    }
+    desc = arm_ldl_ptw(env, ptw, fi);
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         ns = extract32(desc, 3, 1);
         /* Lookup l2 entry.  */
         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
-        desc = arm_ldl_ptw(env, ptw, table, fi);
+        if (!S1_ptw_translate(env, ptw, table, fi)) {
+            goto do_fault;
+        }
+        desc = arm_ldl_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             ptw->in_ptw_idx &= ~1;
             ptw->in_secure = false;
         }
-        descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
+        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
+            goto do_fault;
+        }
+        descriptor = arm_ldq_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This fault type is to be used with FEAT_HAFDBS when
the guest enables hw updates, but places the tables
in memory where atomic updates are unsupported.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
     ARMFault_AsyncExternal,
     ARMFault_Debug,
     ARMFault_TLBConflict,
+    ARMFault_UnsuppAtomicUpdate,
     ARMFault_Lockdown,
     ARMFault_Exclusive,
     ARMFault_ICacheMaint,
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     case ARMFault_TLBConflict:
         fsc = 0x30;
         break;
+    case ARMFault_UnsuppAtomicUpdate:
+        fsc = 0x31;
+        break;
     case ARMFault_Lockdown:
         fsc = 0x34;
         break;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The unconditional loop was used both to iterate over levels
and to control parsing of attributes.  Use an explicit goto
in both cases.

While this appears less clean for iterating over levels, we
will need to jump back into the middle of this loop for
atomic updates, which is even uglier.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 192 +++++++++++++++++++++++------------------------
 1 file changed, 96 insertions(+), 96 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     bool guarded = false;
+    uint64_t descriptor;
+    bool nstable;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * bits at each step.
      */
     tableattrs = is_secure ? 0 : (1 << 4);
-    for (;;) {
-        uint64_t descriptor;
-        bool nstable;
-
-        descaddr |= (address >> (stride * (4 - level))) & indexmask;
-        descaddr &= ~7ULL;
-        nstable = extract32(tableattrs, 4, 1);
-        if (!nstable) {
-            /*
-             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-             * Assert that the non-secure idx are even, and relative order.
-             */
-            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-            ptw->in_ptw_idx &= ~1;
-            ptw->in_secure = false;
-        }
-        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-            goto do_fault;
-        }
-        descriptor = arm_ldq_ptw(env, ptw, fi);
-        if (fi->type != ARMFault_None) {
-            goto do_fault;
-        }
-
-        if (!(descriptor & 1) ||
-            (!(descriptor & 2) && (level == 3))) {
-            /* Invalid, or the Reserved level 3 encoding */
-            goto do_fault;
-        }
-
-        descaddr = descriptor & descaddrmask;
 
+ next_level:
+    descaddr |= (address >> (stride * (4 - level))) & indexmask;
+    descaddr &= ~7ULL;
+    nstable = extract32(tableattrs, 4, 1);
+    if (!nstable) {
         /*
-         * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
-         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
-         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
-         * raise AddressSizeFault.
+         * Stage2_S -> Stage2 or Phys_S -> Phys_NS
+         * Assert that the non-secure idx are even, and relative order.
          */
-        if (outputsize > 48) {
-            if (param.ds) {
-                descaddr |= extract64(descriptor, 8, 2) << 50;
-            } else {
-                descaddr |= extract64(descriptor, 12, 4) << 48;
-            }
-        } else if (descaddr >> outputsize) {
-            fault_type = ARMFault_AddressSize;
-            goto do_fault;
-        }
-
-        if ((descriptor & 2) && (level < 3)) {
-            /*
-             * Table entry. The top five bits are attributes which may
-             * propagate down through lower levels of the table (and
-             * which are all arranged so that 0 means "no effect", so
-             * we can gather them up by ORing in the bits at each level).
-             */
-            tableattrs |= extract64(descriptor, 59, 5);
-            level++;
-            indexmask = indexmask_grainsize;
-            continue;
-        }
-        /*
-         * Block entry at level 1 or 2, or page entry at level 3.
-         * These are basically the same thing, although the number
-         * of bits we pull in from the vaddr varies. Note that although
-         * descaddrmask masks enough of the low bits of the descriptor
-         * to give a correct page or table address, the address field
-         * in a block descriptor is smaller; so we need to explicitly
-         * clear the lower bits here before ORing in the low vaddr bits.
-         */
-        page_size = (1ULL << ((stride * (4 - level)) + 3));
-        descaddr &= ~(hwaddr)(page_size - 1);
-        descaddr |= (address & (page_size - 1));
-        /* Extract attributes from the descriptor */
-        attrs = extract64(descriptor, 2, 10)
-            | (extract64(descriptor, 52, 12) << 10);
-
-        if (regime_is_stage2(mmu_idx)) {
-            /* Stage 2 table descriptors do not include any attribute fields */
-            break;
-        }
-        /* Merge in attributes from table descriptors */
-        attrs |= nstable << 3; /* NS */
-        guarded = extract64(descriptor, 50, 1);  /* GP */
-        if (param.hpd) {
-            /* HPD disables all the table attributes except NSTable.  */
-            break;
-        }
-        attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-        /*
-         * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-         * means "force PL1 access only", which means forcing AP[1] to 0.
-         */
-        attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-        attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-        break;
+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
+        ptw->in_ptw_idx &= ~1;
+        ptw->in_secure = false;
     }
+    if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
+        goto do_fault;
+    }
+    descriptor = arm_ldq_ptw(env, ptw, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
+
+    if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
+        /* Invalid, or the Reserved level 3 encoding */
+        goto do_fault;
+    }
+
+    descaddr = descriptor & descaddrmask;
+
+    /*
+     * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
+     * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
+     * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
+     * raise AddressSizeFault.
+     */
+    if (outputsize > 48) {
+        if (param.ds) {
+            descaddr |= extract64(descriptor, 8, 2) << 50;
+        } else {
+            descaddr |= extract64(descriptor, 12, 4) << 48;
+        }
+    } else if (descaddr >> outputsize) {
+        fault_type = ARMFault_AddressSize;
+        goto do_fault;
+    }
+
+    if ((descriptor & 2) && (level < 3)) {
+        /*
+         * Table entry. The top five bits are attributes which may
+         * propagate down through lower levels of the table (and
+         * which are all arranged so that 0 means "no effect", so
+         * we can gather them up by ORing in the bits at each level).
+         */
+        tableattrs |= extract64(descriptor, 59, 5);
+        level++;
+        indexmask = indexmask_grainsize;
+        goto next_level;
+    }
+
+    /*
+     * Block entry at level 1 or 2, or page entry at level 3.
+     * These are basically the same thing, although the number
+     * of bits we pull in from the vaddr varies. Note that although
+     * descaddrmask masks enough of the low bits of the descriptor
+     * to give a correct page or table address, the address field
+     * in a block descriptor is smaller; so we need to explicitly
+     * clear the lower bits here before ORing in the low vaddr bits.
+     */
+    page_size = (1ULL << ((stride * (4 - level)) + 3));
+    descaddr &= ~(hwaddr)(page_size - 1);
+    descaddr |= (address & (page_size - 1));
+    /* Extract attributes from the descriptor */
+    attrs = extract64(descriptor, 2, 10)
+        | (extract64(descriptor, 52, 12) << 10);
+
+    if (regime_is_stage2(mmu_idx)) {
+        /* Stage 2 table descriptors do not include any attribute fields */
+        goto skip_attrs;
+    }
+    /* Merge in attributes from table descriptors */
+    attrs |= nstable << 3; /* NS */
+    guarded = extract64(descriptor, 50, 1);  /* GP */
+    if (param.hpd) {
+        /* HPD disables all the table attributes except NSTable.  */
+        goto skip_attrs;
+    }
+    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
+    /*
+     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
+     * means "force PL1 access only", which means forcing AP[1] to 0.
+     */
+    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
+    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
+ skip_attrs:
+
     /*
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Always overriding fi->type was incorrect, as we would not properly
propagate the fault type from S1_ptw_translate, or arm_ldq_ptw.
Simplify things by providing a new label for a translation fault.
For other faults, store into fi directly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     ARMCPU *cpu = env_archcpu(env);
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_secure = ptw->in_secure;
-    /* Read an LPAE long-descriptor translation table. */
-    ARMFaultType fault_type = ARMFault_Translation;
     uint32_t level;
     ARMVAParameters param;
     uint64_t ttbr;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * so our choice is to always raise the fault.
          */
         if (param.tsz_oob) {
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
 
         addrsize = 64 - 8 * param.tbi;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                            addrsize - inputsize);
         if (-top_bits != param.select) {
             /* The gap between the two regions is a Translation fault */
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * Translation table walk disabled => Translation fault on TLB miss
          * Note: This is always 0 on 64-bit EL2 and EL3.
          */
-        goto do_fault;
+        goto do_translation_fault;
     }
 
     if (!regime_is_stage2(mmu_idx)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         if (param.ds && stride == 9 && sl2) {
             if (sl0 != 0) {
                 level = 0;
-                fault_type = ARMFault_Translation;
-                goto do_fault;
+                goto do_translation_fault;
             }
             startlevel = -1;
         } else if (!aarch64 || stride == 9) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
                                 inputsize, stride, outputsize);
         if (!ok) {
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
         level = startlevel;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddr |= extract64(ttbr, 2, 4) << 48;
     } else if (descaddr >> outputsize) {
         level = 0;
-        fault_type = ARMFault_AddressSize;
+        fi->type = ARMFault_AddressSize;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
         /* Invalid, or the Reserved level 3 encoding */
-        goto do_fault;
+        goto do_translation_fault;
     }
 
     descaddr = descriptor & descaddrmask;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             descaddr |= extract64(descriptor, 12, 4) << 48;
         }
     } else if (descaddr >> outputsize) {
-        fault_type = ARMFault_AddressSize;
+        fi->type = ARMFault_AddressSize;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
      */
-    fault_type = ARMFault_AccessFlag;
     if ((attrs & (1 << 8)) == 0) {
         /* Access flag */
+        fi->type = ARMFault_AccessFlag;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
 
-    fault_type = ARMFault_Permission;
     if (!(result->f.prot & (1 << access_type))) {
+        fi->type = ARMFault_Permission;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     result->f.lg_page_size = ctz64(page_size);
     return false;
 
-do_fault:
-    fi->type = fault_type;
+ do_translation_fault:
+    fi->type = ARMFault_Translation;
+ do_fault:
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Leave the upper and lower attributes in the place they originate
from in the descriptor.  Shifting them around is confusing, since
one cannot read the bit numbers out of the manual.  Also, new
attributes have been added which would alter the shifts.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20221024051851.3074715-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     hwaddr descaddr, indexmask, indexmask_grainsize;
     uint32_t tableattrs;
     target_ulong page_size;
-    uint32_t attrs;
+    uint64_t attrs;
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
     /* Extract attributes from the descriptor */
-    attrs = extract64(descriptor, 2, 10)
-        | (extract64(descriptor, 52, 12) << 10);
+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
 
     if (regime_is_stage2(mmu_idx)) {
         /* Stage 2 table descriptors do not include any attribute fields */
         goto skip_attrs;
     }
     /* Merge in attributes from table descriptors */
-    attrs |= nstable << 3; /* NS */
+    attrs |= nstable << 5; /* NS */
     guarded = extract64(descriptor, 50, 1);  /* GP */
     if (param.hpd) {
         /* HPD disables all the table attributes except NSTable.  */
         goto skip_attrs;
     }
-    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
+    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
     /*
      * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
      * means "force PL1 access only", which means forcing AP[1] to 0.
      */
-    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
+    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
+    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
  skip_attrs:
 
     /*
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
      */
-    if ((attrs & (1 << 8)) == 0) {
+    if ((attrs & (1 << 10)) == 0) {
         /* Access flag */
         fi->type = ARMFault_AccessFlag;
         goto do_fault;
     }
 
-    ap = extract32(attrs, 4, 2);
+    ap = extract32(attrs, 6, 2);
 
     if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
-        xn = extract32(attrs, 11, 2);
+        xn = extract64(attrs, 53, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
-        ns = extract32(attrs, 3, 1);
-        xn = extract32(attrs, 12, 1);
-        pxn = extract32(attrs, 11, 1);
+        ns = extract32(attrs, 5, 1);
+        xn = extract64(attrs, 54, 1);
+        pxn = extract64(attrs, 53, 1);
         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
-        result->cacheattrs.attrs = extract32(attrs, 0, 4);
+        result->cacheattrs.attrs = extract32(attrs, 2, 4);
     } else {
         /* Index into MAIR registers for cache attributes */
-        uint8_t attrindx = extract32(attrs, 0, 3);
+        uint8_t attrindx = extract32(attrs, 2, 3);
         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     if (param.ds) {
         result->cacheattrs.shareability = param.sh;
     } else {
-        result->cacheattrs.shareability = extract32(attrs, 6, 2);
+        result->cacheattrs.shareability = extract32(attrs, 8, 2);
     }
 
     result->f.phys_addr = descaddr;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Both GP and DBM are in the upper attribute block.
Extend the computation of attrs to include them,
then simplify the setting of guarded.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Replace some gotos with some nested if statements.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     page_size = (1ULL << ((stride * (4 - level)) + 3));
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
-    /* Extract attributes from the descriptor */
-    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
 
-    if (regime_is_stage2(mmu_idx)) {
-        /* Stage 2 table descriptors do not include any attribute fields */
-        goto skip_attrs;
-    }
-    /* Merge in attributes from table descriptors */
-    attrs |= nstable << 5; /* NS */
-    if (param.hpd) {
-        /* HPD disables all the table attributes except NSTable.  */
-        goto skip_attrs;
-    }
-    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
     /*
-     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-     * means "force PL1 access only", which means forcing AP[1] to 0.
+     * Extract attributes from the descriptor, and apply table descriptors.
+     * Stage 2 table descriptors do not include any attribute fields.
+     * HPD disables all the table attributes except NSTable.
      */
-    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
-    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
- skip_attrs:
+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
+    if (!regime_is_stage2(mmu_idx)) {
+        attrs |= nstable << 5; /* NS */
+        if (!param.hpd) {
+            attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
+            /*
+             * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
+             * means "force PL1 access only", which means forcing AP[1] to 0.
+             */
+            attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
+            attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
+        }
+    }
 
     /*
      * Here descaddr is the final physical address, and attributes
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Perform the atomic update for hardware management of the access flag.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |   1 +
 target/arm/cpu64.c            |   1 +
 target/arm/ptw.c              | 176 +++++++++++++++++++++++++++++-----
 3 files changed, 156 insertions(+), 22 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_FlagM (Flag manipulation instructions v2)
 - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
 - FEAT_GTG (Guest translation granule size)
+- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
 - FEAT_HCX (Support for the HCRX_EL2 register)
 - FEAT_HPDS (Hierarchical permission disables)
 - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
     bool in_secure;
     bool in_debug;
     bool out_secure;
+    bool out_rw;
     bool out_be;
+    hwaddr out_virt;
     hwaddr out_phys;
     void *out_host;
 } S1Translate;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     uint8_t pte_attrs;
     bool pte_secure;
 
+    ptw->out_virt = addr;
+
     if (unlikely(ptw->in_debug)) {
         /*
          * From gdbstub, do not use softmmu so that we don't modify the
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             pte_secure = is_secure;
         }
         ptw->out_host = NULL;
+        ptw->out_rw = false;
     } else {
         CPUTLBEntryFull *full;
         int flags;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             goto fail;
         }
         ptw->out_phys = full->phys_addr;
+        ptw->out_rw = full->prot & PROT_WRITE;
         pte_attrs = full->pte_attrs;
         pte_secure = full->attrs.secure;
     }
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    void *host = ptw->out_host;
     uint32_t data;
 
-    if (likely(ptw->out_host)) {
+    if (likely(host)) {
         /* Page tables are in RAM, and we have the host address. */
+        data = qatomic_read((uint32_t *)host);
         if (ptw->out_be) {
-            data = ldl_be_p(ptw->out_host);
+            data = be32_to_cpu(data);
         } else {
-            data = ldl_le_p(ptw->out_host);
+            data = le32_to_cpu(data);
         }
     } else {
         /* Page tables are in MMIO. */
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    void *host = ptw->out_host;
     uint64_t data;
 
-    if (likely(ptw->out_host)) {
+    if (likely(host)) {
         /* Page tables are in RAM, and we have the host address. */
+#ifdef CONFIG_ATOMIC64
+        data = qatomic_read__nocheck((uint64_t *)host);
         if (ptw->out_be) {
-            data = ldq_be_p(ptw->out_host);
+            data = be64_to_cpu(data);
         } else {
-            data = ldq_le_p(ptw->out_host);
+            data = le64_to_cpu(data);
         }
+#else
+        if (ptw->out_be) {
+            data = ldq_be_p(host);
+        } else {
+            data = ldq_le_p(host);
+        }
+#endif
     } else {
         /* Page tables are in MMIO. */
         MemTxAttrs attrs = { .secure = ptw->out_secure };
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
     return data;
 }
 
+static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
+                             uint64_t new_val, S1Translate *ptw,
+                             ARMMMUFaultInfo *fi)
+{
+    uint64_t cur_val;
+    void *host = ptw->out_host;
+
+    if (unlikely(!host)) {
+        fi->type = ARMFault_UnsuppAtomicUpdate;
+        fi->s1ptw = true;
+        return 0;
+    }
+
+    /*
+     * Raising a stage2 Protection fault for an atomic update to a read-only
+     * page is delayed until it is certain that there is a change to make.
+     */
+    if (unlikely(!ptw->out_rw)) {
+        int flags;
+        void *discard;
+
+        env->tlb_fi = fi;
+        flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE,
+                                   arm_to_core_mmu_idx(ptw->in_ptw_idx),
+                                   true, &discard, 0);
+        env->tlb_fi = NULL;
+
+        if (unlikely(flags & TLB_INVALID_MASK)) {
+            assert(fi->type != ARMFault_None);
+            fi->s2addr = ptw->out_virt;
+            fi->stage2 = true;
+            fi->s1ptw = true;
+            fi->s1ns = !ptw->in_secure;
+            return 0;
+        }
+
+        /* In case CAS mismatches and we loop, remember writability. */
+        ptw->out_rw = true;
+    }
+
+#ifdef CONFIG_ATOMIC64
+    if (ptw->out_be) {
+        old_val = cpu_to_be64(old_val);
+        new_val = cpu_to_be64(new_val);
+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
+        cur_val = be64_to_cpu(cur_val);
+    } else {
+        old_val = cpu_to_le64(old_val);
+        new_val = cpu_to_le64(new_val);
+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
+        cur_val = le64_to_cpu(cur_val);
+    }
+#else
+    /*
+     * We can't support the full 64-bit atomic cmpxchg on the host.
+     * Because this is only used for FEAT_HAFDBS, which is only for AA64,
+     * we know that TCG_OVERSIZED_GUEST is set, which means that we are
+     * running in round-robin mode and could only race with dma i/o.
+     */
+#ifndef TCG_OVERSIZED_GUEST
+# error "Unexpected configuration"
+#endif
+    bool locked = qemu_mutex_iothread_locked();
+    if (!locked) {
+       qemu_mutex_lock_iothread();
+    }
+    if (ptw->out_be) {
+        cur_val = ldq_be_p(host);
+        if (cur_val == old_val) {
+            stq_be_p(host, new_val);
+        }
+    } else {
+        cur_val = ldq_le_p(host);
+        if (cur_val == old_val) {
+            stq_le_p(host, new_val);
+        }
+    }
+    if (!locked) {
+        qemu_mutex_unlock_iothread();
+    }
+#endif
+
+    return cur_val;
+}
+
 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                      uint32_t *table, uint32_t address)
 {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
-    uint64_t descriptor;
+    uint64_t descriptor, new_descriptor;
     bool nstable;
 
     /* TODO: This code does not support shareability levels. */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
+    new_descriptor = descriptor;
 
+ restart_atomic_update:
     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
         /* Invalid, or the Reserved level 3 encoding */
         goto do_translation_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * to give a correct page or table address, the address field
      * in a block descriptor is smaller; so we need to explicitly
      * clear the lower bits here before ORing in the low vaddr bits.
+     *
+     * Afterward, descaddr is the final physical address.
      */
     page_size = (1ULL << ((stride * (4 - level)) + 3));
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
 
+    if (likely(!ptw->in_debug)) {
+        /*
+         * Access flag.
+         * If HA is enabled, prepare to update the descriptor below.
+         * Otherwise, pass the access fault on to software.
+         */
+        if (!(descriptor & (1 << 10))) {
+            if (param.ha) {
+                new_descriptor |= 1 << 10; /* AF */
+            } else {
+                fi->type = ARMFault_AccessFlag;
+                goto do_fault;
+            }
+        }
+    }
+
     /*
-     * Extract attributes from the descriptor, and apply table descriptors.
-     * Stage 2 table descriptors do not include any attribute fields.
-     * HPD disables all the table attributes except NSTable.
+     * Extract attributes from the (modified) descriptor, and apply
+     * table descriptors. Stage 2 table descriptors do not include
+     * any attribute fields. HPD disables all the table attributes
+     * except NSTable.
      */
-    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
+    attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
     if (!regime_is_stage2(mmu_idx)) {
         attrs |= nstable << 5; /* NS */
         if (!param.hpd) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         }
     }
 
-    /*
-     * Here descaddr is the final physical address, and attributes
-     * are all in attrs.
-     */
-    if ((attrs & (1 << 10)) == 0) {
-        /* Access flag */
-        fi->type = ARMFault_AccessFlag;
-        goto do_fault;
-    }
-
     ap = extract32(attrs, 6, 2);
-
     if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract64(attrs, 53, 2);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         goto do_fault;
     }
 
+    /* If FEAT_HAFDBS has made changes, update the PTE. */
+    if (new_descriptor != descriptor) {
+        new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
+        /*
+         * I_YZSVV says that if the in-memory descriptor has changed,
+         * then we must use the information in that new value
+         * (which might include a different output address, different
+         * attributes, or generate a fault).
+         * Restart the handling of the descriptor value from scratch.
+         */
+        if (new_descriptor != descriptor) {
+            descriptor = new_descriptor;
+            goto restart_atomic_update;
+        }
+    }
+
     if (ns) {
         /*
          * The NS bit will (as required by the architecture) have no effect if
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Perform the atomic update for hardware management of the dirty bit.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c |  2 +-
 target/arm/ptw.c   | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                 goto do_fault;
             }
         }
+
+        /*
+         * Dirty Bit.
+         * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
+         * bit for writeback. The actual write protection test may still be
+         * overridden by tableattrs, to be merged below.
+         */
+        if (param.hd
+            && extract64(descriptor, 51, 1)  /* DBM */
+            && access_type == MMU_DATA_STORE) {
+            if (regime_is_stage2(mmu_idx)) {
+                new_descriptor |= 1ull << 7;    /* set S2AP[1] */
+            } else {
+                new_descriptor &= ~(1ull << 7); /* clear AP[2] */
+            }
+        }
     }
 
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We had only been reporting the stage2 page size.  This causes
problems if stage1 is using a larger page size (16k, 2M, etc),
but stage2 is using a smaller page size, because cputlb does
not set large_page_{addr,mask} properly.

Fix by using the max of the two page sizes.

Reported-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
                                    ARMMMUFaultInfo *fi)
 {
     hwaddr ipa;
-    int s1_prot;
+    int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
     bool ret, ipa_secure, s2walk_secure;
     ARMCacheAttrs cacheattrs1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Save the stage1 results so that we may merge prot and cacheattrs later.
      */
     s1_prot = result->f.prot;
+    s1_lgpgsz = result->f.lg_page_size;
     cacheattrs1 = result->cacheattrs;
     memset(result, 0, sizeof(*result));
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
         return ret;
     }
 
+    /*
+     * Use the maximum of the S1 & S2 page size, so that invalidation
+     * of pages > TARGET_PAGE_SIZE works correctly.
+     */
+    if (result->f.lg_page_size < s1_lgpgsz) {
+        result->f.lg_page_size = s1_lgpgsz;
+    }
+
     /* Combine the S1 and S2 cache attributes. */
     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
     if (hcr & HCR_DC) {
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading only expects to call deterministic handlers, not
non-deterministic ones. So introduce a way of registering handlers that
won't be called when reseting for snapshots.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-2-Jason@zx2c4.com
[PMM: updated json doc comment with Markus' text; fixed
 checkpatch style nit]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qapi/run-state.json        |  6 +++++-
 include/hw/boards.h        |  2 +-
 include/sysemu/reset.h     |  5 ++++-
 hw/arm/aspeed.c            |  4 ++--
 hw/arm/mps2-tz.c           |  4 ++--
 hw/core/reset.c            | 17 ++++++++++++++++-
 hw/hppa/machine.c          |  4 ++--
 hw/i386/microvm.c          |  4 ++--
 hw/i386/pc.c               |  6 +++---
 hw/ppc/pegasos2.c          |  4 ++--
 hw/ppc/pnv.c               |  4 ++--
 hw/ppc/spapr.c             |  4 ++--
 hw/s390x/s390-virtio-ccw.c |  4 ++--
 migration/savevm.c         |  2 +-
 softmmu/runstate.c         | 11 ++++++++---
 15 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/qapi/run-state.json b/qapi/run-state.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -XXX,XX +XXX,XX @@
 #                   ignores --no-reboot. This is useful for sanitizing
 #                   hypercalls on s390 that are used during kexec/kdump/boot
 #
+# @snapshot-load: A snapshot is being loaded by the record & replay
+#                 subsystem. This value is used only within QEMU.  It
+#                 doesn't occur in QMP. (since 7.2)
+#
 ##
 { 'enum': 'ShutdownCause',
   # Beware, shutdown_caused_by_guest() depends on enumeration order
   'data': [ 'none', 'host-error', 'host-qmp-quit', 'host-qmp-system-reset',
             'host-signal', 'host-ui', 'guest-shutdown', 'guest-reset',
-            'guest-panic', 'subsystem-reset'] }
+            'guest-panic', 'subsystem-reset', 'snapshot-load'] }
 
 ##
 # @StatusInfo:
diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
     const char *deprecation_reason;
 
     void (*init)(MachineState *state);
-    void (*reset)(MachineState *state);
+    void (*reset)(MachineState *state, ShutdownCause reason);
     void (*wakeup)(MachineState *state);
     int (*kvm_type)(MachineState *machine, const char *arg);
 
diff --git a/include/sysemu/reset.h b/include/sysemu/reset.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/reset.h
+++ b/include/sysemu/reset.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_SYSEMU_RESET_H
 #define QEMU_SYSEMU_RESET_H
 
+#include "qapi/qapi-events-run-state.h"
+
 typedef void QEMUResetHandler(void *opaque);
 
 void qemu_register_reset(QEMUResetHandler *func, void *opaque);
+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque);
 void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
-void qemu_devices_reset(void);
+void qemu_devices_reset(ShutdownCause reason);
 
 #endif
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 }
 
-static void fby35_reset(MachineState *state)
+static void fby35_reset(MachineState *state, ShutdownCause reason)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(state);
     AspeedGPIOState *gpio = &bmc->soc.gpio;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Board ID: 7 (Class-1, 4 slots) */
     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2_set_remap(Object *obj, const char *value, Error **errp)
     }
 }
 
-static void mps2_machine_reset(MachineState *machine)
+static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 
@@ -XXX,XX +XXX,XX @@ static void mps2_machine_reset(MachineState *machine)
      * reset see the correct mapping.
      */
     remap_memory(mms, mms->remap);
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 }
 
 static void mps2tz_class_init(ObjectClass *oc, void *data)
diff --git a/hw/core/reset.c b/hw/core/reset.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/reset.c
+++ b/hw/core/reset.c
@@ -XXX,XX +XXX,XX @@ typedef struct QEMUResetEntry {
     QTAILQ_ENTRY(QEMUResetEntry) entry;
     QEMUResetHandler *func;
     void *opaque;
+    bool skip_on_snapshot_load;
 } QEMUResetEntry;
 
 static QTAILQ_HEAD(, QEMUResetEntry) reset_handlers =
@@ -XXX,XX +XXX,XX @@ void qemu_register_reset(QEMUResetHandler *func, void *opaque)
     QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
 }
 
+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque)
+{
+    QEMUResetEntry *re = g_new0(QEMUResetEntry, 1);
+
+    re->func = func;
+    re->opaque = opaque;
+    re->skip_on_snapshot_load = true;
+    QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
+}
+
 void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
 {
     QEMUResetEntry *re;
@@ -XXX,XX +XXX,XX @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
     }
 }
 
-void qemu_devices_reset(void)
+void qemu_devices_reset(ShutdownCause reason)
 {
     QEMUResetEntry *re, *nre;
 
     /* reset all devices */
     QTAILQ_FOREACH_SAFE(re, &reset_handlers, entry, nre) {
+        if (reason == SHUTDOWN_CAUSE_SNAPSHOT_LOAD &&
+            re->skip_on_snapshot_load) {
+            continue;
+        }
         re->func(re->opaque);
     }
 }
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -XXX,XX +XXX,XX @@ static void machine_hppa_init(MachineState *machine)
     cpu[0]->env.gr[19] = FW_CFG_IO_BASE;
 }
 
-static void hppa_machine_reset(MachineState *ms)
+static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
 {
     unsigned int smp_cpus = ms->smp.cpus;
     int i;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Start all CPUs at the firmware entry point.
      *  Monarch CPU will initialize firmware, secondary CPUs
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_state_init(MachineState *machine)
     microvm_devices_init(mms);
 }
 
-static void microvm_machine_reset(MachineState *machine)
+static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     MicrovmMachineState *mms = MICROVM_MACHINE(machine);
     CPUState *cs;
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_reset(MachineState *machine)
         mms->kernel_cmdline_fixed = true;
     }
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     CPU_FOREACH(cs) {
         cpu = X86_CPU(cs);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_initfn(Object *obj)
     cxl_machine_init(obj, &pcms->cxl_devices_state);
 }
 
-static void pc_machine_reset(MachineState *machine)
+static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     CPUState *cs;
     X86CPU *cpu;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Reset APIC after devices have been reset to cancel
      * any changes that qemu_devices_reset() might have done.
@@ -XXX,XX +XXX,XX @@ static void pc_machine_reset(MachineState *machine)
 static void pc_machine_wakeup(MachineState *machine)
 {
     cpu_synchronize_all_states();
-    pc_machine_reset(machine);
+    pc_machine_reset(machine, SHUTDOWN_CAUSE_NONE);
     cpu_synchronize_all_post_reset();
 }
 
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -XXX,XX +XXX,XX @@ static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
 }
 
-static void pegasos2_machine_reset(MachineState *machine)
+static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
     void *fdt;
     uint64_t d[2];
     int sz;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
     if (!pm->vof) {
         return; /* Firmware should set up machine so nothing to do */
     }
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -XXX,XX +XXX,XX @@ static void pnv_powerdown_notify(Notifier *n, void *opaque)
     }
 }
 
-static void pnv_reset(MachineState *machine)
+static void pnv_reset(MachineState *machine, ShutdownCause reason)
 {
     PnvMachineState *pnv = PNV_MACHINE(machine);
     IPMIBmc *bmc;
     void *fdt;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /*
      * The machine should provide by default an internal BMC simulator.
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -XXX,XX +XXX,XX @@ void spapr_check_mmu_mode(bool guest_radix)
     }
 }
 
-static void spapr_machine_reset(MachineState *machine)
+static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
     PowerPCCPU *first_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void spapr_machine_reset(MachineState *machine)
         spapr_setup_hpt(spapr);
     }
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     spapr_ovec_cleanup(spapr->ov5_cas);
     spapr->ov5_cas = spapr_ovec_new();
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -XXX,XX +XXX,XX @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
     s390_pv_prep_reset();
 }
 
-static void s390_machine_reset(MachineState *machine)
+static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
     enum s390_reset reset_type;
@@ -XXX,XX +XXX,XX @@ static void s390_machine_reset(MachineState *machine)
             s390_machine_unprotect(ms);
         }
 
-        qemu_devices_reset();
+        qemu_devices_reset(reason);
         s390_crypto_reset();
 
         /* configure and start the ipl CPU only */
diff --git a/migration/savevm.c b/migration/savevm.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ bool load_snapshot(const char *name, const char *vmstate,
         goto err_drain;
     }
 
-    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
+    qemu_system_reset(SHUTDOWN_CAUSE_SNAPSHOT_LOAD);
     mis->from_src_file = f;
 
     if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -XXX,XX +XXX,XX @@ void qemu_system_reset(ShutdownCause reason)
     cpu_synchronize_all_states();
 
     if (mc && mc->reset) {
-        mc->reset(current_machine);
+        mc->reset(current_machine, reason);
     } else {
-        qemu_devices_reset();
+        qemu_devices_reset(reason);
     }
-    if (reason && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
+    switch (reason) {
+    case SHUTDOWN_CAUSE_NONE:
+    case SHUTDOWN_CAUSE_SUBSYSTEM_RESET:
+    case SHUTDOWN_CAUSE_SNAPSHOT_LOAD:
+        break;
+    default:
         qapi_event_send_reset(shutdown_caused_by_guest(reason), reason);
     }
     cpu_synchronize_all_post_reset();
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

When the system reboots, the rng-seed that the FDT has should be
re-randomized, so that the new boot gets a new seed. Several
architectures require this functionality, so export a function for
injecting a new seed into the given FDT.

Cc: Alistair Francis <alistair.francis@wdc.com>
Cc: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20221025004327.568476-3-Jason@zx2c4.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/device_tree.h |  9 +++++++++
 softmmu/device_tree.c        | 21 +++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/include/sysemu/device_tree.h b/include/sysemu/device_tree.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/device_tree.h
+++ b/include/sysemu/device_tree.h
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_setprop_sized_cells_from_array(void *fdt,
                                                 qdt_tmp);                 \
     })
 
+
+/**
+ * qemu_fdt_randomize_seeds:
+ * @fdt: device tree blob
+ *
+ * Re-randomize all "rng-seed" properties with new seeds.
+ */
+void qemu_fdt_randomize_seeds(void *fdt);
+
 #define FDT_PCI_RANGE_RELOCATABLE          0x80000000
 #define FDT_PCI_RANGE_PREFETCHABLE         0x40000000
 #define FDT_PCI_RANGE_ALIASED              0x20000000
diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/device_tree.c
+++ b/softmmu/device_tree.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/bswap.h"
 #include "qemu/cutils.h"
+#include "qemu/guest-random.h"
 #include "sysemu/device_tree.h"
 #include "hw/loader.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
 
     info_report("dtb dumped to %s", filename);
 }
+
+void qemu_fdt_randomize_seeds(void *fdt)
+{
+    int noffset, poffset, len;
+    const char *name;
+    uint8_t *data;
+
+    for (noffset = fdt_next_node(fdt, 0, NULL);
+         noffset >= 0;
+         noffset = fdt_next_node(fdt, noffset, NULL)) {
+        for (poffset = fdt_first_property_offset(fdt, noffset);
+             poffset >= 0;
+             poffset = fdt_next_property_offset(fdt, poffset)) {
+            data = (uint8_t *)fdt_getprop_by_offset(fdt, poffset, &name, &len);
+            if (!data || strcmp(name, "rng-seed"))
+                continue;
+            qemu_guest_getrandom_nofail(data, len);
+        }
+    }
+}
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-4-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/x86.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -XXX,XX +XXX,XX @@ void x86_load_linux(X86MachineState *x86ms,
         setup_data->type = cpu_to_le32(SETUP_RNG_SEED);
         setup_data->len = cpu_to_le32(RNG_SEED_LENGTH);
         qemu_guest_getrandom_nofail(setup_data->data, RNG_SEED_LENGTH);
-        qemu_register_reset(reset_rng_seed, setup_data);
+        qemu_register_reset_nosnapshotload(reset_rng_seed, setup_data);
         fw_cfg_add_bytes_callback(fw_cfg, FW_CFG_KERNEL_DATA, reset_rng_seed, NULL,
                                   setup_data, kernel, kernel_size, true);
     } else {
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

When the system reboots, the rng-seed that the FDT has should be
re-randomized, so that the new boot gets a new seed. Since the FDT is in
the ROM region at this point, we add a hook right after the ROM has been
added, so that we have a pointer to that copy of the FDT.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-5-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
      * the DTB is copied again upon reset, even if addr points into RAM.
      */
     rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                       rom_ptr_for_as(as, addr, size));
 
     g_free(fdt);
 
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Cc: Bin Meng <bin.meng@windriver.com>
Cc: qemu-riscv@nongnu.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20221025004327.568476-6-Jason@zx2c4.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/riscv/boot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
 #include "sysemu/kvm.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
 
     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
                           &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
 
     return fdt_addr;
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-7-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/m68k/virt.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     M68kCPU *cpu;
     hwaddr initial_pc;
     hwaddr initial_stack;
-    struct bi_record *rng_seed;
 } ResetInfo;
 
 static void main_cpu_reset(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void main_cpu_reset(void *opaque)
     M68kCPU *cpu = reset_info->cpu;
     CPUState *cs = CPU(cpu);
 
-    if (reset_info->rng_seed) {
-        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
-            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
-    }
-
     cpu_reset(cs);
     cpu->env.aregs[7] = reset_info->initial_stack;
     cpu->env.pc = reset_info->initial_pc;
 }
 
+static void rerandomize_rng_seed(void *opaque)
+{
+    struct bi_record *rng_seed = opaque;
+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
+}
+
 static void virt_init(MachineState *machine)
 {
     M68kCPU *cpu = NULL;
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
                               parameters_base, cs->as);
-        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
-                                              param_ptr - param_blob) +
-                               (param_rng_seed - param_blob);
+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
+                            rom_ptr_for_as(cs->as, parameters_base,
+                                           param_ptr - param_blob) +
+                            (param_rng_seed - param_blob));
         g_free(param_blob);
     }
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-8-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/m68k/q800.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo glue_info = {
     },
 };
 
-typedef struct {
-    M68kCPU *cpu;
-    struct bi_record *rng_seed;
-} ResetInfo;
-
 static void main_cpu_reset(void *opaque)
 {
-    ResetInfo *reset_info = opaque;
-    M68kCPU *cpu = reset_info->cpu;
+    M68kCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
 
-    if (reset_info->rng_seed) {
-        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
-            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
-    }
-
     cpu_reset(cs);
     cpu->env.aregs[7] = ldl_phys(cs->as, 0);
     cpu->env.pc = ldl_phys(cs->as, 4);
 }
 
+static void rerandomize_rng_seed(void *opaque)
+{
+    struct bi_record *rng_seed = opaque;
+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
+}
+
 static uint8_t fake_mac_rom[] = {
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
     NubusBus *nubus;
     DeviceState *glue;
     DriveInfo *dinfo;
-    ResetInfo *reset_info;
     uint8_t rng_seed[32];
 
     linux_boot = (kernel_filename != NULL);
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
         exit(1);
     }
 
-    reset_info = g_new0(ResetInfo, 1);
-
     /* init CPUs */
     cpu = M68K_CPU(cpu_create(machine->cpu_type));
-    reset_info->cpu = cpu;
-    qemu_register_reset(main_cpu_reset, reset_info);
+    qemu_register_reset(main_cpu_reset, cpu);
 
     /* RAM */
     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
                               parameters_base, cs->as);
-        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
-                                              param_ptr - param_blob) +
-                               (param_rng_seed - param_blob);
+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
+                            rom_ptr_for_as(cs->as, parameters_base,
+                                           param_ptr - param_blob) +
+                            (param_rng_seed - param_blob));
         g_free(param_blob);
     } else {
         uint8_t *ptr;
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-9-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/mips/boston.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "sysemu/qtest.h"
 #include "sysemu/runstate.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ static void boston_mach_init(MachineState *machine)
             /* Calculate real fdt size after filter */
             dt_size = fdt_totalsize(dtb_load_data);
             rom_add_blob_fixed("dtb", dtb_load_data, dt_size, dtb_paddr);
+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                rom_ptr(dtb_paddr, dt_size));
         } else {
             /* Try to load file as FIT */
             fit_err = load_fit(&boston_fit_loader, machine->kernel_filename, s);
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Stafford Horne <shorne@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-11-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/openrisc/boot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/openrisc/boot.c
+++ b/hw/openrisc/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/openrisc/boot.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 
@@ -XXX,XX +XXX,XX @@ uint32_t openrisc_load_fdt(void *fdt, hwaddr load_start,
 
     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
                           &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
 
     return fdt_addr;
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-12-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/rx/rx-gdbsim.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rx/rx-gdbsim.c
+++ b/hw/rx/rx-gdbsim.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/rx/rx62n.h"
 #include "sysemu/qtest.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/reset.h"
 #include "hw/boards.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ static void rx_gdbsim_init(MachineState *machine)
             dtb_offset = ROUND_DOWN(machine->ram_size - dtb_size, 16);
             rom_add_blob_fixed("dtb", dtb, dtb_size,
                                SDRAM_BASE + dtb_offset);
+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                rom_ptr(SDRAM_BASE + dtb_offset, dtb_size));
             /* Set dtb address to R1 */
             RX_CPU(first_cpu)->env.regs[1] = SDRAM_BASE + dtb_offset;
         }
-- 
2.25.1

This is a respin of my pull request from earlier this week:
 * versal board compile failure fixed
 * a few new patches:
  - MAINTAINERS file fix
  - use ARRAY_SIZE macro in xilinx_zynq
  - avoid an array overrun in strongarm GPIO irq handling
  - fix an assert running KVM on an aarch64-only host

The following changes since commit 69e2d03843412b9c076515b3aa9a71db161b6a1a:

Merge remote-tracking branch 'remotes/riscv/tags/riscv-for-master-3.1-sf1' into staging (2018-11-02 13:16:13 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181102

for you to fetch changes up to 6f16da53ffe4567c0353f85055df04860eb4e6fc:

hw/arm: versal: Add a virtual Xilinx Versal board (2018-11-02 14:11:31 +0000)

----------------------------------------------------------------
target-arm queue:
 * microbit: Add the UART to our nRF51 SoC model
 * Add a virtual Xilinx Versal board "xlnx-versal-virt"
 * hw/arm/virt: Set VIRT_COMPAT_3_0 compat
 * MAINTAINERS: Remove bouncing email in ARM ACPI
 * strongarm: mask off high[31:28] bits from dir and state registers
 * target/arm: Conditionalize some asserts on aarch32 support
 * hw/arm/xilinx_zynq: Use the ARRAY_SIZE macro

----------------------------------------------------------------
Edgar E. Iglesias (2):
      hw/arm: versal: Add a model of Xilinx Versal SoC
      hw/arm: versal: Add a virtual Xilinx Versal board

Eric Auger (1):
      hw/arm/virt: Set VIRT_COMPAT_3_0 compat

Julia Suvorova (3):
      hw/char: Implement nRF51 SoC UART
      hw/arm/nrf51_soc: Connect UART to nRF51 SoC
      tests/boot-serial-test: Add microbit board testcase

Philippe Mathieu-Daudé (2):
      MAINTAINERS: Remove bouncing email in ARM ACPI
      hw/arm/xilinx_zynq: Use the ARRAY_SIZE macro

Prasad J Pandit (1):
      strongarm: mask off high[31:28] bits from dir and state registers

Richard Henderson (1):
      target/arm: Conditionalize some asserts on aarch32 support

hw/arm/Makefile.objs                |   1 +
 hw/char/Makefile.objs               |   1 +
 include/hw/arm/nrf51_soc.h          |   3 +
 include/hw/arm/xlnx-versal.h        | 122 +++++++++
 include/hw/char/nrf51_uart.h        |  78 ++++++
 target/arm/cpu.h                    |   5 +
 hw/arm/microbit.c                   |   2 +
 hw/arm/nrf51_soc.c                  |  20 ++
 hw/arm/strongarm.c                  |   4 +-
 hw/arm/virt.c                       |   4 +
 hw/arm/xilinx_zynq.c                |   2 +-
 hw/arm/xlnx-versal-virt.c           | 494 ++++++++++++++++++++++++++++++++++++
 hw/arm/xlnx-versal.c                | 323 +++++++++++++++++++++++
 hw/char/nrf51_uart.c                | 330 ++++++++++++++++++++++++
 target/arm/cpu.c                    |  15 +-
 tests/boot-serial-test.c            |  19 ++
 MAINTAINERS                         |   1 -
 default-configs/aarch64-softmmu.mak |   1 +
 hw/char/trace-events                |   4 +
 19 files changed, 1423 insertions(+), 6 deletions(-)
 create mode 100644 include/hw/arm/xlnx-versal.h
 create mode 100644 include/hw/char/nrf51_uart.h
 create mode 100644 hw/arm/xlnx-versal-virt.c
 create mode 100644 hw/arm/xlnx-versal.c
 create mode 100644 hw/char/nrf51_uart.c

From: Eric Auger <eric.auger@redhat.com>

We are missing the VIRT_COMPAT_3_0 definition and setting.
Let's add them.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20181024085602.16611-1-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_3_1_options(MachineClass *mc)
 }
 DEFINE_VIRT_MACHINE_AS_LATEST(3, 1)
 
+#define VIRT_COMPAT_3_0 \
+    HW_COMPAT_3_0
+
 static void virt_3_0_instance_init(Object *obj)
 {
     virt_3_1_instance_init(obj);
@@ -XXX,XX +XXX,XX @@ static void virt_3_0_instance_init(Object *obj)
 static void virt_machine_3_0_options(MachineClass *mc)
 {
     virt_machine_3_1_options(mc);
+    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_3_0);
 }
 DEFINE_VIRT_MACHINE(3, 0)
 
-- 
2.19.1

From: Julia Suvorova <jusual@mail.ru>

Not implemented: CTS/NCTS, PSEL*.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/Makefile.objs        |   1 +
 include/hw/char/nrf51_uart.h |  78 +++++++++
 hw/char/nrf51_uart.c         | 330 +++++++++++++++++++++++++++++++++++
 hw/char/trace-events         |   4 +
 4 files changed, 413 insertions(+)
 create mode 100644 include/hw/char/nrf51_uart.h
 create mode 100644 hw/char/nrf51_uart.c

diff --git a/hw/char/Makefile.objs b/hw/char/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/Makefile.objs
+++ b/hw/char/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_IPACK) += ipoctal232.o
 common-obj-$(CONFIG_ESCC) += escc.o
+common-obj-$(CONFIG_NRF51_SOC) += nrf51_uart.o
 common-obj-$(CONFIG_PARALLEL) += parallel.o
 common-obj-$(CONFIG_PARALLEL) += parallel-isa.o
 common-obj-$(CONFIG_PL011) += pl011.o
diff --git a/include/hw/char/nrf51_uart.h b/include/hw/char/nrf51_uart.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/char/nrf51_uart.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * nRF51 SoC UART emulation
+ *
+ * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#ifndef NRF51_UART_H
+#define NRF51_UART_H
+
+#include "hw/sysbus.h"
+#include "chardev/char-fe.h"
+#include "hw/registerfields.h"
+
+#define UART_FIFO_LENGTH 6
+#define UART_BASE 0x40002000
+#define UART_SIZE 0x1000
+
+#define TYPE_NRF51_UART "nrf51_soc.uart"
+#define NRF51_UART(obj) OBJECT_CHECK(NRF51UARTState, (obj), TYPE_NRF51_UART)
+
+REG32(UART_STARTRX, 0x000)
+REG32(UART_STOPRX, 0x004)
+REG32(UART_STARTTX, 0x008)
+REG32(UART_STOPTX, 0x00C)
+REG32(UART_SUSPEND, 0x01C)
+
+REG32(UART_CTS, 0x100)
+REG32(UART_NCTS, 0x104)
+REG32(UART_RXDRDY, 0x108)
+REG32(UART_TXDRDY, 0x11C)
+REG32(UART_ERROR, 0x124)
+REG32(UART_RXTO, 0x144)
+
+REG32(UART_INTEN, 0x300)
+    FIELD(UART_INTEN, CTS, 0, 1)
+    FIELD(UART_INTEN, NCTS, 1, 1)
+    FIELD(UART_INTEN, RXDRDY, 2, 1)
+    FIELD(UART_INTEN, TXDRDY, 7, 1)
+    FIELD(UART_INTEN, ERROR, 9, 1)
+    FIELD(UART_INTEN, RXTO, 17, 1)
+REG32(UART_INTENSET, 0x304)
+REG32(UART_INTENCLR, 0x308)
+REG32(UART_ERRORSRC, 0x480)
+REG32(UART_ENABLE, 0x500)
+REG32(UART_PSELRTS, 0x508)
+REG32(UART_PSELTXD, 0x50C)
+REG32(UART_PSELCTS, 0x510)
+REG32(UART_PSELRXD, 0x514)
+REG32(UART_RXD, 0x518)
+REG32(UART_TXD, 0x51C)
+REG32(UART_BAUDRATE, 0x524)
+REG32(UART_CONFIG, 0x56C)
+
+typedef struct NRF51UARTState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    CharBackend chr;
+    qemu_irq irq;
+    guint watch_tag;
+
+    uint8_t rx_fifo[UART_FIFO_LENGTH];
+    unsigned int rx_fifo_pos;
+    unsigned int rx_fifo_len;
+
+    uint32_t reg[0x56C];
+
+    bool rx_started;
+    bool tx_started;
+    bool pending_tx_byte;
+    bool enabled;
+} NRF51UARTState;
+
+#endif
diff --git a/hw/char/nrf51_uart.c b/hw/char/nrf51_uart.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/char/nrf51_uart.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * nRF51 SoC UART emulation
+ *
+ * See nRF51 Series Reference Manual, "29 Universal Asynchronous
+ * Receiver/Transmitter" for hardware specifications:
+ * http://infocenter.nordicsemi.com/pdf/nRF51_RM_v3.0.pdf
+ *
+ * Copyright (c) 2018 Julia Suvorova <jusual@mail.ru>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/char/nrf51_uart.h"
+#include "trace.h"
+
+static void nrf51_uart_update_irq(NRF51UARTState *s)
+{
+    bool irq = false;
+
+    irq |= (s->reg[R_UART_RXDRDY] &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXDRDY_MASK));
+    irq |= (s->reg[R_UART_TXDRDY] &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_TXDRDY_MASK));
+    irq |= (s->reg[R_UART_ERROR]  &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_ERROR_MASK));
+    irq |= (s->reg[R_UART_RXTO]   &&
+            (s->reg[R_UART_INTEN] & R_UART_INTEN_RXTO_MASK));
+
+    qemu_set_irq(s->irq, irq);
+}
+
+static uint64_t uart_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+    uint64_t r;
+
+    if (!s->enabled) {
+        return 0;
+    }
+
+    switch (addr) {
+    case A_UART_RXD:
+        r = s->rx_fifo[s->rx_fifo_pos];
+        if (s->rx_started && s->rx_fifo_len) {
+            s->rx_fifo_pos = (s->rx_fifo_pos + 1) % UART_FIFO_LENGTH;
+            s->rx_fifo_len--;
+            if (s->rx_fifo_len) {
+                s->reg[R_UART_RXDRDY] = 1;
+                nrf51_uart_update_irq(s);
+            }
+            qemu_chr_fe_accept_input(&s->chr);
+        }
+        break;
+    case A_UART_INTENSET:
+    case A_UART_INTENCLR:
+    case A_UART_INTEN:
+        r = s->reg[R_UART_INTEN];
+        break;
+    default:
+        r = s->reg[addr / 4];
+        break;
+    }
+
+    trace_nrf51_uart_read(addr, r, size);
+
+    return r;
+}
+
+static gboolean uart_transmit(GIOChannel *chan, GIOCondition cond, void *opaque)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+    int r;
+    uint8_t c = s->reg[R_UART_TXD];
+
+    s->watch_tag = 0;
+
+    r = qemu_chr_fe_write(&s->chr, &c, 1);
+    if (r <= 0) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+        if (!s->watch_tag) {
+            /* The hardware has no transmit error reporting,
+             * so silently drop the byte
+             */
+            goto buffer_drained;
+        }
+        return FALSE;
+    }
+
+buffer_drained:
+    s->reg[R_UART_TXDRDY] = 1;
+    s->pending_tx_byte = false;
+    return FALSE;
+}
+
+static void uart_cancel_transmit(NRF51UARTState *s)
+{
+    if (s->watch_tag) {
+        g_source_remove(s->watch_tag);
+        s->watch_tag = 0;
+    }
+}
+
+static void uart_write(void *opaque, hwaddr addr,
+                       uint64_t value, unsigned int size)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    trace_nrf51_uart_write(addr, value, size);
+
+    if (!s->enabled && (addr != A_UART_ENABLE)) {
+        return;
+    }
+
+    switch (addr) {
+    case A_UART_TXD:
+        if (!s->pending_tx_byte && s->tx_started) {
+            s->reg[R_UART_TXD] = value;
+            s->pending_tx_byte = true;
+            uart_transmit(NULL, G_IO_OUT, s);
+        }
+        break;
+    case A_UART_INTEN:
+        s->reg[R_UART_INTEN] = value;
+        break;
+    case A_UART_INTENSET:
+        s->reg[R_UART_INTEN] |= value;
+        break;
+    case A_UART_INTENCLR:
+        s->reg[R_UART_INTEN] &= ~value;
+        break;
+    case A_UART_TXDRDY ... A_UART_RXTO:
+        s->reg[addr / 4] = value;
+        break;
+    case A_UART_ERRORSRC:
+        s->reg[addr / 4] &= ~value;
+        break;
+    case A_UART_RXD:
+        break;
+    case A_UART_RXDRDY:
+        if (value == 0) {
+            s->reg[R_UART_RXDRDY] = 0;
+        }
+        break;
+    case A_UART_STARTTX:
+        if (value == 1) {
+            s->tx_started = true;
+        }
+        break;
+    case A_UART_STARTRX:
+        if (value == 1) {
+            s->rx_started = true;
+        }
+        break;
+    case A_UART_ENABLE:
+        if (value) {
+            if (value == 4) {
+                s->enabled = true;
+            }
+            break;
+        }
+        s->enabled = false;
+        value = 1;
+        /* fall through */
+    case A_UART_SUSPEND:
+    case A_UART_STOPTX:
+        if (value == 1) {
+            s->tx_started = false;
+        }
+        /* fall through */
+    case A_UART_STOPRX:
+        if (addr != A_UART_STOPTX && value == 1) {
+            s->rx_started = false;
+            s->reg[R_UART_RXTO] = 1;
+        }
+        break;
+    default:
+        s->reg[addr / 4] = value;
+        break;
+    }
+    nrf51_uart_update_irq(s);
+}
+
+static const MemoryRegionOps uart_ops = {
+    .read =  uart_read,
+    .write = uart_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void nrf51_uart_reset(DeviceState *dev)
+{
+    NRF51UARTState *s = NRF51_UART(dev);
+
+    s->pending_tx_byte = 0;
+
+    uart_cancel_transmit(s);
+
+    memset(s->reg, 0, sizeof(s->reg));
+
+    s->reg[R_UART_PSELRTS] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELTXD] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELCTS] = 0xFFFFFFFF;
+    s->reg[R_UART_PSELRXD] = 0xFFFFFFFF;
+    s->reg[R_UART_BAUDRATE] = 0x4000000;
+
+    s->rx_fifo_len = 0;
+    s->rx_fifo_pos = 0;
+    s->rx_started = false;
+    s->tx_started = false;
+    s->enabled = false;
+}
+
+static void uart_receive(void *opaque, const uint8_t *buf, int size)
+{
+
+    NRF51UARTState *s = NRF51_UART(opaque);
+    int i;
+
+    if (size == 0 || s->rx_fifo_len >= UART_FIFO_LENGTH) {
+        return;
+    }
+
+    for (i = 0; i < size; i++) {
+        uint32_t pos = (s->rx_fifo_pos + s->rx_fifo_len) % UART_FIFO_LENGTH;
+        s->rx_fifo[pos] = buf[i];
+        s->rx_fifo_len++;
+    }
+
+    s->reg[R_UART_RXDRDY] = 1;
+    nrf51_uart_update_irq(s);
+}
+
+static int uart_can_receive(void *opaque)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    return s->rx_started ? (UART_FIFO_LENGTH - s->rx_fifo_len) : 0;
+}
+
+static void uart_event(void *opaque, int event)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    if (event == CHR_EVENT_BREAK) {
+        s->reg[R_UART_ERRORSRC] |= 3;
+        s->reg[R_UART_ERROR] = 1;
+        nrf51_uart_update_irq(s);
+    }
+}
+
+static void nrf51_uart_realize(DeviceState *dev, Error **errp)
+{
+    NRF51UARTState *s = NRF51_UART(dev);
+
+    qemu_chr_fe_set_handlers(&s->chr, uart_can_receive, uart_receive,
+                             uart_event, NULL, s, NULL, true);
+}
+
+static void nrf51_uart_init(Object *obj)
+{
+    NRF51UARTState *s = NRF51_UART(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &uart_ops, s,
+                          "nrf51_soc.uart", UART_SIZE);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static int nrf51_uart_post_load(void *opaque, int version_id)
+{
+    NRF51UARTState *s = NRF51_UART(opaque);
+
+    if (s->pending_tx_byte) {
+        s->watch_tag = qemu_chr_fe_add_watch(&s->chr, G_IO_OUT | G_IO_HUP,
+                                             uart_transmit, s);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription nrf51_uart_vmstate = {
+    .name = "nrf51_soc.uart",
+    .post_load = nrf51_uart_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(reg, NRF51UARTState, 0x56C),
+        VMSTATE_UINT8_ARRAY(rx_fifo, NRF51UARTState, UART_FIFO_LENGTH),
+        VMSTATE_UINT32(rx_fifo_pos, NRF51UARTState),
+        VMSTATE_UINT32(rx_fifo_len, NRF51UARTState),
+        VMSTATE_BOOL(rx_started, NRF51UARTState),
+        VMSTATE_BOOL(tx_started, NRF51UARTState),
+        VMSTATE_BOOL(pending_tx_byte, NRF51UARTState),
+        VMSTATE_BOOL(enabled, NRF51UARTState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property nrf51_uart_properties[] = {
+    DEFINE_PROP_CHR("chardev", NRF51UARTState, chr),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void nrf51_uart_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = nrf51_uart_reset;
+    dc->realize = nrf51_uart_realize;
+    dc->props = nrf51_uart_properties;
+    dc->vmsd = &nrf51_uart_vmstate;
+}
+
+static const TypeInfo nrf51_uart_info = {
+    .name = TYPE_NRF51_UART,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(NRF51UARTState),
+    .instance_init = nrf51_uart_init,
+    .class_init = nrf51_uart_class_init
+};
+
+static void nrf51_uart_register_types(void)
+{
+    type_register_static(&nrf51_uart_info);
+}
+
+type_init(nrf51_uart_register_types)
diff --git a/hw/char/trace-events b/hw/char/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -XXX,XX +XXX,XX @@ cmsdk_apb_uart_receive(uint8_t c) "CMSDK APB UART: got character 0x%x from backe
 cmsdk_apb_uart_tx_pending(void) "CMSDK APB UART: character send to backend pending"
 cmsdk_apb_uart_tx(uint8_t c) "CMSDK APB UART: character 0x%x sent to backend"
 cmsdk_apb_uart_set_params(int speed) "CMSDK APB UART: params set to %d 8N1"
+
+# hw/char/nrf51_uart.c
+nrf51_uart_read(uint64_t addr, uint64_t r, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
+nrf51_uart_write(uint64_t addr, uint64_t value, unsigned int size) "addr 0x%" PRIx64 " value 0x%" PRIx64 " size %u"
-- 
2.19.1

From: Julia Suvorova <jusual@mail.ru>

Wire up nRF51 UART in the corresponding SoC.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/nrf51_soc.h |  3 +++
 hw/arm/microbit.c          |  2 ++
 hw/arm/nrf51_soc.c         | 20 ++++++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/nrf51_soc.h
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/armv7m.h"
+#include "hw/char/nrf51_uart.h"
 
 #define TYPE_NRF51_SOC "nrf51-soc"
 #define NRF51_SOC(obj) \
@@ -XXX,XX +XXX,XX @@ typedef struct NRF51State {
     /*< public >*/
     ARMv7MState cpu;
 
+    NRF51UARTState uart;
+
     MemoryRegion iomem;
     MemoryRegion sram;
     MemoryRegion flash;
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/boards.h"
 #include "hw/arm/arm.h"
+#include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
 #include "hw/arm/nrf51_soc.h"
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
 
     sysbus_init_child_obj(OBJECT(machine), "nrf51", soc, sizeof(s->nrf51),
                           TYPE_NRF51_SOC);
+    qdev_prop_set_chr(DEVICE(&s->nrf51), "serial0", serial_hd(0));
     object_property_set_link(soc, OBJECT(system_memory), "memory",
                              &error_fatal);
     object_property_set_bool(soc, true, "realized", &error_fatal);
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #define NRF51822_FLASH_SIZE     (256 * 1024)
 #define NRF51822_SRAM_SIZE      (16 * 1024)
 
+#define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
+
 static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
 {
     NRF51State *s = NRF51_SOC(dev_soc);
+    MemoryRegion *mr;
     Error *err = NULL;
 
     if (!s->board_memory) {
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     memory_region_add_subregion(&s->container, SRAM_BASE, &s->sram);
 
+    /* UART */
+    object_property_set_bool(OBJECT(&s->uart), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
+    memory_region_add_subregion_overlap(&s->container, UART_BASE, mr, 0);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
+                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       BASE_TO_IRQ(UART_BASE)));
+
     create_unimplemented_device("nrf51_soc.io", IOMEM_BASE, IOMEM_SIZE);
     create_unimplemented_device("nrf51_soc.ficr", FICR_BASE, FICR_SIZE);
     create_unimplemented_device("nrf51_soc.private",
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
     qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
                          ARM_CPU_TYPE_NAME("cortex-m0"));
     qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+
+    sysbus_init_child_obj(obj, "uart", &s->uart, sizeof(s->uart),
+                           TYPE_NRF51_UART);
+    object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev",
+                              &error_abort);
 }
 
 static Property nrf51_soc_properties[] = {
-- 
2.19.1

From: Julia Suvorova <jusual@mail.ru>

New mini-kernel test for nRF51 SoC UART.

Signed-off-by: Julia Suvorova <jusual@mail.ru>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/boot-serial-test.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tests/boot-serial-test.c b/tests/boot-serial-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/boot-serial-test.c
+++ b/tests/boot-serial-test.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t kernel_aarch64[] = {
     0xfd, 0xff, 0xff, 0x17,                 /* b       -12 (loop) */
 };
 
+static const uint8_t kernel_nrf51[] = {
+    0x00, 0x00, 0x00, 0x00,                 /* Stack top address */
+    0x09, 0x00, 0x00, 0x00,                 /* Reset handler address */
+    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get ENABLE */
+    0x04, 0x21,                             /* movs r1, #4 */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0x04, 0x4a,                             /* ldr  r2, [pc, #16] Get STARTTX */
+    0x01, 0x21,                             /* movs r1, #1 */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0x03, 0x4a,                             /* ldr  r2, [pc, #12] Get TXD */
+    0x54, 0x21,                             /* movs r1, 'T' */
+    0x11, 0x60,                             /* str  r1, [r2] */
+    0xfe, 0xe7,                             /* b    . */
+    0x00, 0x25, 0x00, 0x40,                 /* 0x40002500 = UART ENABLE */
+    0x08, 0x20, 0x00, 0x40,                 /* 0x40002008 = UART STARTTX */
+    0x1c, 0x25, 0x00, 0x40                  /* 0x4000251c = UART TXD */
+};
+
 typedef struct testdef {
     const char *arch;       /* Target architecture */
     const char *machine;    /* Name of the machine */
@@ -XXX,XX +XXX,XX @@ static testdef_t tests[] = {
     { "hppa", "hppa", "", "SeaBIOS wants SYSTEM HALT" },
     { "aarch64", "virt", "-cpu cortex-a57", "TT", sizeof(kernel_aarch64),
       kernel_aarch64 },
+    { "arm", "microbit", "", "T", sizeof(kernel_nrf51), kernel_nrf51 },
 
     { NULL }
 };
-- 
2.19.1

From: Prasad J Pandit <pjp@fedoraproject.org>

The high[31:28] bits of 'direction' and 'state' registers of
SA-1100/SA-1110 device are reserved. Setting them may lead to
OOB 's->handler[]' array access issue. Mask off [31:28] bits to
avoid it.

Reported-by: Moguofang <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20181030114635.31232-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/strongarm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@ static void strongarm_gpio_write(void *opaque, hwaddr offset,
 
     switch (offset) {
     case GPDR:        /* GPIO Pin-Direction registers */
-        s->dir = value;
+        s->dir = value & 0x0fffffff;
         strongarm_gpio_handler_update(s);
         break;
 
     case GPSR:        /* GPIO Pin-Output Set registers */
-        s->olevel |= value;
+        s->olevel |= value & 0x0fffffff;
         strongarm_gpio_handler_update(s);
         break;
 
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

When populating id registers from kvm, on a host that doesn't support
aarch32 mode at all, neither arm_div nor jazelle will be supported either.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181102102025.3546-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h |  5 +++++
 target/arm/cpu.c | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
 }
 
+static inline bool isar_feature_aa64_aa32(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, EL0) >= 2;
+}
+
 static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     CPUARMState *env = &cpu->env;
     int pagebits;
     Error *local_err = NULL;
+    bool no_aa32 = false;
 
     /* If we needed to query the host kernel for the CPU features
      * then it's possible that might have failed in the initfn, but
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
             set_feature(env, ARM_FEATURE_V7VE);
         }
     }
+
+    /*
+     * There exist AArch64 cpus without AArch32 support.  When KVM
+     * queries ID_ISAR0_EL1 on such a host, the value is UNKNOWN.
+     * Similarly, we cannot check ID_AA64PFR0 without AArch64 support.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        no_aa32 = !cpu_isar_feature(aa64_aa32, cpu);
+    }
+
     if (arm_feature(env, ARM_FEATURE_V7VE)) {
         /* v7 Virtualization Extensions. In real hardware this implies
          * EL2 and also the presence of the Security Extensions.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * Presence of EL2 itself is ARM_FEATURE_EL2, and of the
          * Security Extensions is ARM_FEATURE_EL3.
          */
-        assert(cpu_isar_feature(arm_div, cpu));
+        assert(no_aa32 || cpu_isar_feature(arm_div, cpu));
         set_feature(env, ARM_FEATURE_LPAE);
         set_feature(env, ARM_FEATURE_V7);
     }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     if (arm_feature(env, ARM_FEATURE_V6)) {
         set_feature(env, ARM_FEATURE_V5);
         if (!arm_feature(env, ARM_FEATURE_M)) {
-            assert(cpu_isar_feature(jazelle, cpu));
+            assert(no_aa32 || cpu_isar_feature(jazelle, cpu));
             set_feature(env, ARM_FEATURE_AUXCR);
         }
     }
-- 
2.19.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of Xilinx Versal SoC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181102131913.1535-2-edgar.iglesias@xilinx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                |   1 +
 include/hw/arm/xlnx-versal.h        | 122 +++++++++++
 hw/arm/xlnx-versal.c                | 323 ++++++++++++++++++++++++++++
 default-configs/aarch64-softmmu.mak |   1 +
 4 files changed, 447 insertions(+)
 create mode 100644 include/hw/arm/xlnx-versal.h
 create mode 100644 hw/arm/xlnx-versal.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
+obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Model of the Xilinx Versal
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#ifndef XLNX_VERSAL_H
+#define XLNX_VERSAL_H
+
+#include "hw/sysbus.h"
+#include "hw/arm/arm.h"
+#include "hw/intc/arm_gicv3.h"
+
+#define TYPE_XLNX_VERSAL "xlnx-versal"
+#define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
+
+#define XLNX_VERSAL_NR_ACPUS   2
+#define XLNX_VERSAL_NR_UARTS   2
+#define XLNX_VERSAL_NR_GEMS    2
+#define XLNX_VERSAL_NR_IRQS    256
+
+typedef struct Versal {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    struct {
+        struct {
+            MemoryRegion mr;
+            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
+            GICv3State gic;
+        } apu;
+    } fpd;
+
+    MemoryRegion mr_ps;
+
+    struct {
+        /* 4 ranges to access DDR.  */
+        MemoryRegion mr_ddr_ranges[4];
+    } noc;
+
+    struct {
+        MemoryRegion mr_ocm;
+
+        struct {
+            SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
+            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
+        } iou;
+    } lpd;
+
+    struct {
+        MemoryRegion *mr_ddr;
+        uint32_t psci_conduit;
+    } cfg;
+} Versal;
+
+/* Memory-map and IRQ definitions. Copied a subset from
+ * auto-generated files.  */
+
+#define VERSAL_GIC_MAINT_IRQ        9
+#define VERSAL_TIMER_VIRT_IRQ       11
+#define VERSAL_TIMER_S_EL1_IRQ      13
+#define VERSAL_TIMER_NS_EL1_IRQ     14
+#define VERSAL_TIMER_NS_EL2_IRQ     10
+
+#define VERSAL_UART0_IRQ_0         18
+#define VERSAL_UART1_IRQ_0         19
+#define VERSAL_GEM0_IRQ_0          56
+#define VERSAL_GEM0_WAKE_IRQ_0     57
+#define VERSAL_GEM1_IRQ_0          58
+#define VERSAL_GEM1_WAKE_IRQ_0     59
+
+/* Architecturally eserved IRQs suitable for virtualization.  */
+#define VERSAL_RSVD_HIGH_IRQ_FIRST 160
+#define VERSAL_RSVD_HIGH_IRQ_LAST  255
+
+#define MM_TOP_RSVD                 0xa0000000U
+#define MM_TOP_RSVD_SIZE            0x4000000
+#define MM_GIC_APU_DIST_MAIN        0xf9000000U
+#define MM_GIC_APU_DIST_MAIN_SIZE   0x10000
+#define MM_GIC_APU_REDIST_0         0xf9080000U
+#define MM_GIC_APU_REDIST_0_SIZE    0x80000
+
+#define MM_UART0                    0xff000000U
+#define MM_UART0_SIZE               0x10000
+#define MM_UART1                    0xff010000U
+#define MM_UART1_SIZE               0x10000
+
+#define MM_GEM0                     0xff0c0000U
+#define MM_GEM0_SIZE                0x10000
+#define MM_GEM1                     0xff0d0000U
+#define MM_GEM1_SIZE                0x10000
+
+#define MM_OCM                      0xfffc0000U
+#define MM_OCM_SIZE                 0x40000
+
+#define MM_TOP_DDR                  0x0
+#define MM_TOP_DDR_SIZE             0x80000000U
+#define MM_TOP_DDR_2                0x800000000ULL
+#define MM_TOP_DDR_2_SIZE           0x800000000ULL
+#define MM_TOP_DDR_3                0xc000000000ULL
+#define MM_TOP_DDR_3_SIZE           0x4000000000ULL
+#define MM_TOP_DDR_4                0x10000000000ULL
+#define MM_TOP_DDR_4_SIZE           0xb780000000ULL
+
+#define MM_PSM_START                0xffc80000U
+#define MM_PSM_END                  0xffcf0000U
+
+#define MM_CRL                      0xff5e0000U
+#define MM_CRL_SIZE                 0x300000
+#define MM_IOU_SCNTR                0xff130000U
+#define MM_IOU_SCNTR_SIZE           0x10000
+#define MM_IOU_SCNTRS               0xff140000U
+#define MM_IOU_SCNTRS_SIZE          0x10000
+#define MM_FPD_CRF                  0xfd1a0000U
+#define MM_FPD_CRF_SIZE             0x140000
+#endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Versal SoC model.
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "qemu/log.h"
+#include "hw/sysbus.h"
+#include "net/net.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/kvm.h"
+#include "hw/arm/arm.h"
+#include "kvm_arm.h"
+#include "hw/misc/unimp.h"
+#include "hw/intc/arm_gicv3_common.h"
+#include "hw/arm/xlnx-versal.h"
+
+#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+#define GEM_REVISION        0x40070106
+
+static void versal_create_apu_cpus(Versal *s)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
+        Object *obj;
+        char *name;
+
+        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
+        if (!obj) {
+            /* Secondary CPUs start in PSCI powered-down state */
+            error_report("Unable to create apu.cpu[%d] of type %s",
+                         i, XLNX_VERSAL_ACPU_TYPE);
+            exit(EXIT_FAILURE);
+        }
+
+        name = g_strdup_printf("apu-cpu[%d]", i);
+        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
+        g_free(name);
+
+        object_property_set_int(obj, s->cfg.psci_conduit,
+                                "psci-conduit", &error_abort);
+        if (i) {
+            object_property_set_bool(obj, true,
+                                     "start-powered-off", &error_abort);
+        }
+
+        object_property_set_int(obj, ARRAY_SIZE(s->fpd.apu.cpu),
+                                "core-count", &error_abort);
+        object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
+                                 &error_abort);
+        object_property_set_bool(obj, true, "realized", &error_fatal);
+        s->fpd.apu.cpu[i] = ARM_CPU(obj);
+    }
+}
+
+static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+{
+    static const uint64_t addrs[] = {
+        MM_GIC_APU_DIST_MAIN,
+        MM_GIC_APU_REDIST_0
+    };
+    SysBusDevice *gicbusdev;
+    DeviceState *gicdev;
+    int nr_apu_cpus = ARRAY_SIZE(s->fpd.apu.cpu);
+    int i;
+
+    sysbus_init_child_obj(OBJECT(s), "apu-gic",
+                          &s->fpd.apu.gic, sizeof(s->fpd.apu.gic),
+                          gicv3_class_name());
+    gicbusdev = SYS_BUS_DEVICE(&s->fpd.apu.gic);
+    gicdev = DEVICE(&s->fpd.apu.gic);
+    qdev_prop_set_uint32(gicdev, "revision", 3);
+    qdev_prop_set_uint32(gicdev, "num-cpu", 2);
+    qdev_prop_set_uint32(gicdev, "num-irq", XLNX_VERSAL_NR_IRQS + 32);
+    qdev_prop_set_uint32(gicdev, "len-redist-region-count", 1);
+    qdev_prop_set_uint32(gicdev, "redist-region-count[0]", 2);
+    qdev_prop_set_bit(gicdev, "has-security-extensions", true);
+
+    object_property_set_bool(OBJECT(&s->fpd.apu.gic), true, "realized",
+                                    &error_fatal);
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        MemoryRegion *mr;
+
+        mr = sysbus_mmio_get_region(gicbusdev, i);
+        memory_region_add_subregion(&s->fpd.apu.mr, addrs[i], mr);
+    }
+
+    for (i = 0; i < nr_apu_cpus; i++) {
+        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
+        int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
+        qemu_irq maint_irq;
+        int ti;
+        /* Mapping from the output timer irq lines from the CPU to the
+         * GIC PPI inputs.
+         */
+        const int timer_irq[] = {
+            [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
+            [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
+            [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
+            [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
+        };
+
+        for (ti = 0; ti < ARRAY_SIZE(timer_irq); ti++) {
+            qdev_connect_gpio_out(cpudev, ti,
+                                  qdev_get_gpio_in(gicdev,
+                                                   ppibase + timer_irq[ti]));
+        }
+        maint_irq = qdev_get_gpio_in(gicdev,
+                                        ppibase + VERSAL_GIC_MAINT_IRQ);
+        qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
+                                    0, maint_irq);
+        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
+        sysbus_connect_irq(gicbusdev, i + nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
+        sysbus_connect_irq(gicbusdev, i + 2 * nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
+        sysbus_connect_irq(gicbusdev, i + 3 * nr_apu_cpus,
+                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
+    }
+
+    for (i = 0; i < XLNX_VERSAL_NR_IRQS; i++) {
+        pic[i] = qdev_get_gpio_in(gicdev, i);
+    }
+}
+
+static void versal_create_uarts(Versal *s, qemu_irq *pic)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
+        static const int irqs[] = { VERSAL_UART0_IRQ_0, VERSAL_UART1_IRQ_0};
+        static const uint64_t addrs[] = { MM_UART0, MM_UART1 };
+        char *name = g_strdup_printf("uart%d", i);
+        DeviceState *dev;
+        MemoryRegion *mr;
+
+        dev = qdev_create(NULL, "pl011");
+        s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+        qdev_init_nofail(dev);
+
+        mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
+        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+
+        sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
+        g_free(name);
+    }
+}
+
+static void versal_create_gems(Versal *s, qemu_irq *pic)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
+        static const int irqs[] = { VERSAL_GEM0_IRQ_0, VERSAL_GEM1_IRQ_0};
+        static const uint64_t addrs[] = { MM_GEM0, MM_GEM1 };
+        char *name = g_strdup_printf("gem%d", i);
+        NICInfo *nd = &nd_table[i];
+        DeviceState *dev;
+        MemoryRegion *mr;
+
+        dev = qdev_create(NULL, "cadence_gem");
+        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
+        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+        if (nd->used) {
+            qemu_check_nic_model(nd, "cadence_gem");
+            qdev_set_nic_properties(dev, nd);
+        }
+        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
+                                2, "num-priority-queues",
+                                &error_abort);
+        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
+                                 OBJECT(&s->mr_ps), "dma",
+                                 &error_abort);
+        qdev_init_nofail(dev);
+
+        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
+        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+
+        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
+        g_free(name);
+    }
+}
+
+/* This takes the board allocated linear DDR memory and creates aliases
+ * for each split DDR range/aperture on the Versal address map.
+ */
+static void versal_map_ddr(Versal *s)
+{
+    uint64_t size = memory_region_size(s->cfg.mr_ddr);
+    /* Describes the various split DDR access regions.  */
+    static const struct {
+        uint64_t base;
+        uint64_t size;
+    } addr_ranges[] = {
+        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
+        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
+        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
+        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
+    };
+    uint64_t offset = 0;
+    int i;
+
+    assert(ARRAY_SIZE(addr_ranges) == ARRAY_SIZE(s->noc.mr_ddr_ranges));
+    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
+        char *name;
+        uint64_t mapsize;
+
+        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
+        name = g_strdup_printf("noc-ddr-range%d", i);
+        /* Create the MR alias.  */
+        memory_region_init_alias(&s->noc.mr_ddr_ranges[i], OBJECT(s),
+                                 name, s->cfg.mr_ddr,
+                                 offset, mapsize);
+
+        /* Map it onto the NoC MR.  */
+        memory_region_add_subregion(&s->mr_ps, addr_ranges[i].base,
+                                    &s->noc.mr_ddr_ranges[i]);
+        offset += mapsize;
+        size -= mapsize;
+        g_free(name);
+    }
+}
+
+static void versal_unimp_area(Versal *s, const char *name,
+                                MemoryRegion *mr,
+                                hwaddr base, hwaddr size)
+{
+    DeviceState *dev = qdev_create(NULL, TYPE_UNIMPLEMENTED_DEVICE);
+    MemoryRegion *mr_dev;
+
+    qdev_prop_set_string(dev, "name", name);
+    qdev_prop_set_uint64(dev, "size", size);
+    object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+    qdev_init_nofail(dev);
+
+    mr_dev = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_add_subregion(mr, base, mr_dev);
+}
+
+static void versal_unimp(Versal *s)
+{
+    versal_unimp_area(s, "psm", &s->mr_ps,
+                        MM_PSM_START, MM_PSM_END - MM_PSM_START);
+    versal_unimp_area(s, "crl", &s->mr_ps,
+                        MM_CRL, MM_CRL_SIZE);
+    versal_unimp_area(s, "crf", &s->mr_ps,
+                        MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "iou-scntr", &s->mr_ps,
+                        MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
+    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
+                        MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
+}
+
+static void versal_realize(DeviceState *dev, Error **errp)
+{
+    Versal *s = XLNX_VERSAL(dev);
+    qemu_irq pic[XLNX_VERSAL_NR_IRQS];
+
+    versal_create_apu_cpus(s);
+    versal_create_apu_gic(s, pic);
+    versal_create_uarts(s, pic);
+    versal_create_gems(s, pic);
+    versal_map_ddr(s);
+    versal_unimp(s);
+
+    /* Create the On Chip Memory (OCM).  */
+    memory_region_init_ram(&s->lpd.mr_ocm, OBJECT(s), "ocm",
+                           MM_OCM_SIZE, &error_fatal);
+
+    memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
+    memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
+}
+
+static void versal_init(Object *obj)
+{
+    Versal *s = XLNX_VERSAL(obj);
+
+    memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
+    memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
+}
+
+static Property versal_properties[] = {
+    DEFINE_PROP_LINK("ddr", Versal, cfg.mr_ddr, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("psci-conduit", Versal, cfg.psci_conduit, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void versal_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = versal_realize;
+    dc->props = versal_properties;
+    /* No VMSD since we haven't got any top-level SoC state to save.  */
+}
+
+static const TypeInfo versal_info = {
+    .name = TYPE_XLNX_VERSAL,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Versal),
+    .instance_init = versal_init,
+    .class_init = versal_class_init,
+};
+
+static void versal_register_types(void)
+{
+    type_register_static(&versal_info);
+}
+
+type_init(versal_register_types);
diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/aarch64-softmmu.mak
+++ b/default-configs/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
 CONFIG_DPCD=y
 CONFIG_XLNX_ZYNQMP=y
 CONFIG_XLNX_ZYNQMP_ARM=y
+CONFIG_XLNX_VERSAL=y
 CONFIG_ARM_SMMUV3=y
-- 
2.19.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a virtual Xilinx Versal board.

This board is based on the Xilinx Versal SoC. The exact
details of what peripherals are attached to this board
will remain in control of QEMU. QEMU will generate an
FDT on the fly for Linux and other software to auto-discover
peripherals.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20181102131913.1535-3-edgar.iglesias@xilinx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs      |   2 +-
 hw/arm/xlnx-versal-virt.c | 494 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 495 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/xlnx-versal-virt.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
-obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o
+obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Versal Virtual board.
+ *
+ * Copyright (c) 2018 Xilinx Inc.
+ * Written by Edgar E. Iglesias
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 or
+ * (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "sysemu/device_tree.h"
+#include "exec/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/sysbus.h"
+#include "hw/arm/sysbus-fdt.h"
+#include "hw/arm/fdt.h"
+#include "cpu.h"
+#include "hw/arm/xlnx-versal.h"
+
+#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
+#define XLNX_VERSAL_VIRT_MACHINE(obj) \
+    OBJECT_CHECK(VersalVirt, (obj), TYPE_XLNX_VERSAL_VIRT_MACHINE)
+
+typedef struct VersalVirt {
+    MachineState parent_obj;
+
+    Versal soc;
+    MemoryRegion mr_ddr;
+
+    void *fdt;
+    int fdt_size;
+    struct {
+        uint32_t gic;
+        uint32_t ethernet_phy[2];
+        uint32_t clk_125Mhz;
+        uint32_t clk_25Mhz;
+    } phandle;
+    struct arm_boot_info binfo;
+
+    struct {
+        bool secure;
+    } cfg;
+} VersalVirt;
+
+static void fdt_create(VersalVirt *s)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(s);
+    int i;
+
+    s->fdt = create_device_tree(&s->fdt_size);
+    if (!s->fdt) {
+        error_report("create_device_tree() failed");
+        exit(1);
+    }
+
+    /* Allocate all phandles.  */
+    s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
+    for (i = 0; i < ARRAY_SIZE(s->phandle.ethernet_phy); i++) {
+        s->phandle.ethernet_phy[i] = qemu_fdt_alloc_phandle(s->fdt);
+    }
+    s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
+    s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
+
+    /* Create /chosen node for load_dtb.  */
+    qemu_fdt_add_subnode(s->fdt, "/chosen");
+
+    /* Header */
+    qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
+    qemu_fdt_setprop_cell(s->fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_setprop_cell(s->fdt, "/", "#address-cells", 0x2);
+    qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
+    qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
+}
+
+static void fdt_add_clk_node(VersalVirt *s, const char *name,
+                             unsigned int freq_hz, uint32_t phandle)
+{
+    qemu_fdt_add_subnode(s->fdt, name);
+    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
+    qemu_fdt_setprop_cell(s->fdt, name, "clock-frequency", freq_hz);
+    qemu_fdt_setprop_cell(s->fdt, name, "#clock-cells", 0x0);
+    qemu_fdt_setprop_string(s->fdt, name, "compatible", "fixed-clock");
+    qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
+}
+
+static void fdt_add_cpu_nodes(VersalVirt *s, uint32_t psci_conduit)
+{
+    int i;
+
+    qemu_fdt_add_subnode(s->fdt, "/cpus");
+    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#size-cells", 0x0);
+    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#address-cells", 1);
+
+    for (i = XLNX_VERSAL_NR_ACPUS - 1; i >= 0; i--) {
+        char *name = g_strdup_printf("/cpus/cpu@%d", i);
+        ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
+
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop_cell(s->fdt, name, "reg", armcpu->mp_affinity);
+        if (psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
+            qemu_fdt_setprop_string(s->fdt, name, "enable-method", "psci");
+        }
+        qemu_fdt_setprop_string(s->fdt, name, "device_type", "cpu");
+        qemu_fdt_setprop_string(s->fdt, name, "compatible",
+                                armcpu->dtb_compatible);
+        g_free(name);
+    }
+}
+
+static void fdt_add_gic_nodes(VersalVirt *s)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/gic@%x", MM_GIC_APU_DIST_MAIN);
+    qemu_fdt_add_subnode(s->fdt, nodename);
+    qemu_fdt_setprop_cell(s->fdt, nodename, "phandle", s->phandle.gic);
+    qemu_fdt_setprop_cells(s->fdt, nodename, "interrupts",
+                           GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop(s->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_sized_cells(s->fdt, nodename, "reg",
+                                 2, MM_GIC_APU_DIST_MAIN,
+                                 2, MM_GIC_APU_DIST_MAIN_SIZE,
+                                 2, MM_GIC_APU_REDIST_0,
+                                 2, MM_GIC_APU_REDIST_0_SIZE);
+    qemu_fdt_setprop_cell(s->fdt, nodename, "#interrupt-cells", 3);
+    qemu_fdt_setprop_string(s->fdt, nodename, "compatible", "arm,gic-v3");
+}
+
+static void fdt_add_timer_nodes(VersalVirt *s)
+{
+    const char compat[] = "arm,armv8-timer";
+    uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
+
+    qemu_fdt_add_subnode(s->fdt, "/timer");
+    qemu_fdt_setprop_cells(s->fdt, "/timer", "interrupts",
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ, irqflags,
+            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ, irqflags);
+    qemu_fdt_setprop(s->fdt, "/timer", "compatible",
+                     compat, sizeof(compat));
+}
+
+static void fdt_add_uart_nodes(VersalVirt *s)
+{
+    uint64_t addrs[] = { MM_UART1, MM_UART0 };
+    unsigned int irqs[] = { VERSAL_UART1_IRQ_0, VERSAL_UART0_IRQ_0 };
+    const char compat[] = "arm,pl011\0arm,sbsa-uart";
+    const char clocknames[] = "uartclk\0apb_pclk";
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        char *name = g_strdup_printf("/uart@%" PRIx64, addrs[i]);
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop_cell(s->fdt, name, "current-speed", 115200);
+        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
+        qemu_fdt_setprop(s->fdt, name, "clock-names",
+                         clocknames, sizeof(clocknames));
+
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, addrs[i], 2, 0x1000);
+        qemu_fdt_setprop(s->fdt, name, "compatible",
+                         compat, sizeof(compat));
+        qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
+
+        if (addrs[i] == MM_UART0) {
+            /* Select UART0.  */
+            qemu_fdt_setprop_string(s->fdt, "/chosen", "stdout-path", name);
+        }
+        g_free(name);
+    }
+}
+
+static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
+                                     uint32_t phandle)
+{
+    char *name = g_strdup_printf("%s/fixed-link", gemname);
+
+    qemu_fdt_add_subnode(s->fdt, name);
+    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
+    qemu_fdt_setprop(s->fdt, name, "full-duplex", NULL, 0);
+    qemu_fdt_setprop_cell(s->fdt, name, "speed", 1000);
+    g_free(name);
+}
+
+static void fdt_add_gem_nodes(VersalVirt *s)
+{
+    uint64_t addrs[] = { MM_GEM1, MM_GEM0 };
+    unsigned int irqs[] = { VERSAL_GEM1_IRQ_0, VERSAL_GEM0_IRQ_0 };
+    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
+    const char compat_gem[] = "cdns,zynqmp-gem\0cdns,gem";
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
+        char *name = g_strdup_printf("/ethernet@%" PRIx64, addrs[i]);
+        qemu_fdt_add_subnode(s->fdt, name);
+
+        fdt_add_fixed_link_nodes(s, name, s->phandle.ethernet_phy[i]);
+        qemu_fdt_setprop_string(s->fdt, name, "phy-mode", "rgmii-id");
+        qemu_fdt_setprop_cell(s->fdt, name, "phy-handle",
+                              s->phandle.ethernet_phy[i]);
+        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz,
+                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
+        qemu_fdt_setprop(s->fdt, name, "clock-names",
+                         clocknames, sizeof(clocknames));
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, addrs[i], 2, 0x1000);
+        qemu_fdt_setprop(s->fdt, name, "compatible",
+                         compat_gem, sizeof(compat_gem));
+        qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 1);
+        qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 0);
+        g_free(name);
+    }
+}
+
+static void fdt_nop_memory_nodes(void *fdt, Error **errp)
+{
+    Error *err = NULL;
+    char **node_path;
+    int n = 0;
+
+    node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    while (node_path[n]) {
+        if (g_str_has_prefix(node_path[n], "/memory")) {
+            qemu_fdt_nop_node(fdt, node_path[n]);
+        }
+        n++;
+    }
+    g_strfreev(node_path);
+}
+
+static void fdt_add_memory_nodes(VersalVirt *s, void *fdt, uint64_t ram_size)
+{
+    /* Describes the various split DDR access regions.  */
+    static const struct {
+        uint64_t base;
+        uint64_t size;
+    } addr_ranges[] = {
+        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
+        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
+        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
+        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
+    };
+    uint64_t mem_reg_prop[8] = {0};
+    uint64_t size = ram_size;
+    Error *err = NULL;
+    char *name;
+    int i;
+
+    fdt_nop_memory_nodes(fdt, &err);
+    if (err) {
+        error_report_err(err);
+        return;
+    }
+
+    name = g_strdup_printf("/memory@%x", MM_TOP_DDR);
+    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
+        uint64_t mapsize;
+
+        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
+
+        mem_reg_prop[i * 2] = addr_ranges[i].base;
+        mem_reg_prop[i * 2 + 1] = mapsize;
+        size -= mapsize;
+    }
+    qemu_fdt_add_subnode(fdt, name);
+    qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
+
+    switch (i) {
+    case 1:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1]);
+        break;
+    case 2:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3]);
+        break;
+    case 3:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3],
+                                     2, mem_reg_prop[4],
+                                     2, mem_reg_prop[5]);
+        break;
+    case 4:
+        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
+                                     2, mem_reg_prop[0],
+                                     2, mem_reg_prop[1],
+                                     2, mem_reg_prop[2],
+                                     2, mem_reg_prop[3],
+                                     2, mem_reg_prop[4],
+                                     2, mem_reg_prop[5],
+                                     2, mem_reg_prop[6],
+                                     2, mem_reg_prop[7]);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    g_free(name);
+}
+
+static void versal_virt_modify_dtb(const struct arm_boot_info *binfo,
+                                    void *fdt)
+{
+    VersalVirt *s = container_of(binfo, VersalVirt, binfo);
+
+    fdt_add_memory_nodes(s, fdt, binfo->ram_size);
+}
+
+static void *versal_virt_get_dtb(const struct arm_boot_info *binfo,
+                                  int *fdt_size)
+{
+    const VersalVirt *board = container_of(binfo, VersalVirt, binfo);
+
+    *fdt_size = board->fdt_size;
+    return board->fdt;
+}
+
+#define NUM_VIRTIO_TRANSPORT 32
+static void create_virtio_regions(VersalVirt *s)
+{
+    int virtio_mmio_size = 0x200;
+    int i;
+
+    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
+        char *name = g_strdup_printf("virtio%d", i);;
+        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
+        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
+        MemoryRegion *mr;
+        DeviceState *dev;
+        qemu_irq pic_irq;
+
+        pic_irq = qdev_get_gpio_in(DEVICE(&s->soc.fpd.apu.gic), irq);
+        dev = qdev_create(NULL, "virtio-mmio");
+        object_property_add_child(OBJECT(&s->soc), name, OBJECT(dev),
+                                  &error_fatal);
+        qdev_init_nofail(dev);
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic_irq);
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+        memory_region_add_subregion(&s->soc.mr_ps, base, mr);
+        sysbus_create_simple("virtio-mmio", base, pic_irq);
+    }
+
+    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
+        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
+        int irq = VERSAL_RSVD_HIGH_IRQ_FIRST + i;
+        char *name = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
+
+        qemu_fdt_add_subnode(s->fdt, name);
+        qemu_fdt_setprop(s->fdt, name, "dma-coherent", NULL, 0);
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irq,
+                               GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, base, 2, virtio_mmio_size);
+        qemu_fdt_setprop_string(s->fdt, name, "compatible", "virtio,mmio");
+        g_free(name);
+    }
+}
+
+static void versal_virt_init(MachineState *machine)
+{
+    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
+    int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
+
+    /*
+     * If the user provides an Operating System to be loaded, we expect them
+     * to use the -kernel command line option.
+     *
+     * Users can load firmware or boot-loaders with the -device loader options.
+     *
+     * When loading an OS, we generate a dtb and let arm_load_kernel() select
+     * where it gets loaded. This dtb will be passed to the kernel in x0.
+     *
+     * If there's no -kernel option, we generate a DTB and place it at 0x1000
+     * for the bootloaders or firmware to pick up.
+     *
+     * If users want to provide their own DTB, they can use the -dtb option.
+     * These dtb's will have their memory nodes modified to match QEMU's
+     * selected ram_size option before they get passed to the kernel or fw.
+     *
+     * When loading an OS, we turn on QEMU's PSCI implementation with SMC
+     * as the PSCI conduit. When there's no -kernel, we assume the user
+     * provides EL3 firmware to handle PSCI.
+     */
+    if (machine->kernel_filename) {
+        psci_conduit = QEMU_PSCI_CONDUIT_SMC;
+    }
+
+    memory_region_allocate_system_memory(&s->mr_ddr, NULL, "ddr",
+                                         machine->ram_size);
+
+    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
+                          sizeof(s->soc), TYPE_XLNX_VERSAL);
+    object_property_set_link(OBJECT(&s->soc), OBJECT(&s->mr_ddr),
+                             "ddr", &error_abort);
+    object_property_set_int(OBJECT(&s->soc), psci_conduit,
+                            "psci-conduit", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+
+    fdt_create(s);
+    create_virtio_regions(s);
+    fdt_add_gem_nodes(s);
+    fdt_add_uart_nodes(s);
+    fdt_add_gic_nodes(s);
+    fdt_add_timer_nodes(s);
+    fdt_add_cpu_nodes(s, psci_conduit);
+    fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
+    fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
+
+    /* Make the APU cpu address space visible to virtio and other
+     * modules unaware of muliple address-spaces.  */
+    memory_region_add_subregion_overlap(get_system_memory(),
+                                        0, &s->soc.fpd.apu.mr, 0);
+
+    s->binfo.ram_size = machine->ram_size;
+    s->binfo.kernel_filename = machine->kernel_filename;
+    s->binfo.kernel_cmdline = machine->kernel_cmdline;
+    s->binfo.initrd_filename = machine->initrd_filename;
+    s->binfo.loader_start = 0x0;
+    s->binfo.get_dtb = versal_virt_get_dtb;
+    s->binfo.modify_dtb = versal_virt_modify_dtb;
+    if (machine->kernel_filename) {
+        arm_load_kernel(s->soc.fpd.apu.cpu[0], &s->binfo);
+    } else {
+        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
+                                                  &s->binfo);
+        /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
+         * Offset things by 4K.  */
+        s->binfo.loader_start = 0x1000;
+        s->binfo.dtb_limit = 0x1000000;
+        if (arm_load_dtb(s->binfo.loader_start,
+                         &s->binfo, s->binfo.dtb_limit, as) < 0) {
+            exit(EXIT_FAILURE);
+        }
+    }
+}
+
+static void versal_virt_machine_instance_init(Object *obj)
+{
+}
+
+static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Xilinx Versal Virtual development board";
+    mc->init = versal_virt_init;
+    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->no_cdrom = true;
+}
+
+static const TypeInfo versal_virt_machine_init_typeinfo = {
+    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
+    .parent     = TYPE_MACHINE,
+    .class_init = versal_virt_machine_class_init,
+    .instance_init = versal_virt_machine_instance_init,
+    .instance_size = sizeof(VersalVirt),
+};
+
+static void versal_virt_machine_init_register_types(void)
+{
+    type_register_static(&versal_virt_machine_init_typeinfo);
+}
+
+type_init(versal_virt_machine_init_register_types)
+
-- 
2.19.1