Series comparison

-[Qemu-devel] [PULL 00/27] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-ARM pullreq; contains some patches that arrived while I
+Not very much here, but several people have fallen over
-was on holiday, plus the series I sent off before going
+the vector operation segfault bug, so let's get the fix
-away, which got reviewed while I was away.
+into master.
 thanks
 -- PMM
+The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
-The following changes since commit c077a998eb3fcae2d048e3baeb5bc592d30fddde:
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
-  Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20170531' into staging (2017-06-01 15:50:40 +0100)
+are available in the Git repository at:
-are available in the git repository at:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170601
+for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
-for you to fetch changes up to cdc58be430b0bdeaef282e2e70f8135ae531616d:
+  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
   hw/arm/virt: fdt: generate distance-map when needed (2017-06-01 17:27:07 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * virt: numa: provide ACPI distance info when needed
+ * exynos4210: QOM'ify the Exynos4210 SoC
- * aspeed: fix i2c controller bugs
+ * exynos4210: Add DMA support for the Exynos4210
- * aspeed: add temperature sensor device
+ * arm_gicv3: Fix writes to ICC_CTLR_EL3
- * M profile: support MPU
+ * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
- * gicv3: fix mishandling of BPR1, VBPR1
+ * target/arm: Fix vector operation segfault
- * load_uboot_image: don't assume a full header read
+ * target/arm: Minor improvements to BFXIL, EXTR
  * libvixl: Correct build failures on NetBSD
 ----------------------------------------------------------------
-Andrew Jones (3):
+Alistair Francis (1):
-      load_uboot_image: don't assume a full header read
+      target/arm: Fix vector operation segfault
       hw/arm/virt-acpi-build: build SLIT when needed
       hw/arm/virt: fdt: generate distance-map when needed
-Cédric Le Goater (6):
+Guenter Roeck (1):
-      aspeed/i2c: improve command handling
+      hw/arm/exynos4210: Add DMA support for the Exynos4210
       aspeed/i2c: handle LAST command under the RX command
       aspeed/i2c: introduce a state machine
       aspeed: add some I2C devices to the Aspeed machines
       hw/misc: add a TMP42{1,2,3} device model
       aspeed: add a temp sensor device on I2C bus 3
-Kamil Rytarowski (1):
+Peter Maydell (5):
-      libvixl: Correct build failures on NetBSD
+      arm: Move system_clock_scale to armv7m_systick.h
       arm: Remove unnecessary includes of hw/arm/arm.h
       arm: Rename hw/arm/arm.h to hw/arm/boot.h
       hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
       hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-Michael Davidsaver (4):
+Philippe Mathieu-Daudé (3):
-      armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
+      hw/arm/exynos4: Remove unuseful debug code
-      armv7m: Implement M profile default memory map
+      hw/arm/exynos4: Use the IEC binary prefix definitions
-      armv7m: Classify faults as MemManage or BusFault
+      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
       arm: add MPU support to M profile CPUs
-Peter Maydell (12):
+Richard Henderson (2):
-      hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
+      target/arm: Use extract2 for EXTR
-      hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
+      target/arm: Simplify BFXIL expansion
       hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
       arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
       arm: Add support for M profile CPUs having different MMU index semantics
       arm: Use different ARMMMUIdx values for M profile
       arm: Clean up handling of no-MPU PMSA CPUs
       arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
       arm: Don't let no-MPU PMSA cores write to SCTLR.M
       arm: Remove unnecessary check on cpu->pmsav7_dregion
       arm: All M profile cores are PMSA
       arm: Implement HFNMIENA support for M profile MPU
-Wei Huang (1):
+ include/hw/arm/allwinner-a10.h    |  2 +-
-      target/arm: clear PMUVER field of AA64DFR0 when vPMU=off
+ include/hw/arm/aspeed_soc.h       |  1 -
  include/hw/arm/bcm2836.h          |  1 -
  include/hw/arm/{arm.h => boot.h}  | 12 +++------
  include/hw/arm/exynos4210.h       |  9 +++++--
  include/hw/arm/fsl-imx25.h        |  2 +-
  include/hw/arm/fsl-imx31.h        |  2 +-
  include/hw/arm/fsl-imx6.h         |  2 +-
  include/hw/arm/fsl-imx6ul.h       |  2 +-
  include/hw/arm/fsl-imx7.h         |  2 +-
  include/hw/arm/virt.h             |  2 +-
  include/hw/arm/xlnx-versal.h      |  2 +-
  include/hw/arm/xlnx-zynqmp.h      |  2 +-
  include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
  hw/arm/armsse.c                   |  2 +-
  hw/arm/armv7m.c                   |  2 +-
  hw/arm/aspeed.c                   |  2 +-
  hw/arm/boot.c                     |  2 +-
  hw/arm/collie.c                   |  2 +-
  hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
  hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
  hw/arm/highbank.c                 |  2 +-
  hw/arm/integratorcp.c             |  2 +-
  hw/arm/mainstone.c                |  2 +-
  hw/arm/microbit.c                 |  2 +-
  hw/arm/mps2-tz.c                  |  2 +-
  hw/arm/mps2.c                     |  2 +-
  hw/arm/msf2-soc.c                 |  1 -
  hw/arm/msf2-som.c                 |  2 +-
  hw/arm/musca.c                    |  2 +-
  hw/arm/musicpal.c                 |  2 +-
  hw/arm/netduino2.c                |  2 +-
  hw/arm/nrf51_soc.c                |  2 +-
  hw/arm/nseries.c                  |  2 +-
  hw/arm/omap1.c                    |  2 +-
  hw/arm/omap2.c                    |  2 +-
  hw/arm/omap_sx1.c                 |  2 +-
  hw/arm/palm.c                     |  2 +-
  hw/arm/raspi.c                    |  2 +-
  hw/arm/realview.c                 |  2 +-
  hw/arm/spitz.c                    |  2 +-
  hw/arm/stellaris.c                |  2 +-
  hw/arm/stm32f205_soc.c            |  2 +-
  hw/arm/strongarm.c                |  2 +-
  hw/arm/tosa.c                     |  2 +-
  hw/arm/versatilepb.c              |  2 +-
  hw/arm/vexpress.c                 |  2 +-
  hw/arm/virt.c                     |  2 +-
  hw/arm/xilinx_zynq.c              |  2 +-
  hw/arm/xlnx-versal.c              |  2 +-
  hw/arm/z2.c                       |  2 +-
  hw/intc/arm_gicv3_cpuif.c         |  6 ++---
  hw/intc/armv7m_nvic.c             |  1 -
  target/arm/arm-semi.c             |  1 -
  target/arm/cpu.c                  |  1 -
  target/arm/cpu64.c                |  1 -
  target/arm/kvm.c                  |  1 -
  target/arm/kvm32.c                |  1 -
  target/arm/kvm64.c                |  1 -
  target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
  target/arm/translate.c            |  4 +--
 files changed, 164 insertions(+), 123 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (96%)
- disas/libvixl/Makefile.objs     |   3 +
- hw/misc/Makefile.objs           |   1 +
- target/arm/cpu.h                | 118 ++++++++++--
- target/arm/translate.h          |   2 +-
- hw/arm/aspeed.c                 |  36 ++++
- hw/arm/virt-acpi-build.c        |   4 +
- hw/arm/virt.c                   |  21 +++
- hw/core/loader.c                |   3 +-
- hw/i2c/aspeed_i2c.c             |  65 ++++++-
- hw/intc/arm_gicv3_cpuif.c       |  50 ++++-
- hw/intc/armv7m_nvic.c           | 104 +++++++++++
- hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
- target/arm/cpu.c                |  28 ++-
- target/arm/helper.c             | 338 ++++++++++++++++++++++-----------
- target/arm/machine.c            |   7 +-
- target/arm/op_helper.c          |   3 +-
- target/arm/translate-a64.c      |  18 +-
- target/arm/translate.c          |  14 +-
- default-configs/arm-softmmu.mak |   1 +
-files changed, 1060 insertions(+), 157 deletions(-)
- create mode 100644 hw/misc/tmp421.c

-[Qemu-devel] [PULL 01/27] libvixl: Correct build failures on NetBSD
+Deleted patch
-From: Kamil Rytarowski <n54@gmx.com>
-Ensure that C99 macros are defined regardless of the inclusion order of
-headers in vixl. This is required at least on NetBSD.
-The vixl/globals.h headers defines __STDC_CONSTANT_MACROS and must be
-included before other system headers.
-This file defines unconditionally the following macros, without altering
-the original sources:
- - __STDC_CONSTANT_MACROS
- - __STDC_LIMIT_MACROS
- - __STDC_FORMAT_MACROS
-Signed-off-by: Kamil Rytarowski <n54@gmx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20170514051820.15985-1-n54@gmx.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- disas/libvixl/Makefile.objs | 3 +++
-file changed, 3 insertions(+)
-diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/disas/libvixl/Makefile.objs
-+++ b/disas/libvixl/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ libvixl_OBJS = vixl/utils.o \
- # The -Wno-sign-compare is needed only for gcc 4.6, which complains about
- # some signed-unsigned equality comparisons which later gcc versions do not.
- $(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS) -Wno-sign-compare
-+# Ensure that C99 macros are defined regardless of the inclusion order of
-+# headers in vixl. This is required at least on NetBSD.
-+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS
- common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)
---
-.7.4

-[Qemu-devel] [PULL 08/27] arm: Add support for M profile CPUs having different MMU index semantics
+[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
-The M profile CPU's MPU has an awkward corner case which we
+From: Richard Henderson <richard.henderson@linaro.org>
 would like to implement with a different MMU index.
-We can avoid having to bump the number of MMU modes ARM
+This is, after all, how we implement extract2 in tcg/aarch64.
 uses, because some of our existing MMU indexes are only
 used by non-M-profile CPUs, so we can borrow one.
 To avoid that getting too confusing, clean up the code
 to try to keep the two meanings of the index separate.
-Instead of ARMMMUIdx enum values being identical to core QEMU
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-MMU index values, they are now the core index values with some
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-high bits set. Any particular CPU always uses the same high
+Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
-bits (so eventually A profile cores and M profile cores will
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-use different bits). New functions arm_to_core_mmu_idx()
+---
-and core_to_arm_mmu_idx() convert between the two.
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 file changed, 20 insertions(+), 18 deletions(-)
-In general core index values are stored in 'int' types, and
-ARM values are stored in ARMMMUIdx types.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-3-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h           |  71 ++++++++++++++++-----
- target/arm/translate.h     |   2 +-
- target/arm/helper.c        | 151 ++++++++++++++++++++++++---------------------
- target/arm/op_helper.c     |   3 +-
- target/arm/translate-a64.c |  18 ++++--
- target/arm/translate.c     |  10 +--
-files changed, 156 insertions(+), 99 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-  * for the accesses done as part of a stage 1 page table walk, rather than
-  * having to walk the stage 2 page table over and over.)
-  *
-+ * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
-+ * are not quite the same -- different CPU types (most notably M profile
-+ * vs A/R profile) would like to use MMU indexes with different semantics,
-+ * but since we don't ever need to use all of those in a single CPU we
-+ * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
-+ * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
-+ * the same for any particular CPU.
-+ * Variables of type ARMMUIdx are always full values, and the core
-+ * index values are in variables of type 'int'.
-+ *
-  * Our enumeration includes at the end some entries which are not "true"
-  * mmu_idx values in that they don't have corresponding TLBs and are only
-  * valid for doing slow path page table walks.
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-  * of the AT/ATS operations.
-  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
-  */
-+#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
-+#define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
-+
-+#define ARM_MMU_IDX_TYPE_MASK (~0x7)
-+#define ARM_MMU_IDX_COREIDX_MASK 0x7
-+
- typedef enum ARMMMUIdx {
--    ARMMMUIdx_S12NSE0 = 0,
--    ARMMMUIdx_S12NSE1 = 1,
--    ARMMMUIdx_S1E2 = 2,
--    ARMMMUIdx_S1E3 = 3,
--    ARMMMUIdx_S1SE0 = 4,
--    ARMMMUIdx_S1SE1 = 5,
--    ARMMMUIdx_S2NS = 6,
-+    ARMMMUIdx_S12NSE0 = 0 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S12NSE1 = 1 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S1E2 = 2 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S1E3 = 3 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
-     /* Indexes below here don't have TLBs and are used only for AT system
-      * instructions or for the first stage of an S12 page table walk.
-      */
--    ARMMMUIdx_S1NSE0 = 7,
--    ARMMMUIdx_S1NSE1 = 8,
-+    ARMMMUIdx_S1NSE0 = 0 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_S1NSE1 = 1 | ARM_MMU_IDX_NOTLB,
- } ARMMMUIdx;
-+/* Bit macros for the core-mmu-index values for each index,
-+ * for use when calling tlb_flush_by_mmuidx() and friends.
-+ */
-+typedef enum ARMMMUIdxBit {
-+    ARMMMUIdxBit_S12NSE0 = 1 << 0,
-+    ARMMMUIdxBit_S12NSE1 = 1 << 1,
-+    ARMMMUIdxBit_S1E2 = 1 << 2,
-+    ARMMMUIdxBit_S1E3 = 1 << 3,
-+    ARMMMUIdxBit_S1SE0 = 1 << 4,
-+    ARMMMUIdxBit_S1SE1 = 1 << 5,
-+    ARMMMUIdxBit_S2NS = 1 << 6,
-+} ARMMMUIdxBit;
-+
- #define MMU_USER_IDX 0
-+static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
-+{
-+    return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
-+}
-+
-+static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
-+{
-+    return mmu_idx | ARM_MMU_IDX_A;
-+}
-+
- /* Return the exception level we're running at if this is our mmu_idx */
- static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
- {
--    assert(mmu_idx < ARMMMUIdx_S2NS);
--    return mmu_idx & 3;
-+    switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
-+    case ARM_MMU_IDX_A:
-+        return mmu_idx & 3;
-+    default:
-+        g_assert_not_reached();
-+    }
- }
- /* Determine the current mmu_idx to use for normal loads/stores */
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
-     int el = arm_current_el(env);
-     if (el < 2 && arm_is_secure_below_el3(env)) {
--        return ARMMMUIdx_S1SE0 + el;
-+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
-     }
-     return el;
- }
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
- static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                                         target_ulong *cs_base, uint32_t *flags)
- {
--    ARMMMUIdx mmu_idx = cpu_mmu_index(env, false);
-+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
-     if (is_a64(env)) {
-         *pc = env->pc;
-         *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
-@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                    << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
-     }
--    *flags |= (mmu_idx << ARM_TBFLAG_MMUIDX_SHIFT);
-+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
-     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
-      * states defined in the ARM ARM for software singlestep:
-diff --git a/target/arm/translate.h b/target/arm/translate.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
-+++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static inline int arm_dc_feature(DisasContext *dc, int feature)
- static inline int get_mem_index(DisasContext *s)
- {
--    return s->mmu_idx;
-+    return arm_to_core_mmu_idx(s->mmu_idx);
- }
- /* Function used to determine the target exception EL when otherwise not known
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     CPUState *cs = ENV_GET_CPU(env);
-     tlb_flush_by_mmuidx(cs,
--                        (1 << ARMMMUIdx_S12NSE1) |
--                        (1 << ARMMMUIdx_S12NSE0) |
--                        (1 << ARMMMUIdx_S2NS));
-+                        ARMMMUIdxBit_S12NSE1 |
-+                        ARMMMUIdxBit_S12NSE0 |
-+                        ARMMMUIdxBit_S2NS);
- }
- static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     CPUState *cs = ENV_GET_CPU(env);
-     tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                        (1 << ARMMMUIdx_S12NSE1) |
--                                        (1 << ARMMMUIdx_S12NSE0) |
--                                        (1 << ARMMMUIdx_S2NS));
-+                                        ARMMMUIdxBit_S12NSE1 |
-+                                        ARMMMUIdxBit_S12NSE0 |
-+                                        ARMMMUIdxBit_S2NS);
- }
- static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     pageaddr = sextract64(value << 12, 0, 40);
--    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
-+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
- }
- static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     pageaddr = sextract64(value << 12, 0, 40);
-     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                             (1 << ARMMMUIdx_S2NS));
-+                                             ARMMMUIdxBit_S2NS);
- }
- static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     CPUState *cs = ENV_GET_CPU(env);
--    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
- }
- static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     CPUState *cs = ENV_GET_CPU(env);
--    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
- }
- static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     CPUState *cs = ENV_GET_CPU(env);
-     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
--    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
- }
- static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
-     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                             (1 << ARMMMUIdx_S1E2));
-+                                             ARMMMUIdxBit_S1E2);
- }
- static const ARMCPRegInfo cp_reginfo[] = {
-@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
-     if (raw_read(env, ri) != value) {
-         tlb_flush_by_mmuidx(cs,
--                            (1 << ARMMMUIdx_S12NSE1) |
--                            (1 << ARMMMUIdx_S12NSE0) |
--                            (1 << ARMMMUIdx_S2NS));
-+                            ARMMMUIdxBit_S12NSE1 |
-+                            ARMMMUIdxBit_S12NSE0 |
-+                            ARMMMUIdxBit_S2NS);
-         raw_write(env, ri, value);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (arm_is_secure_below_el3(env)) {
-         tlb_flush_by_mmuidx(cs,
--                            (1 << ARMMMUIdx_S1SE1) |
--                            (1 << ARMMMUIdx_S1SE0));
-+                            ARMMMUIdxBit_S1SE1 |
-+                            ARMMMUIdxBit_S1SE0);
-     } else {
-         tlb_flush_by_mmuidx(cs,
--                            (1 << ARMMMUIdx_S12NSE1) |
--                            (1 << ARMMMUIdx_S12NSE0));
-+                            ARMMMUIdxBit_S12NSE1 |
-+                            ARMMMUIdxBit_S12NSE0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (sec) {
-         tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                            (1 << ARMMMUIdx_S1SE1) |
--                                            (1 << ARMMMUIdx_S1SE0));
-+                                            ARMMMUIdxBit_S1SE1 |
-+                                            ARMMMUIdxBit_S1SE0);
-     } else {
-         tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                            (1 << ARMMMUIdx_S12NSE1) |
--                                            (1 << ARMMMUIdx_S12NSE0));
-+                                            ARMMMUIdxBit_S12NSE1 |
-+                                            ARMMMUIdxBit_S12NSE0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (arm_is_secure_below_el3(env)) {
-         tlb_flush_by_mmuidx(cs,
--                            (1 << ARMMMUIdx_S1SE1) |
--                            (1 << ARMMMUIdx_S1SE0));
-+                            ARMMMUIdxBit_S1SE1 |
-+                            ARMMMUIdxBit_S1SE0);
-     } else {
-         if (arm_feature(env, ARM_FEATURE_EL2)) {
-             tlb_flush_by_mmuidx(cs,
--                                (1 << ARMMMUIdx_S12NSE1) |
--                                (1 << ARMMMUIdx_S12NSE0) |
--                                (1 << ARMMMUIdx_S2NS));
-+                                ARMMMUIdxBit_S12NSE1 |
-+                                ARMMMUIdxBit_S12NSE0 |
-+                                ARMMMUIdxBit_S2NS);
-         } else {
-             tlb_flush_by_mmuidx(cs,
--                                (1 << ARMMMUIdx_S12NSE1) |
--                                (1 << ARMMMUIdx_S12NSE0));
-+                                ARMMMUIdxBit_S12NSE1 |
-+                                ARMMMUIdxBit_S12NSE0);
-         }
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     ARMCPU *cpu = arm_env_get_cpu(env);
-     CPUState *cs = CPU(cpu);
--    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
- }
- static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     ARMCPU *cpu = arm_env_get_cpu(env);
-     CPUState *cs = CPU(cpu);
--    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E3));
-+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
- }
- static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (sec) {
-         tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                            (1 << ARMMMUIdx_S1SE1) |
--                                            (1 << ARMMMUIdx_S1SE0));
-+                                            ARMMMUIdxBit_S1SE1 |
-+                                            ARMMMUIdxBit_S1SE0);
-     } else if (has_el2) {
-         tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                            (1 << ARMMMUIdx_S12NSE1) |
--                                            (1 << ARMMMUIdx_S12NSE0) |
--                                            (1 << ARMMMUIdx_S2NS));
-+                                            ARMMMUIdxBit_S12NSE1 |
-+                                            ARMMMUIdxBit_S12NSE0 |
-+                                            ARMMMUIdxBit_S2NS);
-     } else {
-           tlb_flush_by_mmuidx_all_cpus_synced(cs,
--                                              (1 << ARMMMUIdx_S12NSE1) |
--                                              (1 << ARMMMUIdx_S12NSE0));
-+                                              ARMMMUIdxBit_S12NSE1 |
-+                                              ARMMMUIdxBit_S12NSE0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     CPUState *cs = ENV_GET_CPU(env);
--    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
- }
- static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     CPUState *cs = ENV_GET_CPU(env);
--    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E3));
-+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
- }
- static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (arm_is_secure_below_el3(env)) {
-         tlb_flush_page_by_mmuidx(cs, pageaddr,
--                                 (1 << ARMMMUIdx_S1SE1) |
--                                 (1 << ARMMMUIdx_S1SE0));
-+                                 ARMMMUIdxBit_S1SE1 |
-+                                 ARMMMUIdxBit_S1SE0);
-     } else {
-         tlb_flush_page_by_mmuidx(cs, pageaddr,
--                                 (1 << ARMMMUIdx_S12NSE1) |
--                                 (1 << ARMMMUIdx_S12NSE0));
-+                                 ARMMMUIdxBit_S12NSE1 |
-+                                 ARMMMUIdxBit_S12NSE0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     CPUState *cs = CPU(cpu);
-     uint64_t pageaddr = sextract64(value << 12, 0, 56);
--    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
-+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
- }
- static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     CPUState *cs = CPU(cpu);
-     uint64_t pageaddr = sextract64(value << 12, 0, 56);
--    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E3));
-+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
- }
- static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     if (sec) {
-         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                                 (1 << ARMMMUIdx_S1SE1) |
--                                                 (1 << ARMMMUIdx_S1SE0));
-+                                                 ARMMMUIdxBit_S1SE1 |
-+                                                 ARMMMUIdxBit_S1SE0);
-     } else {
-         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                                 (1 << ARMMMUIdx_S12NSE1) |
--                                                 (1 << ARMMMUIdx_S12NSE0));
-+                                                 ARMMMUIdxBit_S12NSE1 |
-+                                                 ARMMMUIdxBit_S12NSE0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                             (1 << ARMMMUIdx_S1E2));
-+                                             ARMMMUIdxBit_S1E2);
- }
- static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                             (1 << ARMMMUIdx_S1E3));
-+                                             ARMMMUIdxBit_S1E3);
- }
- static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     pageaddr = sextract64(value << 12, 0, 48);
--    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
-+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
- }
- static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     pageaddr = sextract64(value << 12, 0, 48);
-     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                             (1 << ARMMMUIdx_S2NS));
-+                                             ARMMMUIdxBit_S2NS);
- }
- static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
- }
-+/* Convert a possible stage1+2 MMU index into the appropriate
-+ * stage 1 MMU index
-+ */
-+static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
-+{
-+    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-+        mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
-+    }
-+    return mmu_idx;
-+}
-+
- /* Returns TBI0 value for current regime el */
- uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
- {
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
-     uint32_t el;
-     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
--       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
--       */
--    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
--        mmu_idx += ARMMMUIdx_S1NSE0;
--    }
-+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-+     */
-+    mmu_idx = stage_1_mmu_idx(mmu_idx);
-     tcr = regime_tcr(env, mmu_idx);
-     el = regime_el(env, mmu_idx);
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
-     uint32_t el;
-     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
--       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
--       */
--    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
--        mmu_idx += ARMMMUIdx_S1NSE0;
--    }
-+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-+     */
-+    mmu_idx = stage_1_mmu_idx(mmu_idx);
-     tcr = regime_tcr(env, mmu_idx);
-     el = regime_el(env, mmu_idx);
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_using_lpae_format(CPUARMState *env,
-  * on whether the long or short descriptor format is in use. */
- bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
- {
--    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
--        mmu_idx += ARMMMUIdx_S1NSE0;
--    }
-+    mmu_idx = stage_1_mmu_idx(mmu_idx);
-     return regime_using_lpae_format(env, mmu_idx);
- }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
-             int ret;
-             ret = get_phys_addr(env, address, access_type,
--                                mmu_idx + ARMMMUIdx_S1NSE0, &ipa, attrs,
-+                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
-                                 prot, page_size, fsr, fi);
-             /* If S1 fails or S2 is disabled, return early.  */
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
-             /*
-              * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
-              */
--            mmu_idx += ARMMMUIdx_S1NSE0;
-+            mmu_idx = stage_1_mmu_idx(mmu_idx);
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
-     int ret;
-     MemTxAttrs attrs = {};
--    ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
-+    ret = get_phys_addr(env, address, access_type,
-+                        core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
-                         &attrs, &prot, &page_size, fsr, fi);
-     if (!ret) {
-         /* Map a single [sub]page.  */
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-     bool ret;
-     uint32_t fsr;
-     ARMMMUFaultInfo fi = {};
-+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
-     *attrs = (MemTxAttrs) {};
--    ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
-+    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-                         attrs, &prot, &page_size, &fsr, &fi);
-     if (ret) {
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
-+++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
-     int target_el;
-     bool same_el;
-     uint32_t syn;
-+    ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
-     if (retaddr) {
-         /* now we have a real cpu fault */
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
-     /* the DFSR for an alignment fault depends on whether we're using
-      * the LPAE long descriptor format, or the short descriptor format
-      */
--    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
-+    if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
-         env->exception.fsr = (1 << 9) | 0x21;
-     } else {
-         env->exception.fsr = 0x1;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void a64_translate_init(void)
+@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
-         offsetof(CPUARMState, exclusive_high), "exclusive_high");
+             } else {
- }
+                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
+             }
--static inline ARMMMUIdx get_a64_user_mem_index(DisasContext *s)
+-        } else if (rm == rn) { /* ROR */
-+static inline int get_a64_user_mem_index(DisasContext *s)
+-            tcg_rm = cpu_reg(s, rm);
- {
+-            if (sf) {
--    /* Return the mmu_idx to use for A64 "unprivileged load/store" insns:
+-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-+    /* Return the core mmu_idx to use for A64 "unprivileged load/store" insns:
+-            } else {
-      *  if EL1, access as if EL0; otherwise access at current EL
+-                TCGv_i32 tmp = tcg_temp_new_i32();
-      */
+-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-+    ARMMMUIdx useridx;
+-                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
-     switch (s->mmu_idx) {
++            if (sf) {
-     case ARMMMUIdx_S12NSE1:
++                /* Specialization to ROR happens in EXTRACT2.  */
--        return ARMMMUIdx_S12NSE0;
++                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
-+        useridx = ARMMMUIdx_S12NSE0;
++            } else {
-+        break;
++                TCGv_i32 t0 = tcg_temp_new_i32();
-     case ARMMMUIdx_S1SE1:
++
--        return ARMMMUIdx_S1SE0;
++                tcg_gen_extrl_i64_i32(t0, tcg_rm);
-+        useridx = ARMMMUIdx_S1SE0;
++                if (rm == rn) {
-+        break;
++                    tcg_gen_rotri_i32(t0, t0, imm);
-     case ARMMMUIdx_S2NS:
++                } else {
-         g_assert_not_reached();
++                    TCGv_i32 t1 = tcg_temp_new_i32();
-     default:
++                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
--        return s->mmu_idx;
++                    tcg_gen_extract2_i32(t0, t0, t1, imm);
-+        useridx = s->mmu_idx;
++                    tcg_temp_free_i32(t1);
-+        break;
++                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
-+    return arm_to_core_mmu_idx(useridx);
- }
- void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
-     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
-     dc->condexec_mask = 0;
-     dc->condexec_cond = 0;
--    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
-+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
-     dc->tbi0 = ARM_TBFLAG_TBI0(tb->flags);
-     dc->tbi1 = ARM_TBFLAG_TBI1(tb->flags);
-     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
-     disas_set_insn_syndrome(s, syn);
- }
--static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
-+static inline int get_a32_user_mem_index(DisasContext *s)
- {
--    /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
-+    /* Return the core mmu_idx to use for A32/T32 "unprivileged load/store"
-      * insns:
-      *  if PL2, UNPREDICTABLE (we choose to implement as if PL0)
-      *  otherwise, access as if at PL0.
-@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
-     case ARMMMUIdx_S1E2:        /* this one is UNPREDICTABLE */
-     case ARMMMUIdx_S12NSE0:
-     case ARMMMUIdx_S12NSE1:
--        return ARMMMUIdx_S12NSE0;
-+        return arm_to_core_mmu_idx(ARMMMUIdx_S12NSE0);
-     case ARMMMUIdx_S1E3:
-     case ARMMMUIdx_S1SE0:
-     case ARMMMUIdx_S1SE1:
--        return ARMMMUIdx_S1SE0;
-+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
-     case ARMMMUIdx_S2NS:
-     default:
-         g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
-     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
-     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
-     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
--    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
-+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
-     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
- #if !defined(CONFIG_USER_ONLY)
-     dc->user = (dc->current_el == 0);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 26/27] hw/arm/virt-acpi-build: build SLIT when needed
+[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
-From: Andrew Jones <drjones@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Cc: Shannon Zhao <zhaoshenglong@huawei.com>
+The mask implied by the extract is redundant with the one
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+implied by the deposit.  Also, fix spelling of BFXIL.
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20170529173751.3443-2-drjones@redhat.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 4 ++++
+ target/arm/translate-a64.c | 6 +++---
-file changed, 4 insertions(+)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
-     if (nb_numa_nodes > 0) {
+             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
-         acpi_add_table(table_offsets, tables_blob);
+             return;
-         build_srat(tables_blob, tables->linker, vms);
+         }
-+        if (have_numa_distance) {
+-        /* opc == 1, BXFIL fall through to deposit */
-+            acpi_add_table(table_offsets, tables_blob);
+-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
-+            build_slit(tables_blob, tables->linker);
++        /* opc == 1, BFXIL fall through to deposit */
-+        }
++        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
          pos = 0;
      } else {
          /* Handle the ri > si case with a deposit
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
          len = ri;
      }
-     if (its_class_name() && !vmc->no_its) {
+-    if (opc == 1) { /* BFM, BXFIL */
 +    if (opc == 1) { /* BFM, BFXIL */
          tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
      } else {
          /* SBFM or UBFM: We start with zero, and we haven't modified
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 19/27] arm: Implement HFNMIENA support for M profile MPU
+[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
-Implement HFNMIENA support for the M profile MPU. This bit controls
+From: Alistair Francis <alistair.francis@wdc.com>
 whether the MPU is treated as enabled when executing at execution
 priorities of less than zero (in NMI, HardFault or with the FAULTMASK
 bit set).
-Doing this requires us to use a different MMU index for "running
+Commit 89e68b575 "target/arm: Use vector operations for saturation"
-at execution priority < 0", because we will have different
+causes this abort() when booting QEMU ARM with a Cortex-A15:
 access permissions for that case versus the normal case.
+0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
+0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
+0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
+0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
+0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
+0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
+0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
+0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
+0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
+0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
+0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
+0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
+0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
+0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
+0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
+0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
+This patch ensures that we don't hit the abort() in the second switch
+case in disas_neon_data_insn() as we will return from the first case.
+Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-14-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h       | 24 +++++++++++++++++++++++-
+ target/arm/translate.c | 4 ++--
- target/arm/helper.c    | 18 +++++++++++++++++-
+file changed, 2 insertions(+), 2 deletions(-)
  target/arm/translate.c |  1 +
 files changed, 41 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-  * for the accesses done as part of a stage 1 page table walk, rather than
-  * having to walk the stage 2 page table over and over.)
-  *
-+ * R profile CPUs have an MPU, but can use the same set of MMU indexes
-+ * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
-+ * NS EL2 if we ever model a Cortex-R52).
-+ *
-+ * M profile CPUs are rather different as they do not have a true MMU.
-+ * They have the following different MMU indexes:
-+ *  User
-+ *  Privileged
-+ *  Execution priority negative (this is like privileged, but the
-+ *  MPU HFNMIENA bit means that it may have different access permission
-+ *  check results to normal privileged code, so can't share a TLB).
-+ *
-  * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
-  * are not quite the same -- different CPU types (most notably M profile
-  * vs A/R profile) would like to use MMU indexes with different semantics,
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
-     ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
-     ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
-+    ARMMMUIdx_MNegPri = 2 | ARM_MMU_IDX_M,
-     /* Indexes below here don't have TLBs and are used only for AT system
-      * instructions or for the first stage of an S12 page table walk.
-      */
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
-     ARMMMUIdxBit_S2NS = 1 << 6,
-     ARMMMUIdxBit_MUser = 1 << 0,
-     ARMMMUIdxBit_MPriv = 1 << 1,
-+    ARMMMUIdxBit_MNegPri = 1 << 2,
- } ARMMMUIdxBit;
- #define MMU_USER_IDX 0
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-     case ARM_MMU_IDX_A:
-         return mmu_idx & 3;
-     case ARM_MMU_IDX_M:
--        return mmu_idx & 1;
-+        return mmu_idx == ARMMMUIdx_MUser ? 0 : 1;
-     default:
-         g_assert_not_reached();
-     }
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
-     if (arm_feature(env, ARM_FEATURE_M)) {
-         ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
-+        /* Execution priority is negative if FAULTMASK is set or
-+         * we're in a HardFault or NMI handler.
-+         */
-+        if ((env->v7m.exception > 0 && env->v7m.exception <= 3)
-+            || env->daif & PSTATE_F) {
-+            return arm_to_core_mmu_idx(ARMMMUIdx_MNegPri);
-+        }
-+
-         return arm_to_core_mmu_idx(mmu_idx);
-     }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_S1NSE0:
-     case ARMMMUIdx_S1NSE1:
-     case ARMMMUIdx_MPriv:
-+    case ARMMMUIdx_MNegPri:
-     case ARMMMUIdx_MUser:
-         return 1;
-     default:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_S1E2:
-     case ARMMMUIdx_S2NS:
-     case ARMMMUIdx_MPriv:
-+    case ARMMMUIdx_MNegPri:
-     case ARMMMUIdx_MUser:
-         return false;
-     case ARMMMUIdx_S1E3:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
-                                                ARMMMUIdx mmu_idx)
- {
-     if (arm_feature(env, ARM_FEATURE_M)) {
--        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
-+        switch (env->v7m.mpu_ctrl &
-+                (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
-+        case R_V7M_MPU_CTRL_ENABLE_MASK:
-+            /* Enabled, but not for HardFault and NMI */
-+            return mmu_idx == ARMMMUIdx_MNegPri;
-+        case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
-+            /* Enabled for all cases */
-+            return false;
-+        case 0:
-+        default:
-+            /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
-+             * we warned about that in armv7m_nvic.c when the guest set it.
-+             */
-+            return true;
-+        }
-     }
-     if (mmu_idx == ARMMMUIdx_S2NS) {
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-     case ARMMMUIdx_MUser:
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-     case ARMMMUIdx_MPriv:
+                            (u ? uqadd_op : sqadd_op) + size);
-+    case ARMMMUIdx_MNegPri:
+-            break;
-         return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
++            return 0;
-     case ARMMMUIdx_S2NS:
-     default:
+         case NEON_3R_VQSUB:
              tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                             rn_ofs, rm_ofs, vec_size, vec_size,
                             (u ? uqsub_op : sqsub_op) + size);
 -            break;
 +            return 0;
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/27] arm: All M profile cores are PMSA
+[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
-All M profile CPUs are PMSA, so set the feature bit.
+The system_clock_scale global is used only by the armv7m systick
-(We haven't actually implemented the M profile MPU register
+device; move the extern declaration to the armv7m_systick.h header,
-interface yet, but setting this feature bit gives us closer
+and expand the comment to explain what it is and that it should
-to correct behaviour for the MPU-disabled case.)
+ideally be replaced with a different approach.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1493122030-32191-11-git-send-email-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 8 ++++++++
+ include/hw/arm/arm.h              |  4 ----
-file changed, 8 insertions(+)
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/include/hw/arm/arm.h
-+++ b/target/arm/cpu.c
++++ b/include/hw/arm/arm.h
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
- {
+                                             const struct arm_boot_info *info,
-     ARMCPU *cpu = ARM_CPU(obj);
+                                             hwaddr mvbar_addr);
-+    /* M profile implies PMSA. We have to do this here rather than
+-/* Multiplication factor to convert from system clock ticks to qemu timer
-+     * in realize with the other feature-implication checks because
+-   ticks.  */
-+     * we look at the PMSA bit to see if we should add some properties.
+-extern int system_clock_scale;
-+     */
+-
-+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+ #endif /* HW_ARM_H */
-+        set_feature(&cpu->env, ARM_FEATURE_PMSA);
+diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
-+    }
+index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/armv7m_systick.h
 +++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
      qemu_irq irq;
  } SysTickState;
 +/*
 + * Multiplication factor to convert from system clock ticks to qemu timer
 + * ticks. This should be set (by board code, usually) to a value
 + * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
 + * in Hz of the CPU.
 + *
 + * This value is used by the systick device when it is running in
 + * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
 + * set how fast the timer should tick.
 + *
 + * TODO: we should refactor this so that rather than using a global
 + * we use a device property or something similar. This is complicated
 + * because (a) the property would need to be plumbed through from the
 + * board code down through various layers to the systick device
 + * and (b) the property needs to be modifiable after realize, because
 + * the stellaris board uses this to implement the behaviour where the
 + * guest can reprogram the PLL registers to downclock the CPU, and the
 + * systick device needs to react accordingly. Possibly this should
 + * be deferred until we have a good API for modelling clock trees.
 + */
 +extern int system_clock_scale;
 +
-     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
+ #endif
          arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property,
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 10/27] arm: Clean up handling of no-MPU PMSA CPUs
+[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
-ARM CPUs come in two flavours:
+The hw/arm/arm.h header now only includes declarations relating
- * proper MMU ("VMSA")
+to boot.c code, so it is only needed by Arm board or SoC code.
- * only an MPU ("PMSA")
+Remove some unnecessary inclusions of it from target/arm files
-For PMSA, the MPU may be implemented, or not (in which case there
+and from hw/intc/armv7m_nvic.c.
 is default "always acts the same" behaviour, but it isn't guest
 programmable).
 QEMU is a bit confused about how we indicate this: we have an
 ARM_FEATURE_MPU, but it's not clear whether this indicates
 "PMSA, not VMSA" or "PMSA and MPU present" , and sometimes we
 use it for one purpose and sometimes the other.
 Currently trying to implement a PMSA-without-MPU core won't
 work correctly because we turn off the ARM_FEATURE_MPU bit
 and then a lot of things which should still exist get
 turned off too.
 As the first step in cleaning this up, rename the feature
 bit to ARM_FEATURE_PMSA, which indicates a PMSA CPU (with
 or without MPU).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1493122030-32191-5-git-send-email-peter.maydell@linaro.org
+Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |  2 +-
+ hw/intc/armv7m_nvic.c | 1 -
- target/arm/cpu.c     | 12 ++++++------
+ target/arm/arm-semi.c | 1 -
- target/arm/helper.c  | 12 ++++++------
+ target/arm/cpu.c      | 1 -
- target/arm/machine.c |  2 +-
+ target/arm/cpu64.c    | 1 -
-files changed, 14 insertions(+), 14 deletions(-)
+ target/arm/kvm.c      | 1 -
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/target/arm/cpu.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@
-     ARM_FEATURE_V6K,
+ #include "cpu.h"
-     ARM_FEATURE_V7,
+ #include "hw/sysbus.h"
-     ARM_FEATURE_THUMB2,
+ #include "qemu/timer.h"
--    ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+-#include "hw/arm/arm.h"
-+    ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
+ #include "hw/intc/armv7m_nvic.h"
-     ARM_FEATURE_VFP3,
+ #include "target/arm/cpu.h"
-     ARM_FEATURE_VFP_FP16,
+ #include "exec/exec-all.h"
-     ARM_FEATURE_NEON,
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-semi.c
 +++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
  #else
  #include "qemu-common.h"
  #include "exec/gdbstub.h"
 -#include "hw/arm/arm.h"
  #include "qemu/cutils.h"
  #endif
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@
-                                  &error_abort);
+ #if !defined(CONFIG_USER_ONLY)
-     }
+ #include "hw/loader.h"
+ #endif
--    if (arm_feature(&cpu->env, ARM_FEATURE_MPU)) {
+-#include "hw/arm/arm.h"
-+    if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
+ #include "sysemu/sysemu.h"
-         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
+ #include "sysemu/hw_accel.h"
-                                  &error_abort);
+ #include "kvm_arm.h"
-         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V7) &&
          !arm_feature(env, ARM_FEATURE_M) &&
 -        !arm_feature(env, ARM_FEATURE_MPU)) {
 +        !arm_feature(env, ARM_FEATURE_PMSA)) {
          /* v7VMSA drops support for the old ARMv5 tiny pages, so we
           * can use 4K pages.
           */
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      }
      if (!cpu->has_mpu) {
 -        unset_feature(env, ARM_FEATURE_MPU);
 +        unset_feature(env, ARM_FEATURE_PMSA);
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU) &&
 +    if (arm_feature(env, ARM_FEATURE_PMSA) &&
          arm_feature(env, ARM_FEATURE_V7)) {
          uint32_t nr = cpu->pmsav7_dregion;
@@ -XXX,XX +XXX,XX @@ static void arm946_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm946";
      set_feature(&cpu->env, ARM_FEATURE_V5);
 -    set_feature(&cpu->env, ARM_FEATURE_MPU);
 +    set_feature(&cpu->env, ARM_FEATURE_PMSA);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      cpu->midr = 0x41059461;
      cpu->ctr = 0x0f004006;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DIV);
      set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
      set_feature(&cpu->env, ARM_FEATURE_V7MP);
 -    set_feature(&cpu->env, ARM_FEATURE_MPU);
 +    set_feature(&cpu->env, ARM_FEATURE_PMSA);
      cpu->midr = 0x411fc153; /* r1p3 */
      cpu->id_pfr0 = 0x0131;
      cpu->id_pfr1 = 0x001;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/cpu64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@
- {
+ #if !defined(CONFIG_USER_ONLY)
-     ARMCPU *cpu = arm_env_get_cpu(env);
+ #include "hw/loader.h"
+ #endif
--    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
+-#include "hw/arm/arm.h"
-+    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
+ #include "sysemu/sysemu.h"
-         && !extended_addresses_enabled(env)) {
+ #include "sysemu/kvm.h"
-         /* For VMSA (when not using the LPAE long descriptor page table
+ #include "kvm_arm.h"
-          * format) this register includes the ASID, so do a TLB flush.
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
          define_arm_cp_regs(cpu, v6k_cp_reginfo);
      }
      if (arm_feature(env, ARM_FEATURE_V7MP) &&
 -        !arm_feature(env, ARM_FEATURE_MPU)) {
 +        !arm_feature(env, ARM_FEATURE_PMSA)) {
          define_arm_cp_regs(cpu, v7mp_cp_reginfo);
      }
      if (arm_feature(env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
          }
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU)) {
 +    if (arm_feature(env, ARM_FEATURE_PMSA)) {
          if (arm_feature(env, ARM_FEATURE_V6)) {
              /* PMSAv6 not implemented */
              assert(arm_feature(env, ARM_FEATURE_V7));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
          }
          define_arm_cp_regs(cpu, id_cp_reginfo);
 -        if (!arm_feature(env, ARM_FEATURE_MPU)) {
 +        if (!arm_feature(env, ARM_FEATURE_PMSA)) {
              define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
          } else if (arm_feature(env, ARM_FEATURE_V7)) {
              define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
      /* pmsav7 has special handling for when MPU is disabled so call it before
       * the common MMU/MPU disabled check below.
       */
 -    if (arm_feature(env, ARM_FEATURE_MPU) &&
 +    if (arm_feature(env, ARM_FEATURE_PMSA) &&
          arm_feature(env, ARM_FEATURE_V7)) {
          *page_size = TARGET_PAGE_SIZE;
          return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
          return 0;
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU)) {
 +    if (arm_feature(env, ARM_FEATURE_PMSA)) {
          /* Pre-v7 MPU */
          *page_size = TARGET_PAGE_SIZE;
          return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/target/arm/kvm.c
-+++ b/target/arm/machine.c
++++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ static bool pmsav7_needed(void *opaque)
+@@ -XXX,XX +XXX,XX @@
-     ARMCPU *cpu = opaque;
+ #include "cpu.h"
-     CPUARMState *env = &cpu->env;
+ #include "trace.h"
+ #include "internals.h"
--    return arm_feature(env, ARM_FEATURE_MPU) &&
+-#include "hw/arm/arm.h"
-+    return arm_feature(env, ARM_FEATURE_PMSA) &&
+ #include "hw/pci/pci.h"
-            arm_feature(env, ARM_FEATURE_V7);
+ #include "exec/memattrs.h"
- }
+ #include "exec/address-spaces.h"
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  #include "qemu/log.h"
  static inline void set_feature(uint64_t *features, int feature)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  static bool have_guest_debug;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 27/27] hw/arm/virt: fdt: generate distance-map when needed
+[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
-From: Andrew Jones <drjones@redhat.com>
+The header file hw/arm/arm.h now includes only declarations
 relating to hw/arm/boot.c functionality. Rename it accordingly,
 and adjust its header comment.
-This is based on patch Shannon Zhao originally posted.
+The bulk of this commit was created via
  perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
-Cc: Shannon Zhao <zhaoshenglong@huawei.com>
+In a few cases we can just delete the #include:
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
-Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
+include/hw/arm/bcm2836.h did not require it.
-Message-id: 20170529173751.3443-3-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 21 +++++++++++++++++++++
+ include/hw/arm/allwinner-a10.h   | 2 +-
-file changed, 21 insertions(+)
+ include/hw/arm/aspeed_soc.h      | 1 -
  include/hw/arm/bcm2836.h         | 1 -
  include/hw/arm/{arm.h => boot.h} | 8 ++++----
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/allwinner-a10.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "qemu/error-report.h"
+ #include "hw/char/serial.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
+ #include "hw/net/allwinner_emac.h"
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ASPEED_SOC_H
+ #define ASPEED_SOC_H
+-#include "hw/arm/arm.h"
+ #include "hw/intc/aspeed_vic.h"
+ #include "hw/misc/aspeed_scu.h"
+ #include "hw/misc/aspeed_sdmc.h"
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/bcm2836.h
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BCM2836_H
+ #define BCM2836_H
+-#include "hw/arm/arm.h"
+ #include "hw/arm/bcm2835_peripherals.h"
+ #include "hw/intc/bcm2836_control.h"
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
+similarity index 98%
+rename from include/hw/arm/arm.h
+rename to include/hw/arm/boot.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/arm.h
++++ b/include/hw/arm/boot.h
+@@ -XXX,XX +XXX,XX @@
+ /*
+- * Misc ARM declarations
++ * ARM kernel loader.
+  *
+  * Copyright (c) 2006 CodeSourcery.
+  * Written by Paul Brook
+@@ -XXX,XX +XXX,XX @@
+  *
+  */
+-#ifndef HW_ARM_H
+-#define HW_ARM_H
++#ifndef HW_ARM_BOOT_H
++#define HW_ARM_BOOT_H
+ #include "exec/memory.h"
+ #include "target/arm/cpu-qom.h"
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+                                             const struct arm_boot_info *info,
+                                             hwaddr mvbar_addr);
+-#endif /* HW_ARM_H */
++#endif /* HW_ARM_BOOT_H */
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx25.h
++++ b/include/hw/arm/fsl-imx25.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX25_H
+ #define FSL_IMX25_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx25_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx31.h
++++ b/include/hw/arm/fsl-imx31.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX31_H
+ #define FSL_IMX31_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx31_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6_H
+ #define FSL_IMX6_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a9mpcore.h"
+ #include "hw/misc/imx6_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6ul.h
++++ b/include/hw/arm/fsl-imx6ul.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6UL_H
+ #define FSL_IMX6UL_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/misc/imx6ul_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX7_H
+ #define FSL_IMX7_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/intc/imx_gpcv2.h"
+ #include "hw/misc/imx7_ccm.h"
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "qemu/notify.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/kvm.h"
+ #include "hw/intc/arm_gicv3_common.h"
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #define XLNX_VERSAL_H
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/xlnx-zynqmp.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef XLNX_ZYNQMP_H
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gic.h"
+ #include "hw/net/cadence_gem.h"
+ #include "hw/char/cadence_uart.h"
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/registerfields.h"
+ #include "hw/arm/armsse.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ /* Format of the System Information block SYS_CONFIG register */
+ typedef enum SysConfigFormat {
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "elf.h"
+ #include "sysemu/qtest.h"
+diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed.c
++++ b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "exec/address-spaces.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/aspeed.h"
+ #include "hw/arm/aspeed_soc.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include <libfdt.h>
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/linux-boot-if.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/collie.c b/hw/arm/collie.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/collie.c
++++ b/hw/arm/collie.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "strongarm.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "exec/address-spaces.h"
+ #include "cpu.h"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/sd/sdhci.h"
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4_boards.c
++++ b/hw/arm/exynos4_boards.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+ #include "net/net.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/net/lan9118.h"
+diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/highbank.c
++++ b/hw/arm/highbank.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "net/net.h"
+ #include "sysemu/kvm.h"
+diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/integratorcp.c
++++ b/hw/arm/integratorcp.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/misc/arm_integrator_debug.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mainstone.c
++++ b/hw/arm/mainstone.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "hw/net/smc91c111.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/microbit.c
++++ b/hw/arm/microbit.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-soc.c
++++ b/hw/arm/msf2-soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/units.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
+ #include "exec/address-spaces.h"
+ #include "hw/char/serial.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-som.c
++++ b/hw/arm/msf2-som.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/msf2-soc.h"
+ #include "cpu.h"
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "exec/address-spaces.h"
+ #include "sysemu/sysemu.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armsse.h"
+ #include "hw/boards.h"
+ #include "hw/char/pl011.h"
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musicpal.c
++++ b/hw/arm/musicpal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduino2.c
++++ b/hw/arm/netduino2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "qemu/error-report.h"
+ #include "hw/arm/stm32f205_soc.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ static void netduino2_init(MachineState *machine)
+ {
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "hw/misc/unimp.h"
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/omap.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/irq.h"
+ #include "ui/console.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap1.c
++++ b/hw/arm/omap1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/soc_dma.h"
+diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap2.c
++++ b/hw/arm/omap2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/qtest.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "qemu/timer.h"
+diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap_sx1.c
++++ b/hw/arm/omap_sx1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/qtest.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/input/tsc2xxx.h"
+ #include "hw/loader.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/raspi.c
++++ b/hw/arm/raspi.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+ #include "hw/loader.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
+diff --git a/hw/arm/realview.c b/hw/arm/realview.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/realview.c
++++ b/hw/arm/realview.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/net/smc91c111.h"
+diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/spitz.c
++++ b/hw/arm/spitz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/pcmcia.h"
+ #include "hw/i2c/i2c.h"
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+ #include "hw/ssi/ssi.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "qemu/timer.h"
+ #include "hw/i2c/i2c.h"
+ #include "net/net.h"
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/stm32f205_soc.h"
+diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/strongarm.c
++++ b/hw/arm/strongarm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "strongarm.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "chardev/char-fe.h"
+ #include "chardev/char-serial.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/tosa.c
++++ b/hw/arm/tosa.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/sharpsl.h"
+ #include "hw/pcmcia.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/versatilepb.c
++++ b/hw/arm/versatilepb.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/vexpress.c
++++ b/hw/arm/vexpress.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@
-                                 "clk24mhz");
+ #include "qemu/option.h"
-     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
-+    if (have_numa_distance) {
+-#include "hw/arm/arm.h"
-+        int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
++#include "hw/arm/boot.h"
-+        uint32_t *matrix = g_malloc0(size);
+ #include "hw/arm/primecell.h"
-+        int idx, i, j;
+ #include "hw/arm/virt.h"
-+
+ #include "hw/block/flash.h"
-+        for (i = 0; i < nb_numa_nodes; i++) {
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
-+            for (j = 0; j < nb_numa_nodes; j++) {
+index XXXXXXX..XXXXXXX 100644
-+                idx = (i * nb_numa_nodes + j) * 3;
+--- a/hw/arm/xilinx_zynq.c
-+                matrix[idx + 0] = cpu_to_be32(i);
++++ b/hw/arm/xilinx_zynq.c
-+                matrix[idx + 1] = cpu_to_be32(j);
+@@ -XXX,XX +XXX,XX @@
-+                matrix[idx + 2] = cpu_to_be32(numa_info[i].distance[j]);
+ #include "qemu-common.h"
-+            }
+ #include "cpu.h"
-+        }
+ #include "hw/sysbus.h"
-+
+-#include "hw/arm/arm.h"
-+        qemu_fdt_add_subnode(fdt, "/distance-map");
++#include "hw/arm/boot.h"
-+        qemu_fdt_setprop_string(fdt, "/distance-map", "compatible",
+ #include "net/net.h"
-+                                "numa-distance-map-v1");
+ #include "exec/address-spaces.h"
-+        qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",
+ #include "sysemu/sysemu.h"
-+                         matrix, size);
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-+        g_free(matrix);
+index XXXXXXX..XXXXXXX 100644
-+    }
+--- a/hw/arm/xlnx-versal.c
- }
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@
- static void fdt_add_psci_node(const VirtMachineState *vms)
+ #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/i2c/i2c.h"
  #include "hw/ssi/ssi.h"
  #include "hw/boards.h"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/27] hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
+[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-We were setting the VBPR1 field of VMCR_EL2 to icv_min_vbpr()
+In ich_vmcr_write() we enforce "writes of BPR fields to less than
-on reset, but this is not correct. The field should reset to
+their minimum sets them to the minimum" by doing a "read vbpr and
-the minimum value of ICV_BPR0_EL1 plus one.
+write it back" operation.  A typo here meant that we weren't handling
 writes to these fields correctly, because we were reading from VBPR0
 but writing to VBPR1.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1493226792-3237-2-git-send-email-peter.maydell@linaro.org
+Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 ---
  hw/intc/arm_gicv3_cpuif.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     cs->ich_hcr_el2 = 0;
+     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
-     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
+      * by reading and writing back the fields.
-     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
+      */
--        (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR1_SHIFT) |
+-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
-+        ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
++    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
-         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
+     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
- }
+     gicv3_cpuif_virt_update(cs);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/27] hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
+[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-When we calculate the mask to use to get the group priority from
+The ICC_CTLR_EL3 register includes some bits which are aliases
-an interrupt priority, the way that NS BPR1 is handled differs
+of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
-from how BPR0 and S BPR1 work -- a BPR1 value of 1 means
+to keep those bits in the cs->icc_ctlr_el1[] struct fields.
-the group priority is in bits [7:1], whereas for BPR0 and S BPR1
+Unfortunately a missing '~' in the code to update the bits
-this is indicated by a 0 BPR value.
+in those fields meant that writing to ICC_CTLR_EL3 would corrupt
+the ICC_CLTR_EL1 register values.
 Subtract 1 from the BPR value before creating the mask if
 we're using the NS BPR value, for both hardware and virtual
 interrupts, as the GICv3 pseudocode does, and fix the comments
 accordingly.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org
+Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_cpuif.c | 42 ++++++++++++++++++++++++++++++++++++++----
+ hw/intc/arm_gicv3_cpuif.c | 4 ++--
-file changed, 38 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
+     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
-     /* Return a mask word which clears the subpriority bits from
-      * a priority value for a virtual interrupt in the specified group.
+     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
--     * This depends on the VBPR value:
+-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+     * This depends on the VBPR value.
++    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+     * If using VBPR0 then:
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
-      *  a BPR of 0 means the group priority bits are [7:1];
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
       *  a BPR of 1 means they are [7:2], and so on down to
       *  a BPR of 7 meaning no group priority bits at all.
 +     * If using VBPR1 then:
 +     *  a BPR of 0 is impossible (the minimum value is 1)
 +     *  a BPR of 1 means the group priority bits are [7:1];
 +     *  a BPR of 2 means they are [7:2], and so on down to
 +     *  a BPR of 7 meaning the group priority is [7].
 +     *
       * Which BPR to use depends on the group of the interrupt and
       * the current ICH_VMCR_EL2.VCBPR settings.
 +     *
 +     * This corresponds to the VGroupBits() pseudocode.
       */
 +    int bpr;
 +
      if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
          group = GICV3_G0;
      }
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
--    return ~0U << (read_vbpr(cs, group) + 1);
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
 +    bpr = read_vbpr(cs, group);
 +    if (group == GICV3_G1NS) {
 +        assert(bpr > 0);
 +        bpr--;
 +    }
 +
 +    return ~0U << (bpr + 1);
  }
  static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
@@ -XXX,XX +XXX,XX @@ static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
  {
      /* Return a mask word which clears the subpriority bits from
       * a priority value for an interrupt in the specified group.
 -     * This depends on the BPR value:
 +     * This depends on the BPR value. For CBPR0 (S or NS):
       *  a BPR of 0 means the group priority bits are [7:1];
       *  a BPR of 1 means they are [7:2], and so on down to
       *  a BPR of 7 meaning no group priority bits at all.
 +     * For CBPR1 NS:
 +     *  a BPR of 0 is impossible (the minimum value is 1)
 +     *  a BPR of 1 means the group priority bits are [7:1];
 +     *  a BPR of 2 means they are [7:2], and so on down to
 +     *  a BPR of 7 meaning the group priority is [7].
 +     *
       * Which BPR to use depends on the group of the interrupt and
       * the current ICC_CTLR.CBPR settings.
 +     *
 +     * This corresponds to the GroupBits() pseudocode.
       */
 +    int bpr;
 +
      if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
          (group == GICV3_G1NS &&
           cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
          group = GICV3_G0;
      }
--    return ~0U << ((cs->icc_bpr[group] & 7) + 1);
+-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+    bpr = cs->icc_bpr[group] & 7;
++    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
-+    if (group == GICV3_G1NS) {
+         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
-+        assert(bpr > 0);
+     }
 +        bpr--;
 +    }
 +
 +    return ~0U << (bpr + 1);
  }
  static bool icc_no_enabled_hppi(GICv3CPUState *cs)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/27] load_uboot_image: don't assume a full header read
+[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
-From: Andrew Jones <drjones@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Don't allow load_uboot_image() to proceed when less bytes than
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-header-size was read.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20190520214342.13709-2-philmd@redhat.com
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20170524091315.20284-1-drjones@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/loader.c | 3 ++-
+ hw/arm/exynos4_boards.c | 24 ------------------------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 24 deletions(-)
-diff --git a/hw/core/loader.c b/hw/core/loader.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/loader.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/core/loader.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
+@@ -XXX,XX +XXX,XX @@
-         return -1;
+ #include "hw/net/lan9118.h"
+ #include "hw/boards.h"
-     size = read(fd, hdr, sizeof(uboot_image_header_t));
--    if (size < 0)
+-#undef DEBUG
-+    if (size < sizeof(uboot_image_header_t)) {
+-
-         goto out;
+-//#define DEBUG
-+    }
+-
+-#ifdef DEBUG
-     bswap_uboot_header(hdr);
+-    #undef PRINT_DEBUG
 -    #define  PRINT_DEBUG(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -#else
 -    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
 -#endif
 -
  #define SMDK_LAN9118_BASE_ADDR      0x05000000
  typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_board_binfo.gic_cpu_if_addr =
              EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 -    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
 -            " kernel_filename: %s\n"
 -            " kernel_cmdline: %s\n"
 -            " initrd_filename: %s\n",
 -            exynos4_board_ram_size[board_type] / 1048576,
 -            exynos4_board_ram_size[board_type],
 -            machine->kernel_filename,
 -            machine->kernel_cmdline,
 -            machine->initrd_filename);
 -
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/27] hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
+Deleted patch
-icc_bpr_write() was not enforcing that writing a value below the
-minimum for the BPR should behave as if the BPR was set to the
-minimum value. This doesn't make a difference for the secure
-BPRs (since we define the minimum for the QEMU implementation
-as zero) but did mean we were allowing the NS BPR1 to be set to
-when 1 should be the lowest value.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493226792-3237-3-git-send-email-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_cpuif.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     GICv3CPUState *cs = icc_cs_from_env(env);
-     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
-+    uint64_t minval;
-     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
-         icv_bpr_write(env, ri, value);
-@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         return;
-     }
-+    minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
-+    if (value < minval) {
-+        value = minval;
-+    }
-+
-     cs->icc_bpr[grp] = value & 7;
-     gicv3_cpuif_update(cs);
- }
---
-.7.4

-[Qemu-devel] [PULL 06/27] target/arm: clear PMUVER field of AA64DFR0 when vPMU=off
+Deleted patch
-From: Wei Huang <wei@redhat.com>
-The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)
-relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support
-is present or not. This patch clears the PMUVER field under TCG mode
-when vPMU=off. Without it, PMUv3 will init insider guest VMs even
-with vPMU=off. This patch also removes a redundant line inside the
-if-statement.
-Signed-off-by: Wei Huang <wei@redhat.com>
-Message-id: 1495123889-32301-1-git-send-email-wei@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-     }
-     if (!cpu->has_pmu) {
--        cpu->has_pmu = false;
-         unset_feature(env, ARM_FEATURE_PMU);
-+        cpu->id_aa64dfr0 &= ~0xf00;
-     }
-     if (!arm_feature(env, ARM_FEATURE_EL2)) {
---
-.7.4

-[Qemu-devel] [PULL 07/27] arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
+Deleted patch
-When identifying the DFSR format for an alignment fault, use
-the mmu index that we are passed, rather than calling cpu_mmu_index()
-to get the mmu index for the current CPU state. This doesn't actually
-make any difference since the only cases where the current MMU index
-differs from the index used for the load are the "unprivileged
-load/store" instructions, and in that case the mmu index may
-differ but the translation regime is the same (apart from the
-"use from Hyp mode" case which is UNPREDICTABLE).
-However it's the more logical thing to do.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-2-git-send-email-peter.maydell@linaro.org
----
- target/arm/op_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
-+++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
-     /* the DFSR for an alignment fault depends on whether we're using
-      * the LPAE long descriptor format, or the short descriptor format
-      */
--    if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
-+    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
-         env->exception.fsr = (1 << 9) | 0x21;
-     } else {
-         env->exception.fsr = 0x1;
---
-.7.4

-[Qemu-devel] [PULL 09/27] arm: Use different ARMMMUIdx values for M profile
+Deleted patch
-Make M profile use completely separate ARMMMUIdx values from
-those that A profile CPUs use. This is a prelude to adding
-support for the MPU and for v8M, which together will require
-MMU indexes which don't map cleanly onto the A profile
-uses:
- non secure User
- non secure Privileged
- non secure Privileged, execution priority < 0
- secure User
- secure Privileged
- secure Privileged, execution priority < 0
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-4-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h       | 21 +++++++++++++++++++--
- target/arm/helper.c    |  5 +++++
- target/arm/translate.c |  3 +++
-files changed, 27 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-  * of the AT/ATS operations.
-  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
-  */
--#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
-+#define ARM_MMU_IDX_A 0x10 /* A profile */
- #define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
-+#define ARM_MMU_IDX_M 0x40 /* M profile */
- #define ARM_MMU_IDX_TYPE_MASK (~0x7)
- #define ARM_MMU_IDX_COREIDX_MASK 0x7
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
-     ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
-     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
-+    ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
-     /* Indexes below here don't have TLBs and are used only for AT system
-      * instructions or for the first stage of an S12 page table walk.
-      */
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
-     ARMMMUIdxBit_S1SE0 = 1 << 4,
-     ARMMMUIdxBit_S1SE1 = 1 << 5,
-     ARMMMUIdxBit_S2NS = 1 << 6,
-+    ARMMMUIdxBit_MUser = 1 << 0,
-+    ARMMMUIdxBit_MPriv = 1 << 1,
- } ARMMMUIdxBit;
- #define MMU_USER_IDX 0
-@@ -XXX,XX +XXX,XX @@ static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
- static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
- {
--    return mmu_idx | ARM_MMU_IDX_A;
-+    if (arm_feature(env, ARM_FEATURE_M)) {
-+        return mmu_idx | ARM_MMU_IDX_M;
-+    } else {
-+        return mmu_idx | ARM_MMU_IDX_A;
-+    }
- }
- /* Return the exception level we're running at if this is our mmu_idx */
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-     switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
-     case ARM_MMU_IDX_A:
-         return mmu_idx & 3;
-+    case ARM_MMU_IDX_M:
-+        return mmu_idx & 1;
-     default:
-         g_assert_not_reached();
-     }
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
- {
-     int el = arm_current_el(env);
-+    if (arm_feature(env, ARM_FEATURE_M)) {
-+        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
-+
-+        return arm_to_core_mmu_idx(mmu_idx);
-+    }
-+
-     if (el < 2 && arm_is_secure_below_el3(env)) {
-         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
-     }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_S1SE1:
-     case ARMMMUIdx_S1NSE0:
-     case ARMMMUIdx_S1NSE1:
-+    case ARMMMUIdx_MPriv:
-+    case ARMMMUIdx_MUser:
-         return 1;
-     default:
-         g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_S1NSE1:
-     case ARMMMUIdx_S1E2:
-     case ARMMMUIdx_S2NS:
-+    case ARMMMUIdx_MPriv:
-+    case ARMMMUIdx_MUser:
-         return false;
-     case ARMMMUIdx_S1E3:
-     case ARMMMUIdx_S1SE0:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
-     switch (mmu_idx) {
-     case ARMMMUIdx_S1SE0:
-     case ARMMMUIdx_S1NSE0:
-+    case ARMMMUIdx_MUser:
-         return true;
-     default:
-         return false;
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
-     case ARMMMUIdx_S1SE0:
-     case ARMMMUIdx_S1SE1:
-         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
-+    case ARMMMUIdx_MUser:
-+    case ARMMMUIdx_MPriv:
-+        return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
-     case ARMMMUIdx_S2NS:
-     default:
-         g_assert_not_reached();
---
-.7.4

-[Qemu-devel] [PULL 11/27] arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
+Deleted patch
-Fix the handling of QOM properties for PMSA CPUs with no MPU:
-Allow no-MPU to be specified by either:
- * has-mpu = false
- * pmsav7_dregion = 0
-and make setting one imply the other. Don't clear the PMSA
-feature bit in this situation.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-6-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.c | 8 +++++++-
-file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-         cpu->id_pfr1 &= ~0xf000;
-     }
-+    /* MPU can be configured out of a PMSA CPU either by setting has-mpu
-+     * to false or by setting pmsav7-dregion to 0.
-+     */
-     if (!cpu->has_mpu) {
--        unset_feature(env, ARM_FEATURE_PMSA);
-+        cpu->pmsav7_dregion = 0;
-+    }
-+    if (cpu->pmsav7_dregion == 0) {
-+        cpu->has_mpu = false;
-     }
-     if (arm_feature(env, ARM_FEATURE_PMSA) &&
---
-.7.4

-[Qemu-devel] [PULL 12/27] arm: Don't let no-MPU PMSA cores write to SCTLR.M
+Deleted patch
-If the CPU is a PMSA config with no MPU implemented, then the
-SCTLR.M bit should be RAZ/WI, so that the guest can never
-turn on the non-existent MPU.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-7-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         return;
-     }
-+    if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
-+        /* M bit is RAZ/WI for PMSA with no MPU implemented */
-+        value &= ~SCTLR_M;
-+    }
-+
-     raw_write(env, ri, value);
-     /* ??? Lots of these bits are not implemented.  */
-     /* This may enable/disable the MMU, so do a TLB flush.  */
---
-.7.4

-[Qemu-devel] [PULL 13/27] arm: Remove unnecessary check on cpu->pmsav7_dregion
+Deleted patch
-Now that we enforce both:
- * pmsav7_dregion == 0 implies has_mpu == false
- * PMSA with has_mpu == false means SCTLR.M cannot be set
-we can remove a check on pmsav7_dregion from get_phys_addr_pmsav7(),
-because we can only reach this code path if the MPU is enabled
-(and so region_translation_disabled() returned false).
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-8-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-         }
-         if (n == -1) { /* no hits */
--            if (cpu->pmsav7_dregion &&
--                (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
-+            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
-                 /* background fault */
-                 *fsr = 0;
-                 return true;
---
-.7.4

-[Qemu-devel] [PULL 14/27] armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-Improve the "-d mmu" tracing for the PMSAv7 MPU translation
-process as an aid in debugging guest MPU configurations:
- * fix a missing newline for a guest-error log
- * report the region number with guest-error or unimp
-   logs of bad region register values
- * add a log message for the overall result of the lookup
- * print "0x" prefix for hex values
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-9-git-send-email-peter.maydell@linaro.org
-[PMM: a little tidyup, report region number in all messages
- rather than just one]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 39 +++++++++++++++++++++++++++------------
-file changed, 27 insertions(+), 12 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-             }
-             if (!rsize) {
--                qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
-+                qemu_log_mask(LOG_GUEST_ERROR,
-+                              "DRSR[%d]: Rsize field cannot be 0\n", n);
-                 continue;
-             }
-             rsize++;
-             rmask = (1ull << rsize) - 1;
-             if (base & rmask) {
--                qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
--                              "to DRSR region size, mask = %" PRIx32,
--                              base, rmask);
-+                qemu_log_mask(LOG_GUEST_ERROR,
-+                              "DRBAR[%d]: 0x%" PRIx32 " misaligned "
-+                              "to DRSR region size, mask = 0x%" PRIx32 "\n",
-+                              n, base, rmask);
-                 continue;
-             }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                 }
-             }
-             if (rsize < TARGET_PAGE_BITS) {
--                qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
-+                qemu_log_mask(LOG_UNIMP,
-+                              "DRSR[%d]: No support for MPU (sub)region "
-                               "alignment of %" PRIu32 " bits. Minimum is %d\n",
--                              rsize, TARGET_PAGE_BITS);
-+                              n, rsize, TARGET_PAGE_BITS);
-                 continue;
-             }
-             if (srdis) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                     break;
-                 default:
-                     qemu_log_mask(LOG_GUEST_ERROR,
--                                  "Bad value for AP bits in DRACR %"
--                                  PRIx32 "\n", ap);
-+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
-+                                  PRIx32 "\n", n, ap);
-                 }
-             } else { /* Priv. mode AP bits decoding */
-                 switch (ap) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                     break;
-                 default:
-                     qemu_log_mask(LOG_GUEST_ERROR,
--                                  "Bad value for AP bits in DRACR %"
--                                  PRIx32 "\n", ap);
-+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
-+                                  PRIx32 "\n", n, ap);
-                 }
-             }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
-      */
-     if (arm_feature(env, ARM_FEATURE_PMSA) &&
-         arm_feature(env, ARM_FEATURE_V7)) {
-+        bool ret;
-         *page_size = TARGET_PAGE_SIZE;
--        return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
--                                    phys_ptr, prot, fsr);
-+        ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-+                                   phys_ptr, prot, fsr);
-+        qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
-+                      " mmu_idx %u -> %s (prot %c%c%c)\n",
-+                      access_type == 1 ? "reading" :
-+                      (access_type == 2 ? "writing" : "execute"),
-+                      (uint32_t)address, mmu_idx,
-+                      ret ? "Miss" : "Hit",
-+                      *prot & PAGE_READ ? 'r' : '-',
-+                      *prot & PAGE_WRITE ? 'w' : '-',
-+                      *prot & PAGE_EXEC ? 'x' : '-');
-+
-+        return ret;
-     }
-     if (regime_translation_disabled(env, mmu_idx)) {
---
-.7.4

-[Qemu-devel] [PULL 15/27] armv7m: Implement M profile default memory map
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-Add support for the M profile default memory map which is used
-if the MPU is not present or disabled.
-The main differences in behaviour from implementing this
-correctly are that we set the PAGE_EXEC attribute on
-the right regions of memory, such that device regions
-are not executable.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Message-id: 1493122030-32191-10-git-send-email-peter.maydell@linaro.org
-[PMM: rephrased comment and commit message; don't mark
- the flash memory region as not-writable; list all
- the cases in the default map explicitly rather than
- using a 'default' case for the non-executable regions]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 41 ++++++++++++++++++++++++++++++++---------
-file changed, 32 insertions(+), 9 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
-                                                 ARMMMUIdx mmu_idx,
-                                                 int32_t address, int *prot)
- {
--    *prot = PAGE_READ | PAGE_WRITE;
--    switch (address) {
--    case 0xF0000000 ... 0xFFFFFFFF:
--        if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
-+    if (!arm_feature(env, ARM_FEATURE_M)) {
-+        *prot = PAGE_READ | PAGE_WRITE;
-+        switch (address) {
-+        case 0xF0000000 ... 0xFFFFFFFF:
-+            if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
-+                /* hivecs execing is ok */
-+                *prot |= PAGE_EXEC;
-+            }
-+            break;
-+        case 0x00000000 ... 0x7FFFFFFF:
-             *prot |= PAGE_EXEC;
-+            break;
-+        }
-+    } else {
-+        /* Default system address map for M profile cores.
-+         * The architecture specifies which regions are execute-never;
-+         * at the MPU level no other checks are defined.
-+         */
-+        switch (address) {
-+        case 0x00000000 ... 0x1fffffff: /* ROM */
-+        case 0x20000000 ... 0x3fffffff: /* SRAM */
-+        case 0x60000000 ... 0x7fffffff: /* RAM */
-+        case 0x80000000 ... 0x9fffffff: /* RAM */
-+            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-+            break;
-+        case 0x40000000 ... 0x5fffffff: /* Peripheral */
-+        case 0xa0000000 ... 0xbfffffff: /* Device */
-+        case 0xc0000000 ... 0xdfffffff: /* Device */
-+        case 0xe0000000 ... 0xffffffff: /* System */
-+            *prot = PAGE_READ | PAGE_WRITE;
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
--        break;
--    case 0x00000000 ... 0x7FFFFFFF:
--        *prot |= PAGE_EXEC;
--        break;
-     }
--
- }
- static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
---
-.7.4

-[Qemu-devel] [PULL 17/27] armv7m: Classify faults as MemManage or BusFault
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-General logic is that operations stopped by the MPU are MemManage,
-and those which go through the MPU and are caught by the unassigned
-handle are BusFault. Distinguish these by looking at the
-exception.fsr values, and set the CFSR bits and (if appropriate)
-fill in the BFAR or MMFAR with the exception address.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Message-id: 1493122030-32191-12-git-send-email-peter.maydell@linaro.org
-[PMM: i-side faults do not set BFAR/MMFAR, only d-side;
- added some CPU_LOG_INT logging]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
----
- target/arm/helper.c | 45 ++++++++++++++++++++++++++++++++++++++++++---
-file changed, 42 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         break;
-     case EXCP_PREFETCH_ABORT:
-     case EXCP_DATA_ABORT:
--        /* TODO: if we implemented the MPU registers, this is where we
--         * should set the MMFAR, etc from exception.fsr and exception.vaddress.
-+        /* Note that for M profile we don't have a guest facing FSR, but
-+         * the env->exception.fsr will be populated by the code that
-+         * raises the fault, in the A profile short-descriptor format.
-          */
--        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
-+        switch (env->exception.fsr & 0xf) {
-+        case 0x8: /* External Abort */
-+            switch (cs->exception_index) {
-+            case EXCP_PREFETCH_ABORT:
-+                env->v7m.cfsr |= R_V7M_CFSR_PRECISERR_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
-+                break;
-+            case EXCP_DATA_ABORT:
-+                env->v7m.cfsr |=
-+                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-+                env->v7m.bfar = env->exception.vaddress;
-+                qemu_log_mask(CPU_LOG_INT,
-+                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
-+                              env->v7m.bfar);
-+                break;
-+            }
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS);
-+            break;
-+        default:
-+            /* All other FSR values are either MPU faults or "can't happen
-+             * for M profile" cases.
-+             */
-+            switch (cs->exception_index) {
-+            case EXCP_PREFETCH_ABORT:
-+                env->v7m.cfsr |= R_V7M_CFSR_IACCVIOL_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
-+                break;
-+            case EXCP_DATA_ABORT:
-+                env->v7m.cfsr |=
-+                    (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
-+                env->v7m.mmfar = env->exception.vaddress;
-+                qemu_log_mask(CPU_LOG_INT,
-+                              "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
-+                              env->v7m.mmfar);
-+                break;
-+            }
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
-+            break;
-+        }
-         break;
-     case EXCP_BKPT:
-         if (semihosting_enabled()) {
---
-.7.4

-[Qemu-devel] [PULL 23/27] aspeed: add some I2C devices to the Aspeed machines
+[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Let's add an RTC to the palmetto BMC and a LM75 temperature sensor to
+It eases code review, unit is explicit.
 the AST2500 EVB to start with.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1494827476-1487-5-git-send-email-clg@kaod.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed.c | 27 +++++++++++++++++++++++++++
+ hw/arm/exynos4_boards.c | 5 +++--
-file changed, 27 insertions(+)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
+@@ -XXX,XX +XXX,XX @@
-     const char *fmc_model;
+  */
-     const char *spi_model;
-     uint32_t num_cs;
+ #include "qemu/osdep.h"
-+    void (*i2c_init)(AspeedBoardState *bmc);
++#include "qemu/units.h"
- } AspeedBoardConfig;
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
- enum {
+ #include "qemu-common.h"
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
          SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
          SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 +static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
 +static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
 +
  static const AspeedBoardConfig aspeed_boards[] = {
      [PALMETTO_BMC] = {
          .soc_name  = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .fmc_model = "n25q256a",
          .spi_model = "mx25l25635e",
          .num_cs    = 1,
 +        .i2c_init  = palmetto_bmc_i2c_init,
      },
      [AST2500_EVB]  = {
          .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .fmc_model = "n25q256a",
          .spi_model = "mx25l25635e",
          .num_cs    = 1,
 +        .i2c_init  = ast2500_evb_i2c_init,
      },
      [ROMULUS_BMC]  = {
          .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
      aspeed_board_binfo.ram_size = ram_size;
      aspeed_board_binfo.loader_start = sc->info->sdram_base;
 +    if (cfg->i2c_init) {
 +        cfg->i2c_init(bmc);
 +    }
 +
      arm_load_kernel(ARM_CPU(first_cpu), &aspeed_board_binfo);
  }
 +static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 +{
 +    AspeedSoCState *soc = &bmc->soc;
 +
 +    /* The palmetto platform expects a ds3231 RTC but a ds1338 is
 +     * enough to provide basic RTC features. Alarms will be missing */
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
 +}
 +
  static void palmetto_bmc_init(MachineState *machine)
  {
      aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
      .class_init = palmetto_bmc_class_init,
  };
-+static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
+ static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-+{
+-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-+    AspeedSoCState *soc = &bmc->soc;
+-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-+
++    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
-+    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
++    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
+ };
-+}
-+
+ static struct arm_boot_info exynos4_board_binfo = {
  static void ast2500_evb_init(MachineState *machine)
  {
      aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 18/27] arm: add MPU support to M profile CPUs
+[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
-From: Michael Davidsaver <mdavidsaver@gmail.com>
+From: Guenter Roeck <linux@roeck-us.net>
-The M series MPU is almost the same as the already implemented R
+QEMU already supports pl330. Instantiate it for Exynos4210.
 profile MPU (v7 PMSA).  So all we need to implement here is the MPU
 register interface in the system register space.
-This implementation has the same restriction as the R profile MPU
+Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
 that it doesn't permit regions to be sized down smaller than 1K.
-We also do not yet implement support for MPU_CTRL.HFNMIENA; this
+/ {
-bit should if zero disable use of the MPU when running HardFault,
+    soc: soc {
-NMI or with FAULTMASK set to 1 (ie at an execution priority of
+        amba {
-less than zero) -- if the MPU is enabled we don't treat these
+            pdma0: pdma@12680000 {
-cases any differently.
+                compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 1493122030-32191-13-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-[PMM: Keep all the bits in mpu_ctrl field, rather than
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
- using SCTLR bits for them; drop broken HFNMIENA support;
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
- various cleanup]
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h      |   6 +++
+ hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
- hw/intc/armv7m_nvic.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 26 insertions(+)
  target/arm/helper.c   |  25 +++++++++++-
  target/arm/machine.c  |   5 ++-
 files changed, 137 insertions(+), 3 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/exynos4210.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@
-         uint32_t dfsr; /* Debug Fault Status Register */
+ /* EHCI */
-         uint32_t mmfar; /* MemManage Fault Address */
+ #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
-         uint32_t bfar; /* BusFault Address */
-+        unsigned mpu_ctrl; /* MPU_CTRL (some bits kept in sctlr_el[1]) */
++/* DMA */
-         int exception;
++#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
-     } v7m;
++#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
++#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
  FIELD(V7M_DFSR, VCATCH, 3, 1)
  FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 +/* v7M MPU_CTRL bits */
 +FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
 +FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
 +FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
 +
- /* If adding a feature bit which corresponds to a Linux ELF
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
-  * HWCAP bit, remember to update the feature-bit-to-hwcap
+x09, 0x00, 0x00, 0x00 };
-  * mapping in linux-user/elfload.c:get_elf_hwcap().
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-index XXXXXXX..XXXXXXX 100644
+     return (0x9 << ARM_AFF1_SHIFT) | cpu;
---- a/hw/intc/armv7m_nvic.c
+ }
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
++static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
- #include "hw/arm/arm.h"
++{
- #include "hw/arm/armv7m_nvic.h"
++    SysBusDevice *busdev;
- #include "target/arm/cpu.h"
++    DeviceState *dev;
 +#include "exec/exec-all.h"
  #include "qemu/log.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
      case 0xd70: /* ISAR4.  */
          return 0x01310102;
      /* TODO: Implement debug registers.  */
 +    case 0xd90: /* MPU_TYPE */
 +        /* Unified MPU; if the MPU is not present this value is zero */
 +        return cpu->pmsav7_dregion << 8;
 +        break;
 +    case 0xd94: /* MPU_CTRL */
 +        return cpu->env.v7m.mpu_ctrl;
 +    case 0xd98: /* MPU_RNR */
 +        return cpu->env.cp15.c6_rgnr;
 +    case 0xd9c: /* MPU_RBAR */
 +    case 0xda4: /* MPU_RBAR_A1 */
 +    case 0xdac: /* MPU_RBAR_A2 */
 +    case 0xdb4: /* MPU_RBAR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
-+        if (region >= cpu->pmsav7_dregion) {
++    dev = qdev_create(NULL, "pl330");
-+            return 0;
++    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
-+        }
++    qdev_init_nofail(dev);
-+        return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
++    busdev = SYS_BUS_DEVICE(dev);
-+    }
++    sysbus_mmio_map(busdev, 0, base);
-+    case 0xda0: /* MPU_RASR */
++    sysbus_connect_irq(busdev, 0, irq);
 +    case 0xda8: /* MPU_RASR_A1 */
 +    case 0xdb0: /* MPU_RASR_A2 */
 +    case 0xdb8: /* MPU_RASR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return 0;
 +        }
 +        return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
 +            (cpu->env.pmsav7.drsr[region] & 0xffff);
 +    }
      default:
          qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
          return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
          qemu_log_mask(LOG_UNIMP,
                        "NVIC: Aux fault status registers unimplemented\n");
          break;
 +    case 0xd90: /* MPU_TYPE */
 +        return; /* RO */
 +    case 0xd94: /* MPU_CTRL */
 +        if ((value &
 +             (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
 +            == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
 +                          "UNPREDICTABLE\n");
 +        }
 +        cpu->env.v7m.mpu_ctrl = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
 +                                         R_V7M_MPU_CTRL_HFNMIENA_MASK |
 +                                         R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
 +        tlb_flush(CPU(cpu));
 +        break;
 +    case 0xd98: /* MPU_RNR */
 +        if (value >= cpu->pmsav7_dregion) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
 +                          PRIu32 "/%" PRIu32 "\n",
 +                          value, cpu->pmsav7_dregion);
 +        } else {
 +            cpu->env.cp15.c6_rgnr = value;
 +        }
 +        break;
 +    case 0xd9c: /* MPU_RBAR */
 +    case 0xda4: /* MPU_RBAR_A1 */
 +    case 0xdac: /* MPU_RBAR_A2 */
 +    case 0xdb4: /* MPU_RBAR_A3 */
 +    {
 +        int region;
 +
 +        if (value & (1 << 4)) {
 +            /* VALID bit means use the region number specified in this
 +             * value and also update MPU_RNR.REGION with that value.
 +             */
 +            region = extract32(value, 0, 4);
 +            if (region >= cpu->pmsav7_dregion) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "MPU region out of range %u/%" PRIu32 "\n",
 +                              region, cpu->pmsav7_dregion);
 +                return;
 +            }
 +            cpu->env.cp15.c6_rgnr = region;
 +        } else {
 +            region = cpu->env.cp15.c6_rgnr;
 +        }
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return;
 +        }
 +
 +        cpu->env.pmsav7.drbar[region] = value & ~0x1f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
 +    case 0xda0: /* MPU_RASR */
 +    case 0xda8: /* MPU_RASR_A1 */
 +    case 0xdb0: /* MPU_RASR_A2 */
 +    case 0xdb8: /* MPU_RASR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return;
 +        }
 +
 +        cpu->env.pmsav7.drsr[region] = value & 0xff3f;
 +        cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
      case 0xf00: /* Software Triggered Interrupt Register */
      {
          /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
  static inline bool regime_translation_disabled(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx)
  {
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
 +    }
 +
      if (mmu_idx == ARMMMUIdx_S2NS) {
          return (env->cp15.hcr_el2 & HCR_VM) == 0;
      }
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
      }
  }
 +static bool pmsav7_use_background_region(ARMCPU *cpu,
 +                                         ARMMMUIdx mmu_idx, bool is_user)
 +{
 +    /* Return true if we should use the default memory map as a
 +     * "background" region if there are no hits against any MPU regions.
 +     */
 +    CPUARMState *env = &cpu->env;
 +
 +    if (is_user) {
 +        return false;
 +    }
 +
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
 +    } else {
 +        return regime_sctlr(env, mmu_idx) & SCTLR_BR;
 +    }
 +}
 +
- static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-                                  int access_type, ARMMMUIdx mmu_idx,
+ {
-                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
+     Exynos4210State *s = g_new0(Exynos4210State, 1);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-         }
+     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
+             s->irq_table[exynos4210_get_irq(28, 3)]);
-         if (n == -1) { /* no hits */
--            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
++    /*** DMA controllers ***/
-+            if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
++    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
-                 /* background fault */
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
-                 *fsr = 0;
++    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
-                 return true;
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
-diff --git a/target/arm/machine.c b/target/arm/machine.c
++    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
-index XXXXXXX..XXXXXXX 100644
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
---- a/target/arm/machine.c
++
-+++ b/target/arm/machine.c
+     return s;
-@@ -XXX,XX +XXX,XX @@ static bool m_needed(void *opaque)
+ }
  static const VMStateDescription vmstate_m = {
      .name = "cpu/m",
 -    .version_id = 3,
 -    .minimum_version_id = 3,
 +    .version_id = 4,
 +    .minimum_version_id = 4,
      .needed = m_needed,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(env.v7m.vecbase, ARMCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
          VMSTATE_UINT32(env.v7m.dfsr, ARMCPU),
          VMSTATE_UINT32(env.v7m.mmfar, ARMCPU),
          VMSTATE_UINT32(env.v7m.bfar, ARMCPU),
 +        VMSTATE_UINT32(env.v7m.mpu_ctrl, ARMCPU),
          VMSTATE_INT32(env.v7m.exception, ARMCPU),
          VMSTATE_END_OF_LIST()
      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 20/27] aspeed/i2c: improve command handling
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Multiple I2C commands can be fired simultaneously and the controller
-execute the commands following these priorities:
-  (1) Master Start Command
-  (2) Master Transmit Command
-  (3) Slave Transmit Command or Master Receive Command
-  (4) Master Stop Command
-The current code is incorrect with respect to the above sequence and
-needs to be reworked to handle each individual command.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-2-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/i2c/aspeed_i2c.c | 24 ++++++++++++++++++------
-file changed, 18 insertions(+), 6 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
- static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
- {
-+    bus->cmd &= ~0xFFFF;
-     bus->cmd |= value & 0xFFFF;
-     bus->intr_status = 0;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-             bus->intr_status |= I2CD_INTR_TX_ACK;
-         }
--    } else if (bus->cmd & I2CD_M_TX_CMD) {
-+        /* START command is also a TX command, as the slave address is
-+         * sent on the bus */
-+        bus->cmd &= ~(I2CD_M_START_CMD | I2CD_M_TX_CMD);
-+
-+        /* No slave found */
-+        if (!i2c_bus_busy(bus->bus)) {
-+            return;
-+        }
-+    }
-+
-+    if (bus->cmd & I2CD_M_TX_CMD) {
-         if (i2c_send(bus->bus, bus->buf)) {
-             bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
-             i2c_end_transfer(bus->bus);
-         } else {
-             bus->intr_status |= I2CD_INTR_TX_ACK;
-         }
-+        bus->cmd &= ~I2CD_M_TX_CMD;
-+    }
--    } else if (bus->cmd & I2CD_M_RX_CMD) {
-+    if (bus->cmd & I2CD_M_RX_CMD) {
-         int ret = i2c_recv(bus->bus);
-         if (ret < 0) {
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-             bus->intr_status |= I2CD_INTR_RX_DONE;
-         }
-         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
-+        bus->cmd &= ~I2CD_M_RX_CMD;
-     }
-     if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-             i2c_end_transfer(bus->bus);
-             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
-         }
-+        bus->cmd &= ~I2CD_M_STOP_CMD;
-     }
--
--    /* command is handled, reset it and check for interrupts  */
--    bus->cmd &= ~0xFFFF;
--    aspeed_i2c_bus_raise_interrupt(bus);
- }
- static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
-         }
-         aspeed_i2c_bus_handle_cmd(bus, value);
-+        aspeed_i2c_bus_raise_interrupt(bus);
-         break;
-     default:
---
-.7.4

-[Qemu-devel] [PULL 21/27] aspeed/i2c: handle LAST command under the RX command
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Today, the LAST command is handled with the STOP command but this is
-incorrect. Also nack the I2C bus when a LAST is issued.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-3-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/i2c/aspeed_i2c.c | 9 ++++++---
-file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-         bus->cmd &= ~I2CD_M_TX_CMD;
-     }
--    if (bus->cmd & I2CD_M_RX_CMD) {
-+    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
-         int ret = i2c_recv(bus->bus);
-         if (ret < 0) {
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-             bus->intr_status |= I2CD_INTR_RX_DONE;
-         }
-         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
--        bus->cmd &= ~I2CD_M_RX_CMD;
-+        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
-+            i2c_nack(bus->bus);
-+        }
-+        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
-     }
--    if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
-+    if (bus->cmd & I2CD_M_STOP_CMD) {
-         if (!i2c_bus_busy(bus->bus)) {
-             bus->intr_status |= I2CD_INTR_ABNORMAL;
-         } else {
---
-.7.4

-[Qemu-devel] [PULL 22/27] aspeed/i2c: introduce a state machine
+[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The Aspeed I2C controller maintains a state machine in the command
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-register, which is mostly used for debug.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20190520214342.13709-5-philmd@redhat.com
 Let's start adding a few states to handle abnormal STOP
 commands. Today, the model uses the busy status of the bus as a
 condition to do so but it is not precise enough.
 Also remove the ABNORMAL bit for failing TX commands. This is
 incorrect with respect to the specs.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 1494827476-1487-4-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i2c/aspeed_i2c.c | 36 +++++++++++++++++++++++++++++++++---
+ include/hw/arm/exynos4210.h |  9 +++++++--
-file changed, 33 insertions(+), 3 deletions(-)
+ hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
  hw/arm/exynos4_boards.c     |  9 ++++++---
 files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/include/hw/arm/exynos4210.h
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
-     }
+ } Exynos4210Irq;
  typedef struct Exynos4210State {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
      Exynos4210Irq irqs;
      qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
      sysbus_connect_irq(busdev, 0, irq);
  }
-+static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
+-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 +static void exynos4210_realize(DeviceState *socdev, Error **errp)
  {
 -    Exynos4210State *s = g_new0(Exynos4210State, 1);
 +    Exynos4210State *s = EXYNOS4210_SOC(socdev);
 +    MemoryRegion *system_mem = get_system_memory();
      qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
-+    bus->cmd &= ~(I2CD_TX_STATE_MASK << I2CD_TX_STATE_SHIFT);
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+    bus->cmd |= (state & I2CD_TX_STATE_MASK) << I2CD_TX_STATE_SHIFT;
++
 +    dc->realize = exynos4210_realize;
 +}
 +
-+static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
++static const TypeInfo exynos4210_info = {
 +    .name = TYPE_EXYNOS4210_SOC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
-+    return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
++    type_register_static(&exynos4210_info);
 +}
 +
-+/*
++type_init(exynos4210_register_types)
-+ * The state machine needs some refinement. It is only used to track
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-+ * invalid STOP commands for the moment.
+index XXXXXXX..XXXXXXX 100644
-+ */
+--- a/hw/arm/exynos4_boards.c
- static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
++++ b/hw/arm/exynos4_boards.c
- {
+@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
-     bus->cmd &= ~0xFFFF;
+ } Exynos4BoardType;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-     bus->intr_status = 0;
+ typedef struct Exynos4BoardState {
+-    Exynos4210State *soc;
-     if (bus->cmd & I2CD_M_START_CMD) {
++    Exynos4210State soc;
-+        uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
+     MemoryRegion dram0_mem;
-+            I2CD_MSTARTR : I2CD_MSTART;
+     MemoryRegion dram1_mem;
-+
+ } Exynos4BoardState;
-+        aspeed_i2c_set_state(bus, state);
+@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
-+
+     exynos4_boards_init_ram(s, get_system_memory(),
-         if (i2c_start_transfer(bus->bus, extract32(bus->buf, 1, 7),
+                             exynos4_board_ram_size[board_type]);
-                                extract32(bus->buf, 0, 1))) {
-             bus->intr_status |= I2CD_INTR_TX_NAK;
+-    s->soc = exynos4210_init(get_system_memory());
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
++    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
-         if (!i2c_bus_busy(bus->bus)) {
++    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
-             return;
++    object_property_set_bool(OBJECT(&s->soc), true, "realized",
-         }
++                             &error_fatal);
-+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
-     }
+     return s;
      if (bus->cmd & I2CD_M_TX_CMD) {
 +        aspeed_i2c_set_state(bus, I2CD_MTXD);
          if (i2c_send(bus->bus, bus->buf)) {
 -            bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
 +            bus->intr_status |= (I2CD_INTR_TX_NAK);
              i2c_end_transfer(bus->bus);
          } else {
              bus->intr_status |= I2CD_INTR_TX_ACK;
          }
          bus->cmd &= ~I2CD_M_TX_CMD;
 +        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
      }
      if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
 -        int ret = i2c_recv(bus->bus);
 +        int ret;
 +
 +        aspeed_i2c_set_state(bus, I2CD_MRXD);
 +        ret = i2c_recv(bus->bus);
          if (ret < 0) {
              qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
              ret = 0xff;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
              i2c_nack(bus->bus);
          }
          bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
 +        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
      }
      if (bus->cmd & I2CD_M_STOP_CMD) {
 -        if (!i2c_bus_busy(bus->bus)) {
 +        if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
              bus->intr_status |= I2CD_INTR_ABNORMAL;
          } else {
 +            aspeed_i2c_set_state(bus, I2CD_MSTOP);
              i2c_end_transfer(bus->bus);
              bus->intr_status |= I2CD_INTR_NORMAL_STOP;
          }
          bus->cmd &= ~I2CD_M_STOP_CMD;
 +        aspeed_i2c_set_state(bus, I2CD_IDLE);
      }
  }
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
+                                                       EXYNOS4_BOARD_SMDKC210);
+     lan9215_init(SMDK_LAN9118_BASE_ADDR,
+-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
++            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
+     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
+ }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 24/27] hw/misc: add a TMP42{1, 2, 3} device model
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Largely inspired by the TMP105 temperature sensor, here is a model for
-the TMP42{1,2,3} temperature sensors.
-Specs can be found here :
-    http://www.ti.com/lit/gpn/tmp421
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-6-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/Makefile.objs           |   1 +
- hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
- default-configs/arm-softmmu.mak |   1 +
-files changed, 403 insertions(+)
- create mode 100644 hw/misc/tmp421.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
-+++ b/hw/misc/Makefile.objs
-@@ -XXX,XX +XXX,XX @@
- common-obj-$(CONFIG_APPLESMC) += applesmc.o
- common-obj-$(CONFIG_MAX111X) += max111x.o
- common-obj-$(CONFIG_TMP105) += tmp105.o
-+common-obj-$(CONFIG_TMP421) += tmp421.o
- common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
- common-obj-$(CONFIG_SGA) += sga.o
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
-diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/tmp421.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Texas Instruments TMP421 temperature sensor.
-+ *
-+ * Copyright (c) 2016 IBM Corporation.
-+ *
-+ * Largely inspired by :
-+ *
-+ * Texas Instruments TMP105 temperature sensor.
-+ *
-+ * Copyright (C) 2008 Nokia Corporation
-+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License as
-+ * published by the Free Software Foundation; either version 2 or
-+ * (at your option) version 3 of the License.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "hw/hw.h"
-+#include "hw/i2c/i2c.h"
-+#include "qapi/error.h"
-+#include "qapi/visitor.h"
-+
-+/* Manufacturer / Device ID's */
-+#define TMP421_MANUFACTURER_ID          0x55
-+#define TMP421_DEVICE_ID                0x21
-+#define TMP422_DEVICE_ID                0x22
-+#define TMP423_DEVICE_ID                0x23
-+
-+typedef struct DeviceInfo {
-+    int model;
-+    const char *name;
-+} DeviceInfo;
-+
-+static const DeviceInfo devices[] = {
-+    { TMP421_DEVICE_ID, "tmp421" },
-+    { TMP422_DEVICE_ID, "tmp422" },
-+    { TMP423_DEVICE_ID, "tmp423" },
-+};
-+
-+typedef struct TMP421State {
-+    /*< private >*/
-+    I2CSlave i2c;
-+    /*< public >*/
-+
-+    int16_t temperature[4];
-+
-+    uint8_t status;
-+    uint8_t config[2];
-+    uint8_t rate;
-+
-+    uint8_t len;
-+    uint8_t buf[2];
-+    uint8_t pointer;
-+
-+} TMP421State;
-+
-+typedef struct TMP421Class {
-+    I2CSlaveClass parent_class;
-+    DeviceInfo *dev;
-+} TMP421Class;
-+
-+#define TYPE_TMP421 "tmp421-generic"
-+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
-+
-+#define TMP421_CLASS(klass) \
-+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
-+#define TMP421_GET_CLASS(obj) \
-+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
-+
-+/* the TMP421 registers */
-+#define TMP421_STATUS_REG               0x08
-+#define    TMP421_STATUS_BUSY             (1 << 7)
-+#define TMP421_CONFIG_REG_1             0x09
-+#define    TMP421_CONFIG_RANGE            (1 << 2)
-+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
-+#define TMP421_CONFIG_REG_2             0x0A
-+#define    TMP421_CONFIG_RC               (1 << 2)
-+#define    TMP421_CONFIG_LEN              (1 << 3)
-+#define    TMP421_CONFIG_REN              (1 << 4)
-+#define    TMP421_CONFIG_REN2             (1 << 5)
-+#define    TMP421_CONFIG_REN3             (1 << 6)
-+
-+#define TMP421_CONVERSION_RATE_REG      0x0B
-+#define TMP421_ONE_SHOT                 0x0F
-+
-+#define TMP421_RESET                    0xFC
-+#define TMP421_MANUFACTURER_ID_REG      0xFE
-+#define TMP421_DEVICE_ID_REG            0xFF
-+
-+#define TMP421_TEMP_MSB0                0x00
-+#define TMP421_TEMP_MSB1                0x01
-+#define TMP421_TEMP_MSB2                0x02
-+#define TMP421_TEMP_MSB3                0x03
-+#define TMP421_TEMP_LSB0                0x10
-+#define TMP421_TEMP_LSB1                0x11
-+#define TMP421_TEMP_LSB2                0x12
-+#define TMP421_TEMP_LSB3                0x13
-+
-+static const int32_t mins[2] = { -40000, -55000 };
-+static const int32_t maxs[2] = { 127000, 150000 };
-+
-+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
-+                                   void *opaque, Error **errp)
-+{
-+    TMP421State *s = TMP421(obj);
-+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-+    int offset = ext_range * 64 * 256;
-+    int64_t value;
-+    int tempid;
-+
-+    if (sscanf(name, "temperature%d", &tempid) != 1) {
-+        error_setg(errp, "error reading %s: %m", name);
-+        return;
-+    }
-+
-+    if (tempid >= 4 || tempid < 0) {
-+        error_setg(errp, "error reading %s", name);
-+        return;
-+    }
-+
-+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
-+
-+    visit_type_int(v, name, &value, errp);
-+}
-+
-+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
-+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
-+ */
-+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
-+                                   void *opaque, Error **errp)
-+{
-+    TMP421State *s = TMP421(obj);
-+    Error *local_err = NULL;
-+    int64_t temp;
-+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
-+    int offset = ext_range * 64 * 256;
-+    int tempid;
-+
-+    visit_type_int(v, name, &temp, &local_err);
-+    if (local_err) {
-+        error_propagate(errp, local_err);
-+        return;
-+    }
-+
-+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
-+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
-+                   temp / 1000, temp % 1000);
-+        return;
-+    }
-+
-+    if (sscanf(name, "temperature%d", &tempid) != 1) {
-+        error_setg(errp, "error reading %s: %m", name);
-+        return;
-+    }
-+
-+    if (tempid >= 4 || tempid < 0) {
-+        error_setg(errp, "error reading %s", name);
-+        return;
-+    }
-+
-+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
-+}
-+
-+static void tmp421_read(TMP421State *s)
-+{
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
-+
-+    s->len = 0;
-+
-+    switch (s->pointer) {
-+    case TMP421_MANUFACTURER_ID_REG:
-+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
-+        break;
-+    case TMP421_DEVICE_ID_REG:
-+        s->buf[s->len++] = sc->dev->model;
-+        break;
-+    case TMP421_CONFIG_REG_1:
-+        s->buf[s->len++] = s->config[0];
-+        break;
-+    case TMP421_CONFIG_REG_2:
-+        s->buf[s->len++] = s->config[1];
-+        break;
-+    case TMP421_CONVERSION_RATE_REG:
-+        s->buf[s->len++] = s->rate;
-+        break;
-+    case TMP421_STATUS_REG:
-+        s->buf[s->len++] = s->status;
-+        break;
-+
-+        /* FIXME: check for channel enablement in config registers */
-+    case TMP421_TEMP_MSB0:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB1:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB2:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_MSB3:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB0:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB1:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB2:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
-+        break;
-+    case TMP421_TEMP_LSB3:
-+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
-+        break;
-+    }
-+}
-+
-+static void tmp421_reset(I2CSlave *i2c);
-+
-+static void tmp421_write(TMP421State *s)
-+{
-+    switch (s->pointer) {
-+    case TMP421_CONVERSION_RATE_REG:
-+        s->rate = s->buf[0];
-+        break;
-+    case TMP421_CONFIG_REG_1:
-+        s->config[0] = s->buf[0];
-+        break;
-+    case TMP421_CONFIG_REG_2:
-+        s->config[1] = s->buf[0];
-+        break;
-+    case TMP421_RESET:
-+        tmp421_reset(I2C_SLAVE(s));
-+        break;
-+    }
-+}
-+
-+static int tmp421_rx(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (s->len < 2) {
-+        return s->buf[s->len++];
-+    } else {
-+        return 0xff;
-+    }
-+}
-+
-+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (s->len == 0) {
-+        /* first byte is the register pointer for a read or write
-+         * operation */
-+        s->pointer = data;
-+        s->len++;
-+    } else if (s->len == 1) {
-+        /* second byte is the data to write. The device only supports
-+         * one byte writes */
-+        s->buf[0] = data;
-+        tmp421_write(s);
-+    }
-+
-+    return 0;
-+}
-+
-+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    if (event == I2C_START_RECV) {
-+        tmp421_read(s);
-+    }
-+
-+    s->len = 0;
-+    return 0;
-+}
-+
-+static const VMStateDescription vmstate_tmp421 = {
-+    .name = "TMP421",
-+    .version_id = 0,
-+    .minimum_version_id = 0,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT8(len, TMP421State),
-+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
-+        VMSTATE_UINT8(pointer, TMP421State),
-+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
-+        VMSTATE_UINT8(status, TMP421State),
-+        VMSTATE_UINT8(rate, TMP421State),
-+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
-+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void tmp421_reset(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
-+
-+    memset(s->temperature, 0, sizeof(s->temperature));
-+    s->pointer = 0;
-+
-+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
-+
-+     /* resistance correction and channel enablement */
-+    switch (sc->dev->model) {
-+    case TMP421_DEVICE_ID:
-+        s->config[1] = 0x1c;
-+        break;
-+    case TMP422_DEVICE_ID:
-+        s->config[1] = 0x3c;
-+        break;
-+    case TMP423_DEVICE_ID:
-+        s->config[1] = 0x7c;
-+        break;
-+    }
-+
-+    s->rate = 0x7;       /* 8Hz */
-+    s->status = 0;
-+}
-+
-+static int tmp421_init(I2CSlave *i2c)
-+{
-+    TMP421State *s = TMP421(i2c);
-+
-+    tmp421_reset(&s->i2c);
-+
-+    return 0;
-+}
-+
-+static void tmp421_initfn(Object *obj)
-+{
-+    object_property_add(obj, "temperature0", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature1", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature2", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+    object_property_add(obj, "temperature3", "int",
-+                        tmp421_get_temperature,
-+                        tmp421_set_temperature, NULL, NULL, NULL);
-+}
-+
-+static void tmp421_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
-+    TMP421Class *sc = TMP421_CLASS(klass);
-+
-+    k->init = tmp421_init;
-+    k->event = tmp421_event;
-+    k->recv = tmp421_rx;
-+    k->send = tmp421_tx;
-+    dc->vmsd = &vmstate_tmp421;
-+    sc->dev = (DeviceInfo *) data;
-+}
-+
-+static const TypeInfo tmp421_info = {
-+    .name          = TYPE_TMP421,
-+    .parent        = TYPE_I2C_SLAVE,
-+    .instance_size = sizeof(TMP421State),
-+    .instance_init = tmp421_initfn,
-+    .class_init    = tmp421_class_init,
-+};
-+
-+static void tmp421_register_types(void)
-+{
-+    int i;
-+
-+    type_register_static(&tmp421_info);
-+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
-+        TypeInfo ti = {
-+            .name       = devices[i].name,
-+            .parent     = TYPE_TMP421,
-+            .class_init = tmp421_class_init,
-+            .class_data = (void *) &devices[i],
-+        };
-+        type_register(&ti);
-+    }
-+}
-+
-+type_init(tmp421_register_types)
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
-index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
-+++ b/default-configs/arm-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
- CONFIG_TSC2005=y
- CONFIG_LM832X=y
- CONFIG_TMP105=y
-+CONFIG_TMP421=y
- CONFIG_STELLARIS=y
- CONFIG_STELLARIS_INPUT=y
- CONFIG_STELLARIS_ENET=y
---
-.7.4

-[Qemu-devel] [PULL 25/27] aspeed: add a temp sensor device on I2C bus 3
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Temperatures can be changed from the monitor with :
-    (qemu) qom-set /machine/unattached/device[2] temperature0 12000
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-7-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
- static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    DeviceState *dev;
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-      * enough to provide basic RTC features. Alarms will be missing */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+
-+    /* add a TMP423 temperature sensor */
-+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
-+                           "tmp423", 0x4c);
-+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
-+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
-+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
-+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
- }
- static void palmetto_bmc_init(MachineState *machine)
---
-.7.4

ARM pullreq; contains some patches that arrived while I
was on holiday, plus the series I sent off before going
away, which got reviewed while I was away.

thanks
-- PMM

The following changes since commit c077a998eb3fcae2d048e3baeb5bc592d30fddde:

Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20170531' into staging (2017-06-01 15:50:40 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170601

for you to fetch changes up to cdc58be430b0bdeaef282e2e70f8135ae531616d:

hw/arm/virt: fdt: generate distance-map when needed (2017-06-01 17:27:07 +0100)

----------------------------------------------------------------
target-arm queue:
 * virt: numa: provide ACPI distance info when needed
 * aspeed: fix i2c controller bugs
 * aspeed: add temperature sensor device
 * M profile: support MPU
 * gicv3: fix mishandling of BPR1, VBPR1
 * load_uboot_image: don't assume a full header read
 * libvixl: Correct build failures on NetBSD

----------------------------------------------------------------
Andrew Jones (3):
      load_uboot_image: don't assume a full header read
      hw/arm/virt-acpi-build: build SLIT when needed
      hw/arm/virt: fdt: generate distance-map when needed

Cédric Le Goater (6):
      aspeed/i2c: improve command handling
      aspeed/i2c: handle LAST command under the RX command
      aspeed/i2c: introduce a state machine
      aspeed: add some I2C devices to the Aspeed machines
      hw/misc: add a TMP42{1,2,3} device model
      aspeed: add a temp sensor device on I2C bus 3

Kamil Rytarowski (1):
      libvixl: Correct build failures on NetBSD

Michael Davidsaver (4):
      armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
      armv7m: Implement M profile default memory map
      armv7m: Classify faults as MemManage or BusFault
      arm: add MPU support to M profile CPUs

Peter Maydell (12):
      hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
      hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
      hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
      arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
      arm: Add support for M profile CPUs having different MMU index semantics
      arm: Use different ARMMMUIdx values for M profile
      arm: Clean up handling of no-MPU PMSA CPUs
      arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
      arm: Don't let no-MPU PMSA cores write to SCTLR.M
      arm: Remove unnecessary check on cpu->pmsav7_dregion
      arm: All M profile cores are PMSA
      arm: Implement HFNMIENA support for M profile MPU

Wei Huang (1):
      target/arm: clear PMUVER field of AA64DFR0 when vPMU=off

From: Kamil Rytarowski <n54@gmx.com>

Ensure that C99 macros are defined regardless of the inclusion order of
headers in vixl. This is required at least on NetBSD.

The vixl/globals.h headers defines __STDC_CONSTANT_MACROS and must be
included before other system headers.

This file defines unconditionally the following macros, without altering
the original sources:
 - __STDC_CONSTANT_MACROS
 - __STDC_LIMIT_MACROS
 - __STDC_FORMAT_MACROS

Signed-off-by: Kamil Rytarowski <n54@gmx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170514051820.15985-1-n54@gmx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 disas/libvixl/Makefile.objs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/disas/libvixl/Makefile.objs
+++ b/disas/libvixl/Makefile.objs
@@ -XXX,XX +XXX,XX @@ libvixl_OBJS = vixl/utils.o \
 # The -Wno-sign-compare is needed only for gcc 4.6, which complains about
 # some signed-unsigned equality comparisons which later gcc versions do not.
 $(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS) -Wno-sign-compare
+# Ensure that C99 macros are defined regardless of the inclusion order of
+# headers in vixl. This is required at least on NetBSD.
+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS
 
 common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)
-- 
2.7.4

We were setting the VBPR1 field of VMCR_EL2 to icv_min_vbpr()
on reset, but this is not correct. The field should reset to
the minimum value of ICV_BPR0_EL1 plus one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-2-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     cs->ich_hcr_el2 = 0;
     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
-        (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR1_SHIFT) |
+        ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
 }
 
-- 
2.7.4

icc_bpr_write() was not enforcing that writing a value below the
minimum for the BPR should behave as if the BPR was set to the
minimum value. This doesn't make a difference for the secure
BPRs (since we define the minimum for the QEMU implementation
as zero) but did mean we were allowing the NS BPR1 to be set to
0 when 1 should be the lowest value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-3-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
+    uint64_t minval;
 
     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
         icv_bpr_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         return;
     }
 
+    minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
+    if (value < minval) {
+        value = minval;
+    }
+
     cs->icc_bpr[grp] = value & 7;
     gicv3_cpuif_update(cs);
 }
-- 
2.7.4

When we calculate the mask to use to get the group priority from
an interrupt priority, the way that NS BPR1 is handled differs
from how BPR0 and S BPR1 work -- a BPR1 value of 1 means
the group priority is in bits [7:1], whereas for BPR0 and S BPR1
this is indicated by a 0 BPR value.

Subtract 1 from the BPR value before creating the mask if
we're using the NS BPR value, for both hardware and virtual
interrupts, as the GICv3 pseudocode does, and fix the comments
accordingly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 42 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
 {
     /* Return a mask word which clears the subpriority bits from
      * a priority value for a virtual interrupt in the specified group.
-     * This depends on the VBPR value:
+     * This depends on the VBPR value.
+     * If using VBPR0 then:
      *  a BPR of 0 means the group priority bits are [7:1];
      *  a BPR of 1 means they are [7:2], and so on down to
      *  a BPR of 7 meaning no group priority bits at all.
+     * If using VBPR1 then:
+     *  a BPR of 0 is impossible (the minimum value is 1)
+     *  a BPR of 1 means the group priority bits are [7:1];
+     *  a BPR of 2 means they are [7:2], and so on down to
+     *  a BPR of 7 meaning the group priority is [7].
+     *
      * Which BPR to use depends on the group of the interrupt and
      * the current ICH_VMCR_EL2.VCBPR settings.
+     *
+     * This corresponds to the VGroupBits() pseudocode.
      */
+    int bpr;
+
     if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
         group = GICV3_G0;
     }
 
-    return ~0U << (read_vbpr(cs, group) + 1);
+    bpr = read_vbpr(cs, group);
+    if (group == GICV3_G1NS) {
+        assert(bpr > 0);
+        bpr--;
+    }
+
+    return ~0U << (bpr + 1);
 }
 
 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
@@ -XXX,XX +XXX,XX @@ static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
 {
     /* Return a mask word which clears the subpriority bits from
      * a priority value for an interrupt in the specified group.
-     * This depends on the BPR value:
+     * This depends on the BPR value. For CBPR0 (S or NS):
      *  a BPR of 0 means the group priority bits are [7:1];
      *  a BPR of 1 means they are [7:2], and so on down to
      *  a BPR of 7 meaning no group priority bits at all.
+     * For CBPR1 NS:
+     *  a BPR of 0 is impossible (the minimum value is 1)
+     *  a BPR of 1 means the group priority bits are [7:1];
+     *  a BPR of 2 means they are [7:2], and so on down to
+     *  a BPR of 7 meaning the group priority is [7].
+     *
      * Which BPR to use depends on the group of the interrupt and
      * the current ICC_CTLR.CBPR settings.
+     *
+     * This corresponds to the GroupBits() pseudocode.
      */
+    int bpr;
+
     if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
         (group == GICV3_G1NS &&
          cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
         group = GICV3_G0;
     }
 
-    return ~0U << ((cs->icc_bpr[group] & 7) + 1);
+    bpr = cs->icc_bpr[group] & 7;
+
+    if (group == GICV3_G1NS) {
+        assert(bpr > 0);
+        bpr--;
+    }
+
+    return ~0U << (bpr + 1);
 }
 
 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
-- 
2.7.4

From: Wei Huang <wei@redhat.com>

The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)
relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support
is present or not. This patch clears the PMUVER field under TCG mode
when vPMU=off. Without it, PMUv3 will init insider guest VMs even
with vPMU=off. This patch also removes a redundant line inside the
if-statement.

Signed-off-by: Wei Huang <wei@redhat.com>
Message-id: 1495123889-32301-1-git-send-email-wei@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_pmu) {
-        cpu->has_pmu = false;
         unset_feature(env, ARM_FEATURE_PMU);
+        cpu->id_aa64dfr0 &= ~0xf00;
     }
 
     if (!arm_feature(env, ARM_FEATURE_EL2)) {
-- 
2.7.4

When identifying the DFSR format for an alignment fault, use
the mmu index that we are passed, rather than calling cpu_mmu_index()
to get the mmu index for the current CPU state. This doesn't actually
make any difference since the only cases where the current MMU index
differs from the index used for the load are the "unprivileged
load/store" instructions, and in that case the mmu index may
differ but the translation regime is the same (apart from the
"use from Hyp mode" case which is UNPREDICTABLE).
However it's the more logical thing to do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/op_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     /* the DFSR for an alignment fault depends on whether we're using
      * the LPAE long descriptor format, or the short descriptor format
      */
-    if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
+    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
         env->exception.fsr = (1 << 9) | 0x21;
     } else {
         env->exception.fsr = 0x1;
-- 
2.7.4

The M profile CPU's MPU has an awkward corner case which we
would like to implement with a different MMU index.

We can avoid having to bump the number of MMU modes ARM
uses, because some of our existing MMU indexes are only
used by non-M-profile CPUs, so we can borrow one.
To avoid that getting too confusing, clean up the code
to try to keep the two meanings of the index separate.

Instead of ARMMMUIdx enum values being identical to core QEMU
MMU index values, they are now the core index values with some
high bits set. Any particular CPU always uses the same high
bits (so eventually A profile cores and M profile cores will
use different bits). New functions arm_to_core_mmu_idx()
and core_to_arm_mmu_idx() convert between the two.

In general core index values are stored in 'int' types, and
ARM values are stored in ARMMMUIdx types.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  71 ++++++++++++++++-----
 target/arm/translate.h     |   2 +-
 target/arm/helper.c        | 151 ++++++++++++++++++++++++---------------------
 target/arm/op_helper.c     |   3 +-
 target/arm/translate-a64.c |  18 ++++--
 target/arm/translate.c     |  10 +--
 6 files changed, 156 insertions(+), 99 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * for the accesses done as part of a stage 1 page table walk, rather than
  * having to walk the stage 2 page table over and over.)
  *
+ * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
+ * are not quite the same -- different CPU types (most notably M profile
+ * vs A/R profile) would like to use MMU indexes with different semantics,
+ * but since we don't ever need to use all of those in a single CPU we
+ * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
+ * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
+ * the same for any particular CPU.
+ * Variables of type ARMMUIdx are always full values, and the core
+ * index values are in variables of type 'int'.
+ *
  * Our enumeration includes at the end some entries which are not "true"
  * mmu_idx values in that they don't have corresponding TLBs and are only
  * valid for doing slow path page table walks.
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * of the AT/ATS operations.
  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
  */
+#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
+#define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
+
+#define ARM_MMU_IDX_TYPE_MASK (~0x7)
+#define ARM_MMU_IDX_COREIDX_MASK 0x7
+
 typedef enum ARMMMUIdx {
-    ARMMMUIdx_S12NSE0 = 0,
-    ARMMMUIdx_S12NSE1 = 1,
-    ARMMMUIdx_S1E2 = 2,
-    ARMMMUIdx_S1E3 = 3,
-    ARMMMUIdx_S1SE0 = 4,
-    ARMMMUIdx_S1SE1 = 5,
-    ARMMMUIdx_S2NS = 6,
+    ARMMMUIdx_S12NSE0 = 0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S12NSE1 = 1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1E2 = 2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1E3 = 3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
     /* Indexes below here don't have TLBs and are used only for AT system
      * instructions or for the first stage of an S12 page table walk.
      */
-    ARMMMUIdx_S1NSE0 = 7,
-    ARMMMUIdx_S1NSE1 = 8,
+    ARMMMUIdx_S1NSE0 = 0 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_S1NSE1 = 1 | ARM_MMU_IDX_NOTLB,
 } ARMMMUIdx;
 
+/* Bit macros for the core-mmu-index values for each index,
+ * for use when calling tlb_flush_by_mmuidx() and friends.
+ */
+typedef enum ARMMMUIdxBit {
+    ARMMMUIdxBit_S12NSE0 = 1 << 0,
+    ARMMMUIdxBit_S12NSE1 = 1 << 1,
+    ARMMMUIdxBit_S1E2 = 1 << 2,
+    ARMMMUIdxBit_S1E3 = 1 << 3,
+    ARMMMUIdxBit_S1SE0 = 1 << 4,
+    ARMMMUIdxBit_S1SE1 = 1 << 5,
+    ARMMMUIdxBit_S2NS = 1 << 6,
+} ARMMMUIdxBit;
+
 #define MMU_USER_IDX 0
 
+static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
+{
+    return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
+}
+
+static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
+{
+    return mmu_idx | ARM_MMU_IDX_A;
+}
+
 /* Return the exception level we're running at if this is our mmu_idx */
 static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
 {
-    assert(mmu_idx < ARMMMUIdx_S2NS);
-    return mmu_idx & 3;
+    switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
+    case ARM_MMU_IDX_A:
+        return mmu_idx & 3;
+    default:
+        g_assert_not_reached();
+    }
 }
 
 /* Determine the current mmu_idx to use for normal loads/stores */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
     int el = arm_current_el(env);
 
     if (el < 2 && arm_is_secure_below_el3(env)) {
-        return ARMMMUIdx_S1SE0 + el;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
     }
     return el;
 }
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
 {
-    ARMMMUIdx mmu_idx = cpu_mmu_index(env, false);
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
     if (is_a64(env)) {
         *pc = env->pc;
         *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                    << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
     }
 
-    *flags |= (mmu_idx << ARM_TBFLAG_MMUIDX_SHIFT);
+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 
     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
      * states defined in the ARM ARM for software singlestep:
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_dc_feature(DisasContext *dc, int feature)
 
 static inline int get_mem_index(DisasContext *s)
 {
-    return s->mmu_idx;
+    return arm_to_core_mmu_idx(s->mmu_idx);
 }
 
 /* Function used to determine the target exception EL when otherwise not known
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
 
     tlb_flush_by_mmuidx(cs,
-                        (1 << ARMMMUIdx_S12NSE1) |
-                        (1 << ARMMMUIdx_S12NSE0) |
-                        (1 << ARMMMUIdx_S2NS));
+                        ARMMMUIdxBit_S12NSE1 |
+                        ARMMMUIdxBit_S12NSE0 |
+                        ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
 
     tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                        (1 << ARMMMUIdx_S12NSE1) |
-                                        (1 << ARMMMUIdx_S12NSE0) |
-                                        (1 << ARMMMUIdx_S2NS));
+                                        ARMMMUIdxBit_S12NSE1 |
+                                        ARMMMUIdxBit_S12NSE0 |
+                                        ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     pageaddr = sextract64(value << 12, 0, 40);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     pageaddr = sextract64(value << 12, 0, 40);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S2NS));
+                                             ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E2));
+                                             ARMMMUIdxBit_S1E2);
 }
 
 static const ARMCPRegInfo cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
     if (raw_read(env, ri) != value) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S12NSE1) |
-                            (1 << ARMMMUIdx_S12NSE0) |
-                            (1 << ARMMMUIdx_S2NS));
+                            ARMMMUIdxBit_S12NSE1 |
+                            ARMMMUIdxBit_S12NSE0 |
+                            ARMMMUIdxBit_S2NS);
         raw_write(env, ri, value);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S1SE1) |
-                            (1 << ARMMMUIdx_S1SE0));
+                            ARMMMUIdxBit_S1SE1 |
+                            ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S12NSE1) |
-                            (1 << ARMMMUIdx_S12NSE0));
+                            ARMMMUIdxBit_S12NSE1 |
+                            ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S1SE1) |
-                                            (1 << ARMMMUIdx_S1SE0));
+                                            ARMMMUIdxBit_S1SE1 |
+                                            ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S12NSE1) |
-                                            (1 << ARMMMUIdx_S12NSE0));
+                                            ARMMMUIdxBit_S12NSE1 |
+                                            ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S1SE1) |
-                            (1 << ARMMMUIdx_S1SE0));
+                            ARMMMUIdxBit_S1SE1 |
+                            ARMMMUIdxBit_S1SE0);
     } else {
         if (arm_feature(env, ARM_FEATURE_EL2)) {
             tlb_flush_by_mmuidx(cs,
-                                (1 << ARMMMUIdx_S12NSE1) |
-                                (1 << ARMMMUIdx_S12NSE0) |
-                                (1 << ARMMMUIdx_S2NS));
+                                ARMMMUIdxBit_S12NSE1 |
+                                ARMMMUIdxBit_S12NSE0 |
+                                ARMMMUIdxBit_S2NS);
         } else {
             tlb_flush_by_mmuidx(cs,
-                                (1 << ARMMMUIdx_S12NSE1) |
-                                (1 << ARMMMUIdx_S12NSE0));
+                                ARMMMUIdxBit_S12NSE1 |
+                                ARMMMUIdxBit_S12NSE0);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S1SE1) |
-                                            (1 << ARMMMUIdx_S1SE0));
+                                            ARMMMUIdxBit_S1SE1 |
+                                            ARMMMUIdxBit_S1SE0);
     } else if (has_el2) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S12NSE1) |
-                                            (1 << ARMMMUIdx_S12NSE0) |
-                                            (1 << ARMMMUIdx_S2NS));
+                                            ARMMMUIdxBit_S12NSE1 |
+                                            ARMMMUIdxBit_S12NSE0 |
+                                            ARMMMUIdxBit_S2NS);
     } else {
           tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                              (1 << ARMMMUIdx_S12NSE1) |
-                                              (1 << ARMMMUIdx_S12NSE0));
+                                              ARMMMUIdxBit_S12NSE1 |
+                                              ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_page_by_mmuidx(cs, pageaddr,
-                                 (1 << ARMMMUIdx_S1SE1) |
-                                 (1 << ARMMMUIdx_S1SE0));
+                                 ARMMMUIdxBit_S1SE1 |
+                                 ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_page_by_mmuidx(cs, pageaddr,
-                                 (1 << ARMMMUIdx_S12NSE1) |
-                                 (1 << ARMMMUIdx_S12NSE0));
+                                 ARMMMUIdxBit_S12NSE1 |
+                                 ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                 (1 << ARMMMUIdx_S1SE1) |
-                                                 (1 << ARMMMUIdx_S1SE0));
+                                                 ARMMMUIdxBit_S1SE1 |
+                                                 ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                 (1 << ARMMMUIdx_S12NSE1) |
-                                                 (1 << ARMMMUIdx_S12NSE0));
+                                                 ARMMMUIdxBit_S12NSE1 |
+                                                 ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E2));
+                                             ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E3));
+                                             ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     pageaddr = sextract64(value << 12, 0, 48);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
 }
 
 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     pageaddr = sextract64(value << 12, 0, 48);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S2NS));
+                                             ARMMMUIdxBit_S2NS);
 }
 
 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
+/* Convert a possible stage1+2 MMU index into the appropriate
+ * stage 1 MMU index
+ */
+static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
+{
+    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
+        mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
+    }
+    return mmu_idx;
+}
+
 /* Returns TBI0 value for current regime el */
 uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
     uint32_t el;
 
     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
-       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-       */
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+     */
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     tcr = regime_tcr(env, mmu_idx);
     el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
     uint32_t el;
 
     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
-       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-       */
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+     */
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     tcr = regime_tcr(env, mmu_idx);
     el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static inline bool regime_using_lpae_format(CPUARMState *env,
  * on whether the long or short descriptor format is in use. */
 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     return regime_using_lpae_format(env, mmu_idx);
 }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             int ret;
 
             ret = get_phys_addr(env, address, access_type,
-                                mmu_idx + ARMMMUIdx_S1NSE0, &ipa, attrs,
+                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
                                 prot, page_size, fsr, fi);
 
             /* If S1 fails or S2 is disabled, return early.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             /*
              * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
              */
-            mmu_idx += ARMMMUIdx_S1NSE0;
+            mmu_idx = stage_1_mmu_idx(mmu_idx);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
     int ret;
     MemTxAttrs attrs = {};
 
-    ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
+    ret = get_phys_addr(env, address, access_type,
+                        core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
                         &attrs, &prot, &page_size, fsr, fi);
     if (!ret) {
         /* Map a single [sub]page.  */
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     bool ret;
     uint32_t fsr;
     ARMMMUFaultInfo fi = {};
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
 
     *attrs = (MemTxAttrs) {};
 
-    ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
+    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
                         attrs, &prot, &page_size, &fsr, &fi);
 
     if (ret) {
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     int target_el;
     bool same_el;
     uint32_t syn;
+    ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
 
     if (retaddr) {
         /* now we have a real cpu fault */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     /* the DFSR for an alignment fault depends on whether we're using
      * the LPAE long descriptor format, or the short descriptor format
      */
-    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
+    if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
         env->exception.fsr = (1 << 9) | 0x21;
     } else {
         env->exception.fsr = 0x1;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void a64_translate_init(void)
         offsetof(CPUARMState, exclusive_high), "exclusive_high");
 }
 
-static inline ARMMMUIdx get_a64_user_mem_index(DisasContext *s)
+static inline int get_a64_user_mem_index(DisasContext *s)
 {
-    /* Return the mmu_idx to use for A64 "unprivileged load/store" insns:
+    /* Return the core mmu_idx to use for A64 "unprivileged load/store" insns:
      *  if EL1, access as if EL0; otherwise access at current EL
      */
+    ARMMMUIdx useridx;
+
     switch (s->mmu_idx) {
     case ARMMMUIdx_S12NSE1:
-        return ARMMMUIdx_S12NSE0;
+        useridx = ARMMMUIdx_S12NSE0;
+        break;
     case ARMMMUIdx_S1SE1:
-        return ARMMMUIdx_S1SE0;
+        useridx = ARMMMUIdx_S1SE0;
+        break;
     case ARMMMUIdx_S2NS:
         g_assert_not_reached();
     default:
-        return s->mmu_idx;
+        useridx = s->mmu_idx;
+        break;
     }
+    return arm_to_core_mmu_idx(useridx);
 }
 
 void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
     dc->condexec_mask = 0;
     dc->condexec_cond = 0;
-    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
     dc->tbi0 = ARM_TBFLAG_TBI0(tb->flags);
     dc->tbi1 = ARM_TBFLAG_TBI1(tb->flags);
     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
     disas_set_insn_syndrome(s, syn);
 }
 
-static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
+static inline int get_a32_user_mem_index(DisasContext *s)
 {
-    /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
+    /* Return the core mmu_idx to use for A32/T32 "unprivileged load/store"
      * insns:
      *  if PL2, UNPREDICTABLE (we choose to implement as if PL0)
      *  otherwise, access as if at PL0.
@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
     case ARMMMUIdx_S1E2:        /* this one is UNPREDICTABLE */
     case ARMMMUIdx_S12NSE0:
     case ARMMMUIdx_S12NSE1:
-        return ARMMMUIdx_S12NSE0;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S12NSE0);
     case ARMMMUIdx_S1E3:
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1SE1:
-        return ARMMMUIdx_S1SE0;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
     case ARMMMUIdx_S2NS:
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
-    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
 #if !defined(CONFIG_USER_ONLY)
     dc->user = (dc->current_el == 0);
-- 
2.7.4

Make M profile use completely separate ARMMMUIdx values from
those that A profile CPUs use. This is a prelude to adding
support for the MPU and for v8M, which together will require
6 MMU indexes which don't map cleanly onto the A profile
uses:
 non secure User
 non secure Privileged
 non secure Privileged, execution priority < 0
 secure User
 secure Privileged
 secure Privileged, execution priority < 0

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 21 +++++++++++++++++++--
 target/arm/helper.c    |  5 +++++
 target/arm/translate.c |  3 +++
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * of the AT/ATS operations.
  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
  */
-#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
+#define ARM_MMU_IDX_A 0x10 /* A profile */
 #define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
+#define ARM_MMU_IDX_M 0x40 /* M profile */
 
 #define ARM_MMU_IDX_TYPE_MASK (~0x7)
 #define ARM_MMU_IDX_COREIDX_MASK 0x7
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
     ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
+    ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
     /* Indexes below here don't have TLBs and are used only for AT system
      * instructions or for the first stage of an S12 page table walk.
      */
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
     ARMMMUIdxBit_S1SE0 = 1 << 4,
     ARMMMUIdxBit_S1SE1 = 1 << 5,
     ARMMMUIdxBit_S2NS = 1 << 6,
+    ARMMMUIdxBit_MUser = 1 << 0,
+    ARMMMUIdxBit_MPriv = 1 << 1,
 } ARMMMUIdxBit;
 
 #define MMU_USER_IDX 0
@@ -XXX,XX +XXX,XX @@ static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
 
 static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
 {
-    return mmu_idx | ARM_MMU_IDX_A;
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return mmu_idx | ARM_MMU_IDX_M;
+    } else {
+        return mmu_idx | ARM_MMU_IDX_A;
+    }
 }
 
 /* Return the exception level we're running at if this is our mmu_idx */
@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
     case ARM_MMU_IDX_A:
         return mmu_idx & 3;
+    case ARM_MMU_IDX_M:
+        return mmu_idx & 1;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
     int el = arm_current_el(env);
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
+
+        return arm_to_core_mmu_idx(mmu_idx);
+    }
+
     if (el < 2 && arm_is_secure_below_el3(env)) {
         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_S1SE1:
     case ARMMMUIdx_S1NSE0:
     case ARMMMUIdx_S1NSE1:
+    case ARMMMUIdx_MPriv:
+    case ARMMMUIdx_MUser:
         return 1;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_S1NSE1:
     case ARMMMUIdx_S1E2:
     case ARMMMUIdx_S2NS:
+    case ARMMMUIdx_MPriv:
+    case ARMMMUIdx_MUser:
         return false;
     case ARMMMUIdx_S1E3:
     case ARMMMUIdx_S1SE0:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
     switch (mmu_idx) {
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1NSE0:
+    case ARMMMUIdx_MUser:
         return true;
     default:
         return false;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1SE1:
         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
+    case ARMMMUIdx_MUser:
+    case ARMMMUIdx_MPriv:
+        return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
     case ARMMMUIdx_S2NS:
     default:
         g_assert_not_reached();
-- 
2.7.4

ARM CPUs come in two flavours:
 * proper MMU ("VMSA")
 * only an MPU ("PMSA")
For PMSA, the MPU may be implemented, or not (in which case there
is default "always acts the same" behaviour, but it isn't guest
programmable).

QEMU is a bit confused about how we indicate this: we have an
ARM_FEATURE_MPU, but it's not clear whether this indicates
"PMSA, not VMSA" or "PMSA and MPU present" , and sometimes we
use it for one purpose and sometimes the other.

Currently trying to implement a PMSA-without-MPU core won't
work correctly because we turn off the ARM_FEATURE_MPU bit
and then a lot of things which should still exist get
turned off too.

As the first step in cleaning this up, rename the feature
bit to ARM_FEATURE_PMSA, which indicates a PMSA CPU (with
or without MPU).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  2 +-
 target/arm/cpu.c     | 12 ++++++------
 target/arm/helper.c  | 12 ++++++------
 target/arm/machine.c |  2 +-
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V6K,
     ARM_FEATURE_V7,
     ARM_FEATURE_THUMB2,
-    ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+    ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
     ARM_FEATURE_VFP3,
     ARM_FEATURE_VFP_FP16,
     ARM_FEATURE_NEON,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
-    if (arm_feature(&cpu->env, ARM_FEATURE_MPU)) {
+    if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
     if (arm_feature(env, ARM_FEATURE_V7) &&
         !arm_feature(env, ARM_FEATURE_M) &&
-        !arm_feature(env, ARM_FEATURE_MPU)) {
+        !arm_feature(env, ARM_FEATURE_PMSA)) {
         /* v7VMSA drops support for the old ARMv5 tiny pages, so we
          * can use 4K pages.
          */
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_mpu) {
-        unset_feature(env, ARM_FEATURE_MPU);
+        unset_feature(env, ARM_FEATURE_PMSA);
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU) &&
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
         uint32_t nr = cpu->pmsav7_dregion;
 
@@ -XXX,XX +XXX,XX @@ static void arm946_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm946";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_MPU);
+    set_feature(&cpu->env, ARM_FEATURE_PMSA);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     cpu->midr = 0x41059461;
     cpu->ctr = 0x0f004006;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DIV);
     set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
     set_feature(&cpu->env, ARM_FEATURE_V7MP);
-    set_feature(&cpu->env, ARM_FEATURE_MPU);
+    set_feature(&cpu->env, ARM_FEATURE_PMSA);
     cpu->midr = 0x411fc153; /* r1p3 */
     cpu->id_pfr0 = 0x0131;
     cpu->id_pfr1 = 0x001;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
 
-    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
+    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
         && !extended_addresses_enabled(env)) {
         /* For VMSA (when not using the LPAE long descriptor page table
          * format) this register includes the ASID, so do a TLB flush.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, v6k_cp_reginfo);
     }
     if (arm_feature(env, ARM_FEATURE_V7MP) &&
-        !arm_feature(env, ARM_FEATURE_MPU)) {
+        !arm_feature(env, ARM_FEATURE_PMSA)) {
         define_arm_cp_regs(cpu, v7mp_cp_reginfo);
     }
     if (arm_feature(env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         }
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU)) {
+    if (arm_feature(env, ARM_FEATURE_PMSA)) {
         if (arm_feature(env, ARM_FEATURE_V6)) {
             /* PMSAv6 not implemented */
             assert(arm_feature(env, ARM_FEATURE_V7));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
         }
         define_arm_cp_regs(cpu, id_cp_reginfo);
-        if (!arm_feature(env, ARM_FEATURE_MPU)) {
+        if (!arm_feature(env, ARM_FEATURE_PMSA)) {
             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
         } else if (arm_feature(env, ARM_FEATURE_V7)) {
             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
     /* pmsav7 has special handling for when MPU is disabled so call it before
      * the common MMU/MPU disabled check below.
      */
-    if (arm_feature(env, ARM_FEATURE_MPU) &&
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
         *page_size = TARGET_PAGE_SIZE;
         return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
         return 0;
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU)) {
+    if (arm_feature(env, ARM_FEATURE_PMSA)) {
         /* Pre-v7 MPU */
         *page_size = TARGET_PAGE_SIZE;
         return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_needed(void *opaque)
     ARMCPU *cpu = opaque;
     CPUARMState *env = &cpu->env;
 
-    return arm_feature(env, ARM_FEATURE_MPU) &&
+    return arm_feature(env, ARM_FEATURE_PMSA) &&
            arm_feature(env, ARM_FEATURE_V7);
 }
 
-- 
2.7.4

Fix the handling of QOM properties for PMSA CPUs with no MPU:

Allow no-MPU to be specified by either:
 * has-mpu = false
 * pmsav7_dregion = 0
and make setting one imply the other. Don't clear the PMSA
feature bit in this situation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->id_pfr1 &= ~0xf000;
     }
 
+    /* MPU can be configured out of a PMSA CPU either by setting has-mpu
+     * to false or by setting pmsav7-dregion to 0.
+     */
     if (!cpu->has_mpu) {
-        unset_feature(env, ARM_FEATURE_PMSA);
+        cpu->pmsav7_dregion = 0;
+    }
+    if (cpu->pmsav7_dregion == 0) {
+        cpu->has_mpu = false;
     }
 
     if (arm_feature(env, ARM_FEATURE_PMSA) &&
-- 
2.7.4

If the CPU is a PMSA config with no MPU implemented, then the
SCTLR.M bit should be RAZ/WI, so that the guest can never
turn on the non-existent MPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
+        /* M bit is RAZ/WI for PMSA with no MPU implemented */
+        value &= ~SCTLR_M;
+    }
+
     raw_write(env, ri, value);
     /* ??? Lots of these bits are not implemented.  */
     /* This may enable/disable the MMU, so do a TLB flush.  */
-- 
2.7.4

Now that we enforce both:
 * pmsav7_dregion == 0 implies has_mpu == false
 * PMSA with has_mpu == false means SCTLR.M cannot be set
we can remove a check on pmsav7_dregion from get_phys_addr_pmsav7(),
because we can only reach this code path if the MPU is enabled
(and so region_translation_disabled() returned false).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
         }
 
         if (n == -1) { /* no hits */
-            if (cpu->pmsav7_dregion &&
-                (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
+            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
                 /* background fault */
                 *fsr = 0;
                 return true;
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Improve the "-d mmu" tracing for the PMSAv7 MPU translation
process as an aid in debugging guest MPU configurations:
 * fix a missing newline for a guest-error log
 * report the region number with guest-error or unimp
   logs of bad region register values
 * add a log message for the overall result of the lookup
 * print "0x" prefix for hex values

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-9-git-send-email-peter.maydell@linaro.org
[PMM: a little tidyup, report region number in all messages
 rather than just one]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 39 +++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
             }
 
             if (!rsize) {
-                qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "DRSR[%d]: Rsize field cannot be 0\n", n);
                 continue;
             }
             rsize++;
             rmask = (1ull << rsize) - 1;
 
             if (base & rmask) {
-                qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
-                              "to DRSR region size, mask = %" PRIx32,
-                              base, rmask);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "DRBAR[%d]: 0x%" PRIx32 " misaligned "
+                              "to DRSR region size, mask = 0x%" PRIx32 "\n",
+                              n, base, rmask);
                 continue;
             }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 }
             }
             if (rsize < TARGET_PAGE_BITS) {
-                qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
+                qemu_log_mask(LOG_UNIMP,
+                              "DRSR[%d]: No support for MPU (sub)region "
                               "alignment of %" PRIu32 " bits. Minimum is %d\n",
-                              rsize, TARGET_PAGE_BITS);
+                              n, rsize, TARGET_PAGE_BITS);
                 continue;
             }
             if (srdis) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                     break;
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
-                                  "Bad value for AP bits in DRACR %"
-                                  PRIx32 "\n", ap);
+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
+                                  PRIx32 "\n", n, ap);
                 }
             } else { /* Priv. mode AP bits decoding */
                 switch (ap) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                     break;
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
-                                  "Bad value for AP bits in DRACR %"
-                                  PRIx32 "\n", ap);
+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
+                                  PRIx32 "\n", n, ap);
                 }
             }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
      */
     if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
+        bool ret;
         *page_size = TARGET_PAGE_SIZE;
-        return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-                                    phys_ptr, prot, fsr);
+        ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
+                                   phys_ptr, prot, fsr);
+        qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
+                      " mmu_idx %u -> %s (prot %c%c%c)\n",
+                      access_type == 1 ? "reading" :
+                      (access_type == 2 ? "writing" : "execute"),
+                      (uint32_t)address, mmu_idx,
+                      ret ? "Miss" : "Hit",
+                      *prot & PAGE_READ ? 'r' : '-',
+                      *prot & PAGE_WRITE ? 'w' : '-',
+                      *prot & PAGE_EXEC ? 'x' : '-');
+
+        return ret;
     }
 
     if (regime_translation_disabled(env, mmu_idx)) {
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Add support for the M profile default memory map which is used
if the MPU is not present or disabled.

The main differences in behaviour from implementing this
correctly are that we set the PAGE_EXEC attribute on
the right regions of memory, such that device regions
are not executable.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-10-git-send-email-peter.maydell@linaro.org
[PMM: rephrased comment and commit message; don't mark
 the flash memory region as not-writable; list all
 the cases in the default map explicitly rather than
 using a 'default' case for the non-executable regions]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 41 ++++++++++++++++++++++++++++++++---------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx,
                                                 int32_t address, int *prot)
 {
-    *prot = PAGE_READ | PAGE_WRITE;
-    switch (address) {
-    case 0xF0000000 ... 0xFFFFFFFF:
-        if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
+    if (!arm_feature(env, ARM_FEATURE_M)) {
+        *prot = PAGE_READ | PAGE_WRITE;
+        switch (address) {
+        case 0xF0000000 ... 0xFFFFFFFF:
+            if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
+                /* hivecs execing is ok */
+                *prot |= PAGE_EXEC;
+            }
+            break;
+        case 0x00000000 ... 0x7FFFFFFF:
             *prot |= PAGE_EXEC;
+            break;
+        }
+    } else {
+        /* Default system address map for M profile cores.
+         * The architecture specifies which regions are execute-never;
+         * at the MPU level no other checks are defined.
+         */
+        switch (address) {
+        case 0x00000000 ... 0x1fffffff: /* ROM */
+        case 0x20000000 ... 0x3fffffff: /* SRAM */
+        case 0x60000000 ... 0x7fffffff: /* RAM */
+        case 0x80000000 ... 0x9fffffff: /* RAM */
+            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            break;
+        case 0x40000000 ... 0x5fffffff: /* Peripheral */
+        case 0xa0000000 ... 0xbfffffff: /* Device */
+        case 0xc0000000 ... 0xdfffffff: /* Device */
+        case 0xe0000000 ... 0xffffffff: /* System */
+            *prot = PAGE_READ | PAGE_WRITE;
+            break;
+        default:
+            g_assert_not_reached();
         }
-        break;
-    case 0x00000000 ... 0x7FFFFFFF:
-        *prot |= PAGE_EXEC;
-        break;
     }
-
 }
 
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-- 
2.7.4

All M profile CPUs are PMSA, so set the feature bit.
(We haven't actually implemented the M profile MPU register
interface yet, but setting this feature bit gives us closer
to correct behaviour for the MPU-disabled case.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-11-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
+    /* M profile implies PMSA. We have to do this here rather than
+     * in realize with the other feature-implication checks because
+     * we look at the PMSA bit to see if we should add some properties.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+        set_feature(&cpu->env, ARM_FEATURE_PMSA);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property,
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

General logic is that operations stopped by the MPU are MemManage,
and those which go through the MPU and are caught by the unassigned
handle are BusFault. Distinguish these by looking at the
exception.fsr values, and set the CFSR bits and (if appropriate)
fill in the BFAR or MMFAR with the exception address.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-12-git-send-email-peter.maydell@linaro.org
[PMM: i-side faults do not set BFAR/MMFAR, only d-side;
 added some CPU_LOG_INT logging]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/arm/helper.c | 45 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         break;
     case EXCP_PREFETCH_ABORT:
     case EXCP_DATA_ABORT:
-        /* TODO: if we implemented the MPU registers, this is where we
-         * should set the MMFAR, etc from exception.fsr and exception.vaddress.
+        /* Note that for M profile we don't have a guest facing FSR, but
+         * the env->exception.fsr will be populated by the code that
+         * raises the fault, in the A profile short-descriptor format.
          */
-        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
+        switch (env->exception.fsr & 0xf) {
+        case 0x8: /* External Abort */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                env->v7m.cfsr |= R_V7M_CFSR_PRECISERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                break;
+            case EXCP_DATA_ABORT:
+                env->v7m.cfsr |=
+                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                env->v7m.bfar = env->exception.vaddress;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              env->v7m.bfar);
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS);
+            break;
+        default:
+            /* All other FSR values are either MPU faults or "can't happen
+             * for M profile" cases.
+             */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                env->v7m.cfsr |= R_V7M_CFSR_IACCVIOL_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
+                break;
+            case EXCP_DATA_ABORT:
+                env->v7m.cfsr |=
+                    (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
+                env->v7m.mmfar = env->exception.vaddress;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
+                              env->v7m.mmfar);
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
+            break;
+        }
         break;
     case EXCP_BKPT:
         if (semihosting_enabled()) {
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

The M series MPU is almost the same as the already implemented R
profile MPU (v7 PMSA).  So all we need to implement here is the MPU
register interface in the system register space.

This implementation has the same restriction as the R profile MPU
that it doesn't permit regions to be sized down smaller than 1K.

We also do not yet implement support for MPU_CTRL.HFNMIENA; this
bit should if zero disable use of the MPU when running HardFault,
NMI or with FAULTMASK set to 1 (ie at an execution priority of
less than zero) -- if the MPU is enabled we don't treat these
cases any differently.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-13-git-send-email-peter.maydell@linaro.org
[PMM: Keep all the bits in mpu_ctrl field, rather than
 using SCTLR bits for them; drop broken HFNMIENA support;
 various cleanup]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h      |   6 +++
 hw/intc/armv7m_nvic.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/helper.c   |  25 +++++++++++-
 target/arm/machine.c  |   5 ++-
 4 files changed, 137 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t dfsr; /* Debug Fault Status Register */
         uint32_t mmfar; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
+        unsigned mpu_ctrl; /* MPU_CTRL (some bits kept in sctlr_el[1]) */
         int exception;
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
 FIELD(V7M_DFSR, VCATCH, 3, 1)
 FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 
+/* v7M MPU_CTRL bits */
+FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
+FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
+FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
+
 /* If adding a feature bit which corresponds to a Linux ELF
  * HWCAP bit, remember to update the feature-bit-to-hwcap
  * mapping in linux-user/elfload.c:get_elf_hwcap().
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/arm.h"
 #include "hw/arm/armv7m_nvic.h"
 #include "target/arm/cpu.h"
+#include "exec/exec-all.h"
 #include "qemu/log.h"
 #include "trace.h"
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xd70: /* ISAR4.  */
         return 0x01310102;
     /* TODO: Implement debug registers.  */
+    case 0xd90: /* MPU_TYPE */
+        /* Unified MPU; if the MPU is not present this value is zero */
+        return cpu->pmsav7_dregion << 8;
+        break;
+    case 0xd94: /* MPU_CTRL */
+        return cpu->env.v7m.mpu_ctrl;
+    case 0xd98: /* MPU_RNR */
+        return cpu->env.cp15.c6_rgnr;
+    case 0xd9c: /* MPU_RBAR */
+    case 0xda4: /* MPU_RBAR_A1 */
+    case 0xdac: /* MPU_RBAR_A2 */
+    case 0xdb4: /* MPU_RBAR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return 0;
+        }
+        return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
+    }
+    case 0xda0: /* MPU_RASR */
+    case 0xda8: /* MPU_RASR_A1 */
+    case 0xdb0: /* MPU_RASR_A2 */
+    case 0xdb8: /* MPU_RASR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return 0;
+        }
+        return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
+            (cpu->env.pmsav7.drsr[region] & 0xffff);
+    }
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
         return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
         qemu_log_mask(LOG_UNIMP,
                       "NVIC: Aux fault status registers unimplemented\n");
         break;
+    case 0xd90: /* MPU_TYPE */
+        return; /* RO */
+    case 0xd94: /* MPU_CTRL */
+        if ((value &
+             (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
+            == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
+            qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
+                          "UNPREDICTABLE\n");
+        }
+        cpu->env.v7m.mpu_ctrl = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
+                                         R_V7M_MPU_CTRL_HFNMIENA_MASK |
+                                         R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
+        tlb_flush(CPU(cpu));
+        break;
+    case 0xd98: /* MPU_RNR */
+        if (value >= cpu->pmsav7_dregion) {
+            qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
+                          PRIu32 "/%" PRIu32 "\n",
+                          value, cpu->pmsav7_dregion);
+        } else {
+            cpu->env.cp15.c6_rgnr = value;
+        }
+        break;
+    case 0xd9c: /* MPU_RBAR */
+    case 0xda4: /* MPU_RBAR_A1 */
+    case 0xdac: /* MPU_RBAR_A2 */
+    case 0xdb4: /* MPU_RBAR_A3 */
+    {
+        int region;
+
+        if (value & (1 << 4)) {
+            /* VALID bit means use the region number specified in this
+             * value and also update MPU_RNR.REGION with that value.
+             */
+            region = extract32(value, 0, 4);
+            if (region >= cpu->pmsav7_dregion) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "MPU region out of range %u/%" PRIu32 "\n",
+                              region, cpu->pmsav7_dregion);
+                return;
+            }
+            cpu->env.cp15.c6_rgnr = region;
+        } else {
+            region = cpu->env.cp15.c6_rgnr;
+        }
+
+        if (region >= cpu->pmsav7_dregion) {
+            return;
+        }
+
+        cpu->env.pmsav7.drbar[region] = value & ~0x1f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
+    case 0xda0: /* MPU_RASR */
+    case 0xda8: /* MPU_RASR_A1 */
+    case 0xdb0: /* MPU_RASR_A2 */
+    case 0xdb8: /* MPU_RASR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return;
+        }
+
+        cpu->env.pmsav7.drsr[region] = value & 0xff3f;
+        cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
     case 0xf00: /* Software Triggered Interrupt Register */
     {
         /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline bool regime_translation_disabled(CPUARMState *env,
                                                ARMMMUIdx mmu_idx)
 {
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
+    }
+
     if (mmu_idx == ARMMMUIdx_S2NS) {
         return (env->cp15.hcr_el2 & HCR_VM) == 0;
     }
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
     }
 }
 
+static bool pmsav7_use_background_region(ARMCPU *cpu,
+                                         ARMMMUIdx mmu_idx, bool is_user)
+{
+    /* Return true if we should use the default memory map as a
+     * "background" region if there are no hits against any MPU regions.
+     */
+    CPUARMState *env = &cpu->env;
+
+    if (is_user) {
+        return false;
+    }
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
+    } else {
+        return regime_sctlr(env, mmu_idx) & SCTLR_BR;
+    }
+}
+
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                                  int access_type, ARMMMUIdx mmu_idx,
                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
         }
 
         if (n == -1) { /* no hits */
-            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
+            if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
                 /* background fault */
                 *fsr = 0;
                 return true;
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool m_needed(void *opaque)
 
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
-    .version_id = 3,
-    .minimum_version_id = 3,
+    .version_id = 4,
+    .minimum_version_id = 4,
     .needed = m_needed,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(env.v7m.vecbase, ARMCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
         VMSTATE_UINT32(env.v7m.dfsr, ARMCPU),
         VMSTATE_UINT32(env.v7m.mmfar, ARMCPU),
         VMSTATE_UINT32(env.v7m.bfar, ARMCPU),
+        VMSTATE_UINT32(env.v7m.mpu_ctrl, ARMCPU),
         VMSTATE_INT32(env.v7m.exception, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
-- 
2.7.4

Implement HFNMIENA support for the M profile MPU. This bit controls
whether the MPU is treated as enabled when executing at execution
priorities of less than zero (in NMI, HardFault or with the FAULTMASK
bit set).

Doing this requires us to use a different MMU index for "running
at execution priority < 0", because we will have different
access permissions for that case versus the normal case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-14-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 24 +++++++++++++++++++++++-
 target/arm/helper.c    | 18 +++++++++++++++++-
 target/arm/translate.c |  1 +
 3 files changed, 41 insertions(+), 2 deletions(-)

From: Cédric Le Goater <clg@kaod.org>

Multiple I2C commands can be fired simultaneously and the controller
execute the commands following these priorities:

(1) Master Start Command
  (2) Master Transmit Command
  (3) Slave Transmit Command or Master Receive Command
  (4) Master Stop Command

The current code is incorrect with respect to the above sequence and
needs to be reworked to handle each individual command.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-2-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
 
 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 {
+    bus->cmd &= ~0xFFFF;
     bus->cmd |= value & 0xFFFF;
     bus->intr_status = 0;
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
 
-    } else if (bus->cmd & I2CD_M_TX_CMD) {
+        /* START command is also a TX command, as the slave address is
+         * sent on the bus */
+        bus->cmd &= ~(I2CD_M_START_CMD | I2CD_M_TX_CMD);
+
+        /* No slave found */
+        if (!i2c_bus_busy(bus->bus)) {
+            return;
+        }
+    }
+
+    if (bus->cmd & I2CD_M_TX_CMD) {
         if (i2c_send(bus->bus, bus->buf)) {
             bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
             i2c_end_transfer(bus->bus);
         } else {
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
+        bus->cmd &= ~I2CD_M_TX_CMD;
+    }
 
-    } else if (bus->cmd & I2CD_M_RX_CMD) {
+    if (bus->cmd & I2CD_M_RX_CMD) {
         int ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_RX_DONE;
         }
         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
+        bus->cmd &= ~I2CD_M_RX_CMD;
     }
 
     if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             i2c_end_transfer(bus->bus);
             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
         }
+        bus->cmd &= ~I2CD_M_STOP_CMD;
     }
-
-    /* command is handled, reset it and check for interrupts  */
-    bus->cmd &= ~0xFFFF;
-    aspeed_i2c_bus_raise_interrupt(bus);
 }
 
 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
         }
 
         aspeed_i2c_bus_handle_cmd(bus, value);
+        aspeed_i2c_bus_raise_interrupt(bus);
         break;
 
     default:
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Today, the LAST command is handled with the STOP command but this is
incorrect. Also nack the I2C bus when a LAST is issued.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         bus->cmd &= ~I2CD_M_TX_CMD;
     }
 
-    if (bus->cmd & I2CD_M_RX_CMD) {
+    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
         int ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_RX_DONE;
         }
         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
-        bus->cmd &= ~I2CD_M_RX_CMD;
+        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
+            i2c_nack(bus->bus);
+        }
+        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
     }
 
-    if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
+    if (bus->cmd & I2CD_M_STOP_CMD) {
         if (!i2c_bus_busy(bus->bus)) {
             bus->intr_status |= I2CD_INTR_ABNORMAL;
         } else {
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

The Aspeed I2C controller maintains a state machine in the command
register, which is mostly used for debug.

Let's start adding a few states to handle abnormal STOP
commands. Today, the model uses the busy status of the bus as a
condition to do so but it is not precise enough.

Also remove the ABNORMAL bit for failing TX commands. This is
incorrect with respect to the specs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-4-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
     }
 }
 
+static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
+{
+    bus->cmd &= ~(I2CD_TX_STATE_MASK << I2CD_TX_STATE_SHIFT);
+    bus->cmd |= (state & I2CD_TX_STATE_MASK) << I2CD_TX_STATE_SHIFT;
+}
+
+static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
+{
+    return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
+}
+
+/*
+ * The state machine needs some refinement. It is only used to track
+ * invalid STOP commands for the moment.
+ */
 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 {
     bus->cmd &= ~0xFFFF;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
     bus->intr_status = 0;
 
     if (bus->cmd & I2CD_M_START_CMD) {
+        uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
+            I2CD_MSTARTR : I2CD_MSTART;
+
+        aspeed_i2c_set_state(bus, state);
+
         if (i2c_start_transfer(bus->bus, extract32(bus->buf, 1, 7),
                                extract32(bus->buf, 0, 1))) {
             bus->intr_status |= I2CD_INTR_TX_NAK;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         if (!i2c_bus_busy(bus->bus)) {
             return;
         }
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & I2CD_M_TX_CMD) {
+        aspeed_i2c_set_state(bus, I2CD_MTXD);
         if (i2c_send(bus->bus, bus->buf)) {
-            bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
+            bus->intr_status |= (I2CD_INTR_TX_NAK);
             i2c_end_transfer(bus->bus);
         } else {
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
         bus->cmd &= ~I2CD_M_TX_CMD;
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
-        int ret = i2c_recv(bus->bus);
+        int ret;
+
+        aspeed_i2c_set_state(bus, I2CD_MRXD);
+        ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
             ret = 0xff;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             i2c_nack(bus->bus);
         }
         bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & I2CD_M_STOP_CMD) {
-        if (!i2c_bus_busy(bus->bus)) {
+        if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
             bus->intr_status |= I2CD_INTR_ABNORMAL;
         } else {
+            aspeed_i2c_set_state(bus, I2CD_MSTOP);
             i2c_end_transfer(bus->bus);
             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
         }
         bus->cmd &= ~I2CD_M_STOP_CMD;
+        aspeed_i2c_set_state(bus, I2CD_IDLE);
     }
 }
 
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Let's add an RTC to the palmetto BMC and a LM75 temperature sensor to
the AST2500 EVB to start with.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-5-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
     const char *fmc_model;
     const char *spi_model;
     uint32_t num_cs;
+    void (*i2c_init)(AspeedBoardState *bmc);
 } AspeedBoardConfig;
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
         SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
         SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 
+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
+static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
+
 static const AspeedBoardConfig aspeed_boards[] = {
     [PALMETTO_BMC] = {
         .soc_name  = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .fmc_model = "n25q256a",
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
+        .i2c_init  = palmetto_bmc_i2c_init,
     },
     [AST2500_EVB]  = {
         .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .fmc_model = "n25q256a",
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
+        .i2c_init  = ast2500_evb_i2c_init,
     },
     [ROMULUS_BMC]  = {
         .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
     aspeed_board_binfo.ram_size = ram_size;
     aspeed_board_binfo.loader_start = sc->info->sdram_base;
 
+    if (cfg->i2c_init) {
+        cfg->i2c_init(bmc);
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), &aspeed_board_binfo);
 }
 
+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* The palmetto platform expects a ds3231 RTC but a ds1338 is
+     * enough to provide basic RTC features. Alarms will be missing */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+}
+
 static void palmetto_bmc_init(MachineState *machine)
 {
     aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
     .class_init = palmetto_bmc_class_init,
 };
 
+static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
+}
+
 static void ast2500_evb_init(MachineState *machine)
 {
     aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for
the TMP42{1,2,3} temperature sensors.

Specs can be found here :

http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-6-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 403 insertions(+)
 create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
 common-obj-$(CONFIG_MAX111X) += max111x.o
 common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_TMP421) += tmp421.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Texas Instruments TMP421 temperature sensor.
+ *
+ * Copyright (c) 2016 IBM Corporation.
+ *
+ * Largely inspired by :
+ *
+ * Texas Instruments TMP105 temperature sensor.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/i2c/i2c.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+
+/* Manufacturer / Device ID's */
+#define TMP421_MANUFACTURER_ID          0x55
+#define TMP421_DEVICE_ID                0x21
+#define TMP422_DEVICE_ID                0x22
+#define TMP423_DEVICE_ID                0x23
+
+typedef struct DeviceInfo {
+    int model;
+    const char *name;
+} DeviceInfo;
+
+static const DeviceInfo devices[] = {
+    { TMP421_DEVICE_ID, "tmp421" },
+    { TMP422_DEVICE_ID, "tmp422" },
+    { TMP423_DEVICE_ID, "tmp423" },
+};
+
+typedef struct TMP421State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    int16_t temperature[4];
+
+    uint8_t status;
+    uint8_t config[2];
+    uint8_t rate;
+
+    uint8_t len;
+    uint8_t buf[2];
+    uint8_t pointer;
+
+} TMP421State;
+
+typedef struct TMP421Class {
+    I2CSlaveClass parent_class;
+    DeviceInfo *dev;
+} TMP421Class;
+
+#define TYPE_TMP421 "tmp421-generic"
+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
+
+#define TMP421_CLASS(klass) \
+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
+#define TMP421_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
+
+/* the TMP421 registers */
+#define TMP421_STATUS_REG               0x08
+#define    TMP421_STATUS_BUSY             (1 << 7)
+#define TMP421_CONFIG_REG_1             0x09
+#define    TMP421_CONFIG_RANGE            (1 << 2)
+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
+#define TMP421_CONFIG_REG_2             0x0A
+#define    TMP421_CONFIG_RC               (1 << 2)
+#define    TMP421_CONFIG_LEN              (1 << 3)
+#define    TMP421_CONFIG_REN              (1 << 4)
+#define    TMP421_CONFIG_REN2             (1 << 5)
+#define    TMP421_CONFIG_REN3             (1 << 6)
+
+#define TMP421_CONVERSION_RATE_REG      0x0B
+#define TMP421_ONE_SHOT                 0x0F
+
+#define TMP421_RESET                    0xFC
+#define TMP421_MANUFACTURER_ID_REG      0xFE
+#define TMP421_DEVICE_ID_REG            0xFF
+
+#define TMP421_TEMP_MSB0                0x00
+#define TMP421_TEMP_MSB1                0x01
+#define TMP421_TEMP_MSB2                0x02
+#define TMP421_TEMP_MSB3                0x03
+#define TMP421_TEMP_LSB0                0x10
+#define TMP421_TEMP_LSB1                0x11
+#define TMP421_TEMP_LSB2                0x12
+#define TMP421_TEMP_LSB3                0x13
+
+static const int32_t mins[2] = { -40000, -55000 };
+static const int32_t maxs[2] = { 127000, 150000 };
+
+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int64_t value;
+    int tempid;
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
+
+    visit_type_int(v, name, &value, errp);
+}
+
+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+ */
+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    Error *local_err = NULL;
+    int64_t temp;
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int tempid;
+
+    visit_type_int(v, name, &temp, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
+                   temp / 1000, temp % 1000);
+        return;
+    }
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
+}
+
+static void tmp421_read(TMP421State *s)
+{
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    s->len = 0;
+
+    switch (s->pointer) {
+    case TMP421_MANUFACTURER_ID_REG:
+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
+        break;
+    case TMP421_DEVICE_ID_REG:
+        s->buf[s->len++] = sc->dev->model;
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->buf[s->len++] = s->config[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->buf[s->len++] = s->config[1];
+        break;
+    case TMP421_CONVERSION_RATE_REG:
+        s->buf[s->len++] = s->rate;
+        break;
+    case TMP421_STATUS_REG:
+        s->buf[s->len++] = s->status;
+        break;
+
+        /* FIXME: check for channel enablement in config registers */
+    case TMP421_TEMP_MSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    }
+}
+
+static void tmp421_reset(I2CSlave *i2c);
+
+static void tmp421_write(TMP421State *s)
+{
+    switch (s->pointer) {
+    case TMP421_CONVERSION_RATE_REG:
+        s->rate = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->config[0] = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->config[1] = s->buf[0];
+        break;
+    case TMP421_RESET:
+        tmp421_reset(I2C_SLAVE(s));
+        break;
+    }
+}
+
+static int tmp421_rx(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len < 2) {
+        return s->buf[s->len++];
+    } else {
+        return 0xff;
+    }
+}
+
+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len == 0) {
+        /* first byte is the register pointer for a read or write
+         * operation */
+        s->pointer = data;
+        s->len++;
+    } else if (s->len == 1) {
+        /* second byte is the data to write. The device only supports
+         * one byte writes */
+        s->buf[0] = data;
+        tmp421_write(s);
+    }
+
+    return 0;
+}
+
+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (event == I2C_START_RECV) {
+        tmp421_read(s);
+    }
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription vmstate_tmp421 = {
+    .name = "TMP421",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, TMP421State),
+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
+        VMSTATE_UINT8(pointer, TMP421State),
+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
+        VMSTATE_UINT8(status, TMP421State),
+        VMSTATE_UINT8(rate, TMP421State),
+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tmp421_reset(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    memset(s->temperature, 0, sizeof(s->temperature));
+    s->pointer = 0;
+
+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
+
+     /* resistance correction and channel enablement */
+    switch (sc->dev->model) {
+    case TMP421_DEVICE_ID:
+        s->config[1] = 0x1c;
+        break;
+    case TMP422_DEVICE_ID:
+        s->config[1] = 0x3c;
+        break;
+    case TMP423_DEVICE_ID:
+        s->config[1] = 0x7c;
+        break;
+    }
+
+    s->rate = 0x7;       /* 8Hz */
+    s->status = 0;
+}
+
+static int tmp421_init(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    tmp421_reset(&s->i2c);
+
+    return 0;
+}
+
+static void tmp421_initfn(Object *obj)
+{
+    object_property_add(obj, "temperature0", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature1", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature2", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature3", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+}
+
+static void tmp421_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    TMP421Class *sc = TMP421_CLASS(klass);
+
+    k->init = tmp421_init;
+    k->event = tmp421_event;
+    k->recv = tmp421_rx;
+    k->send = tmp421_tx;
+    dc->vmsd = &vmstate_tmp421;
+    sc->dev = (DeviceInfo *) data;
+}
+
+static const TypeInfo tmp421_info = {
+    .name          = TYPE_TMP421,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(TMP421State),
+    .instance_init = tmp421_initfn,
+    .class_init    = tmp421_class_init,
+};
+
+static void tmp421_register_types(void)
+{
+    int i;
+
+    type_register_static(&tmp421_info);
+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
+        TypeInfo ti = {
+            .name       = devices[i].name,
+            .parent     = TYPE_TMP421,
+            .class_init = tmp421_class_init,
+            .class_data = (void *) &devices[i],
+        };
+        type_register(&ti);
+    }
+}
+
+type_init(tmp421_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
 CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
+CONFIG_TMP421=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Temperatures can be changed from the monitor with :

(qemu) qom-set /machine/unattached/device[2] temperature0 12000

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-7-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    DeviceState *dev;
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+
+    /* add a TMP423 temperature sensor */
+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
+                           "tmp423", 0x4c);
+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
 static void palmetto_bmc_init(MachineState *machine)
-- 
2.7.4

From: Andrew Jones <drjones@redhat.com>

Cc: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 20170529173751.3443-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     if (nb_numa_nodes > 0) {
         acpi_add_table(table_offsets, tables_blob);
         build_srat(tables_blob, tables->linker, vms);
+        if (have_numa_distance) {
+            acpi_add_table(table_offsets, tables_blob);
+            build_slit(tables_blob, tables->linker);
+        }
     }
 
     if (its_class_name() && !vmc->no_its) {
-- 
2.7.4

From: Andrew Jones <drjones@redhat.com>

This is based on patch Shannon Zhao originally posted.

Cc: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 20170529173751.3443-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
                                 "clk24mhz");
     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);
 
+    if (have_numa_distance) {
+        int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
+        uint32_t *matrix = g_malloc0(size);
+        int idx, i, j;
+
+        for (i = 0; i < nb_numa_nodes; i++) {
+            for (j = 0; j < nb_numa_nodes; j++) {
+                idx = (i * nb_numa_nodes + j) * 3;
+                matrix[idx + 0] = cpu_to_be32(i);
+                matrix[idx + 1] = cpu_to_be32(j);
+                matrix[idx + 2] = cpu_to_be32(numa_info[i].distance[j]);
+            }
+        }
+
+        qemu_fdt_add_subnode(fdt, "/distance-map");
+        qemu_fdt_setprop_string(fdt, "/distance-map", "compatible",
+                                "numa-distance-map-v1");
+        qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",
+                         matrix, size);
+        g_free(matrix);
+    }
 }
 
 static void fdt_add_psci_node(const VirtMachineState *vms)
-- 
2.7.4

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
      * by reading and writing back the fields.
      */
-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
+    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
 
     gicv3_cpuif_virt_update(cs);
-- 
2.20.1

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1