From 4a16724f06ead684a5962477a557c26c677c2729 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:16 +0100 Subject: [PATCH 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Use a symbolic constant M_REG_NUM_BANKS for the array size for registers which are banked by M profile security state, rather than hardcoding lots of 2s. Suggested-by: Philippe Mathieu-Daudé Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.h | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index 98b9b26fd3..5a1f957c51 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -81,8 +81,11 @@ * accessed via env->registerfield[env->v7m.secure] (whether the security * extension is implemented or not). */ -#define M_REG_NS 0 -#define M_REG_S 1 +enum { + M_REG_NS = 0, + M_REG_S = 1, + M_REG_NUM_BANKS = 2, +}; /* ARM-specific interrupt pending bits. */ #define CPU_INTERRUPT_FIQ CPU_INTERRUPT_TGT_EXT_1 @@ -433,19 +436,19 @@ typedef struct CPUARMState { uint32_t other_sp; uint32_t other_ss_msp; uint32_t other_ss_psp; - uint32_t vecbase[2]; - uint32_t basepri[2]; - uint32_t control[2]; - uint32_t ccr[2]; /* Configuration and Control */ - uint32_t cfsr[2]; /* Configurable Fault Status */ + uint32_t vecbase[M_REG_NUM_BANKS]; + uint32_t basepri[M_REG_NUM_BANKS]; + uint32_t control[M_REG_NUM_BANKS]; + uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */ + uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */ uint32_t hfsr; /* HardFault Status */ uint32_t dfsr; /* Debug Fault Status Register */ - uint32_t mmfar[2]; /* MemManage Fault Address */ + uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */ uint32_t bfar; /* BusFault Address */ - unsigned mpu_ctrl[2]; /* MPU_CTRL */ + unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */ int exception; - uint32_t primask[2]; - uint32_t faultmask[2]; + uint32_t primask[M_REG_NUM_BANKS]; + uint32_t faultmask[M_REG_NUM_BANKS]; uint32_t secure; /* Is CPU in Secure state? (not guest visible) */ } v7m; @@ -546,7 +549,7 @@ typedef struct CPUARMState { uint32_t *drbar; uint32_t *drsr; uint32_t *dracr; - uint32_t rnr[2]; + uint32_t rnr[M_REG_NUM_BANKS]; } pmsav7; /* PMSAv8 MPU */ @@ -556,10 +559,10 @@ typedef struct CPUARMState { * pmsav7.rnr (region number register) * pmsav7_dregion (number of configured regions) */ - uint32_t *rbar[2]; - uint32_t *rlar[2]; - uint32_t mair0[2]; - uint32_t mair1[2]; + uint32_t *rbar[M_REG_NUM_BANKS]; + uint32_t *rlar[M_REG_NUM_BANKS]; + uint32_t mair0[M_REG_NUM_BANKS]; + uint32_t mair1[M_REG_NUM_BANKS]; } pmsav8; void *nvic; From dc3c4c14f0f12854dbd967be3486f4db4e66d25b Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:16 +0100 Subject: [PATCH 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit For M profile we must clear the exclusive monitor on reset, exception entry and exception exit. We weren't doing any of these things; fix this bug. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Reviewed-by: Richard Henderson Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.c | 6 ++++++ target/arm/helper.c | 2 ++ target/arm/internals.h | 10 ++++++++++ target/arm/op_helper.c | 2 +- 4 files changed, 19 insertions(+), 1 deletion(-) diff --git a/target/arm/cpu.c b/target/arm/cpu.c index a1acce3c7a..412e94c7ad 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -235,6 +235,12 @@ static void arm_cpu_reset(CPUState *s) env->regs[15] = 0xFFFF0000; } + /* M profile requires that reset clears the exclusive monitor; + * A profile does not, but clearing it makes more sense than having it + * set with an exclusive access on address zero. + */ + arm_clear_exclusive(env); + env->vfp.xregs[ARM_VFP_FPEXC] = 0; #endif diff --git a/target/arm/helper.c b/target/arm/helper.c index 329e5178d8..668e3671bd 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6175,6 +6175,7 @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr) armv7m_nvic_acknowledge_irq(env->nvic); switch_v7m_sp(env, 0); + arm_clear_exclusive(env); /* Clear IT bits */ env->condexec_bits = 0; env->regs[14] = lr; @@ -6354,6 +6355,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) } /* Otherwise, we have a successful exception exit. */ + arm_clear_exclusive(env); qemu_log_mask(CPU_LOG_INT, "...successful exception return\n"); } diff --git a/target/arm/internals.h b/target/arm/internals.h index 5d7f24c95c..a315354cfd 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -443,6 +443,16 @@ bool arm_is_psci_call(ARMCPU *cpu, int excp_type); void arm_handle_psci_call(ARMCPU *cpu); #endif +/** + * arm_clear_exclusive: clear the exclusive monitor + * @env: CPU env + * Clear the CPU's exclusive monitor, like the guest CLREX instruction. + */ +static inline void arm_clear_exclusive(CPUARMState *env) +{ + env->exclusive_addr = -1; +} + /** * ARMMMUFaultInfo: Information describing an ARM MMU Fault * @s2addr: Address that caused a fault at stage 2 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index d1bca462cc..6a60464ab9 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -1022,7 +1022,7 @@ void HELPER(exception_return)(CPUARMState *env) aarch64_save_sp(env, cur_el); - env->exclusive_addr = -1; + arm_clear_exclusive(env); /* We must squash the PSTATE.SS bit to zero unless both of the * following hold: From c6158878650c01b2c753b2ea7d0967c8fe5ca59e Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 03/18] target/arm: Get PRECISERR and IBUSERR the right way round For a bus fault, the M profile BFSR bit PRECISERR means a bus fault on a data access, and IBUSERR means a bus fault on an instruction access. We had these the wrong way around; fix this. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Reviewed-by: Richard Henderson Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index 668e3671bd..1741e0daeb 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6430,15 +6430,15 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) case 0x8: /* External Abort */ switch (cs->exception_index) { case EXCP_PREFETCH_ABORT: - env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK; - qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n"); + env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK; + qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n"); break; case EXCP_DATA_ABORT: env->v7m.cfsr[M_REG_NS] |= - (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK); + (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK); env->v7m.bfar = env->exception.vaddress; qemu_log_mask(CPU_LOG_INT, - "...with CFSR.IBUSERR and BFAR 0x%x\n", + "...with CFSR.PRECISERR and BFAR 0x%x\n", env->v7m.bfar); break; } From 22a9c26af62f9772b7c0512e88f97d0d1f2e0872 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 04/18] nvic: Don't apply group priority mask to negative priorities In several places we were unconditionally applying the nvic_gprio_mask() to a priority value. This is incorrect if the priority is one of the fixed negative priority values (for NMI and HardFault), so don't do it. This bug would have caused both NMI and HardFault to be considered as the same priority and so NMI wouldn't correctly preempt HardFault. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org --- hw/intc/armv7m_nvic.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index 1fecfd6377..d3e20561c7 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -152,8 +152,12 @@ static void nvic_recompute_state(NVICState *s) } } + if (active_prio > 0) { + active_prio &= nvic_gprio_mask(s); + } + s->vectpending = pend_irq; - s->exception_prio = active_prio & nvic_gprio_mask(s); + s->exception_prio = active_prio; trace_nvic_recompute_state(s->vectpending, s->exception_prio); } @@ -329,7 +333,10 @@ void armv7m_nvic_acknowledge_irq(void *opaque) assert(vec->enabled); assert(vec->pending); - pendgroupprio = vec->prio & nvic_gprio_mask(s); + pendgroupprio = vec->prio; + if (pendgroupprio > 0) { + pendgroupprio &= nvic_gprio_mask(s); + } assert(pendgroupprio < running); trace_nvic_acknowledge_irq(pending, vec->prio); From 7115cdf5782922611bcc44c89eec5990db7f6466 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit() In do_v7m_exception_exit(), there's no need to force the high 4 bits of 'type' to 1 when calling v7m_exception_taken(), because we know that they're always 1 or we could not have got to this "handle return to magic exception return address" code. Remove the unnecessary ORs. Signed-off-by: Peter Maydell Reviewed-by: Richard Henderson Acked-by: Alistair Francis Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index 1741e0daeb..fdd5cc6bae 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6306,7 +6306,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) */ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE); - v7m_exception_taken(cpu, type | 0xf0000000); + v7m_exception_taken(cpu, type); qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " "stackframe: failed exception return integrity check\n"); return; @@ -6348,7 +6348,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE); env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; v7m_push_stack(cpu); - v7m_exception_taken(cpu, type | 0xf0000000); + v7m_exception_taken(cpu, type); qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " "failed exception return integrity check\n"); return; From 4d1e7a4745c050f7ccac49a1c01437526b5130b5 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 06/18] target/arm: Add and use defines for EXCRET constants The exception-return magic values get some new bits in v8M, which makes some bit definitions for them worthwhile. We don't use the bit definitions for the switch on the low bits which checks the return type for v7M, because this is defined in the v7M ARM ARM as a set of valid values rather than via per-bit checks. Signed-off-by: Peter Maydell Reviewed-by: Alistair Francis Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 14 +++++++++----- target/arm/internals.h | 10 ++++++++++ 2 files changed, 19 insertions(+), 5 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index fdd5cc6bae..a502e4eb33 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6242,7 +6242,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) " previous exception %d\n", type, env->v7m.exception); - if (extract32(type, 5, 23) != extract32(-1, 5, 23)) { + if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type); } @@ -6255,7 +6255,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) */ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { - int es = type & 1; + int es = type & R_V7M_EXCRET_ES_MASK; if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { env->v7m.faultmask[es] = 0; } @@ -6491,12 +6491,16 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) return; /* Never happens. Keep compiler happy. */ } - lr = 0xfffffff1; + lr = R_V7M_EXCRET_RES1_MASK | + R_V7M_EXCRET_S_MASK | + R_V7M_EXCRET_DCRS_MASK | + R_V7M_EXCRET_FTYPE_MASK | + R_V7M_EXCRET_ES_MASK; if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) { - lr |= 4; + lr |= R_V7M_EXCRET_SPSEL_MASK; } if (!arm_v7m_is_handler_mode(env)) { - lr |= 8; + lr |= R_V7M_EXCRET_MODE_MASK; } v7m_push_stack(cpu); diff --git a/target/arm/internals.h b/target/arm/internals.h index a315354cfd..18be3702f2 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -61,6 +61,16 @@ FIELD(V7M_CONTROL, NPRIV, 0, 1) FIELD(V7M_CONTROL, SPSEL, 1, 1) FIELD(V7M_CONTROL, FPCA, 2, 1) +/* Bit definitions for v7M exception return payload */ +FIELD(V7M_EXCRET, ES, 0, 1) +FIELD(V7M_EXCRET, RES0, 1, 1) +FIELD(V7M_EXCRET, SPSEL, 2, 1) +FIELD(V7M_EXCRET, MODE, 3, 1) +FIELD(V7M_EXCRET, FTYPE, 4, 1) +FIELD(V7M_EXCRET, DCRS, 5, 1) +FIELD(V7M_EXCRET, S, 6, 1) +FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */ + /* * For AArch64, map a given EL to an index in the banked_spsr array. * Note that this mapping and the AArch32 mapping defined in bank_number() From 351e527a613147aa2a2e6910f92923deef27ee48 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In the v7M and v8M ARM ARM, the magic exception return values are referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_* constants to define bits within them. Rename the 'type' variable which holds the exception return value in do_v7m_exception_exit() to excret, making it clearer that it does hold an EXC_RETURN value. Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Reviewed-by: Richard Henderson Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index a502e4eb33..4f41841ef6 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -6212,7 +6212,7 @@ static void v7m_push_stack(ARMCPU *cpu) static void do_v7m_exception_exit(ARMCPU *cpu) { CPUARMState *env = &cpu->env; - uint32_t type; + uint32_t excret; uint32_t xpsr; bool ufault = false; bool return_to_sp_process = false; @@ -6233,18 +6233,19 @@ static void do_v7m_exception_exit(ARMCPU *cpu) * the target value up between env->regs[15] and env->thumb in * gen_bx(). Reconstitute it. */ - type = env->regs[15]; + excret = env->regs[15]; if (env->thumb) { - type |= 1; + excret |= 1; } qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32 " previous exception %d\n", - type, env->v7m.exception); + excret, env->v7m.exception); - if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { + if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) { qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception " - "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type); + "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", + excret); } if (env->v7m.exception != ARMV7M_EXCP_NMI) { @@ -6255,7 +6256,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.) */ if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { - int es = type & R_V7M_EXCRET_ES_MASK; + int es = excret & R_V7M_EXCRET_ES_MASK; if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) { env->v7m.faultmask[es] = 0; } @@ -6283,7 +6284,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) g_assert_not_reached(); } - switch (type & 0xf) { + switch (excret & 0xf) { case 1: /* Return to Handler */ return_to_handler = true; break; @@ -6306,7 +6307,7 @@ static void do_v7m_exception_exit(ARMCPU *cpu) */ env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE); - v7m_exception_taken(cpu, type); + v7m_exception_taken(cpu, excret); qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing " "stackframe: failed exception return integrity check\n"); return; @@ -6341,14 +6342,14 @@ static void do_v7m_exception_exit(ARMCPU *cpu) /* The restored xPSR exception field will be zero if we're * resuming in Thread mode. If that doesn't match what the - * exception return type specified then this is a UsageFault. + * exception return excret specified then this is a UsageFault. */ if (return_to_handler != arm_v7m_is_handler_mode(env)) { /* Take an INVPC UsageFault by pushing the stack again. */ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE); env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK; v7m_push_stack(cpu); - v7m_exception_taken(cpu, type); + v7m_exception_taken(cpu, excret); qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: " "failed exception return integrity check\n"); return; From aff3f0f150769ec4f97c6e2cefe91c4a0377b548 Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 14 Sep 2017 18:43:17 +0100 Subject: [PATCH 08/18] xlnx-ep108: Rename to ZCU102 The EP108 is a early access development board. Now that silicon is in production people have access to the ZCU102. Let's rename the internal QEMU files and variables to use the ZCU102. There is no functional change here as the EP108 is still a valid board option. Signed-off-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Signed-off-by: Peter Maydell --- hw/arm/Makefile.objs | 2 +- hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++------------- 2 files changed, 16 insertions(+), 16 deletions(-) rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%) diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs index a2e56ecaae..5ee6f7da5b 100644 --- a/hw/arm/Makefile.objs +++ b/hw/arm/Makefile.objs @@ -13,7 +13,7 @@ obj-y += omap1.o omap2.o strongarm.o obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o -obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o +obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c similarity index 85% rename from hw/arm/xlnx-ep108.c rename to hw/arm/xlnx-zcu102.c index c339cd495c..e9702eda1c 100644 --- a/hw/arm/xlnx-ep108.c +++ b/hw/arm/xlnx-zcu102.c @@ -1,5 +1,5 @@ /* - * Xilinx ZynqMP EP108 board + * Xilinx ZynqMP ZCU102 board * * Copyright (C) 2015 Xilinx Inc * Written by Peter Crosthwaite @@ -25,16 +25,16 @@ #include "exec/address-spaces.h" #include "qemu/log.h" -typedef struct XlnxEP108 { +typedef struct XlnxZCU102 { XlnxZynqMPState soc; MemoryRegion ddr_ram; -} XlnxEP108; +} XlnxZCU102; -static struct arm_boot_info xlnx_ep108_binfo; +static struct arm_boot_info xlnx_zcu102_binfo; -static void xlnx_ep108_init(MachineState *machine) +static void xlnx_zcu102_init(MachineState *machine) { - XlnxEP108 *s = g_new0(XlnxEP108, 1); + XlnxZCU102 *s = g_new0(XlnxZCU102, 1); int i; uint64_t ram_size = machine->ram_size; @@ -47,7 +47,7 @@ static void xlnx_ep108_init(MachineState *machine) } if (ram_size < 0x08000000) { - qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108", + qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102", ram_size); } @@ -108,18 +108,18 @@ static void xlnx_ep108_init(MachineState *machine) /* TODO create and connect IDE devices for ide_drive_get() */ - xlnx_ep108_binfo.ram_size = ram_size; - xlnx_ep108_binfo.kernel_filename = machine->kernel_filename; - xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline; - xlnx_ep108_binfo.initrd_filename = machine->initrd_filename; - xlnx_ep108_binfo.loader_start = 0; - arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo); + xlnx_zcu102_binfo.ram_size = ram_size; + xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename; + xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline; + xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename; + xlnx_zcu102_binfo.loader_start = 0; + arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo); } static void xlnx_ep108_machine_init(MachineClass *mc) { mc->desc = "Xilinx ZynqMP EP108 board"; - mc->init = xlnx_ep108_init; + mc->init = xlnx_zcu102_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; mc->ignore_memory_transaction_failures = true; @@ -130,7 +130,7 @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init) static void xlnx_zcu102_machine_init(MachineClass *mc) { mc->desc = "Xilinx ZynqMP ZCU102 board"; - mc->init = xlnx_ep108_init; + mc->init = xlnx_zcu102_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; mc->ignore_memory_transaction_failures = true; From b70cf33f030e0fc965b3a02d91c2195e0572ea46 Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 09/18] xlnx-zcu102: Manually create the machines In preperation for future work let's manually create the Xilnx machines. This will allow us to set properties for the machines in the future. Signed-off-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Signed-off-by: Peter Maydell --- hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 67 insertions(+), 7 deletions(-) diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c index e9702eda1c..5b1f184568 100644 --- a/hw/arm/xlnx-zcu102.c +++ b/hw/arm/xlnx-zcu102.c @@ -26,15 +26,24 @@ #include "qemu/log.h" typedef struct XlnxZCU102 { + MachineState parent_obj; + XlnxZynqMPState soc; MemoryRegion ddr_ram; } XlnxZCU102; +#define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102") +#define ZCU102_MACHINE(obj) \ + OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE) + +#define TYPE_EP108_MACHINE MACHINE_TYPE_NAME("xlnx-ep108") +#define EP108_MACHINE(obj) \ + OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE) + static struct arm_boot_info xlnx_zcu102_binfo; -static void xlnx_zcu102_init(MachineState *machine) +static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine) { - XlnxZCU102 *s = g_new0(XlnxZCU102, 1); int i; uint64_t ram_size = machine->ram_size; @@ -116,19 +125,56 @@ static void xlnx_zcu102_init(MachineState *machine) arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo); } -static void xlnx_ep108_machine_init(MachineClass *mc) +static void xlnx_ep108_init(MachineState *machine) { + XlnxZCU102 *s = EP108_MACHINE(machine); + + xlnx_zynqmp_init(s, machine); +} + +static void xlnx_ep108_machine_instance_init(Object *obj) +{ +} + +static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data) +{ + MachineClass *mc = MACHINE_CLASS(oc); + mc->desc = "Xilinx ZynqMP EP108 board"; - mc->init = xlnx_zcu102_init; + mc->init = xlnx_ep108_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; mc->ignore_memory_transaction_failures = true; } -DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init) +static const TypeInfo xlnx_ep108_machine_init_typeinfo = { + .name = MACHINE_TYPE_NAME("xlnx-ep108"), + .parent = TYPE_MACHINE, + .class_init = xlnx_ep108_machine_class_init, + .instance_init = xlnx_ep108_machine_instance_init, + .instance_size = sizeof(XlnxZCU102), +}; -static void xlnx_zcu102_machine_init(MachineClass *mc) +static void xlnx_ep108_machine_init_register_types(void) { + type_register_static(&xlnx_ep108_machine_init_typeinfo); +} + +static void xlnx_zcu102_init(MachineState *machine) +{ + XlnxZCU102 *s = ZCU102_MACHINE(machine); + + xlnx_zynqmp_init(s, machine); +} + +static void xlnx_zcu102_machine_instance_init(Object *obj) +{ +} + +static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data) +{ + MachineClass *mc = MACHINE_CLASS(oc); + mc->desc = "Xilinx ZynqMP ZCU102 board"; mc->init = xlnx_zcu102_init; mc->block_default_type = IF_IDE; @@ -136,4 +182,18 @@ static void xlnx_zcu102_machine_init(MachineClass *mc) mc->ignore_memory_transaction_failures = true; } -DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init) +static const TypeInfo xlnx_zcu102_machine_init_typeinfo = { + .name = MACHINE_TYPE_NAME("xlnx-zcu102"), + .parent = TYPE_MACHINE, + .class_init = xlnx_zcu102_machine_class_init, + .instance_init = xlnx_zcu102_machine_instance_init, + .instance_size = sizeof(XlnxZCU102), +}; + +static void xlnx_zcu102_machine_init_register_types(void) +{ + type_register_static(&xlnx_zcu102_machine_init_typeinfo); +} + +type_init(xlnx_zcu102_machine_init_register_types) +type_init(xlnx_ep108_machine_init_register_types) From b7436e94ded250b92aaa03bd72eab2279aba197b Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 10/18] xlnx-zcu102: Add a machine level secure property Add a machine level secure property. This defaults to false and can be set to true using this machine command line argument: -machine xlnx-zcu102,secure=on This follows what the ARM virt machine does. This property only applies to the ZCU102 machine. The EP108 machine does not have this property. Signed-off-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Signed-off-by: Peter Maydell --- hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c index 5b1f184568..bd573c4695 100644 --- a/hw/arm/xlnx-zcu102.c +++ b/hw/arm/xlnx-zcu102.c @@ -30,6 +30,8 @@ typedef struct XlnxZCU102 { XlnxZynqMPState soc; MemoryRegion ddr_ram; + + bool secure; } XlnxZCU102; #define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102") @@ -42,6 +44,20 @@ typedef struct XlnxZCU102 { static struct arm_boot_info xlnx_zcu102_binfo; +static bool zcu102_get_secure(Object *obj, Error **errp) +{ + XlnxZCU102 *s = ZCU102_MACHINE(obj); + + return s->secure; +} + +static void zcu102_set_secure(Object *obj, bool value, Error **errp) +{ + XlnxZCU102 *s = ZCU102_MACHINE(obj); + + s->secure = value; +} + static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine) { int i; @@ -69,6 +85,8 @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine) object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram), "ddr-ram", &error_abort); + object_property_set_bool(OBJECT(&s->soc), s->secure, "secure", + &error_fatal); object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal); @@ -134,6 +152,10 @@ static void xlnx_ep108_init(MachineState *machine) static void xlnx_ep108_machine_instance_init(Object *obj) { + XlnxZCU102 *s = EP108_MACHINE(obj); + + /* EP108, we don't support setting secure */ + s->secure = false; } static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data) @@ -169,6 +191,16 @@ static void xlnx_zcu102_init(MachineState *machine) static void xlnx_zcu102_machine_instance_init(Object *obj) { + XlnxZCU102 *s = ZCU102_MACHINE(obj); + + /* Default to secure mode being disabled */ + s->secure = false; + object_property_add_bool(obj, "secure", zcu102_get_secure, + zcu102_set_secure, NULL); + object_property_set_description(obj, "secure", + "Set on/off to enable/disable the ARM " + "Security Extensions (TrustZone)", + NULL); } static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data) From 1946809ece906d517e96fdcb0b39c5e63916fb5a Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 11/18] xlnx-zcu102: Add a machine level virtualization property Add a machine level virtualization property. This defaults to false and can be set to true using this machine command line argument: -machine xlnx-zcu102,virtualization=on This follows what the ARM virt machine does. This property only applies to the ZCU102 machine. The EP108 machine does not have this property. Signed-off-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Signed-off-by: Peter Maydell --- hw/arm/xlnx-zcu102.c | 30 +++++++++++++++++++++++++++++- hw/arm/xlnx-zynqmp.c | 3 ++- include/hw/arm/xlnx-zynqmp.h | 2 ++ 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c index bd573c4695..42deefd6d4 100644 --- a/hw/arm/xlnx-zcu102.c +++ b/hw/arm/xlnx-zcu102.c @@ -32,6 +32,7 @@ typedef struct XlnxZCU102 { MemoryRegion ddr_ram; bool secure; + bool virt; } XlnxZCU102; #define TYPE_ZCU102_MACHINE MACHINE_TYPE_NAME("xlnx-zcu102") @@ -58,6 +59,20 @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp) s->secure = value; } +static bool zcu102_get_virt(Object *obj, Error **errp) +{ + XlnxZCU102 *s = ZCU102_MACHINE(obj); + + return s->virt; +} + +static void zcu102_set_virt(Object *obj, bool value, Error **errp) +{ + XlnxZCU102 *s = ZCU102_MACHINE(obj); + + s->virt = value; +} + static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine) { int i; @@ -87,6 +102,8 @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine) "ddr-ram", &error_abort); object_property_set_bool(OBJECT(&s->soc), s->secure, "secure", &error_fatal); + object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization", + &error_fatal); object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal); @@ -154,8 +171,9 @@ static void xlnx_ep108_machine_instance_init(Object *obj) { XlnxZCU102 *s = EP108_MACHINE(obj); - /* EP108, we don't support setting secure */ + /* EP108, we don't support setting secure or virt */ s->secure = false; + s->virt = false; } static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data) @@ -201,6 +219,16 @@ static void xlnx_zcu102_machine_instance_init(Object *obj) "Set on/off to enable/disable the ARM " "Security Extensions (TrustZone)", NULL); + + /* Default to virt (EL2) being disabled */ + s->virt = false; + object_property_add_bool(obj, "virtualization", zcu102_get_virt, + zcu102_set_virt, NULL); + object_property_set_description(obj, "virtualization", + "Set on/off to enable/disable emulating a " + "guest CPU which implements the ARM " + "Virtualization Extensions", + NULL); } static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data) diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c index 22c2a33719..2b27daf51d 100644 --- a/hw/arm/xlnx-zynqmp.c +++ b/hw/arm/xlnx-zynqmp.c @@ -255,7 +255,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) object_property_set_bool(OBJECT(&s->apu_cpu[i]), s->secure, "has_el3", NULL); object_property_set_bool(OBJECT(&s->apu_cpu[i]), - false, "has_el2", NULL); + s->virt, "has_el2", NULL); object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR, "reset-cbar", &error_abort); object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized", @@ -427,6 +427,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) static Property xlnx_zynqmp_props[] = { DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu), DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false), + DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false), DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false), DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION, MemoryRegion *), diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h index c2931bf39c..6eff81a995 100644 --- a/include/hw/arm/xlnx-zynqmp.h +++ b/include/hw/arm/xlnx-zynqmp.h @@ -91,6 +91,8 @@ typedef struct XlnxZynqMPState { /* Has the ARM Security extensions? */ bool secure; + /* Has the ARM Virtualization extensions? */ + bool virt; /* Has the RPU subsystem? */ bool has_rpu; } XlnxZynqMPState; From da69de00763c1bc221149f6618ef2c8f81e9f49a Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated The EP108 is the same as the ZCU102, mark it as deprecated as we don't need two machines. Signed-off-by: Alistair Francis Reviewed-by: Edgar E. Iglesias Signed-off-by: Peter Maydell --- hw/arm/xlnx-zcu102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c index 42deefd6d4..519a16ed98 100644 --- a/hw/arm/xlnx-zcu102.c +++ b/hw/arm/xlnx-zcu102.c @@ -180,7 +180,7 @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data) { MachineClass *mc = MACHINE_CLASS(oc); - mc->desc = "Xilinx ZynqMP EP108 board"; + mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)"; mc->init = xlnx_ep108_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; From dddbba9943ef6a81c8702e4a50cb0a8b1a4201fe Mon Sep 17 00:00:00 2001 From: Jaroslaw Pelczar Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 13/18] AArch64: Fix single stepping of ERET instruction Previously when single stepping through ERET instruction via GDB would result in debugger entering the "next" PC after ERET instruction. When debugging in kernel mode, this will also cause unintended behavior, because debugger will try to access memory from EL0 point of view. Signed-off-by: Jaroslaw Pelczar Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com Reviewed-by: Richard Henderson Signed-off-by: Peter Maydell --- target/arm/translate-a64.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index 9017e30510..1bc12d93ca 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -11348,6 +11348,7 @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu) default: gen_a64_set_pc_im(dc->pc); /* fall through */ + case DISAS_EXIT: case DISAS_JUMP: if (dc->base.singlestep_enabled) { gen_exception_internal(EXCP_DEBUG); From 37e29a64254bf82a1901784fcca17c25f8164c2f Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 14/18] target/arm: Avoid an extra temporary for store_exclusive Instead of copying addr to a local temp, reuse the value (which we have just compared as equal) already saved in cpu_exclusive_addr. Signed-off-by: Richard Henderson Reviewed-by: Alistair Francis Message-id: 20170908163859.29820-1-richard.henderson@linaro.org Signed-off-by: Peter Maydell --- target/arm/translate-a64.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index 1bc12d93ca..083568c468 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -1894,7 +1894,7 @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2, } static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2, - TCGv_i64 inaddr, int size, int is_pair) + TCGv_i64 addr, int size, int is_pair) { /* if (env->exclusive_addr == addr && env->exclusive_val == [addr] * && (!is_pair || env->exclusive_high == [addr + datasize])) { @@ -1910,13 +1910,8 @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2, */ TCGLabel *fail_label = gen_new_label(); TCGLabel *done_label = gen_new_label(); - TCGv_i64 addr = tcg_temp_local_new_i64(); TCGv_i64 tmp; - /* Copy input into a local temp so it is not trashed when the - * basic block ends at the branch insn. - */ - tcg_gen_mov_i64(addr, inaddr); tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label); tmp = tcg_temp_new_i64(); @@ -1927,27 +1922,24 @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2, } else { tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt)); } - tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp, + tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, + cpu_exclusive_val, tmp, get_mem_index(s), MO_64 | MO_ALIGN | s->be_data); tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val); } else if (s->be_data == MO_LE) { - gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt), - cpu_reg(s, rt2)); + gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr, + cpu_reg(s, rt), cpu_reg(s, rt2)); } else { - gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt), - cpu_reg(s, rt2)); + gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr, + cpu_reg(s, rt), cpu_reg(s, rt2)); } } else { - TCGv_i64 val = cpu_reg(s, rt); - tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val, - get_mem_index(s), + tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val, + cpu_reg(s, rt), get_mem_index(s), size | MO_ALIGN | s->be_data); tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val); } - - tcg_temp_free_i64(addr); - tcg_gen_mov_i64(cpu_reg(s, rd), tmp); tcg_temp_free_i64(tmp); tcg_gen_br(done_label); From 70bfdce6a1263fd06144ecc1c3727c44e562d89b Mon Sep 17 00:00:00 2001 From: Pranavkumar Sawargaonkar Date: Thu, 14 Sep 2017 18:43:18 +0100 Subject: [PATCH 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping To implement INTx to gsi routing we need to pass the gpex host bridge the gsi associated to each INTx index. Let's introduce irq_num array and gpex_set_irq_num setter function. Signed-off-by: Pranavkumar Sawargaonkar Signed-off-by: Tushar Jagad Signed-off-by: Eric Auger Tested-by: Feng Kan Reviewed-by: Andrew Jones Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell --- hw/pci-host/gpex.c | 10 ++++++++++ include/hw/pci-host/gpex.h | 3 +++ 2 files changed, 13 insertions(+) diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c index 83084b9aab..41a884da3f 100644 --- a/hw/pci-host/gpex.c +++ b/hw/pci-host/gpex.c @@ -43,6 +43,16 @@ static void gpex_set_irq(void *opaque, int irq_num, int level) qemu_set_irq(s->irq[irq_num], level); } +int gpex_set_irq_num(GPEXHost *s, int index, int gsi) +{ + if (index >= GPEX_NUM_IRQS) { + return -EINVAL; + } + + s->irq_num[index] = gsi; + return 0; +} + static void gpex_host_realize(DeviceState *dev, Error **errp) { PCIHostState *pci = PCI_HOST_BRIDGE(dev); diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h index 68c93488c9..aef38b881b 100644 --- a/include/hw/pci-host/gpex.h +++ b/include/hw/pci-host/gpex.h @@ -51,6 +51,9 @@ typedef struct GPEXHost { MemoryRegion io_ioport; MemoryRegion io_mmio; qemu_irq irq[GPEX_NUM_IRQS]; + int irq_num[GPEX_NUM_IRQS]; } GPEXHost; +int gpex_set_irq_num(GPEXHost *s, int index, int gsi); + #endif /* HW_GPEX_H */ From c9bb8e16080d189a0c393a1061b427993516ae2b Mon Sep 17 00:00:00 2001 From: Pranavkumar Sawargaonkar Date: Thu, 14 Sep 2017 18:43:19 +0100 Subject: [PATCH 16/18] hw/arm/virt: Set INTx/gsi mapping Let's provide the GPEX host bridge with the INTx/gsi mapping. This is needed for INTx/gsi routing. Signed-off-by: Pranavkumar Sawargaonkar Signed-off-by: Tushar Jagad Signed-off-by: Eric Auger Reviewed-by: Andrew Jones Tested-by: Feng Kan Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell --- hw/arm/virt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/virt.c b/hw/arm/virt.c index fe96557997..cfd834d0cc 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -1057,6 +1057,7 @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic) for (i = 0; i < GPEX_NUM_IRQS; i++) { sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]); + gpex_set_irq_num(GPEX_HOST(dev), i, irq + i); } pci = PCI_HOST_BRIDGE(dev); From d464814ae729f3200234ff74d5f050ddad4f1f20 Mon Sep 17 00:00:00 2001 From: Pranavkumar Sawargaonkar Date: Thu, 14 Sep 2017 18:43:19 +0100 Subject: [PATCH 17/18] hw/pci-host/gpex: Implement PCI INTx routing Now we are able to retrieve the gsi from the INTx pin, let's enable intx_to_irq routing. From that point on, irqfd becomes usable along with INTx when assigning a PCIe device. Signed-off-by: Pranavkumar Sawargaonkar Signed-off-by: Tushar Jagad Signed-off-by: Eric Auger Reviewed-by: Andrew Jones Tested-by: Feng Kan Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com Signed-off-by: Peter Maydell --- hw/pci-host/gpex.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c index 41a884da3f..be25245219 100644 --- a/hw/pci-host/gpex.c +++ b/hw/pci-host/gpex.c @@ -53,6 +53,17 @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi) return 0; } +static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin) +{ + PCIINTxRoute route; + GPEXHost *s = opaque; + + route.mode = PCI_INTX_ENABLED; + route.irq = s->irq_num[pin]; + + return route; +} + static void gpex_host_realize(DeviceState *dev, Error **errp) { PCIHostState *pci = PCI_HOST_BRIDGE(dev); @@ -77,6 +88,7 @@ static void gpex_host_realize(DeviceState *dev, Error **errp) &s->io_ioport, 0, 4, TYPE_PCIE_BUS); qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus)); + pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq); qdev_init_nofail(DEVICE(&s->gpex_root)); } From ce3bc112cdb1d462e2d52eaa17a7314e7f3af504 Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Thu, 14 Sep 2017 18:43:19 +0100 Subject: [PATCH 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fix an error that meant we were wiring every UART's overflow interrupts into the same inputs 0 and 1 of the OR gate, rather than giving each its own input. Cc: qemu-stable@nongnu.org Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Alistair Francis Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org --- hw/arm/mps2.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c index abb0ab6d71..769cff872c 100644 --- a/hw/arm/mps2.c +++ b/hw/arm/mps2.c @@ -287,8 +287,8 @@ static void mps2_common_init(MachineState *machine) cmsdk_apb_uart_create(uartbase[i], qdev_get_gpio_in(txrx_orgate_dev, 0), qdev_get_gpio_in(txrx_orgate_dev, 1), - qdev_get_gpio_in(orgate_dev, 0), - qdev_get_gpio_in(orgate_dev, 1), + qdev_get_gpio_in(orgate_dev, i * 2), + qdev_get_gpio_in(orgate_dev, i * 2 + 1), NULL, uartchr, SYSCLK_FRQ); }