Series comparison

-[Qemu-devel] [PULL 00/18] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-ARM queue: nothing particularly exciting, but 18 patches
+Not very much here, but several people have fallen over
-is enough to send out.
+the vector operation segfault bug, so let's get the fix
 into master.
 thanks
 -- PMM
-The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
+The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
-for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
+for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
-  mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
+  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: various code cleanups
+ * exynos4210: QOM'ify the Exynos4210 SoC
- * v7M: set correct BFSR bits on bus fault
+ * exynos4210: Add DMA support for the Exynos4210
- * v7M: clear exclusive monitor on reset and exception entry/exit
+ * arm_gicv3: Fix writes to ICC_CTLR_EL3
- * v7M: don't apply priority mask to negative priorities
+ * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
- * zcu102: support 'secure' and 'virtualization' machine properties
+ * target/arm: Fix vector operation segfault
- * aarch64: fix ERET single stepping
+ * target/arm: Minor improvements to BFXIL, EXTR
  * gpex: implement PCI INTx routing
  * mps2-an511: fix UART overflow interrupt line wiring
 ----------------------------------------------------------------
-Alistair Francis (5):
+Alistair Francis (1):
-      xlnx-ep108: Rename to ZCU102
+      target/arm: Fix vector operation segfault
       xlnx-zcu102: Manually create the machines
       xlnx-zcu102: Add a machine level secure property
       xlnx-zcu102: Add a machine level virtualization property
       xlnx-zcu102: Mark the EP108 machine as deprecated
-Jaroslaw Pelczar (1):
+Guenter Roeck (1):
-      AArch64: Fix single stepping of ERET instruction
+      hw/arm/exynos4210: Add DMA support for the Exynos4210
-Peter Maydell (8):
+Peter Maydell (5):
-      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+      arm: Move system_clock_scale to armv7m_systick.h
-      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
+      arm: Remove unnecessary includes of hw/arm/arm.h
-      target/arm: Get PRECISERR and IBUSERR the right way round
+      arm: Rename hw/arm/arm.h to hw/arm/boot.h
-      nvic: Don't apply group priority mask to negative priorities
+      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
+      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
       target/arm: Add and use defines for EXCRET constants
       target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
       mps2-an511: Fix wiring of UART overflow interrupt lines
-Pranavkumar Sawargaonkar (3):
+Philippe Mathieu-Daudé (3):
-      hw/pci-host/gpex: Set INTx index/gsi mapping
+      hw/arm/exynos4: Remove unuseful debug code
-      hw/arm/virt: Set INTx/gsi mapping
+      hw/arm/exynos4: Use the IEC binary prefix definitions
-      hw/pci-host/gpex: Implement PCI INTx routing
+      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-Richard Henderson (1):
+Richard Henderson (2):
-      target/arm: Avoid an extra temporary for store_exclusive
+      target/arm: Use extract2 for EXTR
       target/arm: Simplify BFXIL expansion
- hw/arm/Makefile.objs         |   2 +-
+ include/hw/arm/allwinner-a10.h    |  2 +-
- include/hw/arm/xlnx-zynqmp.h |   2 +
+ include/hw/arm/aspeed_soc.h       |  1 -
- include/hw/pci-host/gpex.h   |   3 +
+ include/hw/arm/bcm2836.h          |  1 -
- target/arm/cpu.h             |  35 +++---
+ include/hw/arm/{arm.h => boot.h}  | 12 +++------
- target/arm/internals.h       |  20 ++++
+ include/hw/arm/exynos4210.h       |  9 +++++--
- hw/arm/mps2.c                |   4 +-
+ include/hw/arm/fsl-imx25.h        |  2 +-
- hw/arm/virt.c                |   1 +
+ include/hw/arm/fsl-imx31.h        |  2 +-
- hw/arm/xlnx-ep108.c          | 139 -----------------------
+ include/hw/arm/fsl-imx6.h         |  2 +-
- hw/arm/xlnx-zcu102.c         | 259 +++++++++++++++++++++++++++++++++++++++++++
+ include/hw/arm/fsl-imx6ul.h       |  2 +-
- hw/arm/xlnx-zynqmp.c         |   3 +-
+ include/hw/arm/fsl-imx7.h         |  2 +-
- hw/intc/armv7m_nvic.c        |  11 +-
+ include/hw/arm/virt.h             |  2 +-
- hw/pci-host/gpex.c           |  22 ++++
+ include/hw/arm/xlnx-versal.h      |  2 +-
- target/arm/cpu.c             |   6 +
+ include/hw/arm/xlnx-zynqmp.h      |  2 +-
- target/arm/helper.c          |  43 ++++---
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
- target/arm/op_helper.c       |   2 +-
+ hw/arm/armsse.c                   |  2 +-
- target/arm/translate-a64.c   |  27 ++---
+ hw/arm/armv7m.c                   |  2 +-
-files changed, 382 insertions(+), 197 deletions(-)
+ hw/arm/aspeed.c                   |  2 +-
- delete mode 100644 hw/arm/xlnx-ep108.c
+ hw/arm/boot.c                     |  2 +-
- create mode 100644 hw/arm/xlnx-zcu102.c
+ hw/arm/collie.c                   |  2 +-
  hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
  hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
  hw/arm/highbank.c                 |  2 +-
  hw/arm/integratorcp.c             |  2 +-
  hw/arm/mainstone.c                |  2 +-
  hw/arm/microbit.c                 |  2 +-
  hw/arm/mps2-tz.c                  |  2 +-
  hw/arm/mps2.c                     |  2 +-
  hw/arm/msf2-soc.c                 |  1 -
  hw/arm/msf2-som.c                 |  2 +-
  hw/arm/musca.c                    |  2 +-
  hw/arm/musicpal.c                 |  2 +-
  hw/arm/netduino2.c                |  2 +-
  hw/arm/nrf51_soc.c                |  2 +-
  hw/arm/nseries.c                  |  2 +-
  hw/arm/omap1.c                    |  2 +-
  hw/arm/omap2.c                    |  2 +-
  hw/arm/omap_sx1.c                 |  2 +-
  hw/arm/palm.c                     |  2 +-
  hw/arm/raspi.c                    |  2 +-
  hw/arm/realview.c                 |  2 +-
  hw/arm/spitz.c                    |  2 +-
  hw/arm/stellaris.c                |  2 +-
  hw/arm/stm32f205_soc.c            |  2 +-
  hw/arm/strongarm.c                |  2 +-
  hw/arm/tosa.c                     |  2 +-
  hw/arm/versatilepb.c              |  2 +-
  hw/arm/vexpress.c                 |  2 +-
  hw/arm/virt.c                     |  2 +-
  hw/arm/xilinx_zynq.c              |  2 +-
  hw/arm/xlnx-versal.c              |  2 +-
  hw/arm/z2.c                       |  2 +-
  hw/intc/arm_gicv3_cpuif.c         |  6 ++---
  hw/intc/armv7m_nvic.c             |  1 -
  target/arm/arm-semi.c             |  1 -
  target/arm/cpu.c                  |  1 -
  target/arm/cpu64.c                |  1 -
  target/arm/kvm.c                  |  1 -
  target/arm/kvm32.c                |  1 -
  target/arm/kvm64.c                |  1 -
  target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
  target/arm/translate.c            |  4 +--
 files changed, 164 insertions(+), 123 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (96%)

-[Qemu-devel] [PULL 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+Deleted patch
-Use a symbolic constant M_REG_NUM_BANKS for the array size for
-registers which are banked by M profile security state, rather
-than hardcoding lots of 2s.
-Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h | 35 +++++++++++++++++++----------------
-file changed, 19 insertions(+), 16 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
-  * accessed via env->registerfield[env->v7m.secure] (whether the security
-  * extension is implemented or not).
-  */
--#define M_REG_NS 0
--#define M_REG_S 1
-+enum {
-+    M_REG_NS = 0,
-+    M_REG_S = 1,
-+    M_REG_NUM_BANKS = 2,
-+};
- /* ARM-specific interrupt pending bits.  */
- #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t other_sp;
-         uint32_t other_ss_msp;
-         uint32_t other_ss_psp;
--        uint32_t vecbase[2];
--        uint32_t basepri[2];
--        uint32_t control[2];
--        uint32_t ccr[2]; /* Configuration and Control */
--        uint32_t cfsr[2]; /* Configurable Fault Status */
-+        uint32_t vecbase[M_REG_NUM_BANKS];
-+        uint32_t basepri[M_REG_NUM_BANKS];
-+        uint32_t control[M_REG_NUM_BANKS];
-+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
-+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
-         uint32_t hfsr; /* HardFault Status */
-         uint32_t dfsr; /* Debug Fault Status Register */
--        uint32_t mmfar[2]; /* MemManage Fault Address */
-+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
-         uint32_t bfar; /* BusFault Address */
--        unsigned mpu_ctrl[2]; /* MPU_CTRL */
-+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
-         int exception;
--        uint32_t primask[2];
--        uint32_t faultmask[2];
-+        uint32_t primask[M_REG_NUM_BANKS];
-+        uint32_t faultmask[M_REG_NUM_BANKS];
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
-     } v7m;
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t *drbar;
-         uint32_t *drsr;
-         uint32_t *dracr;
--        uint32_t rnr[2];
-+        uint32_t rnr[M_REG_NUM_BANKS];
-     } pmsav7;
-     /* PMSAv8 MPU */
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-          *  pmsav7.rnr (region number register)
-          *  pmsav7_dregion (number of configured regions)
-          */
--        uint32_t *rbar[2];
--        uint32_t *rlar[2];
--        uint32_t mair0[2];
--        uint32_t mair1[2];
-+        uint32_t *rbar[M_REG_NUM_BANKS];
-+        uint32_t *rlar[M_REG_NUM_BANKS];
-+        uint32_t mair0[M_REG_NUM_BANKS];
-+        uint32_t mair1[M_REG_NUM_BANKS];
-     } pmsav8;
-     void *nvic;
---
-.7.4

-[Qemu-devel] [PULL 13/18] AArch64: Fix single stepping of ERET instruction
+[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
-From: Jaroslaw Pelczar <j.pelczar@samsung.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Previously when single stepping through ERET instruction via GDB
+This is, after all, how we implement extract2 in tcg/aarch64.
 would result in debugger entering the "next" PC after ERET instruction.
 When debugging in kernel mode, this will also cause unintended behavior,
 because debugger will try to access memory from EL0 point of view.
-Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 1 +
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
-file changed, 1 insertion(+)
+file changed, 20 insertions(+), 18 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
-         default:
+             } else {
-             gen_a64_set_pc_im(dc->pc);
+                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
-             /* fall through */
+             }
-+        case DISAS_EXIT:
+-        } else if (rm == rn) { /* ROR */
-         case DISAS_JUMP:
+-            tcg_rm = cpu_reg(s, rm);
-             if (dc->base.singlestep_enabled) {
+-            if (sf) {
-                 gen_exception_internal(EXCP_DEBUG);
+-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
 -            } else {
 -                TCGv_i32 tmp = tcg_temp_new_i32();
 -                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
 -                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
 +            if (sf) {
 +                /* Specialization to ROR happens in EXTRACT2.  */
 +                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
 +            } else {
 +                TCGv_i32 t0 = tcg_temp_new_i32();
 +
 +                tcg_gen_extrl_i64_i32(t0, tcg_rm);
 +                if (rm == rn) {
 +                    tcg_gen_rotri_i32(t0, t0, imm);
 +                } else {
 +                    TCGv_i32 t1 = tcg_temp_new_i32();
 +                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
 +                    tcg_gen_extract2_i32(t0, t0, t1, imm);
 +                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/18] target/arm: Avoid an extra temporary for store_exclusive
+[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
 From: Richard Henderson <richard.henderson@linaro.org>
-Instead of copying addr to a local temp, reuse the value (which we
+The mask implied by the extract is redundant with the one
-have just compared as equal) already saved in cpu_exclusive_addr.
+implied by the deposit.  Also, fix spelling of BFXIL.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 26 +++++++++-----------------
+ target/arm/translate-a64.c | 6 +++---
-file changed, 9 insertions(+), 17 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
- }
+             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
+             return;
  static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
 -                                TCGv_i64 inaddr, int size, int is_pair)
 +                                TCGv_i64 addr, int size, int is_pair)
  {
      /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
       *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
       */
      TCGLabel *fail_label = gen_new_label();
      TCGLabel *done_label = gen_new_label();
 -    TCGv_i64 addr = tcg_temp_local_new_i64();
      TCGv_i64 tmp;
 -    /* Copy input into a local temp so it is not trashed when the
 -     * basic block ends at the branch insn.
 -     */
 -    tcg_gen_mov_i64(addr, inaddr);
      tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
      tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
              } else {
                  tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
              }
 -            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
 +            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
 +                                       cpu_exclusive_val, tmp,
                                         get_mem_index(s),
                                         MO_64 | MO_ALIGN | s->be_data);
              tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
          } else if (s->be_data == MO_LE) {
 -            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          } else {
 -            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          }
+-        /* opc == 1, BXFIL fall through to deposit */
+-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
++        /* opc == 1, BFXIL fall through to deposit */
++        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
+         pos = 0;
      } else {
--        TCGv_i64 val = cpu_reg(s, rt);
+         /* Handle the ri > si case with a deposit
--        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
--                                   get_mem_index(s),
+         len = ri;
 +        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
 +                                   cpu_reg(s, rt), get_mem_index(s),
                                     size | MO_ALIGN | s->be_data);
          tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
      }
--
--    tcg_temp_free_i64(addr);
+-    if (opc == 1) { /* BFM, BXFIL */
--
++    if (opc == 1) { /* BFM, BFXIL */
-     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
+         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
-     tcg_temp_free_i64(tmp);
+     } else {
-     tcg_gen_br(done_label);
+         /* SBFM or UBFM: We start with zero, and we haven't modified
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines
+[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
-Fix an error that meant we were wiring every UART's overflow
+From: Alistair Francis <alistair.francis@wdc.com>
 interrupts into the same inputs 0 and 1 of the OR gate,
 rather than giving each its own input.
-Cc: qemu-stable@nongnu.org
+Commit 89e68b575 "target/arm: Use vector operations for saturation"
 causes this abort() when booting QEMU ARM with a Cortex-A15:
 0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
 0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
 0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
 0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 4 ++--
+ target/arm/translate.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/mps2.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-             cmsdk_apb_uart_create(uartbase[i],
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
+                            (u ? uqadd_op : sqadd_op) + size);
--                                  qdev_get_gpio_in(orgate_dev, 0),
+-            break;
--                                  qdev_get_gpio_in(orgate_dev, 1),
++            return 0;
-+                                  qdev_get_gpio_in(orgate_dev, i * 2),
-+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
+         case NEON_3R_VQSUB:
-                                   NULL,
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                                   uartchr, SYSCLK_FRQ);
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-         }
+                            (u ? uqsub_op : sqsub_op) + size);
 -            break;
 +            return 0;
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
+[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
-In the v7M and v8M ARM ARM, the magic exception return values are
+The system_clock_scale global is used only by the armv7m systick
-referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
+device; move the extern declaration to the armv7m_systick.h header,
-constants to define bits within them. Rename the 'type' variable
+and expand the comment to explain what it is and that it should
-which holds the exception return value in do_v7m_exception_exit()
+ideally be replaced with a different approach.
 to excret, making it clearer that it does hold an EXC_RETURN value.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 23 ++++++++++++-----------
+ include/hw/arm/arm.h              |  4 ----
-file changed, 12 insertions(+), 11 deletions(-)
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/arm/arm.h
-+++ b/target/arm/helper.c
++++ b/include/hw/arm/arm.h
-@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
- static void do_v7m_exception_exit(ARMCPU *cpu)
+                                             const struct arm_boot_info *info,
- {
+                                             hwaddr mvbar_addr);
-     CPUARMState *env = &cpu->env;
--    uint32_t type;
+-/* Multiplication factor to convert from system clock ticks to qemu timer
-+    uint32_t excret;
+-   ticks.  */
-     uint32_t xpsr;
+-extern int system_clock_scale;
-     bool ufault = false;
+-
-     bool return_to_sp_process = false;
+ #endif /* HW_ARM_H */
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
-      * the target value up between env->regs[15] and env->thumb in
+index XXXXXXX..XXXXXXX 100644
-      * gen_bx(). Reconstitute it.
+--- a/include/hw/timer/armv7m_systick.h
-      */
++++ b/include/hw/timer/armv7m_systick.h
--    type = env->regs[15];
+@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
-+    excret = env->regs[15];
+     qemu_irq irq;
-     if (env->thumb) {
+ } SysTickState;
--        type |= 1;
-+        excret |= 1;
++/*
-     }
++ * Multiplication factor to convert from system clock ticks to qemu timer
++ * ticks. This should be set (by board code, usually) to a value
-     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
++ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
-                   " previous exception %d\n",
++ * in Hz of the CPU.
--                  type, env->v7m.exception);
++ *
-+                  excret, env->v7m.exception);
++ * This value is used by the systick device when it is running in
++ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
--    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++ * set how fast the timer should tick.
-+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++ *
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
++ * TODO: we should refactor this so that rather than using a global
--                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
++ * we use a device property or something similar. This is complicated
-+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
++ * because (a) the property would need to be plumbed through from the
-+                      excret);
++ * board code down through various layers to the systick device
-     }
++ * and (b) the property needs to be modifiable after realize, because
++ * the stellaris board uses this to implement the behaviour where the
-     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
++ * guest can reprogram the PLL registers to downclock the CPU, and the
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++ * systick device needs to react accordingly. Possibly this should
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
++ * be deferred until we have a good API for modelling clock trees.
-          */
++ */
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++extern int system_clock_scale;
--            int es = type & R_V7M_EXCRET_ES_MASK;
++
-+            int es = excret & R_V7M_EXCRET_ES_MASK;
+ #endif
              if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                  env->v7m.faultmask[es] = 0;
              }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          g_assert_not_reached();
      }
 -    switch (type & 0xf) {
 +    switch (excret & 0xf) {
      case 1: /* Return to Handler */
          return_to_handler = true;
          break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
           */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
 -        v7m_exception_taken(cpu, type);
 +        v7m_exception_taken(cpu, excret);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                        "stackframe: failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      /* The restored xPSR exception field will be zero if we're
       * resuming in Thread mode. If that doesn't match what the
 -     * exception return type specified then this is a UsageFault.
 +     * exception return excret specified then this is a UsageFault.
       */
      if (return_to_handler != arm_v7m_is_handler_mode(env)) {
          /* Take an INVPC UsageFault by pushing the stack again. */
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          v7m_push_stack(cpu);
 -        v7m_exception_taken(cpu, type);
 +        v7m_exception_taken(cpu, excret);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                        "failed exception return integrity check\n");
          return;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/18] nvic: Don't apply group priority mask to negative priorities
+[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
-In several places we were unconditionally applying the
+The hw/arm/arm.h header now only includes declarations relating
-nvic_gprio_mask() to a priority value. This is incorrect
+to boot.c code, so it is only needed by Arm board or SoC code.
-if the priority is one of the fixed negative priority
+Remove some unnecessary inclusions of it from target/arm files
-values (for NMI and HardFault), so don't do it.
+and from hw/intc/armv7m_nvic.c.
 This bug would have caused both NMI and HardFault to be
 considered as the same priority and so NMI wouldn't
 correctly preempt HardFault.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 11 +++++++++--
+ hw/intc/armv7m_nvic.c | 1 -
-file changed, 9 insertions(+), 2 deletions(-)
+ target/arm/arm-semi.c | 1 -
  target/arm/cpu.c      | 1 -
  target/arm/cpu64.c    | 1 -
  target/arm/kvm.c      | 1 -
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
+@@ -XXX,XX +XXX,XX @@
-         }
+ #include "cpu.h"
-     }
+ #include "hw/sysbus.h"
+ #include "qemu/timer.h"
-+    if (active_prio > 0) {
+-#include "hw/arm/arm.h"
-+        active_prio &= nvic_gprio_mask(s);
+ #include "hw/intc/armv7m_nvic.h"
-+    }
+ #include "target/arm/cpu.h"
-+
+ #include "exec/exec-all.h"
-     s->vectpending = pend_irq;
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
--    s->exception_prio = active_prio & nvic_gprio_mask(s);
+index XXXXXXX..XXXXXXX 100644
-+    s->exception_prio = active_prio;
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
-     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
+@@ -XXX,XX +XXX,XX @@
- }
+ #else
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+ #include "qemu-common.h"
-     assert(vec->enabled);
+ #include "exec/gdbstub.h"
-     assert(vec->pending);
+-#include "hw/arm/arm.h"
+ #include "qemu/cutils.h"
--    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+ #endif
-+    pendgroupprio = vec->prio;
-+    if (pendgroupprio > 0) {
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+        pendgroupprio &= nvic_gprio_mask(s);
+index XXXXXXX..XXXXXXX 100644
-+    }
+--- a/target/arm/cpu.c
-     assert(pendgroupprio < running);
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@
-     trace_nvic_acknowledge_irq(pending, vec->prio);
+ #if !defined(CONFIG_USER_ONLY)
  #include "hw/loader.h"
  #endif
 -#include "hw/arm/arm.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/hw_accel.h"
  #include "kvm_arm.h"
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #if !defined(CONFIG_USER_ONLY)
  #include "hw/loader.h"
  #endif
 -#include "hw/arm/arm.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "trace.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  #include "hw/pci/pci.h"
  #include "exec/memattrs.h"
  #include "exec/address-spaces.h"
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  #include "qemu/log.h"
  static inline void set_feature(uint64_t *features, int feature)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  static bool have_guest_debug;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/18] hw/arm/virt: Set INTx/gsi mapping
+[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+The header file hw/arm/arm.h now includes only declarations
 relating to hw/arm/boot.c functionality. Rename it accordingly,
 and adjust its header comment.
-Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
+The bulk of this commit was created via
-needed for INTx/gsi routing.
+ perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+In a few cases we can just delete the #include:
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+include/hw/arm/bcm2836.h did not require it.
-Reviewed-by: Andrew Jones <drjones@redhat.com>
 Tested-by: Feng Kan <fkan@apm.com>
 Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 1 +
+ include/hw/arm/allwinner-a10.h   | 2 +-
-file changed, 1 insertion(+)
+ include/hw/arm/aspeed_soc.h      | 1 -
  include/hw/arm/bcm2836.h         | 1 -
  include/hw/arm/{arm.h => boot.h} | 8 ++++----
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/allwinner-a10.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "qemu/error-report.h"
+ #include "hw/char/serial.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
+ #include "hw/net/allwinner_emac.h"
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ASPEED_SOC_H
+ #define ASPEED_SOC_H
+-#include "hw/arm/arm.h"
+ #include "hw/intc/aspeed_vic.h"
+ #include "hw/misc/aspeed_scu.h"
+ #include "hw/misc/aspeed_sdmc.h"
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/bcm2836.h
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BCM2836_H
+ #define BCM2836_H
+-#include "hw/arm/arm.h"
+ #include "hw/arm/bcm2835_peripherals.h"
+ #include "hw/intc/bcm2836_control.h"
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
+similarity index 98%
+rename from include/hw/arm/arm.h
+rename to include/hw/arm/boot.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/arm.h
++++ b/include/hw/arm/boot.h
+@@ -XXX,XX +XXX,XX @@
+ /*
+- * Misc ARM declarations
++ * ARM kernel loader.
+  *
+  * Copyright (c) 2006 CodeSourcery.
+  * Written by Paul Brook
+@@ -XXX,XX +XXX,XX @@
+  *
+  */
+-#ifndef HW_ARM_H
+-#define HW_ARM_H
++#ifndef HW_ARM_BOOT_H
++#define HW_ARM_BOOT_H
+ #include "exec/memory.h"
+ #include "target/arm/cpu-qom.h"
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+                                             const struct arm_boot_info *info,
+                                             hwaddr mvbar_addr);
+-#endif /* HW_ARM_H */
++#endif /* HW_ARM_BOOT_H */
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx25.h
++++ b/include/hw/arm/fsl-imx25.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX25_H
+ #define FSL_IMX25_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx25_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx31.h
++++ b/include/hw/arm/fsl-imx31.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX31_H
+ #define FSL_IMX31_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx31_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6_H
+ #define FSL_IMX6_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a9mpcore.h"
+ #include "hw/misc/imx6_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6ul.h
++++ b/include/hw/arm/fsl-imx6ul.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6UL_H
+ #define FSL_IMX6UL_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/misc/imx6ul_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX7_H
+ #define FSL_IMX7_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/intc/imx_gpcv2.h"
+ #include "hw/misc/imx7_ccm.h"
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "qemu/notify.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/kvm.h"
+ #include "hw/intc/arm_gicv3_common.h"
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #define XLNX_VERSAL_H
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/xlnx-zynqmp.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef XLNX_ZYNQMP_H
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gic.h"
+ #include "hw/net/cadence_gem.h"
+ #include "hw/char/cadence_uart.h"
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/registerfields.h"
+ #include "hw/arm/armsse.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ /* Format of the System Information block SYS_CONFIG register */
+ typedef enum SysConfigFormat {
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "elf.h"
+ #include "sysemu/qtest.h"
+diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed.c
++++ b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "exec/address-spaces.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/aspeed.h"
+ #include "hw/arm/aspeed_soc.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include <libfdt.h>
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/linux-boot-if.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/collie.c b/hw/arm/collie.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/collie.c
++++ b/hw/arm/collie.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "strongarm.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "exec/address-spaces.h"
+ #include "cpu.h"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/sd/sdhci.h"
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4_boards.c
++++ b/hw/arm/exynos4_boards.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+ #include "net/net.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/net/lan9118.h"
+diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/highbank.c
++++ b/hw/arm/highbank.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "net/net.h"
+ #include "sysemu/kvm.h"
+diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/integratorcp.c
++++ b/hw/arm/integratorcp.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/misc/arm_integrator_debug.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mainstone.c
++++ b/hw/arm/mainstone.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "hw/net/smc91c111.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/microbit.c
++++ b/hw/arm/microbit.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-soc.c
++++ b/hw/arm/msf2-soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/units.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
+ #include "exec/address-spaces.h"
+ #include "hw/char/serial.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-som.c
++++ b/hw/arm/msf2-som.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/msf2-soc.h"
+ #include "cpu.h"
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "exec/address-spaces.h"
+ #include "sysemu/sysemu.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armsse.h"
+ #include "hw/boards.h"
+ #include "hw/char/pl011.h"
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musicpal.c
++++ b/hw/arm/musicpal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduino2.c
++++ b/hw/arm/netduino2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "qemu/error-report.h"
+ #include "hw/arm/stm32f205_soc.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ static void netduino2_init(MachineState *machine)
+ {
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "hw/misc/unimp.h"
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/omap.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/irq.h"
+ #include "ui/console.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap1.c
++++ b/hw/arm/omap1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/soc_dma.h"
+diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap2.c
++++ b/hw/arm/omap2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/qtest.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "qemu/timer.h"
+diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap_sx1.c
++++ b/hw/arm/omap_sx1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/qtest.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/input/tsc2xxx.h"
+ #include "hw/loader.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/raspi.c
++++ b/hw/arm/raspi.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+ #include "hw/loader.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
+diff --git a/hw/arm/realview.c b/hw/arm/realview.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/realview.c
++++ b/hw/arm/realview.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/net/smc91c111.h"
+diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/spitz.c
++++ b/hw/arm/spitz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/pcmcia.h"
+ #include "hw/i2c/i2c.h"
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+ #include "hw/ssi/ssi.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "qemu/timer.h"
+ #include "hw/i2c/i2c.h"
+ #include "net/net.h"
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/stm32f205_soc.h"
+diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/strongarm.c
++++ b/hw/arm/strongarm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "strongarm.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "chardev/char-fe.h"
+ #include "chardev/char-serial.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/tosa.c
++++ b/hw/arm/tosa.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/sharpsl.h"
+ #include "hw/pcmcia.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/versatilepb.c
++++ b/hw/arm/versatilepb.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/vexpress.c
++++ b/hw/arm/vexpress.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/option.h"
-     for (i = 0; i < GPEX_NUM_IRQS; i++) {
+ #include "qapi/error.h"
-         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+ #include "hw/sysbus.h"
-+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
+-#include "hw/arm/arm.h"
-     }
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
-     pci = PCI_HOST_BRIDGE(dev);
+ #include "hw/arm/virt.h"
  #include "hw/block/flash.h"
 diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xilinx_zynq.c
 +++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/i2c/i2c.h"
  #include "hw/ssi/ssi.h"
  #include "hw/boards.h"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated
+[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-From: Alistair Francis <alistair.francis@xilinx.com>
+In ich_vmcr_write() we enforce "writes of BPR fields to less than
 their minimum sets them to the minimum" by doing a "read vbpr and
 write it back" operation.  A typo here meant that we weren't handling
 writes to these fields correctly, because we were reading from VBPR0
 but writing to VBPR1.
-The EP108 is the same as the ZCU102, mark it as deprecated as we don't
-need two machines.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 ---
- hw/arm/xlnx-zcu102.c | 2 +-
+ hw/intc/arm_gicv3_cpuif.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
+     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
-     MachineClass *mc = MACHINE_CLASS(oc);
+      * by reading and writing back the fields.
+      */
--    mc->desc = "Xilinx ZynqMP EP108 board";
+-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
-+    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
++    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
-     mc->init = xlnx_ep108_init;
+     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
+     gicv3_cpuif_virt_update(cs);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
+[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-For M profile we must clear the exclusive monitor on reset, exception
+The ICC_CTLR_EL3 register includes some bits which are aliases
-entry and exception exit.  We weren't doing any of these things; fix
+of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
-this bug.
+to keep those bits in the cs->icc_ctlr_el1[] struct fields.
 Unfortunately a missing '~' in the code to update the bits
 in those fields meant that writing to ICC_CTLR_EL3 would corrupt
 the ICC_CLTR_EL1 register values.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
 Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 10 ++++++++++
+ hw/intc/arm_gicv3_cpuif.c | 4 ++--
- target/arm/cpu.c       |  6 ++++++
+file changed, 2 insertions(+), 2 deletions(-)
  target/arm/helper.c    |  2 ++
  target/arm/op_helper.c |  2 +-
 files changed, 19 insertions(+), 1 deletion(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/target/arm/internals.h
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
- #endif
+     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
- /**
+     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-+ * arm_clear_exclusive: clear the exclusive monitor
+-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+ * @env: CPU env
++    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
-+ */
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
 +static inline void arm_clear_exclusive(CPUARMState *env)
 +{
 +    env->exclusive_addr = -1;
 +}
 +
 +/**
   * ARMMMUFaultInfo: Information describing an ARM MMU Fault
   * @s2addr: Address that caused a fault at stage 2
   * @stage2: True if we faulted at stage 2
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
          env->regs[15] = 0xFFFF0000;
      }
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+    /* M profile requires that reset clears the exclusive monitor;
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
 +     * A profile does not, but clearing it makes more sense than having it
 +     * set with an exclusive access on address zero.
 +     */
 +    arm_clear_exclusive(env);
 +
      env->vfp.xregs[ARM_VFP_FPEXC] = 0;
  #endif
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      armv7m_nvic_acknowledge_irq(env->nvic);
      switch_v7m_sp(env, 0);
 +    arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
      env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      }
-     /* Otherwise, we have a successful exception exit. */
+-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-+    arm_clear_exclusive(env);
++    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
- }
+         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
+     }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
      aarch64_save_sp(env, cur_el);
 -    env->exclusive_addr = -1;
 +    arm_clear_exclusive(env);
      /* We must squash the PSTATE.SS bit to zero unless both of the
       * following hold:
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/18] target/arm: Get PRECISERR and IBUSERR the right way round
+Deleted patch
-For a bus fault, the M profile BFSR bit PRECISERR means a bus
-fault on a data access, and IBUSERR means a bus fault on an
-instruction access. We had these the wrong way around; fix this.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         case 0x8: /* External Abort */
-             switch (cs->exception_index) {
-             case EXCP_PREFETCH_ABORT:
--                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
--                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
-+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
-                 break;
-             case EXCP_DATA_ABORT:
-                 env->v7m.cfsr[M_REG_NS] |=
--                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-                 env->v7m.bfar = env->exception.vaddress;
-                 qemu_log_mask(CPU_LOG_INT,
--                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
-+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
-                               env->v7m.bfar);
-                 break;
-             }
---
-.7.4

-[Qemu-devel] [PULL 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
+Deleted patch
-In do_v7m_exception_exit(), there's no need to force the high 4
-bits of 'type' to 1 when calling v7m_exception_taken(), because
-we know that they're always 1 or we could not have got to this
-"handle return to magic exception return address" code. Remove
-the unnecessary ORs.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          */
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
--        v7m_exception_taken(cpu, type | 0xf0000000);
-+        v7m_exception_taken(cpu, type);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                       "stackframe: failed exception return integrity check\n");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         v7m_push_stack(cpu);
--        v7m_exception_taken(cpu, type | 0xf0000000);
-+        v7m_exception_taken(cpu, type);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
-                       "failed exception return integrity check\n");
-         return;
---
-.7.4

-[Qemu-devel] [PULL 06/18] target/arm: Add and use defines for EXCRET constants
+Deleted patch
-The exception-return magic values get some new bits in v8M, which
-makes some bit definitions for them worthwhile.
-We don't use the bit definitions for the switch on the low bits
-which checks the return type for v7M, because this is defined
-in the v7M ARM ARM as a set of valid values rather than via
-per-bit checks.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
----
- target/arm/internals.h | 10 ++++++++++
- target/arm/helper.c    | 14 +++++++++-----
-files changed, 19 insertions(+), 5 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
- FIELD(V7M_CONTROL, SPSEL, 1, 1)
- FIELD(V7M_CONTROL, FPCA, 2, 1)
-+/* Bit definitions for v7M exception return payload */
-+FIELD(V7M_EXCRET, ES, 0, 1)
-+FIELD(V7M_EXCRET, RES0, 1, 1)
-+FIELD(V7M_EXCRET, SPSEL, 2, 1)
-+FIELD(V7M_EXCRET, MODE, 3, 1)
-+FIELD(V7M_EXCRET, FTYPE, 4, 1)
-+FIELD(V7M_EXCRET, DCRS, 5, 1)
-+FIELD(V7M_EXCRET, S, 6, 1)
-+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
-+
- /*
-  * For AArch64, map a given EL to an index in the banked_spsr array.
-  * Note that this mapping and the AArch32 mapping defined in bank_number()
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                   " previous exception %d\n",
-                   type, env->v7m.exception);
--    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
-+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
-     }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
-          */
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
--            int es = type & 1;
-+            int es = type & R_V7M_EXCRET_ES_MASK;
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
-                 env->v7m.faultmask[es] = 0;
-             }
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         return; /* Never happens.  Keep compiler happy.  */
-     }
--    lr = 0xfffffff1;
-+    lr = R_V7M_EXCRET_RES1_MASK |
-+        R_V7M_EXCRET_S_MASK |
-+        R_V7M_EXCRET_DCRS_MASK |
-+        R_V7M_EXCRET_FTYPE_MASK |
-+        R_V7M_EXCRET_ES_MASK;
-     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
--        lr |= 4;
-+        lr |= R_V7M_EXCRET_SPSEL_MASK;
-     }
-     if (!arm_v7m_is_handler_mode(env)) {
--        lr |= 8;
-+        lr |= R_V7M_EXCRET_MODE_MASK;
-     }
-     v7m_push_stack(cpu);
---
-.7.4

-[Qemu-devel] [PULL 17/18] hw/pci-host/gpex: Implement PCI INTx routing
+[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Now we are able to retrieve the gsi from the INTx pin, let's
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-enable intx_to_irq routing. From that point on, irqfd becomes
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-usable along with INTx when assigning a PCIe device.
+Message-id: 20190520214342.13709-2-philmd@redhat.com
 Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
 Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Tested-by: Feng Kan <fkan@apm.com>
 Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/pci-host/gpex.c | 12 ++++++++++++
+ hw/arm/exynos4_boards.c | 24 ------------------------
-file changed, 12 insertions(+)
+file changed, 24 deletions(-)
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/pci-host/gpex.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+@@ -XXX,XX +XXX,XX @@
-     return 0;
+ #include "hw/net/lan9118.h"
- }
+ #include "hw/boards.h"
-+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+-#undef DEBUG
-+{
+-
-+    PCIINTxRoute route;
+-//#define DEBUG
-+    GPEXHost *s = opaque;
+-
-+
+-#ifdef DEBUG
-+    route.mode = PCI_INTX_ENABLED;
+-    #undef PRINT_DEBUG
-+    route.irq = s->irq_num[pin];
+-    #define  PRINT_DEBUG(fmt, args...) \
-+
+-        do { \
-+    return route;
+-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-+}
+-        } while (0)
-+
+-#else
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
- {
+-#endif
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+-
-@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
+ #define SMDK_LAN9118_BASE_ADDR      0x05000000
-                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
+ typedef enum Exynos4BoardType {
-     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
-+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
+     exynos4_board_binfo.gic_cpu_if_addr =
-     qdev_init_nofail(DEVICE(&s->gpex_root));
+             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
- }
 -    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
 -            " kernel_filename: %s\n"
 -            " kernel_cmdline: %s\n"
 -            " initrd_filename: %s\n",
 -            exynos4_board_ram_size[board_type] / 1048576,
 -            exynos4_board_ram_size[board_type],
 -            machine->kernel_filename,
 -            machine->kernel_cmdline,
 -            machine->initrd_filename);
 -
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/18] xlnx-ep108: Rename to ZCU102
+[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The EP108 is a early access development board. Now that silicon is in
+It eases code review, unit is explicit.
 production people have access to the ZCU102. Let's rename the internal
 QEMU files and variables to use the ZCU102.
-There is no functional change here as the EP108 is still a valid board
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-option.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                   |  2 +-
+ hw/arm/exynos4_boards.c | 5 +++--
- hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
+file changed, 3 insertions(+), 2 deletions(-)
 files changed, 16 insertions(+), 16 deletions(-)
  rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/Makefile.objs
++++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
  obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 -obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
 +obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
 similarity index 85%
 rename from hw/arm/xlnx-ep108.c
 rename to hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-ep108.c
 +++ b/hw/arm/xlnx-zcu102.c
 @@ -XXX,XX +XXX,XX @@
- /*
+  */
-- * Xilinx ZynqMP EP108 board
-+ * Xilinx ZynqMP ZCU102 board
+ #include "qemu/osdep.h"
-  *
++#include "qemu/units.h"
-  * Copyright (C) 2015 Xilinx Inc
+ #include "qapi/error.h"
-  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
+ #include "qemu/error-report.h"
-@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
- #include "exec/address-spaces.h"
+@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
- #include "qemu/log.h"
+ };
--typedef struct XlnxEP108 {
+ static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-+typedef struct XlnxZCU102 {
+-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-     XlnxZynqMPState soc;
+-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-     MemoryRegion ddr_ram;
++    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
--} XlnxEP108;
++    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
-+} XlnxZCU102;
+ };
--static struct arm_boot_info xlnx_ep108_binfo;
+ static struct arm_boot_info exynos4_board_binfo = {
 +static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_ep108_init(MachineState *machine)
 +static void xlnx_zcu102_init(MachineState *machine)
  {
 -    XlnxEP108 *s = g_new0(XlnxEP108, 1);
 +    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
      int i;
      uint64_t ram_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
      }
      if (ram_size < 0x08000000) {
 -        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
 +        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                   ram_size);
      }
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
      /* TODO create and connect IDE devices for ide_drive_get() */
 -    xlnx_ep108_binfo.ram_size = ram_size;
 -    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
 -    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
 -    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
 -    xlnx_ep108_binfo.loader_start = 0;
 -    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
 +    xlnx_zcu102_binfo.ram_size = ram_size;
 +    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
 +    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
 +    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
 +    xlnx_zcu102_binfo.loader_start = 0;
 +    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
  }
  static void xlnx_ep108_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP EP108 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
  static void xlnx_zcu102_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP ZCU102 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 09/18] xlnx-zcu102: Manually create the machines
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-In preperation for future work let's manually create the Xilnx machines.
-This will allow us to set properties for the machines in the future.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
-file changed, 67 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/log.h"
- typedef struct XlnxZCU102 {
-+    MachineState parent_obj;
-+
-     XlnxZynqMPState soc;
-     MemoryRegion ddr_ram;
- } XlnxZCU102;
-+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-+#define ZCU102_MACHINE(obj) \
-+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
-+
-+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
-+#define EP108_MACHINE(obj) \
-+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
-+
- static struct arm_boot_info xlnx_zcu102_binfo;
--static void xlnx_zcu102_init(MachineState *machine)
-+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
- {
--    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
-     int i;
-     uint64_t ram_size = machine->ram_size;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
-     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
- }
--static void xlnx_ep108_machine_init(MachineClass *mc)
-+static void xlnx_ep108_init(MachineState *machine)
-+{
-+    XlnxZCU102 *s = EP108_MACHINE(machine);
-+
-+    xlnx_zynqmp_init(s, machine);
-+}
-+
-+static void xlnx_ep108_machine_instance_init(Object *obj)
- {
-+}
-+
-+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Xilinx ZynqMP EP108 board";
--    mc->init = xlnx_zcu102_init;
-+    mc->init = xlnx_ep108_init;
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
-     mc->ignore_memory_transaction_failures = true;
- }
--DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
-+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
-+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
-+    .parent     = TYPE_MACHINE,
-+    .class_init = xlnx_ep108_machine_class_init,
-+    .instance_init = xlnx_ep108_machine_instance_init,
-+    .instance_size = sizeof(XlnxZCU102),
-+};
--static void xlnx_zcu102_machine_init(MachineClass *mc)
-+static void xlnx_ep108_machine_init_register_types(void)
- {
-+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
-+}
-+
-+static void xlnx_zcu102_init(MachineState *machine)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
-+
-+    xlnx_zynqmp_init(s, machine);
-+}
-+
-+static void xlnx_zcu102_machine_instance_init(Object *obj)
-+{
-+}
-+
-+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-+{
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Xilinx ZynqMP ZCU102 board";
-     mc->init = xlnx_zcu102_init;
-     mc->block_default_type = IF_IDE;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
-     mc->ignore_memory_transaction_failures = true;
- }
--DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
-+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
-+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
-+    .parent     = TYPE_MACHINE,
-+    .class_init = xlnx_zcu102_machine_class_init,
-+    .instance_init = xlnx_zcu102_machine_instance_init,
-+    .instance_size = sizeof(XlnxZCU102),
-+};
-+
-+static void xlnx_zcu102_machine_init_register_types(void)
-+{
-+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
-+}
-+
-+type_init(xlnx_zcu102_machine_init_register_types)
-+type_init(xlnx_ep108_machine_init_register_types)
---
-.7.4

-[Qemu-devel] [PULL 10/18] xlnx-zcu102: Add a machine level secure property
+Deleted patch
-From: Alistair Francis <alistair.francis@xilinx.com>
-Add a machine level secure property. This defaults to false and can be
-set to true using this machine command line argument:
-    -machine xlnx-zcu102,secure=on
-This follows what the ARM virt machine does.
-This property only applies to the ZCU102 machine. The EP108 machine does
-not have this property.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
-file changed, 32 insertions(+)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
-+++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
-     XlnxZynqMPState soc;
-     MemoryRegion ddr_ram;
-+
-+    bool secure;
- } XlnxZCU102;
- #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
- static struct arm_boot_info xlnx_zcu102_binfo;
-+static bool zcu102_get_secure(Object *obj, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    return s->secure;
-+}
-+
-+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
-+{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    s->secure = value;
-+}
-+
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
- {
-     int i;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
-     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
-                          "ddr-ram", &error_abort);
-+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
-+                             &error_fatal);
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
- static void xlnx_ep108_machine_instance_init(Object *obj)
- {
-+    XlnxZCU102 *s = EP108_MACHINE(obj);
-+
-+    /* EP108, we don't support setting secure */
-+    s->secure = false;
- }
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
- static void xlnx_zcu102_machine_instance_init(Object *obj)
- {
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
-+
-+    /* Default to secure mode being disabled */
-+    s->secure = false;
-+    object_property_add_bool(obj, "secure", zcu102_get_secure,
-+                             zcu102_set_secure, NULL);
-+    object_property_set_description(obj, "secure",
-+                                    "Set on/off to enable/disable the ARM "
-+                                    "Security Extensions (TrustZone)",
-+                                    NULL);
- }
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
---
-.7.4

-[Qemu-devel] [PULL 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping
+[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Guenter Roeck <linux@roeck-us.net>
-To implement INTx to gsi routing we need to pass the gpex host
+QEMU already supports pl330. Instantiate it for Exynos4210.
 bridge the gsi associated to each INTx index. Let's introduce
 irq_num array and gpex_set_irq_num setter function.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+/ {
-Tested-by: Feng Kan <fkan@apm.com>
+    soc: soc {
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+        amba {
-Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
+            pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/pci-host/gpex.h |  3 +++
+ hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
- hw/pci-host/gpex.c         | 10 ++++++++++
+file changed, 26 insertions(+)
 files changed, 13 insertions(+)
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci-host/gpex.h
+--- a/hw/arm/exynos4210.c
-+++ b/include/hw/pci-host/gpex.h
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
+@@ -XXX,XX +XXX,XX @@
-     MemoryRegion io_ioport;
+ /* EHCI */
-     MemoryRegion io_mmio;
+ #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
-     qemu_irq irq[GPEX_NUM_IRQS];
-+    int irq_num[GPEX_NUM_IRQS];
++/* DMA */
- } GPEXHost;
++#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
++#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
++#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
 +
- #endif /* HW_GPEX_H */
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+x09, 0x00, 0x00, 0x00 };
-index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-+++ b/hw/pci-host/gpex.c
+     return (0x9 << ARM_AFF1_SHIFT) | cpu;
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
      qemu_set_irq(s->irq[irq_num], level);
  }
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
++static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
 +{
-+    if (index >= GPEX_NUM_IRQS) {
++    SysBusDevice *busdev;
-+        return -EINVAL;
++    DeviceState *dev;
 +    }
 +
-+    s->irq_num[index] = gsi;
++    dev = qdev_create(NULL, "pl330");
-+    return 0;
++    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
 +    qdev_init_nofail(dev);
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, base);
 +    sysbus_connect_irq(busdev, 0, irq);
 +}
 +
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
  {
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
      sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
              s->irq_table[exynos4210_get_irq(28, 3)]);
 +    /*** DMA controllers ***/
 +    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 +
      return s;
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/18] xlnx-zcu102: Add a machine level virtualization property
+[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Add a machine level virtualization property. This defaults to false and can be
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-set to true using this machine command line argument:
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-    -machine xlnx-zcu102,virtualization=on
+Message-id: 20190520214342.13709-5-philmd@redhat.com
 This follows what the ARM virt machine does.
 This property only applies to the ZCU102 machine. The EP108 machine does
 not have this property.
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-zynqmp.h |  2 ++
+ include/hw/arm/exynos4210.h |  9 +++++++--
- hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
+ hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
- hw/arm/xlnx-zynqmp.c         |  3 ++-
+ hw/arm/exynos4_boards.c     |  9 ++++++---
-files changed, 33 insertions(+), 2 deletions(-)
+files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
+--- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
+ } Exynos4210Irq;
-     /* Has the ARM Security extensions?  */
-     bool secure;
+ typedef struct Exynos4210State {
-+    /* Has the ARM Virtualization extensions?  */
++    /*< private >*/
-+    bool virt;
++    SysBusDevice parent_obj;
-     /* Has the RPU subsystem?  */
++    /*< public >*/
-     bool has_rpu;
+     ARMCPU *cpu[EXYNOS4210_NCPUS];
- }  XlnxZynqMPState;
+     Exynos4210Irq irqs;
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/arm/exynos4210.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
-     MemoryRegion ddr_ram;
+     sysbus_connect_irq(busdev, 0, irq);
      bool secure;
 +    bool virt;
  } XlnxZCU102;
  #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
      s->secure = value;
  }
-+static bool zcu102_get_virt(Object *obj, Error **errp)
+-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 +static void exynos4210_realize(DeviceState *socdev, Error **errp)
  {
 -    Exynos4210State *s = g_new0(Exynos4210State, 1);
 +    Exynos4210State *s = EXYNOS4210_SOC(socdev);
 +    MemoryRegion *system_mem = get_system_memory();
      qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    DeviceClass *dc = DEVICE_CLASS(klass);
 +
-+    return s->virt;
++    dc->realize = exynos4210_realize;
 +}
 +
-+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
++static const TypeInfo exynos4210_info = {
 +    .name = TYPE_EXYNOS4210_SOC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    type_register_static(&exynos4210_info);
 +
 +    s->virt = value;
 +}
 +
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
++type_init(exynos4210_register_types)
- {
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-     int i;
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+--- a/hw/arm/exynos4_boards.c
-                          "ddr-ram", &error_abort);
++++ b/hw/arm/exynos4_boards.c
-     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
-                              &error_fatal);
+ } Exynos4BoardType;
-+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
  typedef struct Exynos4BoardState {
 -    Exynos4210State *soc;
 +    Exynos4210State soc;
      MemoryRegion dram0_mem;
      MemoryRegion dram1_mem;
  } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 -    s->soc = exynos4210_init(get_system_memory());
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
 +    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized",
 +                             &error_fatal);
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+     return s;
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
  {
      XlnxZCU102 *s = EP108_MACHINE(obj);
 -    /* EP108, we don't support setting secure */
 +    /* EP108, we don't support setting secure or virt */
      s->secure = false;
 +    s->virt = false;
  }
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+                                                       EXYNOS4_BOARD_SMDKC210);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
-                                     "Set on/off to enable/disable the ARM "
+     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-                                     "Security Extensions (TrustZone)",
+-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
-                                     NULL);
++            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
-+
+     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 +    /* Default to virt (EL2) being disabled */
 +    s->virt = false;
 +    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
 +                             zcu102_set_virt, NULL);
 +    object_property_set_description(obj, "virtualization",
 +                                    "Set on/off to enable/disable emulating a "
 +                                    "guest CPU which implements the ARM "
 +                                    "Virtualization Extensions",
 +                                    NULL);
  }
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                  s->secure, "has_el3", NULL);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
--                                 false, "has_el2", NULL);
-+                                 s->virt, "has_el2", NULL);
-         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
-                                 "reset-cbar", &error_abort);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
- static Property xlnx_zynqmp_props[] = {
-     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
-     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
-+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
-     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
-     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
-                      MemoryRegion *),
 --
-.7.4
+.20.1

ARM queue: nothing particularly exciting, but 18 patches
is enough to send out.

thanks
-- PMM

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

----------------------------------------------------------------
Alistair Francis (5):
      xlnx-ep108: Rename to ZCU102
      xlnx-zcu102: Manually create the machines
      xlnx-zcu102: Add a machine level secure property
      xlnx-zcu102: Add a machine level virtualization property
      xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):
      AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):
      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
      target/arm: Get PRECISERR and IBUSERR the right way round
      nvic: Don't apply group priority mask to negative priorities
      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
      target/arm: Add and use defines for EXCRET constants
      target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
      mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):
      hw/pci-host/gpex: Set INTx index/gsi mapping
      hw/arm/virt: Set INTx/gsi mapping
      hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):
      target/arm: Avoid an extra temporary for store_exclusive

Use a symbolic constant M_REG_NUM_BANKS for the array size for
registers which are banked by M profile security state, rather
than hardcoding lots of 2s.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
  * accessed via env->registerfield[env->v7m.secure] (whether the security
  * extension is implemented or not).
  */
-#define M_REG_NS 0
-#define M_REG_S 1
+enum {
+    M_REG_NS = 0,
+    M_REG_S = 1,
+    M_REG_NUM_BANKS = 2,
+};
 
 /* ARM-specific interrupt pending bits.  */
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t other_sp;
         uint32_t other_ss_msp;
         uint32_t other_ss_psp;
-        uint32_t vecbase[2];
-        uint32_t basepri[2];
-        uint32_t control[2];
-        uint32_t ccr[2]; /* Configuration and Control */
-        uint32_t cfsr[2]; /* Configurable Fault Status */
+        uint32_t vecbase[M_REG_NUM_BANKS];
+        uint32_t basepri[M_REG_NUM_BANKS];
+        uint32_t control[M_REG_NUM_BANKS];
+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
-        uint32_t mmfar[2]; /* MemManage Fault Address */
+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
-        unsigned mpu_ctrl[2]; /* MPU_CTRL */
+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
-        uint32_t primask[2];
-        uint32_t faultmask[2];
+        uint32_t primask[M_REG_NUM_BANKS];
+        uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
-        uint32_t rnr[2];
+        uint32_t rnr[M_REG_NUM_BANKS];
     } pmsav7;
 
     /* PMSAv8 MPU */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          *  pmsav7.rnr (region number register)
          *  pmsav7_dregion (number of configured regions)
          */
-        uint32_t *rbar[2];
-        uint32_t *rlar[2];
-        uint32_t mair0[2];
-        uint32_t mair1[2];
+        uint32_t *rbar[M_REG_NUM_BANKS];
+        uint32_t *rlar[M_REG_NUM_BANKS];
+        uint32_t mair0[M_REG_NUM_BANKS];
+        uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
     void *nvic;
-- 
2.7.4

For M profile we must clear the exclusive monitor on reset, exception
entry and exception exit.  We weren't doing any of these things; fix
this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/cpu.c       |  6 ++++++
 target/arm/helper.c    |  2 ++
 target/arm/op_helper.c |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
 #endif
 
 /**
+ * arm_clear_exclusive: clear the exclusive monitor
+ * @env: CPU env
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+ */
+static inline void arm_clear_exclusive(CPUARMState *env)
+{
+    env->exclusive_addr = -1;
+}
+
+/**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->regs[15] = 0xFFFF0000;
     }
 
+    /* M profile requires that reset clears the exclusive monitor;
+     * A profile does not, but clearing it makes more sense than having it
+     * set with an exclusive access on address zero.
+     */
+    arm_clear_exclusive(env);
+
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 
     armv7m_nvic_acknowledge_irq(env->nvic);
     switch_v7m_sp(env, 0);
+    arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     }
 
     /* Otherwise, we have a successful exception exit. */
+    arm_clear_exclusive(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
 
     aarch64_save_sp(env, cur_el);
 
-    env->exclusive_addr = -1;
+    arm_clear_exclusive(env);
 
     /* We must squash the PSTATE.SS bit to zero unless both of the
      * following hold:
-- 
2.7.4

For a bus fault, the M profile BFSR bit PRECISERR means a bus
fault on a data access, and IBUSERR means a bus fault on an
instruction access. We had these the wrong way around; fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
-                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
-                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
                 break;
             case EXCP_DATA_ABORT:
                 env->v7m.cfsr[M_REG_NS] |=
-                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
                 env->v7m.bfar = env->exception.vaddress;
                 qemu_log_mask(CPU_LOG_INT,
-                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
                               env->v7m.bfar);
                 break;
             }
-- 
2.7.4

In several places we were unconditionally applying the
nvic_gprio_mask() to a priority value. This is incorrect
if the priority is one of the fixed negative priority
values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be
considered as the same priority and so NMI wouldn't
correctly preempt HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
         }
     }
 
+    if (active_prio > 0) {
+        active_prio &= nvic_gprio_mask(s);
+    }
+
     s->vectpending = pend_irq;
-    s->exception_prio = active_prio & nvic_gprio_mask(s);
+    s->exception_prio = active_prio;
 
     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
 }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     assert(vec->enabled);
     assert(vec->pending);
 
-    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    pendgroupprio = vec->prio;
+    if (pendgroupprio > 0) {
+        pendgroupprio &= nvic_gprio_mask(s);
+    }
     assert(pendgroupprio < running);
 
     trace_nvic_acknowledge_irq(pending, vec->prio);
-- 
2.7.4

In do_v7m_exception_exit(), there's no need to force the high 4
bits of 'type' to 1 when calling v7m_exception_taken(), because
we know that they're always 1 or we could not have got to this
"handle return to magic exception return address" code. Remove
the unnecessary ORs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

The exception-return magic values get some new bits in v8M, which
makes some bit definitions for them worthwhile.

We don't use the bit definitions for the switch on the low bits
which checks the return type for v7M, because this is defined
in the v7M ARM ARM as a set of valid values rather than via
per-bit checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 14 +++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
 
+/* Bit definitions for v7M exception return payload */
+FIELD(V7M_EXCRET, ES, 0, 1)
+FIELD(V7M_EXCRET, RES0, 1, 1)
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+FIELD(V7M_EXCRET, MODE, 3, 1)
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+FIELD(V7M_EXCRET, DCRS, 5, 1)
+FIELD(V7M_EXCRET, S, 6, 1)
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                   " previous exception %d\n",
                   type, env->v7m.exception);
 
-    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
     }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & 1;
+            int es = type & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = 0xfffffff1;
+    lr = R_V7M_EXCRET_RES1_MASK |
+        R_V7M_EXCRET_S_MASK |
+        R_V7M_EXCRET_DCRS_MASK |
+        R_V7M_EXCRET_FTYPE_MASK |
+        R_V7M_EXCRET_ES_MASK;
     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= 4;
+        lr |= R_V7M_EXCRET_SPSEL_MASK;
     }
     if (!arm_v7m_is_handler_mode(env)) {
-        lr |= 8;
+        lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-- 
2.7.4

In the v7M and v8M ARM ARM, the magic exception return values are
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
constants to define bits within them. Rename the 'type' variable
which holds the exception return value in do_v7m_exception_exit()
to excret, making it clearer that it does hold an EXC_RETURN value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t type;
+    uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
     bool return_to_sp_process = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * the target value up between env->regs[15] and env->thumb in
      * gen_bx(). Reconstitute it.
      */
-    type = env->regs[15];
+    excret = env->regs[15];
     if (env->thumb) {
-        type |= 1;
+        excret |= 1;
     }
 
     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
                   " previous exception %d\n",
-                  type, env->v7m.exception);
+                  excret, env->v7m.exception);
 
-    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
+                      excret);
     }
 
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & R_V7M_EXCRET_ES_MASK;
+            int es = excret & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
-    switch (type & 0xf) {
+    switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
         break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-     * exception return type specified then this is a UsageFault.
+     * exception return excret specified then this is a UsageFault.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
         /* Take an INVPC UsageFault by pushing the stack again. */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is a early access development board. Now that silicon is in
production people have access to the ZCU102. Let's rename the internal
QEMU files and variables to use the ZCU102.

There is no functional change here as the EP108 is still a valid board
option.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                   |  2 +-
 hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
similarity index 85%
rename from hw/arm/xlnx-ep108.c
rename to hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-ep108.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 /*
- * Xilinx ZynqMP EP108 board
+ * Xilinx ZynqMP ZCU102 board
  *
  * Copyright (C) 2015 Xilinx Inc
  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 
-typedef struct XlnxEP108 {
+typedef struct XlnxZCU102 {
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
-} XlnxEP108;
+} XlnxZCU102;
 
-static struct arm_boot_info xlnx_ep108_binfo;
+static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_ep108_init(MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
-    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
     }
 
     if (ram_size < 0x08000000) {
-        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                  ram_size);
     }
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
     /* TODO create and connect IDE devices for ide_drive_get() */
 
-    xlnx_ep108_binfo.ram_size = ram_size;
-    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
-    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
-    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
-    xlnx_ep108_binfo.loader_start = 0;
-    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
+    xlnx_zcu102_binfo.ram_size = ram_size;
+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+    xlnx_zcu102_binfo.loader_start = 0;
+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
 static void xlnx_ep108_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 static void xlnx_zcu102_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP ZCU102 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

In preperation for future work let's manually create the Xilnx machines.
This will allow us to set properties for the machines in the future.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 typedef struct XlnxZCU102 {
+    MachineState parent_obj;
+
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
 } XlnxZCU102;
 
+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+#define ZCU102_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+
+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+#define EP108_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+
 static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_zcu102_init(MachineState *machine)
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
-    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_machine_init(MachineClass *mc)
+static void xlnx_ep108_init(MachineState *machine)
+{
+    XlnxZCU102 *s = EP108_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+}
+
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_zcu102_init;
+    mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_ep108_machine_class_init,
+    .instance_init = xlnx_ep108_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
 
-static void xlnx_zcu102_machine_init(MachineClass *mc)
+static void xlnx_ep108_machine_init_register_types(void)
 {
+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+}
+
+static void xlnx_zcu102_init(MachineState *machine)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_zcu102_machine_instance_init(Object *obj)
+{
+}
+
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP ZCU102 board";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_zcu102_machine_class_init,
+    .instance_init = xlnx_zcu102_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
+
+static void xlnx_zcu102_machine_init_register_types(void)
+{
+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
+}
+
+type_init(xlnx_zcu102_machine_init_register_types)
+type_init(xlnx_ep108_machine_init_register_types)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level secure property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,secure=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
+
+    bool secure;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
 static struct arm_boot_info xlnx_zcu102_binfo;
 
+static bool zcu102_get_secure(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->secure;
+}
+
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->secure = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 
     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
                          "ddr-ram", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
 static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = EP108_MACHINE(obj);
+
+    /* EP108, we don't support setting secure */
+    s->secure = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
 
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    /* Default to secure mode being disabled */
+    s->secure = false;
+    object_property_add_bool(obj, "secure", zcu102_get_secure,
+                             zcu102_set_secure, NULL);
+    object_property_set_description(obj, "secure",
+                                    "Set on/off to enable/disable the ARM "
+                                    "Security Extensions (TrustZone)",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level virtualization property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,virtualization=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
 hw/arm/xlnx-zynqmp.c         |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
 
     /* Has the ARM Security extensions?  */
     bool secure;
+    /* Has the ARM Virtualization extensions?  */
+    bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
 }  XlnxZynqMPState;
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
     MemoryRegion ddr_ram;
 
     bool secure;
+    bool virt;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
     s->secure = value;
 }
 
+static bool zcu102_get_virt(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->virt;
+}
+
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->virt = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
                          "ddr-ram", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
                              &error_fatal);
+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = EP108_MACHINE(obj);
 
-    /* EP108, we don't support setting secure */
+    /* EP108, we don't support setting secure or virt */
     s->secure = false;
+    s->virt = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                     "Set on/off to enable/disable the ARM "
                                     "Security Extensions (TrustZone)",
                                     NULL);
+
+    /* Default to virt (EL2) being disabled */
+    s->virt = false;
+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+                             zcu102_set_virt, NULL);
+    object_property_set_description(obj, "virtualization",
+                                    "Set on/off to enable/disable emulating a "
+                                    "guest CPU which implements the ARM "
+                                    "Virtualization Extensions",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                  s->secure, "has_el3", NULL);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                 false, "has_el2", NULL);
+                                 s->virt, "has_el2", NULL);
         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-- 
2.7.4

From: Jaroslaw Pelczar <j.pelczar@samsung.com>

Previously when single stepping through ERET instruction via GDB
would result in debugger entering the "next" PC after ERET instruction.
When debugging in kernel mode, this will also cause unintended behavior,
because debugger will try to access memory from EL0 point of view.

Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         default:
             gen_a64_set_pc_im(dc->pc);
             /* fall through */
+        case DISAS_EXIT:
         case DISAS_JUMP:
             if (dc->base.singlestep_enabled) {
                 gen_exception_internal(EXCP_DEBUG);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
 }
 
 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-                                TCGv_i64 inaddr, int size, int is_pair)
+                                TCGv_i64 addr, int size, int is_pair)
 {
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      */
     TCGLabel *fail_label = gen_new_label();
     TCGLabel *done_label = gen_new_label();
-    TCGv_i64 addr = tcg_temp_local_new_i64();
     TCGv_i64 tmp;
 
-    /* Copy input into a local temp so it is not trashed when the
-     * basic block ends at the branch insn.
-     */
-    tcg_gen_mov_i64(addr, inaddr);
     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
             } else {
                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
             }
-            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
+                                       cpu_exclusive_val, tmp,
                                        get_mem_index(s),
                                        MO_64 | MO_ALIGN | s->be_data);
             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
         } else if (s->be_data == MO_LE) {
-            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         } else {
-            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         }
     } else {
-        TCGv_i64 val = cpu_reg(s, rt);
-        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
-                                   get_mem_index(s),
+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+                                   cpu_reg(s, rt), get_mem_index(s),
                                    size | MO_ALIGN | s->be_data);
         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
     }
-
-    tcg_temp_free_i64(addr);
-
     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
     tcg_temp_free_i64(tmp);
     tcg_gen_br(done_label);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/pci-host/gpex.h |  3 +++
 hw/pci-host/gpex.c         | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
     MemoryRegion io_ioport;
     MemoryRegion io_mmio;
     qemu_irq irq[GPEX_NUM_IRQS];
+    int irq_num[GPEX_NUM_IRQS];
 } GPEXHost;
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(s->irq[irq_num], level);
 }
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+    if (index >= GPEX_NUM_IRQS) {
+        return -EINVAL;
+    }
+
+    s->irq_num[index] = gsi;
+    return 0;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
     }
 
     pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/gpex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
     return 0;
 }
 
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+    PCIINTxRoute route;
+    GPEXHost *s = opaque;
+
+    route.mode = PCI_INTX_ENABLED;
+    route.irq = s->irq_num[pin];
+
+    return route;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
 
     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
     qdev_init_nofail(DEVICE(&s->gpex_root));
 }
 
-- 
2.7.4

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
             cmsdk_apb_uart_create(uartbase[i],
                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, 0),
-                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, i * 2),
+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                   NULL,
                                   uartchr, SYSCLK_FRQ);
         }
-- 
2.7.4

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
             return;
         }
-        /* opc == 1, BXFIL fall through to deposit */
-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
+        /* opc == 1, BFXIL fall through to deposit */
+        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
         pos = 0;
     } else {
         /* Handle the ri > si case with a deposit
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
         len = ri;
     }
 
-    if (opc == 1) { /* BFM, BXFIL */
+    if (opc == 1) { /* BFM, BFXIL */
         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
     } else {
         /* SBFM or UBFM: We start with zero, and we haven't modified
-- 
2.20.1

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1