Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-More arm patches (mostly the SDHCI ones from Philippe)
+Not very much here, but several people have fallen over
 the vector operation segfault bug, so let's get the fix
 into master.
 thanks
 -- PMM
-The following changes since commit f521eeee3bd060b460c99e605472b7e03967db43:
+The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
-  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20180115' into staging (2018-01-15 13:17:47 +0000)
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180116
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
-for you to fetch changes up to 60765b6ceeb4998a0d4220b3a53f1f185061da77:
+for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
-  sdhci: add a 'dma' property to the sysbus devices (2018-01-16 13:28:21 +0000)
+  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * SDHCI: cleanups and minor bug fixes
+ * exynos4210: QOM'ify the Exynos4210 SoC
- * target/arm: minor refactor preparatory to fp16 support
+ * exynos4210: Add DMA support for the Exynos4210
- * omap_ssd, ssi-sd, pl181, milkymist-memcard: reset the SD
+ * arm_gicv3: Fix writes to ICC_CTLR_EL3
-   card on controller reset (fixes migration failures)
+ * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
- * target/arm: Handle page table walk load failures correctly
+ * target/arm: Fix vector operation segfault
- * hw/arm/virt: Add virt-2.12 machine type
+ * target/arm: Minor improvements to BFXIL, EXTR
  * get_phys_addr_pmsav7: Support AP=0b111 for v7M
  * hw/intc/armv7m: Support byte and halfword accesses to CFSR
 ----------------------------------------------------------------
-Andrey Smirnov (1):
+Alistair Francis (1):
-      sdhci: Implement write method of ACMD12ERRSTS register
+      target/arm: Fix vector operation segfault
-Peter Maydell (8):
+Guenter Roeck (1):
-      hw/intc/armv7m: Support byte and halfword accesses to CFSR
+      hw/arm/exynos4210: Add DMA support for the Exynos4210
       get_phys_addr_pmsav7: Support AP=0b111 for v7M
       hw/arm/virt: Add virt-2.12 machine type
       target/arm: Handle page table walk load failures correctly
       hw/sd/pl181: Reset SD card on controller reset
       hw/sd/milkymist-memcard: Reset SD card on controller reset
       hw/sd/ssi-sd: Reset SD card on controller reset
       hw/sd/omap_mmc: Reset SD card on controller reset
-Philippe Mathieu-Daudé (13):
+Peter Maydell (5):
-      sdhci: clean up includes
+      arm: Move system_clock_scale to armv7m_systick.h
-      sdhci: remove dead code
+      arm: Remove unnecessary includes of hw/arm/arm.h
-      sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
+      arm: Rename hw/arm/arm.h to hw/arm/boot.h
-      sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
+      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-      sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
+      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-      sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
-      sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
+Philippe Mathieu-Daudé (3):
-      sdhci: convert the DPRINT() calls into trace events
+      hw/arm/exynos4: Remove unuseful debug code
-      sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
+      hw/arm/exynos4: Use the IEC binary prefix definitions
-      sdhci: rename the SDHC_CAPAB register
+      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
       sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
       sdhci: fix the PCI device, using the PCI address space for DMA
       sdhci: add a 'dma' property to the sysbus devices
 Richard Henderson (2):
-      target/arm: Split out vfp_expand_imm
+      target/arm: Use extract2 for EXTR
-      target/arm: Add fp16 support to vfp_expand_imm
+      target/arm: Simplify BFXIL expansion
- hw/sd/sdhci-internal.h     |   7 +-
+ include/hw/arm/allwinner-a10.h    |  2 +-
- include/hw/sd/sdhci.h      |  19 +++-
+ include/hw/arm/aspeed_soc.h       |  1 -
- target/arm/internals.h     |  10 ++
+ include/hw/arm/bcm2836.h          |  1 -
- hw/arm/virt.c              |  19 +++-
+ include/hw/arm/{arm.h => boot.h}  | 12 +++------
- hw/intc/armv7m_nvic.c      |  38 ++++---
+ include/hw/arm/exynos4210.h       |  9 +++++--
- hw/sd/milkymist-memcard.c  |   4 +
+ include/hw/arm/fsl-imx25.h        |  2 +-
- hw/sd/omap_mmc.c           |  14 ++-
+ include/hw/arm/fsl-imx31.h        |  2 +-
- hw/sd/pl181.c              |   4 +
+ include/hw/arm/fsl-imx6.h         |  2 +-
- hw/sd/sdhci.c              | 266 +++++++++++++++++++++++++++------------------
+ include/hw/arm/fsl-imx6ul.h       |  2 +-
- hw/sd/ssi-sd.c             |  25 ++++-
+ include/hw/arm/fsl-imx7.h         |  2 +-
- target/arm/helper.c        |  53 ++++++++-
+ include/hw/arm/virt.h             |  2 +-
- target/arm/op_helper.c     |   7 +-
+ include/hw/arm/xlnx-versal.h      |  2 +-
- target/arm/translate-a64.c |  49 ++++++---
+ include/hw/arm/xlnx-zynqmp.h      |  2 +-
- hw/sd/trace-events         |  14 +++
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
-files changed, 362 insertions(+), 167 deletions(-)
+ hw/arm/armsse.c                   |  2 +-
  hw/arm/armv7m.c                   |  2 +-
  hw/arm/aspeed.c                   |  2 +-
  hw/arm/boot.c                     |  2 +-
  hw/arm/collie.c                   |  2 +-
  hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
  hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
  hw/arm/highbank.c                 |  2 +-
  hw/arm/integratorcp.c             |  2 +-
  hw/arm/mainstone.c                |  2 +-
  hw/arm/microbit.c                 |  2 +-
  hw/arm/mps2-tz.c                  |  2 +-
  hw/arm/mps2.c                     |  2 +-
  hw/arm/msf2-soc.c                 |  1 -
  hw/arm/msf2-som.c                 |  2 +-
  hw/arm/musca.c                    |  2 +-
  hw/arm/musicpal.c                 |  2 +-
  hw/arm/netduino2.c                |  2 +-
  hw/arm/nrf51_soc.c                |  2 +-
  hw/arm/nseries.c                  |  2 +-
  hw/arm/omap1.c                    |  2 +-
  hw/arm/omap2.c                    |  2 +-
  hw/arm/omap_sx1.c                 |  2 +-
  hw/arm/palm.c                     |  2 +-
  hw/arm/raspi.c                    |  2 +-
  hw/arm/realview.c                 |  2 +-
  hw/arm/spitz.c                    |  2 +-
  hw/arm/stellaris.c                |  2 +-
  hw/arm/stm32f205_soc.c            |  2 +-
  hw/arm/strongarm.c                |  2 +-
  hw/arm/tosa.c                     |  2 +-
  hw/arm/versatilepb.c              |  2 +-
  hw/arm/vexpress.c                 |  2 +-
  hw/arm/virt.c                     |  2 +-
  hw/arm/xilinx_zynq.c              |  2 +-
  hw/arm/xlnx-versal.c              |  2 +-
  hw/arm/z2.c                       |  2 +-
  hw/intc/arm_gicv3_cpuif.c         |  6 ++---
  hw/intc/armv7m_nvic.c             |  1 -
  target/arm/arm-semi.c             |  1 -
  target/arm/cpu.c                  |  1 -
  target/arm/cpu64.c                |  1 -
  target/arm/kvm.c                  |  1 -
  target/arm/kvm32.c                |  1 -
  target/arm/kvm64.c                |  1 -
  target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
  target/arm/translate.c            |  4 +--
 files changed, 164 insertions(+), 123 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (96%)

-[Qemu-devel] [PULL 10/24] target/arm: Add fp16 support to vfp_expand_imm
+[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
 From: Richard Henderson <richard.henderson@linaro.org>
+This is, after all, how we implement extract2 in tcg/aarch64.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
 Message-id: 20180110063337.21538-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 5 +++++
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
-file changed, 5 insertions(+)
+file changed, 20 insertions(+), 18 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t vfp_expand_imm(int size, uint8_t imm8)
+@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
-             (extract32(imm8, 0, 6) << 3);
+             } else {
-         imm <<= 16;
+                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
-         break;
+             }
-+    case MO_16:
+-        } else if (rm == rn) { /* ROR */
-+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+-            tcg_rm = cpu_reg(s, rm);
-+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+-            if (sf) {
-+            (extract32(imm8, 0, 6) << 6);
+-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-+        break;
+-            } else {
-     default:
+-                TCGv_i32 tmp = tcg_temp_new_i32();
-         g_assert_not_reached();
+-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
 -                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
 +            if (sf) {
 +                /* Specialization to ROR happens in EXTRACT2.  */
 +                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
 +            } else {
 +                TCGv_i32 t0 = tcg_temp_new_i32();
 +
 +                tcg_gen_extrl_i64_i32(t0, tcg_rm);
 +                if (rm == rn) {
 +                    tcg_gen_rotri_i32(t0, t0, imm);
 +                } else {
 +                    TCGv_i32 t1 = tcg_temp_new_i32();
 +                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
 +                    tcg_gen_extract2_i32(t0, t0, t1, imm);
 +                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 09/24] target/arm: Split out vfp_expand_imm
+[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
 From: Richard Henderson <richard.henderson@linaro.org>
+The mask implied by the extract is redundant with the one
+implied by the deposit.  Also, fix spelling of BFXIL.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Message-id: 20180110063337.21538-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 44 ++++++++++++++++++++++++++++----------------
+ target/arm/translate-a64.c | 6 +++---
-file changed, 28 insertions(+), 16 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
              tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
              return;
          }
 -        /* opc == 1, BXFIL fall through to deposit */
 -        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
 +        /* opc == 1, BFXIL fall through to deposit */
 +        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
          pos = 0;
      } else {
          /* Handle the ri > si case with a deposit
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
          len = ri;
      }
- }
+-    if (opc == 1) { /* BFM, BXFIL */
-+/* The imm8 encodes the sign bit, enough bits to represent an exponent in
++    if (opc == 1) { /* BFM, BFXIL */
-+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
-+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+     } else {
-+ */
+         /* SBFM or UBFM: We start with zero, and we haven't modified
 +static uint64_t vfp_expand_imm(int size, uint8_t imm8)
 +{
 +    uint64_t imm;
 +
 +    switch (size) {
 +    case MO_64:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 +            extract32(imm8, 0, 6);
 +        imm <<= 48;
 +        break;
 +    case MO_32:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 3);
 +        imm <<= 16;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return imm;
 +}
 +
  /* Floating point immediate
   *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
   * +---+---+---+-----------+------+---+------------+-------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
          return;
      }
 -    /* The imm8 encodes the sign bit, enough bits to represent
 -     * an exponent in the range 01....1xx to 10....0xx,
 -     * and the most significant 4 bits of the mantissa; see
 -     * VFPExpandImm() in the v8 ARM ARM.
 -     */
 -    if (is_double) {
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 -            extract32(imm8, 0, 6);
 -        imm <<= 48;
 -    } else {
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 3);
 -        imm <<= 16;
 -    }
 +    imm = vfp_expand_imm(MO_32 + is_double, imm8);
      tcg_res = tcg_const_i64(imm);
      write_fp_dreg(s, rd, tcg_res);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 24/24] sdhci: add a 'dma' property to the sysbus devices
+[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Alistair Francis <alistair.francis@wdc.com>
-Add a 'dma' property allowing machine creation to provide the address-space
+Commit 89e68b575 "target/arm: Use vector operations for saturation"
-SDHCI DMA operates on.
+causes this abort() when booting QEMU ARM with a Cortex-A15:
-[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
+0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
- from qemu/xilinx tag xilinx-v2016.1]
+0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
-Message-id: 20180115182436.2066-15-f4bug@amsat.org
+0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h |  1 +
+ target/arm/translate.c | 4 ++--
- hw/sd/sdhci.c         | 18 +++++++++++++++++-
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 18 insertions(+), 1 deletion(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/target/arm/translate.c
-+++ b/include/hw/sd/sdhci.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-     SDBus sdbus;
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-     MemoryRegion iomem;
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-     AddressSpace *dma_as;
+                            (u ? uqadd_op : sqadd_op) + size);
-+    MemoryRegion *dma_mr;
+-            break;
++            return 0;
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
-     QEMUTimer *transfer_timer;
+         case NEON_3R_VQSUB:
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-index XXXXXXX..XXXXXXX 100644
+                            rn_ofs, rm_ofs, vec_size, vec_size,
---- a/hw/sd/sdhci.c
+                            (u ? uqsub_op : sqsub_op) + size);
-+++ b/hw/sd/sdhci.c
+-            break;
-@@ -XXX,XX +XXX,XX @@ static Property sdhci_sysbus_properties[] = {
++            return 0;
-     DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
-     DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
+         case NEON_3R_VMUL: /* VMUL */
-                      false),
+             if (u) {
 +    DEFINE_PROP_LINK("dma", SDHCIState,
 +                     dma_mr, TYPE_MEMORY_REGION, MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_init(Object *obj)
  static void sdhci_sysbus_finalize(Object *obj)
  {
      SDHCIState *s = SYSBUS_SDHCI(obj);
 +
 +    if (s->dma_mr) {
 +        object_unparent(OBJECT(s->dma_mr));
 +    }
 +
      sdhci_uninitfn(s);
  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
          return;
      }
 -    s->dma_as = &address_space_memory;
 +    if (s->dma_mr) {
 +        address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
 +    } else {
 +        /* use system_memory() if property "dma" not set */
 +        s->dma_as = &address_space_memory;
 +    }
      sysbus_init_irq(sbd, &s->irq);
      sysbus_init_mmio(sbd, &s->iomem);
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
      SDHCIState *s = SYSBUS_SDHCI(dev);
      sdhci_common_unrealize(s, &error_abort);
 +
 +     if (s->dma_mr) {
 +        address_space_destroy(s->dma_as);
 +    }
  }
  static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/24] hw/sd/omap_mmc: Reset SD card on controller reset
+[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
-Since omap_mmc is still using the legacy SD card API, the SD
+The system_clock_scale global is used only by the armv7m systick
-card created by sd_init() is not plugged into any bus. This
+device; move the extern declaration to the armv7m_systick.h header,
-means that the controller has to reset it manually.
+and expand the comment to explain what it is and that it should
+ideally be replaced with a different approach.
 Failing to do this mostly didn't affect the guest since the
 guest typically does a programmed SD card reset as part of
 its SD controller driver initialization, but would mean that
 migration fails because it's only in sd_reset() that we
 set up the wpgrps_size field.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1515506513-31961-5-git-send-email-peter.maydell@linaro.org
+Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 ---
- hw/sd/omap_mmc.c | 14 ++++++++++----
+ include/hw/arm/arm.h              |  4 ----
-file changed, 10 insertions(+), 4 deletions(-)
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/omap_mmc.c
+--- a/include/hw/arm/arm.h
-+++ b/hw/sd/omap_mmc.c
++++ b/include/hw/arm/arm.h
-@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
-     host->cdet_enable = 0;
+                                             const struct arm_boot_info *info,
-     qemu_set_irq(host->coverswitch, host->cdet_state);
+                                             hwaddr mvbar_addr);
-     host->clkdiv = 0;
 -/* Multiplication factor to convert from system clock ticks to qemu timer
 -   ticks.  */
 -extern int system_clock_scale;
 -
  #endif /* HW_ARM_H */
 diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/armv7m_systick.h
 +++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
      qemu_irq irq;
  } SysTickState;
 +/*
 + * Multiplication factor to convert from system clock ticks to qemu timer
 + * ticks. This should be set (by board code, usually) to a value
 + * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
 + * in Hz of the CPU.
 + *
 + * This value is used by the systick device when it is running in
 + * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
 + * set how fast the timer should tick.
 + *
 + * TODO: we should refactor this so that rather than using a global
 + * we use a device property or something similar. This is complicated
 + * because (a) the property would need to be plumbed through from the
 + * board code down through various layers to the systick device
 + * and (b) the property needs to be modifiable after realize, because
 + * the stellaris board uses this to implement the behaviour where the
 + * guest can reprogram the PLL registers to downclock the CPU, and the
 + * systick device needs to react accordingly. Possibly this should
 + * be deferred until we have a good API for modelling clock trees.
 + */
 +extern int system_clock_scale;
 +
-+    /* Since we're still using the legacy SD API the card is not plugged
+ #endif
 +     * into any bus, and we must reset it manually. When omap_mmc is
 +     * QOMified this must move into the QOM reset function.
 +     */
 +    device_reset(DEVICE(host->card));
  }
  static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
      s->lines = 1;    /* TODO: needs to be settable per-board */
      s->rev = 1;
 -    omap_mmc_reset(s);
 -
      memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
      memory_region_add_subregion(sysmem, base, &s->iomem);
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
          exit(1);
      }
 +    omap_mmc_reset(s);
 +
      return s;
  }
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
      s->lines = 4;
      s->rev = 2;
 -    omap_mmc_reset(s);
 -
      memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
                            omap_l4_region_size(ta, 0));
      omap_l4_attach(ta, 0, &s->iomem);
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
      s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);
      sd_set_cb(s->card, NULL, s->cdet);
 +    omap_mmc_reset(s);
 +
      return s;
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 01/24] hw/intc/armv7m: Support byte and halfword accesses to CFSR
+[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
-The Configurable Fault Status Register for ARMv7M and v8M is
+The hw/arm/arm.h header now only includes declarations relating
-supposed to be byte and halfword accessible, but we were only
+to boot.c code, so it is only needed by Arm board or SoC code.
-implementing word accesses. Add support for the other access
+Remove some unnecessary inclusions of it from target/arm files
-sizes, which are used by the Zephyr RTOS.
+and from hw/intc/armv7m_nvic.c.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reported-by: Andy Gross <andy.gross@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1512742372-31517-1-git-send-email-peter.maydell@linaro.org
+Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 38 ++++++++++++++++++++++----------------
+ hw/intc/armv7m_nvic.c | 1 -
-file changed, 22 insertions(+), 16 deletions(-)
+ target/arm/arm-semi.c | 1 -
  target/arm/cpu.c      | 1 -
  target/arm/cpu64.c    | 1 -
  target/arm/kvm.c      | 1 -
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@
-             val |= (1 << 8);
+ #include "cpu.h"
-         }
+ #include "hw/sysbus.h"
-         return val;
+ #include "qemu/timer.h"
--    case 0xd28: /* Configurable Fault Status.  */
+-#include "hw/arm/arm.h"
--        /* The BFSR bits [15:8] are shared between security states
+ #include "hw/intc/armv7m_nvic.h"
--         * and we store them in the NS copy
+ #include "target/arm/cpu.h"
--         */
+ #include "exec/exec-all.h"
--        val = cpu->env.v7m.cfsr[attrs.secure];
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
--        val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+index XXXXXXX..XXXXXXX 100644
--        return val;
+--- a/target/arm/arm-semi.c
-     case 0xd2c: /* Hard Fault Status.  */
++++ b/target/arm/arm-semi.c
-         return cpu->env.v7m.hfsr;
+@@ -XXX,XX +XXX,XX @@
-     case 0xd30: /* Debug Fault Status.  */
+ #else
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+ #include "qemu-common.h"
-         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
+ #include "exec/gdbstub.h"
-         nvic_irq_update(s);
+-#include "hw/arm/arm.h"
-         break;
+ #include "qemu/cutils.h"
--    case 0xd28: /* Configurable Fault Status.  */
+ #endif
--        cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
--        if (attrs.secure) {
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
--            /* The BFSR bits [15:8] are shared between security states
+index XXXXXXX..XXXXXXX 100644
--             * and we store them in the NS copy.
+--- a/target/arm/cpu.c
--             */
++++ b/target/arm/cpu.c
--            cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
+@@ -XXX,XX +XXX,XX @@
--        }
+ #if !defined(CONFIG_USER_ONLY)
--        break;
+ #include "hw/loader.h"
-     case 0xd2c: /* Hard Fault Status.  */
+ #endif
-         cpu->env.v7m.hfsr &= ~value; /* W1C */
+-#include "hw/arm/arm.h"
-         break;
+ #include "sysemu/sysemu.h"
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
+ #include "sysemu/hw_accel.h"
-             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
+ #include "kvm_arm.h"
-         }
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-         break;
+index XXXXXXX..XXXXXXX 100644
-+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+--- a/target/arm/cpu64.c
-+        /* The BFSR bits [15:8] are shared between security states
++++ b/target/arm/cpu64.c
-+         * and we store them in the NS copy
+@@ -XXX,XX +XXX,XX @@
-+         */
+ #if !defined(CONFIG_USER_ONLY)
-+        val = s->cpu->env.v7m.cfsr[attrs.secure];
+ #include "hw/loader.h"
-+        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+ #endif
-+        val = extract32(val, (offset - 0xd28) * 8, size * 8);
+-#include "hw/arm/arm.h"
-+        break;
+ #include "sysemu/sysemu.h"
-     case 0xfe0 ... 0xfff: /* ID.  */
+ #include "sysemu/kvm.h"
-         if (offset & 3) {
+ #include "kvm_arm.h"
-             val = 0;
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
+index XXXXXXX..XXXXXXX 100644
-         }
+--- a/target/arm/kvm.c
-         nvic_irq_update(s);
++++ b/target/arm/kvm.c
-         return MEMTX_OK;
+@@ -XXX,XX +XXX,XX @@
-+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+ #include "cpu.h"
-+        /* All bits are W1C, so construct 32 bit value with 0s in
+ #include "trace.h"
-+         * the parts not written by the access size
+ #include "internals.h"
-+         */
+-#include "hw/arm/arm.h"
-+        value <<= ((offset - 0xd28) * 8);
+ #include "hw/pci/pci.h"
-+
+ #include "exec/memattrs.h"
-+        s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
+ #include "exec/address-spaces.h"
-+        if (attrs.secure) {
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-+            /* The BFSR bits [15:8] are shared between security states
+index XXXXXXX..XXXXXXX 100644
-+             * and we store them in the NS copy.
+--- a/target/arm/kvm32.c
-+             */
++++ b/target/arm/kvm32.c
-+            s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
+@@ -XXX,XX +XXX,XX @@
-+        }
+ #include "sysemu/kvm.h"
-+        return MEMTX_OK;
+ #include "kvm_arm.h"
-     }
+ #include "internals.h"
-     if (size == 4) {
+-#include "hw/arm/arm.h"
-         nvic_writel(s, offset, value, attrs);
+ #include "qemu/log.h"
  static inline void set_feature(uint64_t *features, int feature)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  static bool have_guest_debug;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/24] get_phys_addr_pmsav7: Support AP=0b111 for v7M
+Deleted patch
-For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111
-is an UNPREDICTABLE reserved combination. However, for v7M
-this value is documented as having the same behaviour as 0b110:
-read-only for both privileged and unprivileged. Accept this
-value on an M profile core rather than treating it as a guest
-error and a no-access page.
-Reported-by: Andy Gross <andy.gross@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1512742402-31669-1-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 14 ++++++++++++++
-file changed, 14 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                 case 6:
-                     *prot |= PAGE_READ | PAGE_EXEC;
-                     break;
-+                case 7:
-+                    /* for v7M, same as 6; for R profile a reserved value */
-+                    if (arm_feature(env, ARM_FEATURE_M)) {
-+                        *prot |= PAGE_READ | PAGE_EXEC;
-+                        break;
-+                    }
-+                    /* fall through */
-                 default:
-                     qemu_log_mask(LOG_GUEST_ERROR,
-                                   "DRACR[%d]: Bad value for AP bits: 0x%"
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-                 case 6:
-                     *prot |= PAGE_READ | PAGE_EXEC;
-                     break;
-+                case 7:
-+                    /* for v7M, same as 6; for R profile a reserved value */
-+                    if (arm_feature(env, ARM_FEATURE_M)) {
-+                        *prot |= PAGE_READ | PAGE_EXEC;
-+                        break;
-+                    }
-+                    /* fall through */
-                 default:
-                     qemu_log_mask(LOG_GUEST_ERROR,
-                                   "DRACR[%d]: Bad value for AP bits: 0x%"
---
-.7.4

-[Qemu-devel] [PULL 03/24] hw/arm/virt: Add virt-2.12 machine type
+[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
-Add virt-2.12 machine type.
+The header file hw/arm/arm.h now includes only declarations
 relating to hw/arm/boot.c functionality. Rename it accordingly,
 and adjust its header comment.
 The bulk of this commit was created via
  perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
 In a few cases we can just delete the #include:
 hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
 include/hw/arm/bcm2836.h did not require it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 19 +++++++++++++++++--
+ include/hw/arm/allwinner-a10.h   | 2 +-
-file changed, 17 insertions(+), 2 deletions(-)
+ include/hw/arm/aspeed_soc.h      | 1 -
  include/hw/arm/bcm2836.h         | 1 -
  include/hw/arm/{arm.h => boot.h} | 8 ++++----
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/allwinner-a10.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "qemu/error-report.h"
+ #include "hw/char/serial.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
+ #include "hw/net/allwinner_emac.h"
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ASPEED_SOC_H
+ #define ASPEED_SOC_H
+-#include "hw/arm/arm.h"
+ #include "hw/intc/aspeed_vic.h"
+ #include "hw/misc/aspeed_scu.h"
+ #include "hw/misc/aspeed_sdmc.h"
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/bcm2836.h
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BCM2836_H
+ #define BCM2836_H
+-#include "hw/arm/arm.h"
+ #include "hw/arm/bcm2835_peripherals.h"
+ #include "hw/intc/bcm2836_control.h"
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
+similarity index 98%
+rename from include/hw/arm/arm.h
+rename to include/hw/arm/boot.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/arm.h
++++ b/include/hw/arm/boot.h
+@@ -XXX,XX +XXX,XX @@
+ /*
+- * Misc ARM declarations
++ * ARM kernel loader.
+  *
+  * Copyright (c) 2006 CodeSourcery.
+  * Written by Paul Brook
+@@ -XXX,XX +XXX,XX @@
+  *
+  */
+-#ifndef HW_ARM_H
+-#define HW_ARM_H
++#ifndef HW_ARM_BOOT_H
++#define HW_ARM_BOOT_H
+ #include "exec/memory.h"
+ #include "target/arm/cpu-qom.h"
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+                                             const struct arm_boot_info *info,
+                                             hwaddr mvbar_addr);
+-#endif /* HW_ARM_H */
++#endif /* HW_ARM_BOOT_H */
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx25.h
++++ b/include/hw/arm/fsl-imx25.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX25_H
+ #define FSL_IMX25_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx25_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx31.h
++++ b/include/hw/arm/fsl-imx31.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX31_H
+ #define FSL_IMX31_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx31_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6_H
+ #define FSL_IMX6_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a9mpcore.h"
+ #include "hw/misc/imx6_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6ul.h
++++ b/include/hw/arm/fsl-imx6ul.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6UL_H
+ #define FSL_IMX6UL_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/misc/imx6ul_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX7_H
+ #define FSL_IMX7_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/intc/imx_gpcv2.h"
+ #include "hw/misc/imx7_ccm.h"
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "qemu/notify.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/kvm.h"
+ #include "hw/intc/arm_gicv3_common.h"
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #define XLNX_VERSAL_H
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/xlnx-zynqmp.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef XLNX_ZYNQMP_H
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gic.h"
+ #include "hw/net/cadence_gem.h"
+ #include "hw/char/cadence_uart.h"
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/registerfields.h"
+ #include "hw/arm/armsse.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ /* Format of the System Information block SYS_CONFIG register */
+ typedef enum SysConfigFormat {
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "elf.h"
+ #include "sysemu/qtest.h"
+diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed.c
++++ b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "exec/address-spaces.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/aspeed.h"
+ #include "hw/arm/aspeed_soc.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include <libfdt.h>
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/linux-boot-if.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/collie.c b/hw/arm/collie.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/collie.c
++++ b/hw/arm/collie.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "strongarm.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "exec/address-spaces.h"
+ #include "cpu.h"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/sd/sdhci.h"
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4_boards.c
++++ b/hw/arm/exynos4_boards.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+ #include "net/net.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/net/lan9118.h"
+diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/highbank.c
++++ b/hw/arm/highbank.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "net/net.h"
+ #include "sysemu/kvm.h"
+diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/integratorcp.c
++++ b/hw/arm/integratorcp.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/misc/arm_integrator_debug.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mainstone.c
++++ b/hw/arm/mainstone.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "hw/net/smc91c111.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/microbit.c
++++ b/hw/arm/microbit.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-soc.c
++++ b/hw/arm/msf2-soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/units.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
+ #include "exec/address-spaces.h"
+ #include "hw/char/serial.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-som.c
++++ b/hw/arm/msf2-som.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/msf2-soc.h"
+ #include "cpu.h"
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "exec/address-spaces.h"
+ #include "sysemu/sysemu.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armsse.h"
+ #include "hw/boards.h"
+ #include "hw/char/pl011.h"
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musicpal.c
++++ b/hw/arm/musicpal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduino2.c
++++ b/hw/arm/netduino2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "qemu/error-report.h"
+ #include "hw/arm/stm32f205_soc.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ static void netduino2_init(MachineState *machine)
+ {
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "hw/misc/unimp.h"
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/omap.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/irq.h"
+ #include "ui/console.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap1.c
++++ b/hw/arm/omap1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/soc_dma.h"
+diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap2.c
++++ b/hw/arm/omap2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/qtest.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "qemu/timer.h"
+diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap_sx1.c
++++ b/hw/arm/omap_sx1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/qtest.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/input/tsc2xxx.h"
+ #include "hw/loader.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/raspi.c
++++ b/hw/arm/raspi.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+ #include "hw/loader.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
+diff --git a/hw/arm/realview.c b/hw/arm/realview.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/realview.c
++++ b/hw/arm/realview.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/net/smc91c111.h"
+diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/spitz.c
++++ b/hw/arm/spitz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/pcmcia.h"
+ #include "hw/i2c/i2c.h"
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+ #include "hw/ssi/ssi.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "qemu/timer.h"
+ #include "hw/i2c/i2c.h"
+ #include "net/net.h"
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stm32f205_soc.c
++++ b/hw/arm/stm32f205_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/stm32f205_soc.h"
+diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/strongarm.c
++++ b/hw/arm/strongarm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "strongarm.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "chardev/char-fe.h"
+ #include "chardev/char-serial.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/tosa.c
++++ b/hw/arm/tosa.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/sharpsl.h"
+ #include "hw/pcmcia.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/versatilepb.c
++++ b/hw/arm/versatilepb.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/vexpress.c
++++ b/hw/arm/vexpress.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
+ #include "hw/net/lan9118.h"
+ #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
+@@ -XXX,XX +XXX,XX @@
- }
+ #include "qemu/option.h"
- type_init(machvirt_machine_init);
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
--static void virt_2_11_instance_init(Object *obj)
+-#include "hw/arm/arm.h"
-+static void virt_2_12_instance_init(Object *obj)
++#include "hw/arm/boot.h"
- {
+ #include "hw/arm/primecell.h"
-     VirtMachineState *vms = VIRT_MACHINE(obj);
+ #include "hw/arm/virt.h"
-     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
+ #include "hw/block/flash.h"
-@@ -XXX,XX +XXX,XX @@ static void virt_2_11_instance_init(Object *obj)
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
-     vms->irqmap = a15irqmap;
+index XXXXXXX..XXXXXXX 100644
- }
+--- a/hw/arm/xilinx_zynq.c
++++ b/hw/arm/xilinx_zynq.c
-+static void virt_machine_2_12_options(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@
-+{
+ #include "qemu-common.h"
-+}
+ #include "cpu.h"
-+DEFINE_VIRT_MACHINE_AS_LATEST(2, 12)
+ #include "hw/sysbus.h"
-+
+-#include "hw/arm/arm.h"
-+#define VIRT_COMPAT_2_11 \
++#include "hw/arm/boot.h"
-+    HW_COMPAT_2_11
+ #include "net/net.h"
-+
+ #include "exec/address-spaces.h"
-+static void virt_2_11_instance_init(Object *obj)
+ #include "sysemu/sysemu.h"
-+{
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-+    virt_2_12_instance_init(obj);
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/arm/xlnx-versal.c
-+
++++ b/hw/arm/xlnx-versal.c
- static void virt_machine_2_11_options(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@
- {
+ #include "net/net.h"
-+    virt_machine_2_12_options(mc);
+ #include "sysemu/sysemu.h"
-+    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_11);
+ #include "sysemu/kvm.h"
- }
+-#include "hw/arm/arm.h"
--DEFINE_VIRT_MACHINE_AS_LATEST(2, 11)
++#include "hw/arm/boot.h"
-+DEFINE_VIRT_MACHINE(2, 11)
+ #include "kvm_arm.h"
+ #include "hw/misc/unimp.h"
- #define VIRT_COMPAT_2_10 \
+ #include "hw/intc/arm_gicv3_common.h"
-     HW_COMPAT_2_10
+diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/i2c/i2c.h"
  #include "hw/ssi/ssi.h"
  #include "hw/boards.h"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/24] target/arm: Handle page table walk load failures correctly
+[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-Instead of ignoring the response from address_space_ld*()
+In ich_vmcr_write() we enforce "writes of BPR fields to less than
-(indicating an attempt to read a page table descriptor from
+their minimum sets them to the minimum" by doing a "read vbpr and
-an invalid physical address), use it to report the failure
+write it back" operation.  A typo here meant that we weren't handling
-correctly.
+writes to these fields correctly, because we were reading from VBPR0
+but writing to VBPR1.
 Since this is another couple of locations where we need to
 decide the value of the ARMMMUFaultInfo ea bit based on a
 MemTxResult, we factor out that operation into a helper
 function.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 10 ++++++++++
+ hw/intc/arm_gicv3_cpuif.c | 2 +-
- target/arm/helper.c    | 39 ++++++++++++++++++++++++++++++++++-----
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/op_helper.c |  7 +------
 files changed, 45 insertions(+), 11 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/target/arm/internals.h
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
+@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     return fsc;
+     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
- }
+      * by reading and writing back the fields.
+      */
-+static inline bool arm_extabort_type(MemTxResult result)
+-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
-+{
++    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
-+    /* The EA bit in syndromes and fault status registers is an
+     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
-+     * IMPDEF classification of external aborts. ARM implementations
-+     * usually use this to indicate AXI bus Decode error (0) or
+     gicv3_cpuif_virt_update(cs);
 +     * Slave error (1); in QEMU we follow that.
 +     */
 +    return result != MEMTX_DECODE_ERROR;
 +}
 +
  /* Do a page table walk and add page to TLB if possible */
  bool arm_tlb_fill(CPUState *cpu, vaddr address,
                    MMUAccessType access_type, int mmu_idx,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
                                   &txattrs, &s2prot, &s2size, fi, NULL);
          if (ret) {
 +            assert(fi->type != ARMFault_None);
              fi->s2addr = addr;
              fi->stage2 = true;
              fi->s1ptw = true;
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
      MemTxAttrs attrs = {};
 +    MemTxResult result = MEMTX_OK;
      AddressSpace *as;
 +    uint32_t data;
      attrs.secure = is_secure;
      as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
          return 0;
      }
      if (regime_translation_big_endian(env, mmu_idx)) {
 -        return address_space_ldl_be(as, addr, attrs, NULL);
 +        data = address_space_ldl_be(as, addr, attrs, &result);
      } else {
 -        return address_space_ldl_le(as, addr, attrs, NULL);
 +        data = address_space_ldl_le(as, addr, attrs, &result);
      }
 +    if (result == MEMTX_OK) {
 +        return data;
 +    }
 +    fi->type = ARMFault_SyncExternalOnWalk;
 +    fi->ea = arm_extabort_type(result);
 +    return 0;
  }
  static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
      MemTxAttrs attrs = {};
 +    MemTxResult result = MEMTX_OK;
      AddressSpace *as;
 +    uint32_t data;
      attrs.secure = is_secure;
      as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
          return 0;
      }
      if (regime_translation_big_endian(env, mmu_idx)) {
 -        return address_space_ldq_be(as, addr, attrs, NULL);
 +        data = address_space_ldq_be(as, addr, attrs, &result);
      } else {
 -        return address_space_ldq_le(as, addr, attrs, NULL);
 +        data = address_space_ldq_le(as, addr, attrs, &result);
 +    }
 +    if (result == MEMTX_OK) {
 +        return data;
      }
 +    fi->type = ARMFault_SyncExternalOnWalk;
 +    fi->ea = arm_extabort_type(result);
 +    return 0;
  }
  static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
      }
      desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                         mmu_idx, fi);
 +    if (fi->type != ARMFault_None) {
 +        goto do_fault;
 +    }
      type = (desc & 3);
      domain = (desc >> 5) & 0x0f;
      if (regime_el(env, mmu_idx) == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
          }
          desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                             mmu_idx, fi);
 +        if (fi->type != ARMFault_None) {
 +            goto do_fault;
 +        }
          switch (desc & 3) {
          case 0: /* Page translation fault.  */
              fi->type = ARMFault_Translation;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
      }
      desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                         mmu_idx, fi);
 +    if (fi->type != ARMFault_None) {
 +        goto do_fault;
 +    }
      type = (desc & 3);
      if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
          /* Section translation fault, or attempt to use the encoding
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
          desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                             mmu_idx, fi);
 +        if (fi->type != ARMFault_None) {
 +            goto do_fault;
 +        }
          ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
          switch (desc & 3) {
          case 0: /* Page translation fault.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          descaddr &= ~7ULL;
          nstable = extract32(tableattrs, 4, 1);
          descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
 -        if (fi->s1ptw) {
 +        if (fi->type != ARMFault_None) {
              goto do_fault;
          }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
      /* now we have a real cpu fault */
      cpu_restore_state(cs, retaddr);
 -    /* The EA bit in syndromes and fault status registers is an
 -     * IMPDEF classification of external aborts. ARM implementations
 -     * usually use this to indicate AXI bus Decode error (0) or
 -     * Slave error (1); in QEMU we follow that.
 -     */
 -    fi.ea = (response != MEMTX_DECODE_ERROR);
 +    fi.ea = arm_extabort_type(response);
      fi.type = ARMFault_SyncExternal;
      deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/24] hw/sd/pl181: Reset SD card on controller reset
+Deleted patch
-Since pl181 is still using the legacy SD card API, the SD
-card created by sd_init() is not plugged into any bus. This
-means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-Cc: qemu-stable@nongnu.org
-Fixes: https://bugs.launchpad.net/qemu/+bug/1739378
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-2-git-send-email-peter.maydell@linaro.org
----
- hw/sd/pl181.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/pl181.c
-+++ b/hw/sd/pl181.c
-@@ -XXX,XX +XXX,XX @@ static void pl181_reset(DeviceState *d)
-     /* We can assume our GPIO outputs have been wired up now */
-     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->card));
- }
- static void pl181_init(Object *obj)
---
-.7.4

-[Qemu-devel] [PULL 06/24] hw/sd/milkymist-memcard: Reset SD card on controller reset
+Deleted patch
-Since milkymist-memcard is still using the legacy SD card API,
-the SD card created by sd_init() is not plugged into any bus.
-This means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-3-git-send-email-peter.maydell@linaro.org
----
- hw/sd/milkymist-memcard.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/milkymist-memcard.c
-+++ b/hw/sd/milkymist-memcard.c
-@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
-     for (i = 0; i < R_MAX; i++) {
-         s->regs[i] = 0;
-     }
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->card));
- }
- static int milkymist_memcard_init(SysBusDevice *dev)
---
-.7.4

-[Qemu-devel] [PULL 07/24] hw/sd/ssi-sd: Reset SD card on controller reset
+Deleted patch
-Since ssi-sd is still using the legacy SD card API, the SD
-card created by sd_init() is not plugged into any bus. This
-means that the controller has to reset it manually.
-Failing to do this mostly didn't affect the guest since the
-guest typically does a programmed SD card reset as part of
-its SD controller driver initialization, but meant that
-migration failed because it's only in sd_reset() that we
-set up the wpgrps_size field.
-In the case of sd-ssi, we have to implement an entire
-reset function since there wasn't one previously, and
-that requires a QOM cast macro that got omitted when this
-device was QOMified.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1515506513-31961-4-git-send-email-peter.maydell@linaro.org
----
- hw/sd/ssi-sd.c | 25 +++++++++++++++++++++++--
-file changed, 23 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/ssi-sd.c
-+++ b/hw/sd/ssi-sd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     SDState *sd;
- } ssi_sd_state;
-+#define TYPE_SSI_SD "ssi-sd"
-+#define SSI_SD(obj) OBJECT_CHECK(ssi_sd_state, (obj), TYPE_SSI_SD)
-+
- /* State word bits.  */
- #define SSI_SDR_LOCKED          0x0001
- #define SSI_SDR_WP_ERASE        0x0002
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
-     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
-     DriveInfo *dinfo;
--    s->mode = SSI_SD_CMD;
-     /* FIXME use a qdev drive property instead of drive_get_next() */
-     dinfo = drive_get_next(IF_SD);
-     s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
-     }
- }
-+static void ssi_sd_reset(DeviceState *dev)
-+{
-+    ssi_sd_state *s = SSI_SD(dev);
-+
-+    s->mode = SSI_SD_CMD;
-+    s->cmd = 0;
-+    memset(s->cmdarg, 0, sizeof(s->cmdarg));
-+    memset(s->response, 0, sizeof(s->response));
-+    s->arglen = 0;
-+    s->response_pos = 0;
-+    s->stopping = 0;
-+
-+    /* Since we're still using the legacy SD API the card is not plugged
-+     * into any bus, and we must reset it manually.
-+     */
-+    device_reset(DEVICE(s->sd));
-+}
-+
- static void ssi_sd_class_init(ObjectClass *klass, void *data)
- {
-     DeviceClass *dc = DEVICE_CLASS(klass);
-@@ -XXX,XX +XXX,XX @@ static void ssi_sd_class_init(ObjectClass *klass, void *data)
-     k->transfer = ssi_sd_transfer;
-     k->cs_polarity = SSI_CS_LOW;
-     dc->vmsd = &vmstate_ssi_sd;
-+    dc->reset = ssi_sd_reset;
- }
- static const TypeInfo ssi_sd_info = {
--    .name          = "ssi-sd",
-+    .name          = TYPE_SSI_SD,
-     .parent        = TYPE_SSI_SLAVE,
-     .instance_size = sizeof(ssi_sd_state),
-     .class_init    = ssi_sd_class_init,
---
-.7.4

-[Qemu-devel] [PULL 11/24] sdhci: clean up includes
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-2-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci-internal.h | 4 ----
- include/hw/sd/sdhci.h  | 7 ++++++-
- hw/sd/sdhci.c          | 1 +
-files changed, 7 insertions(+), 5 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
-+++ b/hw/sd/sdhci-internal.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef SDHCI_INTERNAL_H
- #define SDHCI_INTERNAL_H
--#include "hw/sd/sdhci.h"
--
- /* R/W SDMA System Address register 0x0 */
- #define SDHC_SYSAD                     0x00
-@@ -XXX,XX +XXX,XX @@ enum {
-     sdhc_gap_write  = 2   /* SDHC stopped at block gap during write operation */
- };
--extern const VMStateDescription sdhci_vmstate;
--
- #endif
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@
- #define SDHCI_H
- #include "qemu-common.h"
--#include "hw/block/block.h"
- #include "hw/pci/pci.h"
- #include "hw/sysbus.h"
- #include "hw/sd/sd.h"
- /* SD/MMC host controller state */
- typedef struct SDHCIState {
-+    /*< private >*/
-     union {
-         PCIDevice pcidev;
-         SysBusDevice busdev;
-     };
-+
-+    /*< public >*/
-     SDBus sdbus;
-     MemoryRegion iomem;
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     qemu_irq ro_cb;
-     qemu_irq irq;
-+    /* Registers cleared on reset */
-     uint32_t sdmasysad;    /* SDMA System Address register */
-     uint16_t blksize;      /* Host DMA Buff Boundary and Transfer BlkSize Reg */
-     uint16_t blkcnt;       /* Blocks count for current transfer */
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     uint16_t acmd12errsts; /* Auto CMD12 error status register */
-     uint64_t admasysaddr;  /* ADMA System Address Register */
-+    /* Read-only registers */
-     uint32_t capareg;      /* Capabilities Register */
-     uint32_t maxcurr;      /* Maximum Current Capabilities Register */
-+
-     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
-     uint32_t buf_maxsz;
-     uint16_t data_count;   /* current element in FIFO buffer */
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/dma.h"
- #include "qemu/timer.h"
- #include "qemu/bitops.h"
-+#include "hw/sd/sdhci.h"
- #include "sdhci-internal.h"
- #include "qemu/log.h"
---
-.7.4

-[Qemu-devel] [PULL 12/24] sdhci: remove dead code
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-3-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/sd/sdhci.h | 2 --
- hw/sd/sdhci.c         | 2 --
-files changed, 4 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
-     QEMUTimer *transfer_timer;
--    qemu_irq eject_cb;
--    qemu_irq ro_cb;
-     qemu_irq irq;
-     /* Registers cleared on reset */
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
-     timer_free(s->insert_timer);
-     timer_del(s->transfer_timer);
-     timer_free(s->transfer_timer);
--    qemu_free_irq(s->eject_cb);
--    qemu_free_irq(s->ro_cb);
-     g_free(s->fifo_buffer);
-     s->fifo_buffer = NULL;
---
-.7.4

-[Qemu-devel] [PULL 18/24] sdhci: convert the DPRINT() calls into trace events
+[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The ICC_CTLR_EL3 register includes some bits which are aliases
 of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
 to keep those bits in the cs->icc_ctlr_el1[] struct fields.
 Unfortunately a missing '~' in the code to update the bits
 in those fields meant that writing to ICC_CTLR_EL3 would corrupt
 the ICC_CLTR_EL1 register values.
-zero-initialize ADMADescr 'dscr' in sdhci_do_adma() to avoid:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
 ---
  hw/intc/arm_gicv3_cpuif.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-  hw/sd/sdhci.c: In function ‘sdhci_do_adma’:
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
   hw/sd/sdhci.c:714:29: error: ‘dscr.addr’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
              trace_sdhci_adma("link", s->admasysaddr);
                              ^
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Acked-by: Alistair Francis <alistair.francis@xilinx.com>
 Message-id: 20180115182436.2066-9-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/sd/sdhci.c      | 89 ++++++++++++++++++------------------------------------
  hw/sd/trace-events | 14 +++++++++
 files changed, 44 insertions(+), 59 deletions(-)
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
- #include "sdhci-internal.h"
+     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
- #include "qapi/error.h"
- #include "qemu/log.h"
+     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
--
+-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
--/* host controller debug messages */
++    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
--#ifndef SDHC_DEBUG
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
--#define SDHC_DEBUG                        0
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
 -#endif
 -
 -#define DPRINT_L1(fmt, args...) \
 -    do { \
 -        if (SDHC_DEBUG) { \
 -            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
 -        } \
 -    } while (0)
 -#define DPRINT_L2(fmt, args...) \
 -    do { \
 -        if (SDHC_DEBUG > 1) { \
 -            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
 -        } \
 -    } while (0)
 -#define ERRPRINT(fmt, args...) \
 -    do { \
 -        if (SDHC_DEBUG) { \
 -            fprintf(stderr, "QEMU SDHC ERROR: " fmt, ## args); \
 -        } \
 -    } while (0)
 +#include "trace.h"
  #define TYPE_SDHCI_BUS "sdhci-bus"
  #define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS)
@@ -XXX,XX +XXX,XX @@ static void sdhci_raise_insertion_irq(void *opaque)
  static void sdhci_set_inserted(DeviceState *dev, bool level)
  {
      SDHCIState *s = (SDHCIState *)dev;
 -    DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject");
 +    trace_sdhci_set_inserted(level ? "insert" : "eject");
      if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
          /* Give target some time to notice card ejection */
          timer_mod(s->insert_timer,
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
      s->acmd12errsts = 0;
      request.cmd = s->cmdreg >> 8;
      request.arg = s->argument;
 -    DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg);
 +
 +    trace_sdhci_send_command(request.cmd, request.arg);
      rlen = sdbus_do_command(&s->sdbus, &request, response);
      if (s->cmdreg & SDHC_CMD_RESPONSE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
              s->rspreg[0] = (response[0] << 24) | (response[1] << 16) |
                             (response[2] << 8)  |  response[3];
              s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
 -            DPRINT_L1("Response: RSPREG[31..0]=0x%08x\n", s->rspreg[0]);
 +            trace_sdhci_response4(s->rspreg[0]);
          } else if (rlen == 16) {
              s->rspreg[0] = (response[11] << 24) | (response[12] << 16) |
                             (response[13] << 8) |  response[14];
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
                             (response[5] << 8)  |  response[6];
              s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
                              response[2];
 -            DPRINT_L1("Response received:\n RSPREG[127..96]=0x%08x, RSPREG[95.."
 -                  "64]=0x%08x,\n RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x\n",
 -                  s->rspreg[3], s->rspreg[2], s->rspreg[1], s->rspreg[0]);
 +            trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
 +                                   s->rspreg[1], s->rspreg[0]);
          } else {
 -            ERRPRINT("Timeout waiting for command response\n");
 +            trace_sdhci_error("timeout waiting for command response");
              if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
                  s->errintsts |= SDHC_EIS_CMDTIMEOUT;
                  s->norintsts |= SDHC_NIS_ERR;
@@ -XXX,XX +XXX,XX @@ static void sdhci_end_transfer(SDHCIState *s)
          request.cmd = 0x0C;
          request.arg = 0;
 -        DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg);
 +        trace_sdhci_end_transfer(request.cmd, request.arg);
          sdbus_do_command(&s->sdbus, &request, response);
          /* Auto CMD12 response goes to the upper Response register */
          s->rspreg[3] = (response[0] << 24) | (response[1] << 16) |
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
      /* first check that a valid data exists in host controller input buffer */
      if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
 -        ERRPRINT("Trying to read from empty buffer\n");
 +        trace_sdhci_error("read from empty buffer");
          return 0;
      }
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
          s->data_count++;
          /* check if we've read all valid data (blksize bytes) from buffer */
          if ((s->data_count) >= (s->blksize & 0x0fff)) {
 -            DPRINT_L2("All %u bytes of data have been read from input buffer\n",
 -                    s->data_count);
 +            trace_sdhci_read_dataport(s->data_count);
              s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
              s->data_count = 0;  /* next buff read must start at position [0] */
@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
      /* Check that there is free space left in a buffer */
      if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
 -        ERRPRINT("Can't write to data buffer: buffer full\n");
 +        trace_sdhci_error("Can't write to data buffer: buffer full");
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
+-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-         s->data_count++;
++    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-         value >>= 8;
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
-         if (s->data_count >= (s->blksize & 0x0fff)) {
+         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
 -            DPRINT_L2("write buffer filled with %u bytes of data\n",
 -                    s->data_count);
 +            trace_sdhci_write_dataport(s->data_count);
              s->data_count = 0;
              s->prnsts &= ~SDHC_SPACE_AVAILABLE;
              if (s->prnsts & SDHC_DOING_WRITE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
  {
      unsigned int n, begin, length;
      const uint16_t block_size = s->blksize & 0x0fff;
 -    ADMADescr dscr;
 +    ADMADescr dscr = {};
      int i;
      for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
          s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
          get_adma_description(s, &dscr);
 -        DPRINT_L2("ADMA loop: addr=" TARGET_FMT_plx ", len=%d, attr=%x\n",
 -                dscr.addr, dscr.length, dscr.attr);
 +        trace_sdhci_adma_loop(dscr.addr, dscr.length, dscr.attr);
          if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
              /* Indicate that error occurred in ST_FDS state */
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
              break;
          case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
              s->admasysaddr = dscr.addr;
 -            DPRINT_L1("ADMA link: admasysaddr=0x%" PRIx64 "\n",
 -                      s->admasysaddr);
 +            trace_sdhci_adma("link", s->admasysaddr);
              break;
          default:
              s->admasysaddr += dscr.incr;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
          }
          if (dscr.attr & SDHC_ADMA_ATTR_INT) {
 -            DPRINT_L1("ADMA interrupt: admasysaddr=0x%" PRIx64 "\n",
 -                      s->admasysaddr);
 +            trace_sdhci_adma("interrupt", s->admasysaddr);
              if (s->norintstsen & SDHC_NISEN_DMA) {
                  s->norintsts |= SDHC_NIS_DMA;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
          /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
          if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                      (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
 -            DPRINT_L2("ADMA transfer completed\n");
 +            trace_sdhci_adma_transfer_completed();
              if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
                  (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                  s->blkcnt != 0)) {
 -                ERRPRINT("SD/MMC host ADMA length mismatch\n");
 +                trace_sdhci_error("SD/MMC host ADMA length mismatch");
                  s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
                          SDHC_ADMAERR_STATE_ST_TFR;
                  if (s->errintstsen & SDHC_EISEN_ADMAERR) {
 -                    ERRPRINT("Set ADMA error flag\n");
 +                    trace_sdhci_error("Set ADMA error flag");
                      s->errintsts |= SDHC_EIS_ADMAERR;
                      s->norintsts |= SDHC_NIS_ERR;
                  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
              break;
          case SDHC_CTRL_ADMA1_32:
              if (!(s->capareg & SDHC_CAN_DO_ADMA1)) {
 -                ERRPRINT("ADMA1 not supported\n");
 +                trace_sdhci_error("ADMA1 not supported");
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
              break;
          case SDHC_CTRL_ADMA2_32:
              if (!(s->capareg & SDHC_CAN_DO_ADMA2)) {
 -                ERRPRINT("ADMA2 not supported\n");
 +                trace_sdhci_error("ADMA2 not supported");
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
          case SDHC_CTRL_ADMA2_64:
              if (!(s->capareg & SDHC_CAN_DO_ADMA2) ||
                      !(s->capareg & SDHC_64_BIT_BUS_SUPPORT)) {
 -                ERRPRINT("64 bit ADMA not supported\n");
 +                trace_sdhci_error("64 bit ADMA not supported");
                  break;
              }
              sdhci_do_adma(s);
              break;
          default:
 -            ERRPRINT("Unsupported DMA type\n");
 +            trace_sdhci_error("Unsupported DMA type");
              break;
          }
      } else {
@@ -XXX,XX +XXX,XX @@ static inline bool
  sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
  {
      if ((s->data_count & 0x3) != byte_num) {
 -        ERRPRINT("Non-sequential access to Buffer Data Port register"
 -                "is prohibited\n");
 +        trace_sdhci_error("Non-sequential access to Buffer Data Port register"
 +                          "is prohibited\n");
          return false;
      }
-     return true;
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-     case  SDHC_BDATA:
-         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
-             ret = sdhci_read_dataport(s, size);
--            DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset,
--                      ret, ret);
-+            trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
-             return ret;
-         }
-         break;
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-     ret >>= (offset & 0x3) * 8;
-     ret &= (1ULL << (size * 8)) - 1;
--    DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset, ret, ret);
-+    trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
-     return ret;
- }
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-                       "not implemented\n", size, offset, value >> shift);
-         break;
-     }
--    DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
--              size, (int)offset, value >> shift, value >> shift);
-+    trace_sdhci_access("wr", size << 3, offset, "<-",
-+                       value >> shift, value >> shift);
- }
- static const MemoryRegionOps sdhci_mmio_ops = {
-diff --git a/hw/sd/trace-events b/hw/sd/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/trace-events
-+++ b/hw/sd/trace-events
-@@ -XXX,XX +XXX,XX @@
- # See docs/devel/tracing.txt for syntax documentation.
-+# hw/sd/sdhci.c
-+sdhci_set_inserted(const char *level) "card state changed: %s"
-+sdhci_send_command(uint8_t cmd, uint32_t arg) "CMD%02u ARG[0x%08x]"
-+sdhci_error(const char *msg) "%s"
-+sdhci_response4(uint32_t r0) "RSPREG[31..0]=0x%08x"
-+sdhci_response16(uint32_t r3, uint32_t r2, uint32_t r1, uint32_t r0) "RSPREG[127..96]=0x%08x, RSPREG[95..64]=0x%08x, RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x"
-+sdhci_end_transfer(uint8_t cmd, uint32_t arg) "Automatically issue CMD%02u 0x%08x"
-+sdhci_adma(const char *desc, uint32_t sysad) "%s: admasysaddr=0x%" PRIx32
-+sdhci_adma_loop(uint64_t addr, uint16_t length, uint8_t attr) "addr=0x%08" PRIx64 ", len=%d, attr=0x%x"
-+sdhci_adma_transfer_completed(void) ""
-+sdhci_access(const char *access, unsigned int size, uint64_t offset, const char *dir, uint64_t val, uint64_t val2) "%s%u: addr[0x%04" PRIx64 "] %s 0x%08" PRIx64 " (%" PRIu64 ")"
-+sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read from input buffer"
-+sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
-+
- # hw/sd/milkymist-memcard.c
- milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
- milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 15/24] sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
+[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20180115182436.2066-6-f4bug@amsat.org
+Message-id: 20190520214342.13709-2-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 30 +++++++++++++++++++++---------
+ hw/arm/exynos4_boards.c | 24 ------------------------
-file changed, 21 insertions(+), 9 deletions(-)
+file changed, 24 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
+@@ -XXX,XX +XXX,XX @@
-     s->fifo_buffer = NULL;
+ #include "hw/net/lan9118.h"
- }
+ #include "hw/boards.h"
-+static void sdhci_common_realize(SDHCIState *s, Error **errp)
+-#undef DEBUG
-+{
+-
-+    s->buf_maxsz = sdhci_get_fifolen(s);
+-//#define DEBUG
-+    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+-
-+
+-#ifdef DEBUG
-+    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
+-    #undef PRINT_DEBUG
-+                          SDHC_REGISTERS_MAP_SIZE);
+-    #define  PRINT_DEBUG(fmt, args...) \
-+}
+-        do { \
-+
+-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
- static bool sdhci_pending_insert_vmstate_needed(void *opaque)
+-        } while (0)
- {
+-#else
-     SDHCIState *s = opaque;
+-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-@@ -XXX,XX +XXX,XX @@ static Property sdhci_pci_properties[] = {
+-#endif
- static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
+-
- {
+ #define SMDK_LAN9118_BASE_ADDR      0x05000000
-     SDHCIState *s = PCI_SDHCI(dev);
-+
+ typedef enum Exynos4BoardType {
-+    sdhci_initfn(s);
+@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
-+    sdhci_common_realize(s, errp);
+     exynos4_board_binfo.gic_cpu_if_addr =
-+    if (errp && *errp) {
+             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
-+        return;
-+    }
+-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-+
+-            " kernel_filename: %s\n"
-     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
+-            " kernel_cmdline: %s\n"
-     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
+-            " initrd_filename: %s\n",
--    sdhci_initfn(s);
+-            exynos4_board_ram_size[board_type] / 1048576,
--    s->buf_maxsz = sdhci_get_fifolen(s);
+-            exynos4_board_ram_size[board_type],
--    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+-            machine->kernel_filename,
-     s->irq = pci_allocate_irq(dev);
+-            machine->kernel_cmdline,
--    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
+-            machine->initrd_filename);
--            SDHC_REGISTERS_MAP_SIZE);
+-
-     pci_register_bar(dev, 0, 0, &s->iomem);
+     exynos4_boards_init_ram(s, get_system_memory(),
- }
+                             exynos4_board_ram_size[board_type]);
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
      SDHCIState *s = SYSBUS_SDHCI(dev);
      SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 -    s->buf_maxsz = sdhci_get_fifolen(s);
 -    s->fifo_buffer = g_malloc0(s->buf_maxsz);
 +    sdhci_common_realize(s, errp);
 +    if (errp && *errp) {
 +        return;
 +    }
 +
      sysbus_init_irq(sbd, &s->irq);
 -    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
 -            SDHC_REGISTERS_MAP_SIZE);
      sysbus_init_mmio(sbd, &s->iomem);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 13/24] sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
+[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Add common/sysbus/pci/sdbus comments to have clearer code blocks separation.
+It eases code review, unit is explicit.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180115182436.2066-4-f4bug@amsat.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h |  4 +++-
+ hw/arm/exynos4_boards.c | 5 +++--
- hw/sd/sdhci.c         | 25 +++++++++++++++++--------
+file changed, 3 insertions(+), 2 deletions(-)
 files changed, 20 insertions(+), 9 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/hw/arm/exynos4_boards.c
-+++ b/include/hw/sd/sdhci.h
++++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
      uint32_t buf_maxsz;
      uint16_t data_count;   /* current element in FIFO buffer */
      uint8_t  stopped_state;/* Current SDHC state */
 -    bool     pending_insert_quirk;/* Quirk for Raspberry Pi card insert int */
      bool     pending_insert_state;
      /* Buffer Data Port Register - virtual access point to R and W buffers */
      /* Software Reset Register - always reads as 0 */
      /* Force Event Auto CMD12 Error Interrupt Reg - write only */
      /* Force Event Error Interrupt Register- write only */
      /* RO Host Controller Version Register always reads as 0x2401 */
 +
 +    /* Configurable properties */
 +    bool pending_insert_quirk; /* Quirk for Raspberry Pi card insert int */
  } SDHCIState;
  #define TYPE_PCI_SDHCI "sdhci-pci"
 diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sdhci.c
 +++ b/hw/sd/sdhci.c
 @@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
-+#include "qapi/error.h"
++#include "qemu/units.h"
- #include "hw/hw.h"
+ #include "qapi/error.h"
- #include "sysemu/block-backend.h"
+ #include "qemu/error-report.h"
- #include "sysemu/blockdev.h"
+ #include "qemu-common.h"
-@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
+@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
      }
  }
 +/* --- qdev common --- */
 +
 +#define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
 +    /* Capabilities registers provide information on supported features
 +     * of this specific host controller implementation */ \
 +    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
 +    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
 +
  static void sdhci_initfn(SDHCIState *s)
  {
      qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
      },
  };
--/* Capabilities registers provide information on supported features of this
+ static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-- * specific host controller implementation */
+-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-+/* --- qdev PCI --- */
+-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-+
++    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
- static Property sdhci_pci_properties[] = {
++    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 -    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
 -            SDHC_CAPAB_REG_DEFAULT),
 -    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
 +    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
      DEFINE_PROP_END_OF_LIST(),
  };
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_pci_info = {
+ static struct arm_boot_info exynos4_board_binfo = {
      },
  };
 +/* --- qdev SysBus --- */
 +
  static Property sdhci_sysbus_properties[] = {
 -    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
 -            SDHC_CAPAB_REG_DEFAULT),
 -    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
 +    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
      DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
                       false),
      DEFINE_PROP_END_OF_LIST(),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_sysbus_info = {
      .class_init = sdhci_sysbus_class_init,
  };
 +/* --- qdev bus master --- */
 +
  static void sdhci_bus_class_init(ObjectClass *klass, void *data)
  {
      SDBusClass *sbc = SD_BUS_CLASS(klass);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/24] sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
+[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Guenter Roeck <linux@roeck-us.net>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+QEMU already supports pl330. Instantiate it for Exynos4210.
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-7-f4bug@amsat.org
+Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
 / {
     soc: soc {
         amba {
             pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 22 ++++++++++++++++++++++
+ hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
-file changed, 22 insertions(+)
+file changed, 26 insertions(+)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/arm/exynos4210.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/arm/exynos4210.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/bitops.h"
+ /* EHCI */
- #include "hw/sd/sdhci.h"
+ #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
- #include "sdhci-internal.h"
-+#include "qapi/error.h"
++/* DMA */
- #include "qemu/log.h"
++#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
++#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
- /* host controller debug messages */
++#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
-@@ -XXX,XX +XXX,XX @@ static void sdhci_common_realize(SDHCIState *s, Error **errp)
++
-                           SDHC_REGISTERS_MAP_SIZE);
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
-+static void sdhci_common_unrealize(SDHCIState *s, Error **errp)
++static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
 +{
-+    /* This function is expected to be called only once for each class:
++    SysBusDevice *busdev;
-+     * - SysBus:    via DeviceClass->unrealize(),
++    DeviceState *dev;
-+     * - PCI:       via PCIDeviceClass->exit().
++
-+     * However to avoid double-free and/or use-after-free we still nullify
++    dev = qdev_create(NULL, "pl330");
-+     * this variable (better safe than sorry!). */
++    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
-+    g_free(s->fifo_buffer);
++    qdev_init_nofail(dev);
-+    s->fifo_buffer = NULL;
++    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, base);
 +    sysbus_connect_irq(busdev, 0, irq);
 +}
 +
- static bool sdhci_pending_insert_vmstate_needed(void *opaque)
+ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
  {
-     SDHCIState *s = opaque;
+     Exynos4210State *s = g_new0(Exynos4210State, 1);
-@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
- static void sdhci_pci_exit(PCIDevice *dev)
+     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
- {
+             s->irq_table[exynos4210_get_irq(28, 3)]);
-     SDHCIState *s = PCI_SDHCI(dev);
 +    /*** DMA controllers ***/
 +    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 +
-+    sdhci_common_unrealize(s, &error_abort);
+     return s;
      sdhci_uninitfn(s);
  }
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
      sysbus_init_mmio(sbd, &s->iomem);
  }
 +static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
 +{
 +    SDHCIState *s = SYSBUS_SDHCI(dev);
 +
 +    sdhci_common_unrealize(s, &error_abort);
 +}
 +
  static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      dc->props = sdhci_sysbus_properties;
      dc->realize = sdhci_sysbus_realize;
 +    dc->unrealize = sdhci_sysbus_unrealize;
      sdhci_common_class_init(klass, data);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/24] sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
+[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Now both inherited classes appear as DEVICE_CATEGORY_STORAGE.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20190520214342.13709-5-philmd@redhat.com
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Message-id: 20180115182436.2066-5-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sdhci.c | 18 +++++++++++++-----
+ include/hw/arm/exynos4210.h |  9 +++++++--
-file changed, 13 insertions(+), 5 deletions(-)
+ hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
  hw/arm/exynos4_boards.c     |  9 ++++++---
 files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/include/hw/arm/exynos4210.h
-+++ b/hw/sd/sdhci.c
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
-     },
+ } Exynos4210Irq;
- };
+ typedef struct Exynos4210State {
-+static void sdhci_common_class_init(ObjectClass *klass, void *data)
++    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
      Exynos4210Irq irqs;
      qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
      sysbus_connect_irq(busdev, 0, irq);
  }
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 +static void exynos4210_realize(DeviceState *socdev, Error **errp)
  {
 -    Exynos4210State *s = g_new0(Exynos4210State, 1);
 +    Exynos4210State *s = EXYNOS4210_SOC(socdev);
 +    MemoryRegion *system_mem = get_system_memory();
      qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
-+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
++    dc->realize = exynos4210_realize;
 +    dc->vmsd = &sdhci_vmstate;
 +    dc->reset = sdhci_poweron_reset;
 +}
 +
- /* --- qdev PCI --- */
++static const TypeInfo exynos4210_info = {
++    .name = TYPE_EXYNOS4210_SOC,
- static Property sdhci_pci_properties[] = {
++    .parent = TYPE_SYS_BUS_DEVICE,
-@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_class_init(ObjectClass *klass, void *data)
++    .instance_size = sizeof(Exynos4210State),
-     k->vendor_id = PCI_VENDOR_ID_REDHAT;
++    .class_init = exynos4210_class_init,
-     k->device_id = PCI_DEVICE_ID_REDHAT_SDHCI;
++};
      k->class_id = PCI_CLASS_SYSTEM_SDHCI;
 -    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
 -    dc->vmsd = &sdhci_vmstate;
      dc->props = sdhci_pci_properties;
 -    dc->reset = sdhci_poweron_reset;
 +
-+    sdhci_common_class_init(klass, data);
++static void exynos4210_register_types(void)
 +{
 +    type_register_static(&exynos4210_info);
 +}
 +
 +type_init(exynos4210_register_types)
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
  } Exynos4BoardType;
  typedef struct Exynos4BoardState {
 -    Exynos4210State *soc;
 +    Exynos4210State soc;
      MemoryRegion dram0_mem;
      MemoryRegion dram1_mem;
  } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 -    s->soc = exynos4210_init(get_system_memory());
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
 +    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized",
 +                             &error_fatal);
      return s;
  }
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
- static const TypeInfo sdhci_pci_info = {
+                                                       EXYNOS4_BOARD_SMDKC210);
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
- {
+     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-     DeviceClass *dc = DEVICE_CLASS(klass);
+-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
++            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
--    dc->vmsd = &sdhci_vmstate;
+     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
      dc->props = sdhci_sysbus_properties;
      dc->realize = sdhci_sysbus_realize;
 -    dc->reset = sdhci_poweron_reset;
 +
 +    sdhci_common_class_init(klass, data);
  }
- static const TypeInfo sdhci_sysbus_info = {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 17/24] sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-8-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci.c | 7 ++++---
-file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-         ret = (SD_HOST_SPECv2_VERS << 16) | sdhci_slotint(s);
-         break;
-     default:
--        ERRPRINT("bad %ub read: addr[0x%04x]\n", size, (int)offset);
-+        qemu_log_mask(LOG_UNIMP, "SDHC rd_%ub @0x%02" HWADDR_PRIx " "
-+                      "not implemented\n", size, offset);
-         break;
-     }
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         sdhci_update_irq(s);
-         break;
-     default:
--        ERRPRINT("bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n",
--                 size, (int)offset, value >> shift, value >> shift);
-+        qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
-+                      "not implemented\n", size, offset, value >> shift);
-         break;
-     }
-     DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
---
-.7.4

-[Qemu-devel] [PULL 19/24] sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-10-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci-internal.h | 1 +
- hw/sd/sdhci.c          | 3 +--
-files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
-+++ b/hw/sd/sdhci-internal.h
-@@ -XXX,XX +XXX,XX @@
- #define SDHC_TRNS_ACMD12               0x0004
- #define SDHC_TRNS_READ                 0x0010
- #define SDHC_TRNS_MULTI                0x0020
-+#define SDHC_TRNMOD_MASK               0x0037
- /* R/W Command Register 0x0 */
- #define SDHC_CMDREG                    0x0E
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@
-     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
-     (SDHC_CAPAB_TOCLKFREQ))
--#define MASK_TRNMOD     0x0037
- #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
- static uint8_t sdhci_slotint(SDHCIState *s)
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
-             value &= ~SDHC_TRNS_DMA;
-         }
--        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
-+        MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
-         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
-         /* Writing to the upper byte of CMDREG triggers SD command generation */
---
-.7.4

-[Qemu-devel] [PULL 20/24] sdhci: rename the SDHC_CAPAB register
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-11-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci-internal.h | 2 +-
- hw/sd/sdhci.c          | 2 +-
-files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci-internal.h
-+++ b/hw/sd/sdhci-internal.h
-@@ -XXX,XX +XXX,XX @@
- #define SDHC_ACMD12ERRSTS              0x3C
- /* HWInit Capabilities Register 0x05E80080 */
--#define SDHC_CAPAREG                   0x40
-+#define SDHC_CAPAB                     0x40
- #define SDHC_CAN_DO_DMA                0x00400000
- #define SDHC_CAN_DO_ADMA2              0x00080000
- #define SDHC_CAN_DO_ADMA1              0x00100000
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-     case SDHC_ACMD12ERRSTS:
-         ret = s->acmd12errsts;
-         break;
--    case SDHC_CAPAREG:
-+    case SDHC_CAPAB:
-         ret = s->capareg;
-         break;
-     case SDHC_MAXCURR:
---
-.7.4

-[Qemu-devel] [PULL 21/24] sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-running qtests:
-  $ make check-qtest-arm
-    GTESTER check-qtest-arm
-  SDHC rd_4b @0x44 not implemented
-  SDHC wr_4b @0x40 <- 0x89abcdef not implemented
-  SDHC wr_4b @0x44 <- 0x01234567 not implemented
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-12-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/sd/sdhci.h |  4 ++--
- hw/sd/sdhci.c         | 23 +++++++++++++++++++----
-files changed, 21 insertions(+), 6 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     uint64_t admasysaddr;  /* ADMA System Address Register */
-     /* Read-only registers */
--    uint32_t capareg;      /* Capabilities Register */
--    uint32_t maxcurr;      /* Maximum Current Capabilities Register */
-+    uint64_t capareg;      /* Capabilities Register */
-+    uint64_t maxcurr;      /* Maximum Current Capabilities Register */
-     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
-     uint32_t buf_maxsz;
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
-         ret = s->acmd12errsts;
-         break;
-     case SDHC_CAPAB:
--        ret = s->capareg;
-+        ret = (uint32_t)s->capareg;
-+        break;
-+    case SDHC_CAPAB + 4:
-+        ret = (uint32_t)(s->capareg >> 32);
-         break;
-     case SDHC_MAXCURR:
--        ret = s->maxcurr;
-+        ret = (uint32_t)s->maxcurr;
-+        break;
-+    case SDHC_MAXCURR + 4:
-+        ret = (uint32_t)(s->maxcurr >> 32);
-         break;
-     case SDHC_ADMAERR:
-         ret =  s->admaerr;
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         }
-         sdhci_update_irq(s);
-         break;
-+
-+    case SDHC_CAPAB:
-+    case SDHC_CAPAB + 4:
-+    case SDHC_MAXCURR:
-+    case SDHC_MAXCURR + 4:
-+        qemu_log_mask(LOG_GUEST_ERROR, "SDHC wr_%ub @0x%02" HWADDR_PRIx
-+                      " <- 0x%08x read-only\n", size, offset, value >> shift);
-+        break;
-+
-     default:
-         qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
-                       "not implemented\n", size, offset, value >> shift);
-@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
- #define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
-     /* Capabilities registers provide information on supported features
-      * of this specific host controller implementation */ \
--    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
--    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
-+    DEFINE_PROP_UINT64("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
-+    DEFINE_PROP_UINT64("maxcurr", _state, maxcurr, 0)
- static void sdhci_initfn(SDHCIState *s)
- {
---
-.7.4

-[Qemu-devel] [PULL 22/24] sdhci: Implement write method of ACMD12ERRSTS register
+Deleted patch
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 20180115182436.2066-13-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sdhci.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
-         }
-         sdhci_update_irq(s);
-         break;
-+    case SDHC_ACMD12ERRSTS:
-+        MASKED_WRITE(s->acmd12errsts, mask, value);
-+        break;
-     case SDHC_CAPAB:
-     case SDHC_CAPAB + 4:
---
-.7.4

-[Qemu-devel] [PULL 23/24] sdhci: fix the PCI device, using the PCI address space for DMA
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-While SysBus devices can use the get_system_memory() address space,
-PCI devices should use the bus master address space for DMA.
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180115182436.2066-14-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/sd/sdhci.h |  1 +
- hw/sd/sdhci.c         | 29 +++++++++++++++--------------
-files changed, 16 insertions(+), 14 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
-+++ b/include/hw/sd/sdhci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
-     /*< public >*/
-     SDBus sdbus;
-     MemoryRegion iomem;
-+    AddressSpace *dma_as;
-     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
-     QEMUTimer *transfer_timer;
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
-                     s->blkcnt--;
-                 }
-             }
--            dma_memory_write(&address_space_memory, s->sdmasysad,
-+            dma_memory_write(s->dma_as, s->sdmasysad,
-                              &s->fifo_buffer[begin], s->data_count - begin);
-             s->sdmasysad += s->data_count - begin;
-             if (s->data_count == block_size) {
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
-                 s->data_count = block_size;
-                 boundary_count -= block_size - begin;
-             }
--            dma_memory_read(&address_space_memory, s->sdmasysad,
-+            dma_memory_read(s->dma_as, s->sdmasysad,
-                             &s->fifo_buffer[begin], s->data_count - begin);
-             s->sdmasysad += s->data_count - begin;
-             if (s->data_count == block_size) {
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
-         for (n = 0; n < datacnt; n++) {
-             s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
-         }
--        dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer,
--                         datacnt);
-+        dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
-     } else {
--        dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer,
--                        datacnt);
-+        dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
-         for (n = 0; n < datacnt; n++) {
-             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
-         }
-@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
-     hwaddr entry_addr = (hwaddr)s->admasysaddr;
-     switch (SDHC_DMA_TYPE(s->hostctl)) {
-     case SDHC_CTRL_ADMA2_32:
--        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma2,
-+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma2,
-                         sizeof(adma2));
-         adma2 = le64_to_cpu(adma2);
-         /* The spec does not specify endianness of descriptor table.
-@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
-         dscr->incr = 8;
-         break;
-     case SDHC_CTRL_ADMA1_32:
--        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma1,
-+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma1,
-                         sizeof(adma1));
-         adma1 = le32_to_cpu(adma1);
-         dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
-@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
-         }
-         break;
-     case SDHC_CTRL_ADMA2_64:
--        dma_memory_read(&address_space_memory, entry_addr,
-+        dma_memory_read(s->dma_as, entry_addr,
-                         (uint8_t *)(&dscr->attr), 1);
--        dma_memory_read(&address_space_memory, entry_addr + 2,
-+        dma_memory_read(s->dma_as, entry_addr + 2,
-                         (uint8_t *)(&dscr->length), 2);
-         dscr->length = le16_to_cpu(dscr->length);
--        dma_memory_read(&address_space_memory, entry_addr + 4,
-+        dma_memory_read(s->dma_as, entry_addr + 4,
-                         (uint8_t *)(&dscr->addr), 8);
-         dscr->attr = le64_to_cpu(dscr->attr);
-         dscr->attr &= 0xfffffff8;
-@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
-                         s->data_count = block_size;
-                         length -= block_size - begin;
-                     }
--                    dma_memory_write(&address_space_memory, dscr.addr,
-+                    dma_memory_write(s->dma_as, dscr.addr,
-                                      &s->fifo_buffer[begin],
-                                      s->data_count - begin);
-                     dscr.addr += s->data_count - begin;
-@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
-                         s->data_count = block_size;
-                         length -= block_size - begin;
-                     }
--                    dma_memory_read(&address_space_memory, dscr.addr,
-+                    dma_memory_read(s->dma_as, dscr.addr,
-                                     &s->fifo_buffer[begin],
-                                     s->data_count - begin);
-                     dscr.addr += s->data_count - begin;
-@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
-     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
-     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
-     s->irq = pci_allocate_irq(dev);
--    pci_register_bar(dev, 0, 0, &s->iomem);
-+    s->dma_as = pci_get_address_space(dev);
-+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->iomem);
- }
- static void sdhci_pci_exit(PCIDevice *dev)
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
-         return;
-     }
-+    s->dma_as = &address_space_memory;
-+
-     sysbus_init_irq(sbd, &s->irq);
-     sysbus_init_mmio(sbd, &s->iomem);
- }
---
-.7.4

More arm patches (mostly the SDHCI ones from Philippe)

thanks
-- PMM

The following changes since commit f521eeee3bd060b460c99e605472b7e03967db43:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20180115' into staging (2018-01-15 13:17:47 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180116

for you to fetch changes up to 60765b6ceeb4998a0d4220b3a53f1f185061da77:

sdhci: add a 'dma' property to the sysbus devices (2018-01-16 13:28:21 +0000)

----------------------------------------------------------------
target-arm queue:
 * SDHCI: cleanups and minor bug fixes
 * target/arm: minor refactor preparatory to fp16 support
 * omap_ssd, ssi-sd, pl181, milkymist-memcard: reset the SD
   card on controller reset (fixes migration failures)
 * target/arm: Handle page table walk load failures correctly
 * hw/arm/virt: Add virt-2.12 machine type
 * get_phys_addr_pmsav7: Support AP=0b111 for v7M
 * hw/intc/armv7m: Support byte and halfword accesses to CFSR

----------------------------------------------------------------
Andrey Smirnov (1):
      sdhci: Implement write method of ACMD12ERRSTS register

Peter Maydell (8):
      hw/intc/armv7m: Support byte and halfword accesses to CFSR
      get_phys_addr_pmsav7: Support AP=0b111 for v7M
      hw/arm/virt: Add virt-2.12 machine type
      target/arm: Handle page table walk load failures correctly
      hw/sd/pl181: Reset SD card on controller reset
      hw/sd/milkymist-memcard: Reset SD card on controller reset
      hw/sd/ssi-sd: Reset SD card on controller reset
      hw/sd/omap_mmc: Reset SD card on controller reset

Philippe Mathieu-Daudé (13):
      sdhci: clean up includes
      sdhci: remove dead code
      sdhci: use DEFINE_SDHCI_COMMON_PROPERTIES() for common sysbus/pci properties
      sdhci: refactor common sysbus/pci class_init() into sdhci_common_class_init()
      sdhci: refactor common sysbus/pci realize() into sdhci_common_realize()
      sdhci: refactor common sysbus/pci unrealize() into sdhci_common_unrealize()
      sdhci: use qemu_log_mask(UNIMP) instead of fprintf()
      sdhci: convert the DPRINT() calls into trace events
      sdhci: move MASK_TRNMOD with other SDHC_TRN* defines in "sd-internal.h"
      sdhci: rename the SDHC_CAPAB register
      sdhci: fix CAPAB/MAXCURR registers, both are 64bit and read-only
      sdhci: fix the PCI device, using the PCI address space for DMA
      sdhci: add a 'dma' property to the sysbus devices

Richard Henderson (2):
      target/arm: Split out vfp_expand_imm
      target/arm: Add fp16 support to vfp_expand_imm

The Configurable Fault Status Register for ARMv7M and v8M is
supposed to be byte and halfword accessible, but we were only
implementing word accesses. Add support for the other access
sizes, which are used by the Zephyr RTOS.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Andy Gross <andy.gross@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1512742372-31517-1-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 38 ++++++++++++++++++++++----------------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             val |= (1 << 8);
         }
         return val;
-    case 0xd28: /* Configurable Fault Status.  */
-        /* The BFSR bits [15:8] are shared between security states
-         * and we store them in the NS copy
-         */
-        val = cpu->env.v7m.cfsr[attrs.secure];
-        val |= cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
-        return val;
     case 0xd2c: /* Hard Fault Status.  */
         return cpu->env.v7m.hfsr;
     case 0xd30: /* Debug Fault Status.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         s->vectors[ARMV7M_EXCP_DEBUG].active = (value & (1 << 8)) != 0;
         nvic_irq_update(s);
         break;
-    case 0xd28: /* Configurable Fault Status.  */
-        cpu->env.v7m.cfsr[attrs.secure] &= ~value; /* W1C */
-        if (attrs.secure) {
-            /* The BFSR bits [15:8] are shared between security states
-             * and we store them in the NS copy.
-             */
-            cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
-        }
-        break;
     case 0xd2c: /* Hard Fault Status.  */
         cpu->env.v7m.hfsr &= ~value; /* W1C */
         break;
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
             val = deposit32(val, i * 8, 8, get_prio(s, hdlidx, sbank));
         }
         break;
+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+        /* The BFSR bits [15:8] are shared between security states
+         * and we store them in the NS copy
+         */
+        val = s->cpu->env.v7m.cfsr[attrs.secure];
+        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        val = extract32(val, (offset - 0xd28) * 8, size * 8);
+        break;
     case 0xfe0 ... 0xfff: /* ID.  */
         if (offset & 3) {
             val = 0;
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
         }
         nvic_irq_update(s);
         return MEMTX_OK;
+    case 0xd28 ... 0xd2b: /* Configurable Fault Status (CFSR) */
+        /* All bits are W1C, so construct 32 bit value with 0s in
+         * the parts not written by the access size
+         */
+        value <<= ((offset - 0xd28) * 8);
+
+        s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
+        if (attrs.secure) {
+            /* The BFSR bits [15:8] are shared between security states
+             * and we store them in the NS copy.
+             */
+            s->cpu->env.v7m.cfsr[M_REG_NS] &= ~(value & R_V7M_CFSR_BFSR_MASK);
+        }
+        return MEMTX_OK;
     }
     if (size == 4) {
         nvic_writel(s, offset, value, attrs);
-- 
2.7.4

For PMSAv7, the v7A/R Arm ARM defines that setting AP to 0b111
is an UNPREDICTABLE reserved combination. However, for v7M
this value is documented as having the same behaviour as 0b110:
read-only for both privileged and unprivileged. Accept this
value on an M profile core rather than treating it as a guest
error and a no-access page.

Reported-by: Andy Gross <andy.gross@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1512742402-31669-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 6:
                     *prot |= PAGE_READ | PAGE_EXEC;
                     break;
+                case 7:
+                    /* for v7M, same as 6; for R profile a reserved value */
+                    if (arm_feature(env, ARM_FEATURE_M)) {
+                        *prot |= PAGE_READ | PAGE_EXEC;
+                        break;
+                    }
+                    /* fall through */
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
                                   "DRACR[%d]: Bad value for AP bits: 0x%"
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 case 6:
                     *prot |= PAGE_READ | PAGE_EXEC;
                     break;
+                case 7:
+                    /* for v7M, same as 6; for R profile a reserved value */
+                    if (arm_feature(env, ARM_FEATURE_M)) {
+                        *prot |= PAGE_READ | PAGE_EXEC;
+                        break;
+                    }
+                    /* fall through */
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
                                   "DRACR[%d]: Bad value for AP bits: 0x%"
-- 
2.7.4

Add virt-2.12 machine type.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-static void virt_2_11_instance_init(Object *obj)
+static void virt_2_12_instance_init(Object *obj)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
@@ -XXX,XX +XXX,XX @@ static void virt_2_11_instance_init(Object *obj)
     vms->irqmap = a15irqmap;
 }
 
+static void virt_machine_2_12_options(MachineClass *mc)
+{
+}
+DEFINE_VIRT_MACHINE_AS_LATEST(2, 12)
+
+#define VIRT_COMPAT_2_11 \
+    HW_COMPAT_2_11
+
+static void virt_2_11_instance_init(Object *obj)
+{
+    virt_2_12_instance_init(obj);
+}
+
 static void virt_machine_2_11_options(MachineClass *mc)
 {
+    virt_machine_2_12_options(mc);
+    SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_11);
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(2, 11)
+DEFINE_VIRT_MACHINE(2, 11)
 
 #define VIRT_COMPAT_2_10 \
     HW_COMPAT_2_10
-- 
2.7.4

Instead of ignoring the response from address_space_ld*()
(indicating an attempt to read a page table descriptor from
an invalid physical address), use it to report the failure
correctly.

Since this is another couple of locations where we need to
decide the value of the ARMMMUFaultInfo ea bit based on a
MemTxResult, we factor out that operation into a helper
function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 39 ++++++++++++++++++++++++++++++++++-----
 target/arm/op_helper.c |  7 +------
 3 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     return fsc;
 }
 
+static inline bool arm_extabort_type(MemTxResult result)
+{
+    /* The EA bit in syndromes and fault status registers is an
+     * IMPDEF classification of external aborts. ARM implementations
+     * usually use this to indicate AXI bus Decode error (0) or
+     * Slave error (1); in QEMU we follow that.
+     */
+    return result != MEMTX_DECODE_ERROR;
+}
+
 /* Do a page table walk and add page to TLB if possible */
 bool arm_tlb_fill(CPUState *cpu, vaddr address,
                   MMUAccessType access_type, int mmu_idx,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
                                  &txattrs, &s2prot, &s2size, fi, NULL);
         if (ret) {
+            assert(fi->type != ARMFault_None);
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     MemTxAttrs attrs = {};
+    MemTxResult result = MEMTX_OK;
     AddressSpace *as;
+    uint32_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
         return 0;
     }
     if (regime_translation_big_endian(env, mmu_idx)) {
-        return address_space_ldl_be(as, addr, attrs, NULL);
+        data = address_space_ldl_be(as, addr, attrs, &result);
     } else {
-        return address_space_ldl_le(as, addr, attrs, NULL);
+        data = address_space_ldl_le(as, addr, attrs, &result);
     }
+    if (result == MEMTX_OK) {
+        return data;
+    }
+    fi->type = ARMFault_SyncExternalOnWalk;
+    fi->ea = arm_extabort_type(result);
+    return 0;
 }
 
 static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     MemTxAttrs attrs = {};
+    MemTxResult result = MEMTX_OK;
     AddressSpace *as;
+    uint32_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
         return 0;
     }
     if (regime_translation_big_endian(env, mmu_idx)) {
-        return address_space_ldq_be(as, addr, attrs, NULL);
+        data = address_space_ldq_be(as, addr, attrs, &result);
     } else {
-        return address_space_ldq_le(as, addr, attrs, NULL);
+        data = address_space_ldq_le(as, addr, attrs, &result);
+    }
+    if (result == MEMTX_OK) {
+        return data;
     }
+    fi->type = ARMFault_SyncExternalOnWalk;
+    fi->ea = arm_extabort_type(result);
+    return 0;
 }
 
 static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
     }
     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                        mmu_idx, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
     type = (desc & 3);
     domain = (desc >> 5) & 0x0f;
     if (regime_el(env, mmu_idx) == 1) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, uint32_t address,
         }
         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                            mmu_idx, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
         switch (desc & 3) {
         case 0: /* Page translation fault.  */
             fi->type = ARMFault_Translation;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
     }
     desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                        mmu_idx, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
     type = (desc & 3);
     if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
         /* Section translation fault, or attempt to use the encoding
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
         desc = arm_ldl_ptw(cs, table, regime_is_secure(env, mmu_idx),
                            mmu_idx, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
         ap = ((desc >> 4) & 3) | ((desc >> 7) & 4);
         switch (desc & 3) {
         case 0: /* Page translation fault.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
         descaddr &= ~7ULL;
         nstable = extract32(tableattrs, 4, 1);
         descriptor = arm_ldq_ptw(cs, descaddr, !nstable, mmu_idx, fi);
-        if (fi->s1ptw) {
+        if (fi->type != ARMFault_None) {
             goto do_fault;
         }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
     /* now we have a real cpu fault */
     cpu_restore_state(cs, retaddr);
 
-    /* The EA bit in syndromes and fault status registers is an
-     * IMPDEF classification of external aborts. ARM implementations
-     * usually use this to indicate AXI bus Decode error (0) or
-     * Slave error (1); in QEMU we follow that.
-     */
-    fi.ea = (response != MEMTX_DECODE_ERROR);
+    fi.ea = arm_extabort_type(response);
     fi.type = ARMFault_SyncExternal;
     deliver_fault(cpu, addr, access_type, mmu_idx, &fi);
 }
-- 
2.7.4

Since pl181 is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

Failing to do this mostly didn't affect the guest since the
guest typically does a programmed SD card reset as part of
its SD controller driver initialization, but meant that
migration failed because it's only in sd_reset() that we
set up the wpgrps_size field.

Cc: qemu-stable@nongnu.org
Fixes: https://bugs.launchpad.net/qemu/+bug/1739378
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-2-git-send-email-peter.maydell@linaro.org
---
 hw/sd/pl181.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/pl181.c b/hw/sd/pl181.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/pl181.c
+++ b/hw/sd/pl181.c
@@ -XXX,XX +XXX,XX @@ static void pl181_reset(DeviceState *d)
 
     /* We can assume our GPIO outputs have been wired up now */
     sd_set_cb(s->card, s->cardstatus[0], s->cardstatus[1]);
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->card));
 }
 
 static void pl181_init(Object *obj)
-- 
2.7.4

Since milkymist-memcard is still using the legacy SD card API,
the SD card created by sd_init() is not plugged into any bus.
This means that the controller has to reset it manually.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-3-git-send-email-peter.maydell@linaro.org
---
 hw/sd/milkymist-memcard.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@ static void milkymist_memcard_reset(DeviceState *d)
     for (i = 0; i < R_MAX; i++) {
         s->regs[i] = 0;
     }
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->card));
 }
 
 static int milkymist_memcard_init(SysBusDevice *dev)
-- 
2.7.4

Since ssi-sd is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

In the case of sd-ssi, we have to implement an entire
reset function since there wasn't one previously, and
that requires a QOM cast macro that got omitted when this
device was QOMified.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-4-git-send-email-peter.maydell@linaro.org
---
 hw/sd/ssi-sd.c | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/hw/sd/ssi-sd.c b/hw/sd/ssi-sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/ssi-sd.c
+++ b/hw/sd/ssi-sd.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     SDState *sd;
 } ssi_sd_state;
 
+#define TYPE_SSI_SD "ssi-sd"
+#define SSI_SD(obj) OBJECT_CHECK(ssi_sd_state, (obj), TYPE_SSI_SD)
+
 /* State word bits.  */
 #define SSI_SDR_LOCKED          0x0001
 #define SSI_SDR_WP_ERASE        0x0002
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
     ssi_sd_state *s = FROM_SSI_SLAVE(ssi_sd_state, d);
     DriveInfo *dinfo;
 
-    s->mode = SSI_SD_CMD;
     /* FIXME use a qdev drive property instead of drive_get_next() */
     dinfo = drive_get_next(IF_SD);
     s->sd = sd_init(dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, true);
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_realize(SSISlave *d, Error **errp)
     }
 }
 
+static void ssi_sd_reset(DeviceState *dev)
+{
+    ssi_sd_state *s = SSI_SD(dev);
+
+    s->mode = SSI_SD_CMD;
+    s->cmd = 0;
+    memset(s->cmdarg, 0, sizeof(s->cmdarg));
+    memset(s->response, 0, sizeof(s->response));
+    s->arglen = 0;
+    s->response_pos = 0;
+    s->stopping = 0;
+
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually.
+     */
+    device_reset(DEVICE(s->sd));
+}
+
 static void ssi_sd_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void ssi_sd_class_init(ObjectClass *klass, void *data)
     k->transfer = ssi_sd_transfer;
     k->cs_polarity = SSI_CS_LOW;
     dc->vmsd = &vmstate_ssi_sd;
+    dc->reset = ssi_sd_reset;
 }
 
 static const TypeInfo ssi_sd_info = {
-    .name          = "ssi-sd",
+    .name          = TYPE_SSI_SD,
     .parent        = TYPE_SSI_SLAVE,
     .instance_size = sizeof(ssi_sd_state),
     .class_init    = ssi_sd_class_init,
-- 
2.7.4

Since omap_mmc is still using the legacy SD card API, the SD
card created by sd_init() is not plugged into any bus. This
means that the controller has to reset it manually.

Failing to do this mostly didn't affect the guest since the
guest typically does a programmed SD card reset as part of
its SD controller driver initialization, but would mean that
migration fails because it's only in sd_reset() that we
set up the wpgrps_size field.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1515506513-31961-5-git-send-email-peter.maydell@linaro.org
---
 hw/sd/omap_mmc.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
     host->cdet_enable = 0;
     qemu_set_irq(host->coverswitch, host->cdet_state);
     host->clkdiv = 0;
+
+    /* Since we're still using the legacy SD API the card is not plugged
+     * into any bus, and we must reset it manually. When omap_mmc is
+     * QOMified this must move into the QOM reset function.
+     */
+    device_reset(DEVICE(host->card));
 }
 
 static uint64_t omap_mmc_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
     s->lines = 1;	/* TODO: needs to be settable per-board */
     s->rev = 1;
 
-    omap_mmc_reset(s);
-
     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc", 0x800);
     memory_region_add_subregion(sysmem, base, &s->iomem);
 
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap_mmc_init(hwaddr base,
         exit(1);
     }
 
+    omap_mmc_reset(s);
+
     return s;
 }
 
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
     s->lines = 4;
     s->rev = 2;
 
-    omap_mmc_reset(s);
-
     memory_region_init_io(&s->iomem, NULL, &omap_mmc_ops, s, "omap.mmc",
                           omap_l4_region_size(ta, 0));
     omap_l4_attach(ta, 0, &s->iomem);
@@ -XXX,XX +XXX,XX @@ struct omap_mmc_s *omap2_mmc_init(struct omap_target_agent_s *ta,
     s->cdet = qemu_allocate_irq(omap_mmc_cover_cb, s, 0);
     sd_set_cb(s->card, NULL, s->cdet);
 
+    omap_mmc_reset(s);
+
     return s;
 }
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180110063337.21538-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 44 ++++++++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
+/* The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+static uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* The imm8 encodes the sign bit, enough bits to represent
-     * an exponent in the range 01....1xx to 10....0xx,
-     * and the most significant 4 bits of the mantissa; see
-     * VFPExpandImm() in the v8 ARM ARM.
-     */
-    if (is_double) {
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-    } else {
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-    }
+    imm = vfp_expand_imm(MO_32 + is_double, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 4 ----
 include/hw/sd/sdhci.h  | 7 ++++++-
 hw/sd/sdhci.c          | 1 +
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef SDHCI_INTERNAL_H
 #define SDHCI_INTERNAL_H
 
-#include "hw/sd/sdhci.h"
-
 /* R/W SDMA System Address register 0x0 */
 #define SDHC_SYSAD                     0x00
 
@@ -XXX,XX +XXX,XX @@ enum {
     sdhc_gap_write  = 2   /* SDHC stopped at block gap during write operation */
 };
 
-extern const VMStateDescription sdhci_vmstate;
-
 #endif
diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@
 #define SDHCI_H
 
 #include "qemu-common.h"
-#include "hw/block/block.h"
 #include "hw/pci/pci.h"
 #include "hw/sysbus.h"
 #include "hw/sd/sd.h"
 
 /* SD/MMC host controller state */
 typedef struct SDHCIState {
+    /*< private >*/
     union {
         PCIDevice pcidev;
         SysBusDevice busdev;
     };
+
+    /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
 
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     qemu_irq ro_cb;
     qemu_irq irq;
 
+    /* Registers cleared on reset */
     uint32_t sdmasysad;    /* SDMA System Address register */
     uint16_t blksize;      /* Host DMA Buff Boundary and Transfer BlkSize Reg */
     uint16_t blkcnt;       /* Blocks count for current transfer */
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint16_t acmd12errsts; /* Auto CMD12 error status register */
     uint64_t admasysaddr;  /* ADMA System Address Register */
 
+    /* Read-only registers */
     uint32_t capareg;      /* Capabilities Register */
     uint32_t maxcurr;      /* Maximum Current Capabilities Register */
+
     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
     uint32_t buf_maxsz;
     uint16_t data_count;   /* current element in FIFO buffer */
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
+#include "hw/sd/sdhci.h"
 #include "sdhci-internal.h"
 #include "qemu/log.h"
 
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h | 2 --
 hw/sd/sdhci.c         | 2 --
 2 files changed, 4 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
 
     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
     QEMUTimer *transfer_timer;
-    qemu_irq eject_cb;
-    qemu_irq ro_cb;
     qemu_irq irq;
 
     /* Registers cleared on reset */
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
     timer_free(s->insert_timer);
     timer_del(s->transfer_timer);
     timer_free(s->transfer_timer);
-    qemu_free_irq(s->eject_cb);
-    qemu_free_irq(s->ro_cb);
 
     g_free(s->fifo_buffer);
     s->fifo_buffer = NULL;
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add common/sysbus/pci/sdbus comments to have clearer code blocks separation.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180115182436.2066-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  4 +++-
 hw/sd/sdhci.c         | 25 +++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint32_t buf_maxsz;
     uint16_t data_count;   /* current element in FIFO buffer */
     uint8_t  stopped_state;/* Current SDHC state */
-    bool     pending_insert_quirk;/* Quirk for Raspberry Pi card insert int */
     bool     pending_insert_state;
     /* Buffer Data Port Register - virtual access point to R and W buffers */
     /* Software Reset Register - always reads as 0 */
     /* Force Event Auto CMD12 Error Interrupt Reg - write only */
     /* Force Event Error Interrupt Register- write only */
     /* RO Host Controller Version Register always reads as 0x2401 */
+
+    /* Configurable properties */
+    bool pending_insert_quirk; /* Quirk for Raspberry Pi card insert int */
 } SDHCIState;
 
 #define TYPE_PCI_SDHCI "sdhci-pci"
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "hw/hw.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
     }
 }
 
+/* --- qdev common --- */
+
+#define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
+    /* Capabilities registers provide information on supported features
+     * of this specific host controller implementation */ \
+    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
+    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
+
 static void sdhci_initfn(SDHCIState *s)
 {
     qbus_create_inplace(&s->sdbus, sizeof(s->sdbus),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
     },
 };
 
-/* Capabilities registers provide information on supported features of this
- * specific host controller implementation */
+/* --- qdev PCI --- */
+
 static Property sdhci_pci_properties[] = {
-    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
-            SDHC_CAPAB_REG_DEFAULT),
-    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_pci_info = {
     },
 };
 
+/* --- qdev SysBus --- */
+
 static Property sdhci_sysbus_properties[] = {
-    DEFINE_PROP_UINT32("capareg", SDHCIState, capareg,
-            SDHC_CAPAB_REG_DEFAULT),
-    DEFINE_PROP_UINT32("maxcurr", SDHCIState, maxcurr, 0),
+    DEFINE_SDHCI_COMMON_PROPERTIES(SDHCIState),
     DEFINE_PROP_BOOL("pending-insert-quirk", SDHCIState, pending_insert_quirk,
                      false),
     DEFINE_PROP_END_OF_LIST(),
@@ -XXX,XX +XXX,XX @@ static const TypeInfo sdhci_sysbus_info = {
     .class_init = sdhci_sysbus_class_init,
 };
 
+/* --- qdev bus master --- */
+
 static void sdhci_bus_class_init(ObjectClass *klass, void *data)
 {
     SDBusClass *sbc = SD_BUS_CLASS(klass);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Now both inherited classes appear as DEVICE_CATEGORY_STORAGE.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ const VMStateDescription sdhci_vmstate = {
     },
 };
 
+static void sdhci_common_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+    dc->vmsd = &sdhci_vmstate;
+    dc->reset = sdhci_poweron_reset;
+}
+
 /* --- qdev PCI --- */
 
 static Property sdhci_pci_properties[] = {
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_class_init(ObjectClass *klass, void *data)
     k->vendor_id = PCI_VENDOR_ID_REDHAT;
     k->device_id = PCI_DEVICE_ID_REDHAT_SDHCI;
     k->class_id = PCI_CLASS_SYSTEM_SDHCI;
-    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
-    dc->vmsd = &sdhci_vmstate;
     dc->props = sdhci_pci_properties;
-    dc->reset = sdhci_poweron_reset;
+
+    sdhci_common_class_init(klass, data);
 }
 
 static const TypeInfo sdhci_pci_info = {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->vmsd = &sdhci_vmstate;
     dc->props = sdhci_sysbus_properties;
     dc->realize = sdhci_sysbus_realize;
-    dc->reset = sdhci_poweron_reset;
+
+    sdhci_common_class_init(klass, data);
 }
 
 static const TypeInfo sdhci_sysbus_info = {
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_uninitfn(SDHCIState *s)
     s->fifo_buffer = NULL;
 }
 
+static void sdhci_common_realize(SDHCIState *s, Error **errp)
+{
+    s->buf_maxsz = sdhci_get_fifolen(s);
+    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
+                          SDHC_REGISTERS_MAP_SIZE);
+}
+
 static bool sdhci_pending_insert_vmstate_needed(void *opaque)
 {
     SDHCIState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static Property sdhci_pci_properties[] = {
 static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
 {
     SDHCIState *s = PCI_SDHCI(dev);
+
+    sdhci_initfn(s);
+    sdhci_common_realize(s, errp);
+    if (errp && *errp) {
+        return;
+    }
+
     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
-    sdhci_initfn(s);
-    s->buf_maxsz = sdhci_get_fifolen(s);
-    s->fifo_buffer = g_malloc0(s->buf_maxsz);
     s->irq = pci_allocate_irq(dev);
-    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
-            SDHC_REGISTERS_MAP_SIZE);
     pci_register_bar(dev, 0, 0, &s->iomem);
 }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     SDHCIState *s = SYSBUS_SDHCI(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    s->buf_maxsz = sdhci_get_fifolen(s);
-    s->fifo_buffer = g_malloc0(s->buf_maxsz);
+    sdhci_common_realize(s, errp);
+    if (errp && *errp) {
+        return;
+    }
+
     sysbus_init_irq(sbd, &s->irq);
-    memory_region_init_io(&s->iomem, OBJECT(s), &sdhci_mmio_ops, s, "sdhci",
-            SDHC_REGISTERS_MAP_SIZE);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-7-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "hw/sd/sdhci.h"
 #include "sdhci-internal.h"
+#include "qapi/error.h"
 #include "qemu/log.h"
 
 /* host controller debug messages */
@@ -XXX,XX +XXX,XX @@ static void sdhci_common_realize(SDHCIState *s, Error **errp)
                           SDHC_REGISTERS_MAP_SIZE);
 }
 
+static void sdhci_common_unrealize(SDHCIState *s, Error **errp)
+{
+    /* This function is expected to be called only once for each class:
+     * - SysBus:    via DeviceClass->unrealize(),
+     * - PCI:       via PCIDeviceClass->exit().
+     * However to avoid double-free and/or use-after-free we still nullify
+     * this variable (better safe than sorry!). */
+    g_free(s->fifo_buffer);
+    s->fifo_buffer = NULL;
+}
+
 static bool sdhci_pending_insert_vmstate_needed(void *opaque)
 {
     SDHCIState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
 static void sdhci_pci_exit(PCIDevice *dev)
 {
     SDHCIState *s = PCI_SDHCI(dev);
+
+    sdhci_common_unrealize(s, &error_abort);
     sdhci_uninitfn(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
+static void sdhci_sysbus_unrealize(DeviceState *dev, Error **errp)
+{
+    SDHCIState *s = SYSBUS_SDHCI(dev);
+
+    sdhci_common_unrealize(s, &error_abort);
+}
+
 static void sdhci_sysbus_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->props = sdhci_sysbus_properties;
     dc->realize = sdhci_sysbus_realize;
+    dc->unrealize = sdhci_sysbus_unrealize;
 
     sdhci_common_class_init(klass, data);
 }
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
         ret = (SD_HOST_SPECv2_VERS << 16) | sdhci_slotint(s);
         break;
     default:
-        ERRPRINT("bad %ub read: addr[0x%04x]\n", size, (int)offset);
+        qemu_log_mask(LOG_UNIMP, "SDHC rd_%ub @0x%02" HWADDR_PRIx " "
+                      "not implemented\n", size, offset);
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         sdhci_update_irq(s);
         break;
     default:
-        ERRPRINT("bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n",
-                 size, (int)offset, value >> shift, value >> shift);
+        qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
+                      "not implemented\n", size, offset, value >> shift);
         break;
     }
     DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

zero-initialize ADMADescr 'dscr' in sdhci_do_adma() to avoid:

hw/sd/sdhci.c: In function ‘sdhci_do_adma’:
  hw/sd/sdhci.c:714:29: error: ‘dscr.addr’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
             trace_sdhci_adma("link", s->admasysaddr);
                             ^

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-9-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci.c      | 89 ++++++++++++++++++------------------------------------
 hw/sd/trace-events | 14 +++++++++
 2 files changed, 44 insertions(+), 59 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
 #include "sdhci-internal.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
-
-/* host controller debug messages */
-#ifndef SDHC_DEBUG
-#define SDHC_DEBUG                        0
-#endif
-
-#define DPRINT_L1(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG) { \
-            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
-        } \
-    } while (0)
-#define DPRINT_L2(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG > 1) { \
-            fprintf(stderr, "QEMU SDHC: " fmt, ## args); \
-        } \
-    } while (0)
-#define ERRPRINT(fmt, args...) \
-    do { \
-        if (SDHC_DEBUG) { \
-            fprintf(stderr, "QEMU SDHC ERROR: " fmt, ## args); \
-        } \
-    } while (0)
+#include "trace.h"
 
 #define TYPE_SDHCI_BUS "sdhci-bus"
 #define SDHCI_BUS(obj) OBJECT_CHECK(SDBus, (obj), TYPE_SDHCI_BUS)
@@ -XXX,XX +XXX,XX @@ static void sdhci_raise_insertion_irq(void *opaque)
 static void sdhci_set_inserted(DeviceState *dev, bool level)
 {
     SDHCIState *s = (SDHCIState *)dev;
-    DPRINT_L1("Card state changed: %s!\n", level ? "insert" : "eject");
 
+    trace_sdhci_set_inserted(level ? "insert" : "eject");
     if ((s->norintsts & SDHC_NIS_REMOVE) && level) {
         /* Give target some time to notice card ejection */
         timer_mod(s->insert_timer,
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
     s->acmd12errsts = 0;
     request.cmd = s->cmdreg >> 8;
     request.arg = s->argument;
-    DPRINT_L1("sending CMD%u ARG[0x%08x]\n", request.cmd, request.arg);
+
+    trace_sdhci_send_command(request.cmd, request.arg);
     rlen = sdbus_do_command(&s->sdbus, &request, response);
 
     if (s->cmdreg & SDHC_CMD_RESPONSE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
             s->rspreg[0] = (response[0] << 24) | (response[1] << 16) |
                            (response[2] << 8)  |  response[3];
             s->rspreg[1] = s->rspreg[2] = s->rspreg[3] = 0;
-            DPRINT_L1("Response: RSPREG[31..0]=0x%08x\n", s->rspreg[0]);
+            trace_sdhci_response4(s->rspreg[0]);
         } else if (rlen == 16) {
             s->rspreg[0] = (response[11] << 24) | (response[12] << 16) |
                            (response[13] << 8) |  response[14];
@@ -XXX,XX +XXX,XX @@ static void sdhci_send_command(SDHCIState *s)
                            (response[5] << 8)  |  response[6];
             s->rspreg[3] = (response[0] << 16) | (response[1] << 8) |
                             response[2];
-            DPRINT_L1("Response received:\n RSPREG[127..96]=0x%08x, RSPREG[95.."
-                  "64]=0x%08x,\n RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x\n",
-                  s->rspreg[3], s->rspreg[2], s->rspreg[1], s->rspreg[0]);
+            trace_sdhci_response16(s->rspreg[3], s->rspreg[2],
+                                   s->rspreg[1], s->rspreg[0]);
         } else {
-            ERRPRINT("Timeout waiting for command response\n");
+            trace_sdhci_error("timeout waiting for command response");
             if (s->errintstsen & SDHC_EISEN_CMDTIMEOUT) {
                 s->errintsts |= SDHC_EIS_CMDTIMEOUT;
                 s->norintsts |= SDHC_NIS_ERR;
@@ -XXX,XX +XXX,XX @@ static void sdhci_end_transfer(SDHCIState *s)
 
         request.cmd = 0x0C;
         request.arg = 0;
-        DPRINT_L1("Automatically issue CMD%d %08x\n", request.cmd, request.arg);
+        trace_sdhci_end_transfer(request.cmd, request.arg);
         sdbus_do_command(&s->sdbus, &request, response);
         /* Auto CMD12 response goes to the upper Response register */
         s->rspreg[3] = (response[0] << 24) | (response[1] << 16) |
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
 
     /* first check that a valid data exists in host controller input buffer */
     if ((s->prnsts & SDHC_DATA_AVAILABLE) == 0) {
-        ERRPRINT("Trying to read from empty buffer\n");
+        trace_sdhci_error("read from empty buffer");
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t sdhci_read_dataport(SDHCIState *s, unsigned size)
         s->data_count++;
         /* check if we've read all valid data (blksize bytes) from buffer */
         if ((s->data_count) >= (s->blksize & 0x0fff)) {
-            DPRINT_L2("All %u bytes of data have been read from input buffer\n",
-                    s->data_count);
+            trace_sdhci_read_dataport(s->data_count);
             s->prnsts &= ~SDHC_DATA_AVAILABLE; /* no more data in a buffer */
             s->data_count = 0;  /* next buff read must start at position [0] */
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
 
     /* Check that there is free space left in a buffer */
     if (!(s->prnsts & SDHC_SPACE_AVAILABLE)) {
-        ERRPRINT("Can't write to data buffer: buffer full\n");
+        trace_sdhci_error("Can't write to data buffer: buffer full");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_write_dataport(SDHCIState *s, uint32_t value, unsigned size)
         s->data_count++;
         value >>= 8;
         if (s->data_count >= (s->blksize & 0x0fff)) {
-            DPRINT_L2("write buffer filled with %u bytes of data\n",
-                    s->data_count);
+            trace_sdhci_write_dataport(s->data_count);
             s->data_count = 0;
             s->prnsts &= ~SDHC_SPACE_AVAILABLE;
             if (s->prnsts & SDHC_DOING_WRITE) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
 {
     unsigned int n, begin, length;
     const uint16_t block_size = s->blksize & 0x0fff;
-    ADMADescr dscr;
+    ADMADescr dscr = {};
     int i;
 
     for (i = 0; i < SDHC_ADMA_DESCS_PER_DELAY; ++i) {
         s->admaerr &= ~SDHC_ADMAERR_LENGTH_MISMATCH;
 
         get_adma_description(s, &dscr);
-        DPRINT_L2("ADMA loop: addr=" TARGET_FMT_plx ", len=%d, attr=%x\n",
-                dscr.addr, dscr.length, dscr.attr);
+        trace_sdhci_adma_loop(dscr.addr, dscr.length, dscr.attr);
 
         if ((dscr.attr & SDHC_ADMA_ATTR_VALID) == 0) {
             /* Indicate that error occurred in ST_FDS state */
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
             break;
         case SDHC_ADMA_ATTR_ACT_LINK:   /* link to next descriptor table */
             s->admasysaddr = dscr.addr;
-            DPRINT_L1("ADMA link: admasysaddr=0x%" PRIx64 "\n",
-                      s->admasysaddr);
+            trace_sdhci_adma("link", s->admasysaddr);
             break;
         default:
             s->admasysaddr += dscr.incr;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
         }
 
         if (dscr.attr & SDHC_ADMA_ATTR_INT) {
-            DPRINT_L1("ADMA interrupt: admasysaddr=0x%" PRIx64 "\n",
-                      s->admasysaddr);
+            trace_sdhci_adma("interrupt", s->admasysaddr);
             if (s->norintstsen & SDHC_NISEN_DMA) {
                 s->norintsts |= SDHC_NIS_DMA;
             }
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
         /* ADMA transfer terminates if blkcnt == 0 or by END attribute */
         if (((s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                     (s->blkcnt == 0)) || (dscr.attr & SDHC_ADMA_ATTR_END)) {
-            DPRINT_L2("ADMA transfer completed\n");
+            trace_sdhci_adma_transfer_completed();
             if (length || ((dscr.attr & SDHC_ADMA_ATTR_END) &&
                 (s->trnmod & SDHC_TRNS_BLK_CNT_EN) &&
                 s->blkcnt != 0)) {
-                ERRPRINT("SD/MMC host ADMA length mismatch\n");
+                trace_sdhci_error("SD/MMC host ADMA length mismatch");
                 s->admaerr |= SDHC_ADMAERR_LENGTH_MISMATCH |
                         SDHC_ADMAERR_STATE_ST_TFR;
                 if (s->errintstsen & SDHC_EISEN_ADMAERR) {
-                    ERRPRINT("Set ADMA error flag\n");
+                    trace_sdhci_error("Set ADMA error flag");
                     s->errintsts |= SDHC_EIS_ADMAERR;
                     s->norintsts |= SDHC_NIS_ERR;
                 }
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
             break;
         case SDHC_CTRL_ADMA1_32:
             if (!(s->capareg & SDHC_CAN_DO_ADMA1)) {
-                ERRPRINT("ADMA1 not supported\n");
+                trace_sdhci_error("ADMA1 not supported");
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
             break;
         case SDHC_CTRL_ADMA2_32:
             if (!(s->capareg & SDHC_CAN_DO_ADMA2)) {
-                ERRPRINT("ADMA2 not supported\n");
+                trace_sdhci_error("ADMA2 not supported");
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void sdhci_data_transfer(void *opaque)
         case SDHC_CTRL_ADMA2_64:
             if (!(s->capareg & SDHC_CAN_DO_ADMA2) ||
                     !(s->capareg & SDHC_64_BIT_BUS_SUPPORT)) {
-                ERRPRINT("64 bit ADMA not supported\n");
+                trace_sdhci_error("64 bit ADMA not supported");
                 break;
             }
 
             sdhci_do_adma(s);
             break;
         default:
-            ERRPRINT("Unsupported DMA type\n");
+            trace_sdhci_error("Unsupported DMA type");
             break;
         }
     } else {
@@ -XXX,XX +XXX,XX @@ static inline bool
 sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
 {
     if ((s->data_count & 0x3) != byte_num) {
-        ERRPRINT("Non-sequential access to Buffer Data Port register"
-                "is prohibited\n");
+        trace_sdhci_error("Non-sequential access to Buffer Data Port register"
+                          "is prohibited\n");
         return false;
     }
     return true;
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
     case  SDHC_BDATA:
         if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) {
             ret = sdhci_read_dataport(s, size);
-            DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset,
-                      ret, ret);
+            trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
             return ret;
         }
         break;
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
 
     ret >>= (offset & 0x3) * 8;
     ret &= (1ULL << (size * 8)) - 1;
-    DPRINT_L2("read %ub: addr[0x%04x] -> %u(0x%x)\n", size, (int)offset, ret, ret);
+    trace_sdhci_access("rd", size << 3, offset, "->", ret, ret);
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
                       "not implemented\n", size, offset, value >> shift);
         break;
     }
-    DPRINT_L2("write %ub: addr[0x%04x] <- %u(0x%x)\n",
-              size, (int)offset, value >> shift, value >> shift);
+    trace_sdhci_access("wr", size << 3, offset, "<-",
+                       value >> shift, value >> shift);
 }
 
 static const MemoryRegionOps sdhci_mmio_ops = {
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -XXX,XX +XXX,XX @@
 # See docs/devel/tracing.txt for syntax documentation.
 
+# hw/sd/sdhci.c
+sdhci_set_inserted(const char *level) "card state changed: %s"
+sdhci_send_command(uint8_t cmd, uint32_t arg) "CMD%02u ARG[0x%08x]"
+sdhci_error(const char *msg) "%s"
+sdhci_response4(uint32_t r0) "RSPREG[31..0]=0x%08x"
+sdhci_response16(uint32_t r3, uint32_t r2, uint32_t r1, uint32_t r0) "RSPREG[127..96]=0x%08x, RSPREG[95..64]=0x%08x, RSPREG[63..32]=0x%08x, RSPREG[31..0]=0x%08x"
+sdhci_end_transfer(uint8_t cmd, uint32_t arg) "Automatically issue CMD%02u 0x%08x"
+sdhci_adma(const char *desc, uint32_t sysad) "%s: admasysaddr=0x%" PRIx32
+sdhci_adma_loop(uint64_t addr, uint16_t length, uint8_t attr) "addr=0x%08" PRIx64 ", len=%d, attr=0x%x"
+sdhci_adma_transfer_completed(void) ""
+sdhci_access(const char *access, unsigned int size, uint64_t offset, const char *dir, uint64_t val, uint64_t val2) "%s%u: addr[0x%04" PRIx64 "] %s 0x%08" PRIx64 " (%" PRIu64 ")"
+sdhci_read_dataport(uint16_t data_count) "all %u bytes of data have been read from input buffer"
+sdhci_write_dataport(uint16_t data_count) "write buffer filled with %u bytes of data"
+
 # hw/sd/milkymist-memcard.c
 milkymist_memcard_memory_read(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
 milkymist_memcard_memory_write(uint32_t addr, uint32_t value) "addr 0x%08x value 0x%08x"
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-10-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 1 +
 hw/sd/sdhci.c          | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #define SDHC_TRNS_ACMD12               0x0004
 #define SDHC_TRNS_READ                 0x0010
 #define SDHC_TRNS_MULTI                0x0020
+#define SDHC_TRNMOD_MASK               0x0037
 
 /* R/W Command Register 0x0 */
 #define SDHC_CMDREG                    0x0E
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@
     (SDHC_CAPAB_BASECLKFREQ << 8) | (SDHC_CAPAB_TOUNIT << 7) | \
     (SDHC_CAPAB_TOCLKFREQ))
 
-#define MASK_TRNMOD     0x0037
 #define MASKED_WRITE(reg, mask, val)  (reg = (reg & (mask)) | (val))
 
 static uint8_t sdhci_slotint(SDHCIState *s)
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         if (!(s->capareg & SDHC_CAN_DO_DMA)) {
             value &= ~SDHC_TRNS_DMA;
         }
-        MASKED_WRITE(s->trnmod, mask, value & MASK_TRNMOD);
+        MASKED_WRITE(s->trnmod, mask, value & SDHC_TRNMOD_MASK);
         MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16);
 
         /* Writing to the upper byte of CMDREG triggers SD command generation */
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-11-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sdhci-internal.h | 2 +-
 hw/sd/sdhci.c          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sdhci-internal.h b/hw/sd/sdhci-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci-internal.h
+++ b/hw/sd/sdhci-internal.h
@@ -XXX,XX +XXX,XX @@
 #define SDHC_ACMD12ERRSTS              0x3C
 
 /* HWInit Capabilities Register 0x05E80080 */
-#define SDHC_CAPAREG                   0x40
+#define SDHC_CAPAB                     0x40
 #define SDHC_CAN_DO_DMA                0x00400000
 #define SDHC_CAN_DO_ADMA2              0x00080000
 #define SDHC_CAN_DO_ADMA1              0x00100000
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
     case SDHC_ACMD12ERRSTS:
         ret = s->acmd12errsts;
         break;
-    case SDHC_CAPAREG:
+    case SDHC_CAPAB:
         ret = s->capareg;
         break;
     case SDHC_MAXCURR:
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

running qtests:

$ make check-qtest-arm
    GTESTER check-qtest-arm
  SDHC rd_4b @0x44 not implemented
  SDHC wr_4b @0x40 <- 0x89abcdef not implemented
  SDHC wr_4b @0x44 <- 0x01234567 not implemented

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20180115182436.2066-12-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  4 ++--
 hw/sd/sdhci.c         | 23 +++++++++++++++++++----
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     uint64_t admasysaddr;  /* ADMA System Address Register */
 
     /* Read-only registers */
-    uint32_t capareg;      /* Capabilities Register */
-    uint32_t maxcurr;      /* Maximum Current Capabilities Register */
+    uint64_t capareg;      /* Capabilities Register */
+    uint64_t maxcurr;      /* Maximum Current Capabilities Register */
 
     uint8_t  *fifo_buffer; /* SD host i/o FIFO buffer */
     uint32_t buf_maxsz;
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
         ret = s->acmd12errsts;
         break;
     case SDHC_CAPAB:
-        ret = s->capareg;
+        ret = (uint32_t)s->capareg;
+        break;
+    case SDHC_CAPAB + 4:
+        ret = (uint32_t)(s->capareg >> 32);
         break;
     case SDHC_MAXCURR:
-        ret = s->maxcurr;
+        ret = (uint32_t)s->maxcurr;
+        break;
+    case SDHC_MAXCURR + 4:
+        ret = (uint32_t)(s->maxcurr >> 32);
         break;
     case SDHC_ADMAERR:
         ret =  s->admaerr;
@@ -XXX,XX +XXX,XX @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
         }
         sdhci_update_irq(s);
         break;
+
+    case SDHC_CAPAB:
+    case SDHC_CAPAB + 4:
+    case SDHC_MAXCURR:
+    case SDHC_MAXCURR + 4:
+        qemu_log_mask(LOG_GUEST_ERROR, "SDHC wr_%ub @0x%02" HWADDR_PRIx
+                      " <- 0x%08x read-only\n", size, offset, value >> shift);
+        break;
+
     default:
         qemu_log_mask(LOG_UNIMP, "SDHC wr_%ub @0x%02" HWADDR_PRIx " <- 0x%08x "
                       "not implemented\n", size, offset, value >> shift);
@@ -XXX,XX +XXX,XX @@ static inline unsigned int sdhci_get_fifolen(SDHCIState *s)
 #define DEFINE_SDHCI_COMMON_PROPERTIES(_state) \
     /* Capabilities registers provide information on supported features
      * of this specific host controller implementation */ \
-    DEFINE_PROP_UINT32("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
-    DEFINE_PROP_UINT32("maxcurr", _state, maxcurr, 0)
+    DEFINE_PROP_UINT64("capareg", _state, capareg, SDHC_CAPAB_REG_DEFAULT), \
+    DEFINE_PROP_UINT64("maxcurr", _state, maxcurr, 0)
 
 static void sdhci_initfn(SDHCIState *s)
 {
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

While SysBus devices can use the get_system_memory() address space,
PCI devices should use the bus master address space for DMA.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180115182436.2066-14-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  1 +
 hw/sd/sdhci.c         | 29 +++++++++++++++--------------
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
+    AddressSpace *dma_as;
 
     QEMUTimer *insert_timer;       /* timer for 'changing' sd card. */
     QEMUTimer *transfer_timer;
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                     s->blkcnt--;
                 }
             }
-            dma_memory_write(&address_space_memory, s->sdmasysad,
+            dma_memory_write(s->dma_as, s->sdmasysad,
                              &s->fifo_buffer[begin], s->data_count - begin);
             s->sdmasysad += s->data_count - begin;
             if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_multi_blocks(SDHCIState *s)
                 s->data_count = block_size;
                 boundary_count -= block_size - begin;
             }
-            dma_memory_read(&address_space_memory, s->sdmasysad,
+            dma_memory_read(s->dma_as, s->sdmasysad,
                             &s->fifo_buffer[begin], s->data_count - begin);
             s->sdmasysad += s->data_count - begin;
             if (s->data_count == block_size) {
@@ -XXX,XX +XXX,XX @@ static void sdhci_sdma_transfer_single_block(SDHCIState *s)
         for (n = 0; n < datacnt; n++) {
             s->fifo_buffer[n] = sdbus_read_data(&s->sdbus);
         }
-        dma_memory_write(&address_space_memory, s->sdmasysad, s->fifo_buffer,
-                         datacnt);
+        dma_memory_write(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
     } else {
-        dma_memory_read(&address_space_memory, s->sdmasysad, s->fifo_buffer,
-                        datacnt);
+        dma_memory_read(s->dma_as, s->sdmasysad, s->fifo_buffer, datacnt);
         for (n = 0; n < datacnt; n++) {
             sdbus_write_data(&s->sdbus, s->fifo_buffer[n]);
         }
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
     hwaddr entry_addr = (hwaddr)s->admasysaddr;
     switch (SDHC_DMA_TYPE(s->hostctl)) {
     case SDHC_CTRL_ADMA2_32:
-        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma2,
+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma2,
                         sizeof(adma2));
         adma2 = le64_to_cpu(adma2);
         /* The spec does not specify endianness of descriptor table.
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
         dscr->incr = 8;
         break;
     case SDHC_CTRL_ADMA1_32:
-        dma_memory_read(&address_space_memory, entry_addr, (uint8_t *)&adma1,
+        dma_memory_read(s->dma_as, entry_addr, (uint8_t *)&adma1,
                         sizeof(adma1));
         adma1 = le32_to_cpu(adma1);
         dscr->addr = (hwaddr)(adma1 & 0xFFFFF000);
@@ -XXX,XX +XXX,XX @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
         }
         break;
     case SDHC_CTRL_ADMA2_64:
-        dma_memory_read(&address_space_memory, entry_addr,
+        dma_memory_read(s->dma_as, entry_addr,
                         (uint8_t *)(&dscr->attr), 1);
-        dma_memory_read(&address_space_memory, entry_addr + 2,
+        dma_memory_read(s->dma_as, entry_addr + 2,
                         (uint8_t *)(&dscr->length), 2);
         dscr->length = le16_to_cpu(dscr->length);
-        dma_memory_read(&address_space_memory, entry_addr + 4,
+        dma_memory_read(s->dma_as, entry_addr + 4,
                         (uint8_t *)(&dscr->addr), 8);
         dscr->attr = le64_to_cpu(dscr->attr);
         dscr->attr &= 0xfffffff8;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                         s->data_count = block_size;
                         length -= block_size - begin;
                     }
-                    dma_memory_write(&address_space_memory, dscr.addr,
+                    dma_memory_write(s->dma_as, dscr.addr,
                                      &s->fifo_buffer[begin],
                                      s->data_count - begin);
                     dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_do_adma(SDHCIState *s)
                         s->data_count = block_size;
                         length -= block_size - begin;
                     }
-                    dma_memory_read(&address_space_memory, dscr.addr,
+                    dma_memory_read(s->dma_as, dscr.addr,
                                     &s->fifo_buffer[begin],
                                     s->data_count - begin);
                     dscr.addr += s->data_count - begin;
@@ -XXX,XX +XXX,XX @@ static void sdhci_pci_realize(PCIDevice *dev, Error **errp)
     dev->config[PCI_CLASS_PROG] = 0x01; /* Standard Host supported DMA */
     dev->config[PCI_INTERRUPT_PIN] = 0x01; /* interrupt pin A */
     s->irq = pci_allocate_irq(dev);
-    pci_register_bar(dev, 0, 0, &s->iomem);
+    s->dma_as = pci_get_address_space(dev);
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->iomem);
 }
 
 static void sdhci_pci_exit(PCIDevice *dev)
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
         return;
     }
 
+    s->dma_as = &address_space_memory;
+
     sysbus_init_irq(sbd, &s->irq);
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add a 'dma' property allowing machine creation to provide the address-space
SDHCI DMA operates on.

[based on a patch from Alistair Francis <alistair.francis@xilinx.com>
 from qemu/xilinx tag xilinx-v2016.1]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180115182436.2066-15-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h |  1 +
 hw/sd/sdhci.c         | 18 +++++++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
             return;
         }
-        /* opc == 1, BXFIL fall through to deposit */
-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
+        /* opc == 1, BFXIL fall through to deposit */
+        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
         pos = 0;
     } else {
         /* Handle the ri > si case with a deposit
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
         len = ri;
     }
 
-    if (opc == 1) { /* BFM, BXFIL */
+    if (opc == 1) { /* BFM, BFXIL */
         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
     } else {
         /* SBFM or UBFM: We start with zero, and we haven't modified
-- 
2.20.1

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1