Series comparison

-[Qemu-devel] [PULL 00/19] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-First arm pullreq of the 2.13 cycle!
+Not very much here, but several people have fallen over
 the vector operation segfault bug, so let's get the fix
 into master.
+thanks
 -- PMM
-The following changes since commit 4743c23509a51bd4ee85cc272287a41917d1be35:
+The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
-  Update version for v2.12.0 release (2018-04-24 16:44:55 +0100)
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180426
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
-for you to fetch changes up to fbf32752663878947de455ff57cb5b9318f14bec:
+for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
-  xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo (2018-04-26 11:04:40 +0100)
+  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo
+ * exynos4210: QOM'ify the Exynos4210 SoC
- * timer/aspeed: fix vmstate version id
+ * exynos4210: Add DMA support for the Exynos4210
- * hw/arm/aspeed_soc: don't use vmstate_register_ram_global for SRAM
+ * arm_gicv3: Fix writes to ICC_CTLR_EL3
- * hw/arm/aspeed: don't make 'boot_rom' region 'nomigrate'
+ * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
- * hw/arm/highbank: don't make sysram 'nomigrate'
+ * target/arm: Fix vector operation segfault
- * hw/arm/raspi: Don't bother setting default_cpu_type
+ * target/arm: Minor improvements to BFXIL, EXTR
  * PMU emulation: some minor bugfixes and preparation for
    support of other events than just the cycle counter
  * target/arm: Use v7m_stack_read() for reading the frame signature
  * target/arm: Remove stale TODO comment
  * arm: always start from first_cpu when registering loader cpu reset callback
  * device_tree: Increase FDT_MAX_SIZE to 1 MiB
 ----------------------------------------------------------------
-Aaron Lindsay (9):
+Alistair Francis (1):
-      target/arm: Check PMCNTEN for whether PMCCNTR is enabled
+      target/arm: Fix vector operation segfault
       target/arm: Treat PMCCNTR as alias of PMCCNTR_EL0
       target/arm: Mask PMU register writes based on PMCR_EL0.N
       target/arm: Fetch GICv3 state directly from CPUARMState
       target/arm: Support multiple EL change hooks
       target/arm: Add pre-EL change hooks
       target/arm: Allow EL change hooks to do IO
       target/arm: Fix bitmask for PMCCFILTR writes
       target/arm: Make PMOVSCLR and PMUSERENR 64 bits wide
-Cédric Le Goater (1):
+Guenter Roeck (1):
-      timer/aspeed: fix vmstate version id
+      hw/arm/exynos4210: Add DMA support for the Exynos4210
-Geert Uytterhoeven (1):
+Peter Maydell (5):
-      device_tree: Increase FDT_MAX_SIZE to 1 MiB
+      arm: Move system_clock_scale to armv7m_systick.h
       arm: Remove unnecessary includes of hw/arm/arm.h
       arm: Rename hw/arm/arm.h to hw/arm/boot.h
       hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
       hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-Igor Mammedov (1):
+Philippe Mathieu-Daudé (3):
-      arm: always start from first_cpu when registering loader cpu reset callback
+      hw/arm/exynos4: Remove unuseful debug code
       hw/arm/exynos4: Use the IEC binary prefix definitions
       hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-Peter Maydell (6):
+Richard Henderson (2):
-      target/arm: Remove stale TODO comment
+      target/arm: Use extract2 for EXTR
-      target/arm: Use v7m_stack_read() for reading the frame signature
+      target/arm: Simplify BFXIL expansion
       hw/arm/raspi: Don't bother setting default_cpu_type
       hw/arm/highbank: don't make sysram 'nomigrate'
       hw/arm/aspeed: don't make 'boot_rom' region 'nomigrate'
       hw/arm/aspeed_soc: don't use vmstate_register_ram_global for SRAM
-Sai Pavan Boddu (1):
+ include/hw/arm/allwinner-a10.h    |  2 +-
-      xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo
+ include/hw/arm/aspeed_soc.h       |  1 -
  include/hw/arm/bcm2836.h          |  1 -
  include/hw/arm/{arm.h => boot.h}  | 12 +++------
  include/hw/arm/exynos4210.h       |  9 +++++--
  include/hw/arm/fsl-imx25.h        |  2 +-
  include/hw/arm/fsl-imx31.h        |  2 +-
  include/hw/arm/fsl-imx6.h         |  2 +-
  include/hw/arm/fsl-imx6ul.h       |  2 +-
  include/hw/arm/fsl-imx7.h         |  2 +-
  include/hw/arm/virt.h             |  2 +-
  include/hw/arm/xlnx-versal.h      |  2 +-
  include/hw/arm/xlnx-zynqmp.h      |  2 +-
  include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
  hw/arm/armsse.c                   |  2 +-
  hw/arm/armv7m.c                   |  2 +-
  hw/arm/aspeed.c                   |  2 +-
  hw/arm/boot.c                     |  2 +-
  hw/arm/collie.c                   |  2 +-
  hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
  hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
  hw/arm/highbank.c                 |  2 +-
  hw/arm/integratorcp.c             |  2 +-
  hw/arm/mainstone.c                |  2 +-
  hw/arm/microbit.c                 |  2 +-
  hw/arm/mps2-tz.c                  |  2 +-
  hw/arm/mps2.c                     |  2 +-
  hw/arm/msf2-soc.c                 |  1 -
  hw/arm/msf2-som.c                 |  2 +-
  hw/arm/musca.c                    |  2 +-
  hw/arm/musicpal.c                 |  2 +-
  hw/arm/netduino2.c                |  2 +-
  hw/arm/nrf51_soc.c                |  2 +-
  hw/arm/nseries.c                  |  2 +-
  hw/arm/omap1.c                    |  2 +-
  hw/arm/omap2.c                    |  2 +-
  hw/arm/omap_sx1.c                 |  2 +-
  hw/arm/palm.c                     |  2 +-
  hw/arm/raspi.c                    |  2 +-
  hw/arm/realview.c                 |  2 +-
  hw/arm/spitz.c                    |  2 +-
  hw/arm/stellaris.c                |  2 +-
  hw/arm/stm32f205_soc.c            |  2 +-
  hw/arm/strongarm.c                |  2 +-
  hw/arm/tosa.c                     |  2 +-
  hw/arm/versatilepb.c              |  2 +-
  hw/arm/vexpress.c                 |  2 +-
  hw/arm/virt.c                     |  2 +-
  hw/arm/xilinx_zynq.c              |  2 +-
  hw/arm/xlnx-versal.c              |  2 +-
  hw/arm/z2.c                       |  2 +-
  hw/intc/arm_gicv3_cpuif.c         |  6 ++---
  hw/intc/armv7m_nvic.c             |  1 -
  target/arm/arm-semi.c             |  1 -
  target/arm/cpu.c                  |  1 -
  target/arm/cpu64.c                |  1 -
  target/arm/kvm.c                  |  1 -
  target/arm/kvm32.c                |  1 -
  target/arm/kvm64.c                |  1 -
  target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
  target/arm/translate.c            |  4 +--
 files changed, 164 insertions(+), 123 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (96%)
- target/arm/cpu.h           | 48 +++++++++++++++++-------------
- target/arm/internals.h     | 14 +++++++--
- device_tree.c              |  2 +-
- hw/arm/aspeed.c            |  2 +-
- hw/arm/aspeed_soc.c        |  3 +-
- hw/arm/boot.c              |  2 +-
- hw/arm/highbank.c          |  2 +-
- hw/arm/raspi.c             |  2 --
- hw/intc/arm_gicv3_cpuif.c  | 10 ++-----
- hw/ssi/xilinx_spips.c      |  3 +-
- hw/timer/aspeed_timer.c    |  2 +-
- target/arm/cpu.c           | 37 +++++++++++++++++++----
- target/arm/helper.c        | 73 ++++++++++++++++++++++++++--------------------
- target/arm/op_helper.c     |  8 +++++
- target/arm/translate-a64.c |  6 ++++
- target/arm/translate.c     | 12 ++++++++
-files changed, 148 insertions(+), 78 deletions(-)

-[Qemu-devel] [PULL 01/19] device_tree: Increase FDT_MAX_SIZE to 1 MiB
+Deleted patch
-From: Geert Uytterhoeven <geert+renesas@glider.be>
-It is not uncommon for a contemporary FDT to be larger than 64 KiB,
-leading to failures loading the device tree from sysfs:
-    qemu-system-aarch64: qemu_fdt_setprop: Couldn't set ...: FDT_ERR_NOSPACE
-Hence increase the limit to 1 MiB, like on PPC.
-For reference, the largest arm64 DTB created from the Linux sources is
-ca. 75 KiB large (100 KiB when built with symbols/fixup support).
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Message-id: 1523541337-23919-1-git-send-email-geert+renesas@glider.be
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- device_tree.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/device_tree.c b/device_tree.c
-index XXXXXXX..XXXXXXX 100644
---- a/device_tree.c
-+++ b/device_tree.c
-@@ -XXX,XX +XXX,XX @@
- #include <libfdt.h>
--#define FDT_MAX_SIZE  0x10000
-+#define FDT_MAX_SIZE  0x100000
- void *create_device_tree(int *sizep)
- {
---
-.17.0

-[Qemu-devel] [PULL 02/19] arm: always start from first_cpu when registering loader cpu reset callback
+Deleted patch
-From: Igor Mammedov <imammedo@redhat.com>
-if arm_load_kernel() were passed non first_cpu, QEMU would end up
-with partially set do_cpu_reset() callback leaving some CPUs without it.
-Make sure that do_cpu_reset() is registered for all CPUs by enumerating
-CPUs from first_cpu.
-(In practice every board that we have was passing us the first CPU
-as the boot CPU, either directly or indirectly, so this wasn't
-causing incorrect behaviour.)
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: added a note that this isn't a behaviour change]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/boot.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
-+++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
-      * actually loading a kernel, the handler is also responsible for
-      * arranging that we start it correctly.
-      */
--    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
-+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
-         qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
-     }
- }
---
-.17.0

-[Qemu-devel] [PULL 03/19] target/arm: Remove stale TODO comment
+Deleted patch
-Remove a stale TODO comment -- we have now made the arm_ldl_ptw()
-and arm_ldq_ptw() functions propagate physical memory read errors
-out to their callers.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180419142151.9862-1-peter.maydell@linaro.org
----
- target/arm/helper.c | 8 +-------
-file changed, 1 insertion(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-     return addr;
- }
--/* All loads done in the course of a page table walk go through here.
-- * TODO: rather than ignoring errors from physical memory reads (which
-- * are external aborts in ARM terminology) we should propagate this
-- * error out so that we can turn it into a Data Abort if this walk
-- * was being done for a CPU load/store or an address translation instruction
-- * (but not if it was for a debug access).
-- */
-+/* All loads done in the course of a page table walk go through here. */
- static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
-                             ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
- {
---
-.17.0

-[Qemu-devel] [PULL 04/19] target/arm: Use v7m_stack_read() for reading the frame signature
+Deleted patch
-In commit 95695effe8caa552b8f2 we changed the v7M/v8M stack
-pop code to use a new v7m_stack_read() function that checks
-whether the read should fail due to an MPU or bus abort.
-We missed one call though, the one which reads the signature
-word for the callee-saved register part of the frame.
-Correct the omission.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180419142106.9694-1-peter.maydell@linaro.org
----
- target/arm/helper.c | 9 +++++----
-file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool v7m_push_stack(ARMCPU *cpu)
- static void do_v7m_exception_exit(ARMCPU *cpu)
- {
-     CPUARMState *env = &cpu->env;
--    CPUState *cs = CPU(cpu);
-     uint32_t excret;
-     uint32_t xpsr;
-     bool ufault = false;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-             ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
-              (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
-             uint32_t expected_sig = 0xfefa125b;
--            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
-+            uint32_t actual_sig;
--            if (expected_sig != actual_sig) {
-+            pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
-+
-+            if (pop_ok && expected_sig != actual_sig) {
-                 /* Take a SecureFault on the current stack */
-                 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
-                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                 return;
-             }
--            pop_ok =
-+            pop_ok = pop_ok &&
-                 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
-                 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
-                 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
---
-.17.0

-[Qemu-devel] [PULL 05/19] target/arm: Check PMCNTEN for whether PMCCNTR is enabled
+Deleted patch
-From: Aaron Lindsay <alindsay@codeaurora.org>
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1523997485-1905-2-git-send-email-alindsay@codeaurora.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_ccnt_enabled(CPUARMState *env)
- {
-     /* This does not support checking PMCCFILTR_EL0 register */
--    if (!(env->cp15.c9_pmcr & PMCRE)) {
-+    if (!(env->cp15.c9_pmcr & PMCRE) || !(env->cp15.c9_pmcnten & (1 << 31))) {
-         return false;
-     }
---
-.17.0

-[Qemu-devel] [PULL 06/19] target/arm: Treat PMCCNTR as alias of PMCCNTR_EL0
+Deleted patch
-From: Aaron Lindsay <alindsay@codeaurora.org>
-They share the same underlying state
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1523997485-1905-3-git-send-email-alindsay@codeaurora.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
-       .writefn = pmselr_write, .raw_writefn = raw_write, },
-     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
--      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
-+      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
-       .readfn = pmccntr_read, .writefn = pmccntr_write32,
-       .accessfn = pmreg_access_ccntr },
-     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
---
-.17.0

-[Qemu-devel] [PULL 18/19] timer/aspeed: fix vmstate version id
+[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-commit 1d3e65aa7ac5 ("hw/timer: Add value matching support to
+This is, after all, how we implement extract2 in tcg/aarch64.
 aspeed_timer") increased the vmstate version of aspeed.timer because
 the state had changed, but it also bumped the version of the
 VMSTATE_STRUCT_ARRAY under the aspeed.timerctrl which did not need to.
-Change back this version to fix migration.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20180423101433.17759-1-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/aspeed_timer.c | 2 +-
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 20 insertions(+), 18 deletions(-)
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/aspeed_timer.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/timer/aspeed_timer.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer_state = {
+@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
-         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
+             } else {
-         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
+                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
-         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
+             }
--                             ASPEED_TIMER_NR_TIMERS, 2, vmstate_aspeed_timer,
+-        } else if (rm == rn) { /* ROR */
-+                             ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
+-            tcg_rm = cpu_reg(s, rm);
-                              AspeedTimer),
+-            if (sf) {
-         VMSTATE_END_OF_LIST()
+-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
 -            } else {
 -                TCGv_i32 tmp = tcg_temp_new_i32();
 -                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
 -                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
 +            if (sf) {
 +                /* Specialization to ROR happens in EXTRACT2.  */
 +                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
 +            } else {
 +                TCGv_i32 t0 = tcg_temp_new_i32();
 +
 +                tcg_gen_extrl_i64_i32(t0, tcg_rm);
 +                if (rm == rn) {
 +                    tcg_gen_rotri_i32(t0, t0, imm);
 +                } else {
 +                    TCGv_i32 t1 = tcg_temp_new_i32();
 +                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
 +                    tcg_gen_extract2_i32(t0, t0, t1, imm);
 +                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 11/19] target/arm: Allow EL change hooks to do IO
+[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
-From: Aaron Lindsay <alindsay@codeaurora.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-During code generation, surround CPSR writes and exception returns which
+The mask implied by the extract is redundant with the one
-call the EL change hooks with gen_io_start/end. The immediate need is
+implied by the deposit.  Also, fix spelling of BFXIL.
 for the PMU to access the clock and icount during EL change to support
 mode filtering.
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1523997485-1905-9-git-send-email-alindsay@codeaurora.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c |  6 ++++++
+ target/arm/translate-a64.c | 6 +++---
- target/arm/translate.c     | 12 ++++++++++++
+file changed, 3 insertions(+), 3 deletions(-)
 files changed, 18 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
-             unallocated_encoding(s);
+             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
              return;
          }
-+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+-        /* opc == 1, BXFIL fall through to deposit */
-+            gen_io_start();
+-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
-+        }
++        /* opc == 1, BFXIL fall through to deposit */
-         gen_helper_exception_return(cpu_env);
++        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
-+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+         pos = 0;
-+            gen_io_end();
+     } else {
-+        }
+         /* Handle the ri > si case with a deposit
-         /* Must exit loop to check un-masked IRQs */
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
-         s->base.is_jmp = DISAS_EXIT;
+         len = ri;
-         return;
+     }
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
+-    if (opc == 1) { /* BFM, BXFIL */
---- a/target/arm/translate.c
++    if (opc == 1) { /* BFM, BFXIL */
-+++ b/target/arm/translate.c
+         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
-@@ -XXX,XX +XXX,XX @@ static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
+     } else {
-      * appropriately depending on the new Thumb bit, so it must
+         /* SBFM or UBFM: We start with zero, and we haven't modified
       * be called after storing the new PC.
       */
 +    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
 +        gen_io_start();
 +    }
      gen_helper_cpsr_write_eret(cpu_env, cpsr);
 +    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
 +        gen_io_end();
 +    }
      tcg_temp_free_i32(cpsr);
      /* Must exit loop to check un-masked IRQs */
      s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                  if (exc_return) {
                      /* Restore CPSR from SPSR.  */
                      tmp = load_cpu_field(spsr);
 +                    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
 +                        gen_io_start();
 +                    }
                      gen_helper_cpsr_write_eret(cpu_env, tmp);
 +                    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
 +                        gen_io_end();
 +                    }
                      tcg_temp_free_i32(tmp);
                      /* Must exit loop to check un-masked IRQs */
                      s->base.is_jmp = DISAS_EXIT;
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 19/19] xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo
+[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
-From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-SNOOP_NONE state handle is moved above in the if ladder, as it's same
+Commit 89e68b575 "target/arm: Use vector operations for saturation"
-as SNOOP_STRIPPING during data cycles.
+causes this abort() when booting QEMU ARM with a Cortex-A15:
-Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com>
+0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
-Message-id: 1524119244-1240-1-git-send-email-saipava@xilinx.com
+0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
 0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/xilinx_spips.c | 3 ++-
+ target/arm/translate.c | 4 ++--
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
+--- a/target/arm/translate.c
-+++ b/hw/ssi/xilinx_spips.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-         if (fifo8_is_empty(&s->tx_fifo)) {
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-             xilinx_spips_update_ixr(s);
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-             return;
+                            (u ? uqadd_op : sqadd_op) + size);
--        } else if (s->snoop_state == SNOOP_STRIPING) {
+-            break;
-+        } else if (s->snoop_state == SNOOP_STRIPING ||
++            return 0;
-+                   s->snoop_state == SNOOP_NONE) {
-             for (i = 0; i < num_effective_busses(s); ++i) {
+         case NEON_3R_VQSUB:
-                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-             }
+                            rn_ofs, rm_ofs, vec_size, vec_size,
                             (u ? uqsub_op : sqsub_op) + size);
 -            break;
 +            return 0;
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 17/19] hw/arm/aspeed_soc: don't use vmstate_register_ram_global for SRAM
+[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
-Currently we use vmstate_register_ram_global() for the SRAM;
+The system_clock_scale global is used only by the armv7m systick
-this is not a good idea for devices, because it means that
+device; move the extern declaration to the armv7m_systick.h header,
-you can only ever create one instance of the device, as
+and expand the comment to explain what it is and that it should
-the second instance would get a RAM block name clash.
+ideally be replaced with a different approach.
 Instead, use memory_region_init_ram(), which automatically
 registers the RAM block with a local-to-the-device name.
 Note that this would be a cross-version migration compatibility break
 for the "palmetto-bmc", "ast2500-evb" and "romulus-bmc" machines,
 but migration is currently broken for them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Cédric Le Goater <clg@kaod.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180420124835.7268-4-peter.maydell@linaro.org
+Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 ---
- hw/arm/aspeed_soc.c | 3 +--
+ include/hw/arm/arm.h              |  4 ----
-file changed, 1 insertion(+), 2 deletions(-)
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/include/hw/arm/arm.h
-+++ b/hw/arm/aspeed_soc.c
++++ b/include/hw/arm/arm.h
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
-     }
+                                             const struct arm_boot_info *info,
+                                             hwaddr mvbar_addr);
-     /* SRAM */
--    memory_region_init_ram_nomigrate(&s->sram, OBJECT(dev), "aspeed.sram",
+-/* Multiplication factor to convert from system clock ticks to qemu timer
-+    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
+-   ticks.  */
-                            sc->info->sram_size, &err);
+-extern int system_clock_scale;
-     if (err) {
+-
-         error_propagate(errp, err);
+ #endif /* HW_ARM_H */
-         return;
+diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
-     }
+index XXXXXXX..XXXXXXX 100644
--    vmstate_register_ram_global(&s->sram);
+--- a/include/hw/timer/armv7m_systick.h
-     memory_region_add_subregion(get_system_memory(), ASPEED_SOC_SRAM_BASE,
++++ b/include/hw/timer/armv7m_systick.h
-                                 &s->sram);
+@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
+     qemu_irq irq;
  } SysTickState;
 +/*
 + * Multiplication factor to convert from system clock ticks to qemu timer
 + * ticks. This should be set (by board code, usually) to a value
 + * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
 + * in Hz of the CPU.
 + *
 + * This value is used by the systick device when it is running in
 + * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
 + * set how fast the timer should tick.
 + *
 + * TODO: we should refactor this so that rather than using a global
 + * we use a device property or something similar. This is complicated
 + * because (a) the property would need to be plumbed through from the
 + * board code down through various layers to the systick device
 + * and (b) the property needs to be modifiable after realize, because
 + * the stellaris board uses this to implement the behaviour where the
 + * guest can reprogram the PLL registers to downclock the CPU, and the
 + * systick device needs to react accordingly. Possibly this should
 + * be deferred until we have a good API for modelling clock trees.
 + */
 +extern int system_clock_scale;
 +
  #endif
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 09/19] target/arm: Support multiple EL change hooks
+[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
-From: Aaron Lindsay <alindsay@codeaurora.org>
+The hw/arm/arm.h header now only includes declarations relating
 to boot.c code, so it is only needed by Arm board or SoC code.
 Remove some unnecessary inclusions of it from target/arm files
 and from hw/intc/armv7m_nvic.c.
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
-Message-id: 1523997485-1905-7-git-send-email-alindsay@codeaurora.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h       | 20 ++++++++++----------
+ hw/intc/armv7m_nvic.c | 1 -
- target/arm/internals.h |  7 ++++---
+ target/arm/arm-semi.c | 1 -
- target/arm/cpu.c       | 21 ++++++++++++++++-----
+ target/arm/cpu.c      | 1 -
-files changed, 30 insertions(+), 18 deletions(-)
+ target/arm/cpu64.c    | 1 -
  target/arm/kvm.c      | 1 -
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/target/arm/cpu.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@
- } CPUARMState;
+ #include "cpu.h"
+ #include "hw/sysbus.h"
- /**
+ #include "qemu/timer.h"
-- * ARMELChangeHook:
+-#include "hw/arm/arm.h"
-+ * ARMELChangeHookFn:
+ #include "hw/intc/armv7m_nvic.h"
-  * type of a function which can be registered via arm_register_el_change_hook()
+ #include "target/arm/cpu.h"
-  * to get callbacks when the CPU changes its exception level or mode.
+ #include "exec/exec-all.h"
-  */
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
 -typedef void ARMELChangeHook(ARMCPU *cpu, void *opaque);
 -
 +typedef void ARMELChangeHookFn(ARMCPU *cpu, void *opaque);
 +typedef struct ARMELChangeHook ARMELChangeHook;
 +struct ARMELChangeHook {
 +    ARMELChangeHookFn *hook;
 +    void *opaque;
 +    QLIST_ENTRY(ARMELChangeHook) node;
 +};
  /* These values map onto the return values for
   * QEMU_PSCI_0_2_FN_AFFINITY_INFO */
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
       */
      bool cfgend;
 -    ARMELChangeHook *el_change_hook;
 -    void *el_change_hook_opaque;
 +    QLIST_HEAD(, ARMELChangeHook) el_change_hooks;
      int32_t node_id; /* NUMA node this CPU belongs to */
@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
   * CPU changes exception level or mode. The hook function will be
   * passed a pointer to the ARMCPU and the opaque data pointer passed
   * to this function when the hook was registered.
 - *
 - * Note that we currently only support registering a single hook function,
 - * and will assert if this function is called twice.
 - * This facility is intended for the use of the GICv3 emulation.
   */
 -void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
 +void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                   void *opaque);
  /**
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/arm-semi.c
-+++ b/target/arm/internals.h
++++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+@@ -XXX,XX +XXX,XX @@
-                                    int mmu_idx, MemTxAttrs attrs,
+ #else
-                                    MemTxResult response, uintptr_t retaddr);
+ #include "qemu-common.h"
+ #include "exec/gdbstub.h"
--/* Call the EL change hook if one has been registered */
+-#include "hw/arm/arm.h"
-+/* Call any registered EL change hooks */
+ #include "qemu/cutils.h"
- static inline void arm_call_el_change_hook(ARMCPU *cpu)
+ #endif
  {
 -    if (cpu->el_change_hook) {
 -        cpu->el_change_hook(cpu, cpu->el_change_hook_opaque);
 +    ARMELChangeHook *hook, *next;
 +    QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
 +        hook->hook(cpu, hook->opaque);
      }
  }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@
-          | CPU_INTERRUPT_EXITTB);
+ #if !defined(CONFIG_USER_ONLY)
- }
+ #include "hw/loader.h"
+ #endif
--void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
+-#include "hw/arm/arm.h"
-+void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+ #include "sysemu/sysemu.h"
-                                  void *opaque)
+ #include "sysemu/hw_accel.h"
- {
+ #include "kvm_arm.h"
--    /* We currently only support registering a single hook function */
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
--    assert(!cpu->el_change_hook);
+index XXXXXXX..XXXXXXX 100644
--    cpu->el_change_hook = hook;
+--- a/target/arm/cpu64.c
--    cpu->el_change_hook_opaque = opaque;
++++ b/target/arm/cpu64.c
-+    ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
+@@ -XXX,XX +XXX,XX @@
-+
+ #if !defined(CONFIG_USER_ONLY)
-+    entry->hook = hook;
+ #include "hw/loader.h"
-+    entry->opaque = opaque;
+ #endif
-+
+-#include "hw/arm/arm.h"
-+    QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
+ #include "sysemu/sysemu.h"
- }
+ #include "sysemu/kvm.h"
+ #include "kvm_arm.h"
- static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+index XXXXXXX..XXXXXXX 100644
-     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
+--- a/target/arm/kvm.c
-                                          g_free, g_free);
++++ b/target/arm/kvm.c
+@@ -XXX,XX +XXX,XX @@
-+    QLIST_INIT(&cpu->el_change_hooks);
+ #include "cpu.h"
-+
+ #include "trace.h"
- #ifndef CONFIG_USER_ONLY
+ #include "internals.h"
-     /* Our inbound IRQ and FIQ lines */
+-#include "hw/arm/arm.h"
-     if (kvm_enabled()) {
+ #include "hw/pci/pci.h"
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
+ #include "exec/memattrs.h"
- static void arm_cpu_finalizefn(Object *obj)
+ #include "exec/address-spaces.h"
- {
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-     ARMCPU *cpu = ARM_CPU(obj);
+index XXXXXXX..XXXXXXX 100644
-+    ARMELChangeHook *hook, *next;
+--- a/target/arm/kvm32.c
-+
++++ b/target/arm/kvm32.c
-     g_hash_table_destroy(cpu->cp_regs);
+@@ -XXX,XX +XXX,XX @@
-+
+ #include "sysemu/kvm.h"
-+    QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
+ #include "kvm_arm.h"
-+        QLIST_REMOVE(hook, node);
+ #include "internals.h"
-+        g_free(hook);
+-#include "hw/arm/arm.h"
-+    }
+ #include "qemu/log.h"
- }
+ static inline void set_feature(uint64_t *features, int feature)
- static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "internals.h"
 -#include "hw/arm/arm.h"
  static bool have_guest_debug;
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 14/19] hw/arm/raspi: Don't bother setting default_cpu_type
+[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
-In commit 210f47840dd62, we changed the bcm2836 SoC object to
+The header file hw/arm/arm.h now includes only declarations
-always create a CPU of the correct type for that SoC model. This
+relating to hw/arm/boot.c functionality. Rename it accordingly,
-makes the default_cpu_type settings in the MachineClass structs
+and adjust its header comment.
-for the raspi2 and raspi3 boards redundant. We didn't change
-those at the time because it would have meant a temporary
+The bulk of this commit was created via
-regression in a corner case of error handling if the user
+ perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
-requested a non-existing CPU type. The -cpu parse handling
-changes in 2278b93941d42c3 mean that it no longer implicitly
+In a few cases we can just delete the #include:
-depends on default_cpu_type for this to work, so we can now
+hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
-delete the redundant default_cpu_type fields.
+include/hw/arm/bcm2836.h did not require it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180420155547.9497-1-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 2 --
+ include/hw/arm/allwinner-a10.h   | 2 +-
-file changed, 2 deletions(-)
+ include/hw/arm/aspeed_soc.h      | 1 -
  include/hw/arm/bcm2836.h         | 1 -
  include/hw/arm/{arm.h => boot.h} | 8 ++++----
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/allwinner-a10.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "qemu/error-report.h"
+ #include "hw/char/serial.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
+ #include "hw/net/allwinner_emac.h"
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/aspeed_soc.h
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef ASPEED_SOC_H
+ #define ASPEED_SOC_H
+-#include "hw/arm/arm.h"
+ #include "hw/intc/aspeed_vic.h"
+ #include "hw/misc/aspeed_scu.h"
+ #include "hw/misc/aspeed_sdmc.h"
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/bcm2836.h
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef BCM2836_H
+ #define BCM2836_H
+-#include "hw/arm/arm.h"
+ #include "hw/arm/bcm2835_peripherals.h"
+ #include "hw/intc/bcm2836_control.h"
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
+similarity index 98%
+rename from include/hw/arm/arm.h
+rename to include/hw/arm/boot.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/arm.h
++++ b/include/hw/arm/boot.h
+@@ -XXX,XX +XXX,XX @@
+ /*
+- * Misc ARM declarations
++ * ARM kernel loader.
+  *
+  * Copyright (c) 2006 CodeSourcery.
+  * Written by Paul Brook
+@@ -XXX,XX +XXX,XX @@
+  *
+  */
+-#ifndef HW_ARM_H
+-#define HW_ARM_H
++#ifndef HW_ARM_BOOT_H
++#define HW_ARM_BOOT_H
+ #include "exec/memory.h"
+ #include "target/arm/cpu-qom.h"
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+                                             const struct arm_boot_info *info,
+                                             hwaddr mvbar_addr);
+-#endif /* HW_ARM_H */
++#endif /* HW_ARM_BOOT_H */
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx25.h
++++ b/include/hw/arm/fsl-imx25.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX25_H
+ #define FSL_IMX25_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx25_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx31.h
++++ b/include/hw/arm/fsl-imx31.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX31_H
+ #define FSL_IMX31_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/imx_avic.h"
+ #include "hw/misc/imx31_ccm.h"
+ #include "hw/char/imx_serial.h"
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6_H
+ #define FSL_IMX6_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a9mpcore.h"
+ #include "hw/misc/imx6_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6ul.h
++++ b/include/hw/arm/fsl-imx6ul.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6UL_H
+ #define FSL_IMX6UL_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/misc/imx6ul_ccm.h"
+ #include "hw/misc/imx6_src.h"
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX7_H
+ #define FSL_IMX7_H
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/cpu/a15mpcore.h"
+ #include "hw/intc/imx_gpcv2.h"
+ #include "hw/misc/imx7_ccm.h"
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "qemu/notify.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/kvm.h"
+ #include "hw/intc/arm_gicv3_common.h"
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #define XLNX_VERSAL_H
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/xlnx-zynqmp.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef XLNX_ZYNQMP_H
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/intc/arm_gic.h"
+ #include "hw/net/cadence_gem.h"
+ #include "hw/char/cadence_uart.h"
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/registerfields.h"
+ #include "hw/arm/armsse.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ /* Format of the System Information block SYS_CONFIG register */
+ typedef enum SysConfigFormat {
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "elf.h"
+ #include "sysemu/qtest.h"
+diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/aspeed.c
++++ b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "exec/address-spaces.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/aspeed.h"
+ #include "hw/arm/aspeed_soc.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include <libfdt.h>
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/linux-boot-if.h"
+ #include "sysemu/kvm.h"
+ #include "sysemu/sysemu.h"
+diff --git a/hw/arm/collie.c b/hw/arm/collie.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/collie.c
++++ b/hw/arm/collie.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "strongarm.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "exec/address-spaces.h"
+ #include "cpu.h"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/sd/sdhci.h"
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4_boards.c
++++ b/hw/arm/exynos4_boards.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/sysemu.h"
+ #include "hw/sysbus.h"
+ #include "net/net.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/exynos4210.h"
+ #include "hw/net/lan9118.h"
+diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/highbank.c
++++ b/hw/arm/highbank.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/loader.h"
+ #include "net/net.h"
+ #include "sysemu/kvm.h"
+diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/integratorcp.c
++++ b/hw/arm/integratorcp.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/misc/arm_integrator_debug.h"
+ #include "hw/net/smc91c111.h"
+ #include "net/net.h"
+diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mainstone.c
++++ b/hw/arm/mainstone.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "hw/hw.h"
+ #include "hw/arm/pxa.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "hw/net/smc91c111.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/microbit.c
++++ b/hw/arm/microbit.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "sysemu/sysemu.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2.c
++++ b/hw/arm/mps2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armv7m.h"
+ #include "hw/or-irq.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-soc.c
++++ b/hw/arm/msf2-soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/units.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
+ #include "exec/address-spaces.h"
+ #include "hw/char/serial.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/msf2-som.c
++++ b/hw/arm/msf2-som.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "qemu/error-report.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "exec/address-spaces.h"
+ #include "hw/arm/msf2-soc.h"
+ #include "cpu.h"
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "exec/address-spaces.h"
+ #include "sysemu/sysemu.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/armsse.h"
+ #include "hw/boards.h"
+ #include "hw/char/pl011.h"
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musicpal.c
++++ b/hw/arm/musicpal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "cpu.h"
+ #include "hw/sysbus.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "net/net.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/netduino2.c
++++ b/hw/arm/netduino2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #include "qemu/error-report.h"
+ #include "hw/arm/stm32f205_soc.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ static void netduino2_init(MachineState *machine)
+ {
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+ #include "qemu-common.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/sysbus.h"
+ #include "hw/boards.h"
+ #include "hw/misc/unimp.h"
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nseries.c
++++ b/hw/arm/nseries.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/bswap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/omap.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/irq.h"
+ #include "ui/console.h"
+ #include "hw/boards.h"
+diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap1.c
++++ b/hw/arm/omap1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "cpu.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "hw/arm/soc_dma.h"
+diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap2.c
++++ b/hw/arm/omap2.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/qtest.h"
+ #include "hw/boards.h"
+ #include "hw/hw.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/arm/omap.h"
+ #include "sysemu/sysemu.h"
+ #include "qemu/timer.h"
+diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/omap_sx1.c
++++ b/hw/arm/omap_sx1.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/block/flash.h"
+ #include "sysemu/qtest.h"
+ #include "exec/address-spaces.h"
+diff --git a/hw/arm/palm.c b/hw/arm/palm.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/palm.c
++++ b/hw/arm/palm.c
+@@ -XXX,XX +XXX,XX @@
+ #include "ui/console.h"
+ #include "hw/arm/omap.h"
+ #include "hw/boards.h"
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
+ #include "hw/input/tsc2xxx.h"
+ #include "hw/loader.h"
+ #include "exec/address-spaces.h"
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@
-     mc->no_parallel = 1;
+ #include "qemu/error-report.h"
-     mc->no_floppy = 1;
+ #include "hw/boards.h"
-     mc->no_cdrom = 1;
+ #include "hw/loader.h"
--    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
+-#include "hw/arm/arm.h"
-     mc->max_cpus = BCM283X_NCPUS;
++#include "hw/arm/boot.h"
-     mc->min_cpus = BCM283X_NCPUS;
+ #include "sysemu/sysemu.h"
-     mc->default_cpus = BCM283X_NCPUS;
-@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
+ #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
-     mc->no_parallel = 1;
+diff --git a/hw/arm/realview.c b/hw/arm/realview.c
-     mc->no_floppy = 1;
+index XXXXXXX..XXXXXXX 100644
-     mc->no_cdrom = 1;
+--- a/hw/arm/realview.c
--    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
++++ b/hw/arm/realview.c
-     mc->max_cpus = BCM283X_NCPUS;
+@@ -XXX,XX +XXX,XX @@
-     mc->min_cpus = BCM283X_NCPUS;
+ #include "qemu-common.h"
-     mc->default_cpus = BCM283X_NCPUS;
+ #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/net/smc91c111.h"
 diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/spitz.c
 +++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "hw/pcmcia.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/sysbus.h"
  #include "hw/ssi/ssi.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "qemu/timer.h"
  #include "hw/i2c/i2c.h"
  #include "net/net.h"
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f205_soc.c
 +++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/stm32f205_soc.h"
 diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/strongarm.c
 +++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "strongarm.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "chardev/char-fe.h"
  #include "chardev/char-serial.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/tosa.c
 +++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/sharpsl.h"
  #include "hw/pcmcia.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/versatilepb.c
 +++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/vexpress.c
 +++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/arm/virt.h"
  #include "hw/block/flash.h"
 diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xilinx_zynq.c
 +++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/i2c/i2c.h"
  #include "hw/ssi/ssi.h"
  #include "hw/boards.h"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 16/19] hw/arm/aspeed: don't make 'boot_rom' region 'nomigrate'
+[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-Currently we use memory_region_init_ram_nomigrate() to create
+In ich_vmcr_write() we enforce "writes of BPR fields to less than
-the "aspeed.boot_rom" memory region, and we don't manually
+their minimum sets them to the minimum" by doing a "read vbpr and
-register it with vmstate_register_ram(). This currently
+write it back" operation.  A typo here meant that we weren't handling
-means that its contents are migrated but as a ram block
+writes to these fields correctly, because we were reading from VBPR0
-whose name is the empty string; in future it may mean they
+but writing to VBPR1.
 are not migrated at all. Use memory_region_init_ram() instead.
 Note that would be a cross-version migration compatibility break
 for the "palmetto-bmc", "ast2500-evb" and "romulus-bmc" machines,
 but migration is currently broken for them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 Message-id: 20180420124835.7268-3-peter.maydell@linaro.org
 ---
- hw/arm/aspeed.c | 2 +-
+ hw/intc/arm_gicv3_cpuif.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/arm/aspeed.c
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-          * SoC and 128MB for the AST2500 SoC, which is twice as big as
+     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
-          * needed by the flash modules of the Aspeed machines.
+      * by reading and writing back the fields.
-          */
+      */
--        memory_region_init_rom_nomigrate(boot_rom, OBJECT(bmc), "aspeed.boot_rom",
+-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
-+        memory_region_init_rom(boot_rom, OBJECT(bmc), "aspeed.boot_rom",
++    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
-                                fl->size, &error_abort);
+     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
-         memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
-                                     boot_rom);
+     gicv3_cpuif_virt_update(cs);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 08/19] target/arm: Fetch GICv3 state directly from CPUARMState
+[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-From: Aaron Lindsay <alindsay@codeaurora.org>
+The ICC_CTLR_EL3 register includes some bits which are aliases
 of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
 to keep those bits in the cs->icc_ctlr_el1[] struct fields.
 Unfortunately a missing '~' in the code to update the bits
 in those fields meant that writing to ICC_CTLR_EL3 would corrupt
 the ICC_CLTR_EL1 register values.
-This eliminates the need for fetching it from el_change_hook_opaque, and
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-allows for supporting multiple el_change_hooks without having to hack
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-something together to find the registered opaque belonging to GICv3.
+Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
 ---
  hw/intc/arm_gicv3_cpuif.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1523997485-1905-6-git-send-email-alindsay@codeaurora.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h          | 10 ----------
- hw/intc/arm_gicv3_cpuif.c | 10 ++--------
-files changed, 2 insertions(+), 18 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
- void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
-                                  void *opaque);
--/**
-- * arm_get_el_change_hook_opaque:
-- * Return the opaque data that will be used by the el_change_hook
-- * for this CPU.
-- */
--static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
--{
--    return cpu->el_change_hook_opaque;
--}
--
- /**
-  * aa32_vfp_dreg:
-  * Return a pointer to the Dn register within env in 32-bit mode.
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
- static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
- {
+     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
--    /* Given the CPU, find the right GICv3CPUState struct.
+-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
--     * Since we registered the CPU interface with the EL change hook as
++    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
--     * the opaque pointer, we can just directly get from the CPU to it.
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
--     */
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
--    return arm_get_el_change_hook_opaque(arm_env_get_cpu(env));
+     }
-+    return env->gicv3state;
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
- }
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
+     }
- static bool gicv3_use_ns_bank(CPUARMState *env)
-@@ -XXX,XX +XXX,XX @@ void gicv3_init_cpuif(GICv3State *s)
+-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-          * it might be with code translated by CPU 0 but run by CPU 1, in
++    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-          * which case we'd get the wrong value.
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
-          * So instead we define the regs with no ri->opaque info, and
+         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
--         * get back to the GICv3CPUState from the ARMCPU by reading back
+     }
 -         * the opaque pointer from the el_change_hook, which we're going
 -         * to need to register anyway.
 +         * get back to the GICv3CPUState from the CPUARMState.
           */
          define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
          if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 12/19] target/arm: Fix bitmask for PMCCFILTR writes
+[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
-From: Aaron Lindsay <alindsay@codeaurora.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-It was shifted to the left one bit too few.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Message-id: 20190520214342.13709-2-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1523997485-1905-10-git-send-email-alindsay@codeaurora.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ hw/arm/exynos4_boards.c | 24 ------------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 24 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@
-                             uint64_t value)
+ #include "hw/net/lan9118.h"
- {
+ #include "hw/boards.h"
-     pmccntr_sync(env);
--    env->cp15.pmccfiltr_el0 = value & 0x7E000000;
+-#undef DEBUG
-+    env->cp15.pmccfiltr_el0 = value & 0xfc000000;
+-
-     pmccntr_sync(env);
+-//#define DEBUG
- }
+-
 -#ifdef DEBUG
 -    #undef PRINT_DEBUG
 -    #define  PRINT_DEBUG(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -#else
 -    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
 -#endif
 -
  #define SMDK_LAN9118_BASE_ADDR      0x05000000
  typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_board_binfo.gic_cpu_if_addr =
              EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 -    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
 -            " kernel_filename: %s\n"
 -            " kernel_cmdline: %s\n"
 -            " initrd_filename: %s\n",
 -            exynos4_board_ram_size[board_type] / 1048576,
 -            exynos4_board_ram_size[board_type],
 -            machine->kernel_filename,
 -            machine->kernel_cmdline,
 -            machine->initrd_filename);
 -
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 13/19] target/arm: Make PMOVSCLR and PMUSERENR 64 bits wide
+[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
-From: Aaron Lindsay <alindsay@codeaurora.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-This is a bug fix to ensure 64-bit reads of these registers don't read
+It eases code review, unit is explicit.
 adjacent data.
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1523997485-1905-13-git-send-email-alindsay@codeaurora.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h    | 4 ++--
+ hw/arm/exynos4_boards.c | 5 +++--
- target/arm/helper.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
 files changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/exynos4_boards.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@
-         uint32_t c9_data;
+  */
-         uint64_t c9_pmcr; /* performance monitor control register */
-         uint64_t c9_pmcnten; /* perf monitor counter enables */
+ #include "qemu/osdep.h"
--        uint32_t c9_pmovsr; /* perf monitor overflow status */
++#include "qemu/units.h"
--        uint32_t c9_pmuserenr; /* perf monitor user enable */
+ #include "qapi/error.h"
-+        uint64_t c9_pmovsr; /* perf monitor overflow status */
+ #include "qemu/error-report.h"
-+        uint64_t c9_pmuserenr; /* perf monitor user enable */
+ #include "qemu-common.h"
-         uint64_t c9_pmselr; /* perf monitor counter selection register */
+@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
-         uint64_t c9_pminten; /* perf monitor interrupt enables */
+ };
-         union { /* Memory attribute redirection */
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+ static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-index XXXXXXX..XXXXXXX 100644
+-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
---- a/target/arm/helper.c
+-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-+++ b/target/arm/helper.c
++    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
++    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
-       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
+ };
-       .writefn = pmcntenclr_write },
-     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
+ static struct arm_boot_info exynos4_board_binfo = {
 -      .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
 +      .access = PL0_RW,
 +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
        .accessfn = pmreg_access,
        .writefn = pmovsr_write,
        .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
        .accessfn = pmreg_access_xevcntr },
      { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
        .access = PL0_R | PL1_RW, .accessfn = access_tpm,
 -      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
 +      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
        .resetvalue = 0,
        .writefn = pmuserenr_write, .raw_writefn = raw_write },
      { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 10/19] target/arm: Add pre-EL change hooks
+[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
-From: Aaron Lindsay <alindsay@codeaurora.org>
+From: Guenter Roeck <linux@roeck-us.net>
-Because the design of the PMU requires that the counter values be
+QEMU already supports pl330. Instantiate it for Exynos4210.
 converted between their delta and guest-visible forms for mode
 filtering, an additional hook which occurs before the EL is changed is
 necessary.
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
-Message-id: 1523997485-1905-8-git-send-email-alindsay@codeaurora.org
 / {
     soc: soc {
         amba {
             pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h       | 22 +++++++++++++++++++---
+ hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
- target/arm/internals.h |  7 +++++++
+file changed, 26 insertions(+)
  target/arm/cpu.c       | 16 ++++++++++++++++
  target/arm/helper.c    | 14 ++++++++------
  target/arm/op_helper.c |  8 ++++++++
 files changed, 58 insertions(+), 9 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/exynos4210.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@
-      */
+ /* EHCI */
-     bool cfgend;
+ #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
-+    QLIST_HEAD(, ARMELChangeHook) pre_el_change_hooks;
++/* DMA */
-     QLIST_HEAD(, ARMELChangeHook) el_change_hooks;
++#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
++#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
-     int32_t node_id; /* NUMA node this CPU belongs to */
++#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
-@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
++
- #endif
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
+x09, 0x00, 0x00, 0x00 };
- /**
-- * arm_register_el_change_hook:
+@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-- * Register a hook function which will be called back whenever this
+     return (0x9 << ARM_AFF1_SHIFT) | cpu;
-+ * arm_register_pre_el_change_hook:
+ }
-+ * Register a hook function which will be called immediately before this
-  * CPU changes exception level or mode. The hook function will be
++static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
   * passed a pointer to the ARMCPU and the opaque data pointer passed
   * to this function when the hook was registered.
 + *
 + * Note that if a pre-change hook is called, any registered post-change hooks
 + * are guaranteed to subsequently be called.
   */
 -void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
 +void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                   void *opaque);
 +/**
 + * arm_register_el_change_hook:
 + * Register a hook function which will be called immediately after this
 + * CPU changes exception level or mode. The hook function will be
 + * passed a pointer to the ARMCPU and the opaque data pointer passed
 + * to this function when the hook was registered.
 + *
 + * Note that any registered hooks registered here are guaranteed to be called
 + * if pre-change hooks have been.
 + */
 +void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook, void
 +        *opaque);
  /**
   * aa32_vfp_dreg:
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
                                     MemTxResult response, uintptr_t retaddr);
  /* Call any registered EL change hooks */
 +static inline void arm_call_pre_el_change_hook(ARMCPU *cpu)
 +{
-+    ARMELChangeHook *hook, *next;
++    SysBusDevice *busdev;
-+    QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
++    DeviceState *dev;
 +        hook->hook(cpu, hook->opaque);
 +    }
 +}
  static inline void arm_call_el_change_hook(ARMCPU *cpu)
  {
      ARMELChangeHook *hook, *next;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
           | CPU_INTERRUPT_EXITTB);
  }
 +void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
 +                                 void *opaque)
 +{
 +    ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
 +
-+    entry->hook = hook;
++    dev = qdev_create(NULL, "pl330");
-+    entry->opaque = opaque;
++    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
-+
++    qdev_init_nofail(dev);
-+    QLIST_INSERT_HEAD(&cpu->pre_el_change_hooks, entry, node);
++    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, base);
 +    sysbus_connect_irq(busdev, 0, irq);
 +}
 +
- void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                                   void *opaque)
  {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+     Exynos4210State *s = g_new0(Exynos4210State, 1);
-     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
+@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-                                          g_free, g_free);
+     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
+             s->irq_table[exynos4210_get_irq(28, 3)]);
-+    QLIST_INIT(&cpu->pre_el_change_hooks);
-     QLIST_INIT(&cpu->el_change_hooks);
++    /*** DMA controllers ***/
++    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
- #ifndef CONFIG_USER_ONLY
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
++    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
-     g_hash_table_destroy(cpu->cp_regs);
++    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 +    QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
 +        QLIST_REMOVE(hook, node);
 +        g_free(hook);
 +    }
      QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
          QLIST_REMOVE(hook, node);
          g_free(hook);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
          return;
      }
 +    /* Hooks may change global state so BQL should be held, also the
 +     * BQL needs to be held for any modification of
 +     * cs->interrupt_request.
 +     */
 +    g_assert(qemu_mutex_iothread_locked());
 +
-+    arm_call_pre_el_change_hook(cpu);
+     return s;
-+
+ }
      assert(!excp_is_internal(cs->exception_index));
      if (arm_el_is_aa64(env, new_el)) {
          arm_cpu_do_interrupt_aarch64(cs);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
          arm_cpu_do_interrupt_aarch32(cs);
      }
 -    /* Hooks may change global state so BQL should be held, also the
 -     * BQL needs to be held for any modification of
 -     * cs->interrupt_request.
 -     */
 -    g_assert(qemu_mutex_iothread_locked());
 -
      arm_call_el_change_hook(cpu);
      if (!kvm_enabled()) {
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
  /* Write the CPSR for a 32-bit exception return */
  void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
  {
 +    qemu_mutex_lock_iothread();
 +    arm_call_pre_el_change_hook(arm_env_get_cpu(env));
 +    qemu_mutex_unlock_iothread();
 +
      cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn);
      /* Generated code has already stored the new PC value, but
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
          goto illegal_return;
      }
 +    qemu_mutex_lock_iothread();
 +    arm_call_pre_el_change_hook(arm_env_get_cpu(env));
 +    qemu_mutex_unlock_iothread();
 +
      if (!return_to_aa64) {
          env->aarch64 = 0;
          /* We do a raw CPSR write because aarch64_sync_64_to_32()
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 07/19] target/arm: Mask PMU register writes based on PMCR_EL0.N
+[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-From: Aaron Lindsay <alindsay@codeaurora.org>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-This is in preparation for enabling counters other than PMCCNTR
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
+Message-id: 20190520214342.13709-5-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1523997485-1905-5-git-send-email-alindsay@codeaurora.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 31 ++++++++++++++++++++++---------
+ include/hw/arm/exynos4210.h |  9 +++++++--
-file changed, 22 insertions(+), 9 deletions(-)
+ hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
  hw/arm/exynos4_boards.c     |  9 ++++++---
 files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/arm/exynos4210.h
-+++ b/target/arm/helper.c
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
- static void v8m_security_lookup(CPUARMState *env, uint32_t address,
+ } Exynos4210Irq;
-                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 V8M_SAttributes *sattrs);
+ typedef struct Exynos4210State {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
      Exynos4210Irq irqs;
      qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
--/* Definitions for the PMCCNTR and PMCR registers */
+ /* Initialize exynos4210 IRQ subsystem stub */
--#define PMCRD   0x8
+ qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
--#define PMCRC   0x4
--#define PMCRE   0x1
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
- #endif
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
- static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
-     REGINFO_SENTINEL
+     sysbus_connect_irq(busdev, 0, irq);
- };
+ }
-+/* Definitions for the PMU registers */
+-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-+#define PMCRN_MASK  0xf800
++static void exynos4210_realize(DeviceState *socdev, Error **errp)
-+#define PMCRN_SHIFT 11
+ {
-+#define PMCRD   0x8
+-    Exynos4210State *s = g_new0(Exynos4210State, 1);
-+#define PMCRC   0x4
++    Exynos4210State *s = EXYNOS4210_SOC(socdev);
-+#define PMCRE   0x1
++    MemoryRegion *system_mem = get_system_memory();
      qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
-+static inline uint32_t pmu_num_counters(CPUARMState *env)
++static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
-+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
++    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = exynos4210_realize;
 +}
 +
-+/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
++static const TypeInfo exynos4210_info = {
-+static inline uint64_t pmu_counter_mask(CPUARMState *env)
++    .name = TYPE_EXYNOS4210_SOC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
-+  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
++    type_register_static(&exynos4210_info);
 +}
 +
- static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
++type_init(exynos4210_register_types)
-                                    bool isread)
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
- {
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+--- a/hw/arm/exynos4_boards.c
- static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
++++ b/hw/arm/exynos4_boards.c
-                             uint64_t value)
+@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
- {
+ } Exynos4BoardType;
--    value &= (1 << 31);
-+    value &= pmu_counter_mask(env);
+ typedef struct Exynos4BoardState {
-     env->cp15.c9_pmcnten |= value;
+-    Exynos4210State *soc;
 +    Exynos4210State soc;
      MemoryRegion dram0_mem;
      MemoryRegion dram1_mem;
  } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 -    s->soc = exynos4210_init(get_system_memory());
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
 +    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized",
 +                             &error_fatal);
      return s;
  }
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
- static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                                       EXYNOS4_BOARD_SMDKC210);
-                              uint64_t value)
- {
+     lan9215_init(SMDK_LAN9118_BASE_ADDR,
--    value &= (1 << 31);
+-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
-+    value &= pmu_counter_mask(env);
++            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
-     env->cp15.c9_pmcnten &= ~value;
+     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
  }
-@@ -XXX,XX +XXX,XX @@ static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint64_t value)
- {
-     /* We have no event counters so only the C bit can be changed */
--    value &= (1 << 31);
-+    value &= pmu_counter_mask(env);
-     env->cp15.c9_pminten |= value;
- }
- static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint64_t value)
- {
--    value &= (1 << 31);
-+    value &= pmu_counter_mask(env);
-     env->cp15.c9_pminten &= ~value;
- }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 15/19] hw/arm/highbank: don't make sysram 'nomigrate'
+Deleted patch
-Currently we use memory_region_init_ram_nomigrate() to create
-the "highbank.sysram" memory region, and we don't manually
-register it with vmstate_register_ram(). This currently
-means that its contents are migrated but as a ram block
-whose name is the empty string; in future it may mean they
-are not migrated at all. Use memory_region_init_ram() instead.
-Note that this is a cross-version migration compatibility
-break for the "highbank" and "midway" machines.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180420124835.7268-2-peter.maydell@linaro.org
----
- hw/arm/highbank.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/highbank.c
-+++ b/hw/arm/highbank.c
-@@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id)
-     memory_region_add_subregion(sysmem, 0, dram);
-     sysram = g_new(MemoryRegion, 1);
--    memory_region_init_ram_nomigrate(sysram, NULL, "highbank.sysram", 0x8000,
-+    memory_region_init_ram(sysram, NULL, "highbank.sysram", 0x8000,
-                            &error_fatal);
-     memory_region_add_subregion(sysmem, 0xfff88000, sysram);
-     if (bios_name != NULL) {
---
-.17.0

First arm pullreq of the 2.13 cycle!

-- PMM

The following changes since commit 4743c23509a51bd4ee85cc272287a41917d1be35:

Update version for v2.12.0 release (2018-04-24 16:44:55 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180426

for you to fetch changes up to fbf32752663878947de455ff57cb5b9318f14bec:

xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo (2018-04-26 11:04:40 +0100)

----------------------------------------------------------------
target-arm queue:
 * xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo
 * timer/aspeed: fix vmstate version id
 * hw/arm/aspeed_soc: don't use vmstate_register_ram_global for SRAM
 * hw/arm/aspeed: don't make 'boot_rom' region 'nomigrate'
 * hw/arm/highbank: don't make sysram 'nomigrate'
 * hw/arm/raspi: Don't bother setting default_cpu_type
 * PMU emulation: some minor bugfixes and preparation for
   support of other events than just the cycle counter
 * target/arm: Use v7m_stack_read() for reading the frame signature
 * target/arm: Remove stale TODO comment
 * arm: always start from first_cpu when registering loader cpu reset callback
 * device_tree: Increase FDT_MAX_SIZE to 1 MiB

----------------------------------------------------------------
Aaron Lindsay (9):
      target/arm: Check PMCNTEN for whether PMCCNTR is enabled
      target/arm: Treat PMCCNTR as alias of PMCCNTR_EL0
      target/arm: Mask PMU register writes based on PMCR_EL0.N
      target/arm: Fetch GICv3 state directly from CPUARMState
      target/arm: Support multiple EL change hooks
      target/arm: Add pre-EL change hooks
      target/arm: Allow EL change hooks to do IO
      target/arm: Fix bitmask for PMCCFILTR writes
      target/arm: Make PMOVSCLR and PMUSERENR 64 bits wide

Cédric Le Goater (1):
      timer/aspeed: fix vmstate version id

Geert Uytterhoeven (1):
      device_tree: Increase FDT_MAX_SIZE to 1 MiB

Igor Mammedov (1):
      arm: always start from first_cpu when registering loader cpu reset callback

Peter Maydell (6):
      target/arm: Remove stale TODO comment
      target/arm: Use v7m_stack_read() for reading the frame signature
      hw/arm/raspi: Don't bother setting default_cpu_type
      hw/arm/highbank: don't make sysram 'nomigrate'
      hw/arm/aspeed: don't make 'boot_rom' region 'nomigrate'
      hw/arm/aspeed_soc: don't use vmstate_register_ram_global for SRAM

Sai Pavan Boddu (1):
      xilinx_spips: Correct SNOOP_NONE state when flushing the txfifo

From: Geert Uytterhoeven <geert+renesas@glider.be>

It is not uncommon for a contemporary FDT to be larger than 64 KiB,
leading to failures loading the device tree from sysfs:

qemu-system-aarch64: qemu_fdt_setprop: Couldn't set ...: FDT_ERR_NOSPACE

Hence increase the limit to 1 MiB, like on PPC.

For reference, the largest arm64 DTB created from the Linux sources is
ca. 75 KiB large (100 KiB when built with symbols/fixup support).

Cc: qemu-stable@nongnu.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Message-id: 1523541337-23919-1-git-send-email-geert+renesas@glider.be
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 device_tree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/device_tree.c b/device_tree.c
index XXXXXXX..XXXXXXX 100644
--- a/device_tree.c
+++ b/device_tree.c
@@ -XXX,XX +XXX,XX @@
 
 #include <libfdt.h>
 
-#define FDT_MAX_SIZE  0x10000
+#define FDT_MAX_SIZE  0x100000
 
 void *create_device_tree(int *sizep)
 {
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

if arm_load_kernel() were passed non first_cpu, QEMU would end up
with partially set do_cpu_reset() callback leaving some CPUs without it.

Make sure that do_cpu_reset() is registered for all CPUs by enumerating
CPUs from first_cpu.

(In practice every board that we have was passing us the first CPU
as the boot CPU, either directly or indirectly, so this wasn't
causing incorrect behaviour.)

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added a note that this isn't a behaviour change]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
      * actually loading a kernel, the handler is also responsible for
      * arranging that we start it correctly.
      */
-    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
         qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
     }
 }
-- 
2.17.0

Remove a stale TODO comment -- we have now made the arm_ldl_ptw()
and arm_ldq_ptw() functions propagate physical memory read errors
out to their callers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180419142151.9862-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
     return addr;
 }
 
-/* All loads done in the course of a page table walk go through here.
- * TODO: rather than ignoring errors from physical memory reads (which
- * are external aborts in ARM terminology) we should propagate this
- * error out so that we can turn it into a Data Abort if this walk
- * was being done for a CPU load/store or an address translation instruction
- * (but not if it was for a debug access).
- */
+/* All loads done in the course of a page table walk go through here. */
 static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
                             ARMMMUIdx mmu_idx, ARMMMUFaultInfo *fi)
 {
-- 
2.17.0

In commit 95695effe8caa552b8f2 we changed the v7M/v8M stack
pop code to use a new v7m_stack_read() function that checks
whether the read should fail due to an MPU or bus abort.
We missed one call though, the one which reads the signature
word for the callee-saved register part of the frame.

Correct the omission.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180419142106.9694-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
     uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
             ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
              (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
             uint32_t expected_sig = 0xfefa125b;
-            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
+            uint32_t actual_sig;
 
-            if (expected_sig != actual_sig) {
+            pop_ok = v7m_stack_read(cpu, &actual_sig, frameptr, mmu_idx);
+
+            if (pop_ok && expected_sig != actual_sig) {
                 /* Take a SecureFault on the current stack */
                 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                 return;
             }
 
-            pop_ok =
+            pop_ok = pop_ok &&
                 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
                 v7m_stack_read(cpu, &env->regs[4], frameptr + 0x8, mmu_idx) &&
                 v7m_stack_read(cpu, &env->regs[5], frameptr + 0xc, mmu_idx) &&
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

They share the same underlying state

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1523997485-1905-3-git-send-email-alindsay@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmselr),
       .writefn = pmselr_write, .raw_writefn = raw_write, },
     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
-      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_IO,
+      .access = PL0_RW, .resetvalue = 0, .type = ARM_CP_ALIAS | ARM_CP_IO,
       .readfn = pmccntr_read, .writefn = pmccntr_write32,
       .accessfn = pmreg_access_ccntr },
     { .name = "PMCCNTR_EL0", .state = ARM_CP_STATE_AA64,
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

This is in preparation for enabling counters other than PMCCNTR

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1523997485-1905-5-git-send-email-alindsay@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 31 ++++++++++++++++++++++---------
 1 file changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {
 static void v8m_security_lookup(CPUARMState *env, uint32_t address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 V8M_SAttributes *sattrs);
-
-/* Definitions for the PMCCNTR and PMCR registers */
-#define PMCRD   0x8
-#define PMCRC   0x4
-#define PMCRE   0x1
 #endif
 
 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+/* Definitions for the PMU registers */
+#define PMCRN_MASK  0xf800
+#define PMCRN_SHIFT 11
+#define PMCRD   0x8
+#define PMCRC   0x4
+#define PMCRE   0x1
+
+static inline uint32_t pmu_num_counters(CPUARMState *env)
+{
+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
+}
+
+/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
+static inline uint64_t pmu_counter_mask(CPUARMState *env)
+{
+  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
+}
+
 static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
@@ -XXX,XX +XXX,XX @@ static void pmccfiltr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void pmcntenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
                             uint64_t value)
 {
-    value &= (1 << 31);
+    value &= pmu_counter_mask(env);
     env->cp15.c9_pmcnten |= value;
 }
 
 static void pmcntenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
-    value &= (1 << 31);
+    value &= pmu_counter_mask(env);
     env->cp15.c9_pmcnten &= ~value;
 }
 
@@ -XXX,XX +XXX,XX @@ static void pmintenset_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
     /* We have no event counters so only the C bit can be changed */
-    value &= (1 << 31);
+    value &= pmu_counter_mask(env);
     env->cp15.c9_pminten |= value;
 }
 
 static void pmintenclr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                              uint64_t value)
 {
-    value &= (1 << 31);
+    value &= pmu_counter_mask(env);
     env->cp15.c9_pminten &= ~value;
 }
 
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

This eliminates the need for fetching it from el_change_hook_opaque, and
allows for supporting multiple el_change_hooks without having to hack
something together to find the registered opaque belonging to GICv3.

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1523997485-1905-6-git-send-email-alindsay@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 10 ----------
 hw/intc/arm_gicv3_cpuif.c | 10 ++--------
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
 void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
                                  void *opaque);
 
-/**
- * arm_get_el_change_hook_opaque:
- * Return the opaque data that will be used by the el_change_hook
- * for this CPU.
- */
-static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
-{
-    return cpu->el_change_hook_opaque;
-}
-
 /**
  * aa32_vfp_dreg:
  * Return a pointer to the Dn register within env in 32-bit mode.
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
 
 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
 {
-    /* Given the CPU, find the right GICv3CPUState struct.
-     * Since we registered the CPU interface with the EL change hook as
-     * the opaque pointer, we can just directly get from the CPU to it.
-     */
-    return arm_get_el_change_hook_opaque(arm_env_get_cpu(env));
+    return env->gicv3state;
 }
 
 static bool gicv3_use_ns_bank(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ void gicv3_init_cpuif(GICv3State *s)
          * it might be with code translated by CPU 0 but run by CPU 1, in
          * which case we'd get the wrong value.
          * So instead we define the regs with no ri->opaque info, and
-         * get back to the GICv3CPUState from the ARMCPU by reading back
-         * the opaque pointer from the el_change_hook, which we're going
-         * to need to register anyway.
+         * get back to the GICv3CPUState from the CPUARMState.
          */
         define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
         if (arm_feature(&cpu->env, ARM_FEATURE_EL2)
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Message-id: 1523997485-1905-7-git-send-email-alindsay@codeaurora.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       | 20 ++++++++++----------
 target/arm/internals.h |  7 ++++---
 target/arm/cpu.c       | 21 ++++++++++++++++-----
 3 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
 } CPUARMState;
 
 /**
- * ARMELChangeHook:
+ * ARMELChangeHookFn:
  * type of a function which can be registered via arm_register_el_change_hook()
  * to get callbacks when the CPU changes its exception level or mode.
  */
-typedef void ARMELChangeHook(ARMCPU *cpu, void *opaque);
-
+typedef void ARMELChangeHookFn(ARMCPU *cpu, void *opaque);
+typedef struct ARMELChangeHook ARMELChangeHook;
+struct ARMELChangeHook {
+    ARMELChangeHookFn *hook;
+    void *opaque;
+    QLIST_ENTRY(ARMELChangeHook) node;
+};
 
 /* These values map onto the return values for
  * QEMU_PSCI_0_2_FN_AFFINITY_INFO */
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      */
     bool cfgend;
 
-    ARMELChangeHook *el_change_hook;
-    void *el_change_hook_opaque;
+    QLIST_HEAD(, ARMELChangeHook) el_change_hooks;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
 
@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
  * CPU changes exception level or mode. The hook function will be
  * passed a pointer to the ARMCPU and the opaque data pointer passed
  * to this function when the hook was registered.
- *
- * Note that we currently only support registering a single hook function,
- * and will assert if this function is called twice.
- * This facility is intended for the use of the GICv3 emulation.
  */
-void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
+void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque);
 
 /**
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
                                    int mmu_idx, MemTxAttrs attrs,
                                    MemTxResult response, uintptr_t retaddr);
 
-/* Call the EL change hook if one has been registered */
+/* Call any registered EL change hooks */
 static inline void arm_call_el_change_hook(ARMCPU *cpu)
 {
-    if (cpu->el_change_hook) {
-        cpu->el_change_hook(cpu, cpu->el_change_hook_opaque);
+    ARMELChangeHook *hook, *next;
+    QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
+        hook->hook(cpu, hook->opaque);
     }
 }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
          | CPU_INTERRUPT_EXITTB);
 }
 
-void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHook *hook,
+void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque)
 {
-    /* We currently only support registering a single hook function */
-    assert(!cpu->el_change_hook);
-    cpu->el_change_hook = hook;
-    cpu->el_change_hook_opaque = opaque;
+    ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
+
+    entry->hook = hook;
+    entry->opaque = opaque;
+
+    QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
 }
 
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
                                          g_free, g_free);
 
+    QLIST_INIT(&cpu->el_change_hooks);
+
 #ifndef CONFIG_USER_ONLY
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
 static void arm_cpu_finalizefn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMELChangeHook *hook, *next;
+
     g_hash_table_destroy(cpu->cp_regs);
+
+    QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
+        QLIST_REMOVE(hook, node);
+        g_free(hook);
+    }
 }
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

Because the design of the PMU requires that the counter values be
converted between their delta and guest-visible forms for mode
filtering, an additional hook which occurs before the EL is changed is
necessary.

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Message-id: 1523997485-1905-8-git-send-email-alindsay@codeaurora.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       | 22 +++++++++++++++++++---
 target/arm/internals.h |  7 +++++++
 target/arm/cpu.c       | 16 ++++++++++++++++
 target/arm/helper.c    | 14 ++++++++------
 target/arm/op_helper.c |  8 ++++++++
 5 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      */
     bool cfgend;
 
+    QLIST_HEAD(, ARMELChangeHook) pre_el_change_hooks;
     QLIST_HEAD(, ARMELChangeHook) el_change_hooks;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
@@ -XXX,XX +XXX,XX @@ static inline AddressSpace *arm_addressspace(CPUState *cs, MemTxAttrs attrs)
 #endif
 
 /**
- * arm_register_el_change_hook:
- * Register a hook function which will be called back whenever this
+ * arm_register_pre_el_change_hook:
+ * Register a hook function which will be called immediately before this
  * CPU changes exception level or mode. The hook function will be
  * passed a pointer to the ARMCPU and the opaque data pointer passed
  * to this function when the hook was registered.
+ *
+ * Note that if a pre-change hook is called, any registered post-change hooks
+ * are guaranteed to subsequently be called.
  */
-void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque);
+/**
+ * arm_register_el_change_hook:
+ * Register a hook function which will be called immediately after this
+ * CPU changes exception level or mode. The hook function will be
+ * passed a pointer to the ARMCPU and the opaque data pointer passed
+ * to this function when the hook was registered.
+ *
+ * Note that any registered hooks registered here are guaranteed to be called
+ * if pre-change hooks have been.
+ */
+void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook, void
+        *opaque);
 
 /**
  * aa32_vfp_dreg:
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
                                    MemTxResult response, uintptr_t retaddr);
 
 /* Call any registered EL change hooks */
+static inline void arm_call_pre_el_change_hook(ARMCPU *cpu)
+{
+    ARMELChangeHook *hook, *next;
+    QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
+        hook->hook(cpu, hook->opaque);
+    }
+}
 static inline void arm_call_el_change_hook(ARMCPU *cpu)
 {
     ARMELChangeHook *hook, *next;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
          | CPU_INTERRUPT_EXITTB);
 }
 
+void arm_register_pre_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+                                 void *opaque)
+{
+    ARMELChangeHook *entry = g_new0(ARMELChangeHook, 1);
+
+    entry->hook = hook;
+    entry->opaque = opaque;
+
+    QLIST_INSERT_HEAD(&cpu->pre_el_change_hooks, entry, node);
+}
+
 void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
                                  void *opaque)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     cpu->cp_regs = g_hash_table_new_full(g_int_hash, g_int_equal,
                                          g_free, g_free);
 
+    QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
 
     g_hash_table_destroy(cpu->cp_regs);
 
+    QLIST_FOREACH_SAFE(hook, &cpu->pre_el_change_hooks, node, next) {
+        QLIST_REMOVE(hook, node);
+        g_free(hook);
+    }
     QLIST_FOREACH_SAFE(hook, &cpu->el_change_hooks, node, next) {
         QLIST_REMOVE(hook, node);
         g_free(hook);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
         return;
     }
 
+    /* Hooks may change global state so BQL should be held, also the
+     * BQL needs to be held for any modification of
+     * cs->interrupt_request.
+     */
+    g_assert(qemu_mutex_iothread_locked());
+
+    arm_call_pre_el_change_hook(cpu);
+
     assert(!excp_is_internal(cs->exception_index));
     if (arm_el_is_aa64(env, new_el)) {
         arm_cpu_do_interrupt_aarch64(cs);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
         arm_cpu_do_interrupt_aarch32(cs);
     }
 
-    /* Hooks may change global state so BQL should be held, also the
-     * BQL needs to be held for any modification of
-     * cs->interrupt_request.
-     */
-    g_assert(qemu_mutex_iothread_locked());
-
     arm_call_el_change_hook(cpu);
 
     if (!kvm_enabled()) {
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(cpsr_write)(CPUARMState *env, uint32_t val, uint32_t mask)
 /* Write the CPSR for a 32-bit exception return */
 void HELPER(cpsr_write_eret)(CPUARMState *env, uint32_t val)
 {
+    qemu_mutex_lock_iothread();
+    arm_call_pre_el_change_hook(arm_env_get_cpu(env));
+    qemu_mutex_unlock_iothread();
+
     cpsr_write(env, val, CPSR_ERET_MASK, CPSRWriteExceptionReturn);
 
     /* Generated code has already stored the new PC value, but
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
         goto illegal_return;
     }
 
+    qemu_mutex_lock_iothread();
+    arm_call_pre_el_change_hook(arm_env_get_cpu(env));
+    qemu_mutex_unlock_iothread();
+
     if (!return_to_aa64) {
         env->aarch64 = 0;
         /* We do a raw CPSR write because aarch64_sync_64_to_32()
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

During code generation, surround CPSR writes and exception returns which
call the EL change hooks with gen_io_start/end. The immediate need is
for the PMU to access the clock and icount during EL change to support
mode filtering.

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Message-id: 1523997485-1905-9-git-send-email-alindsay@codeaurora.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c |  6 ++++++
 target/arm/translate.c     | 12 ++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
             unallocated_encoding(s);
             return;
         }
+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+            gen_io_start();
+        }
         gen_helper_exception_return(cpu_env);
+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+            gen_io_end();
+        }
         /* Must exit loop to check un-masked IRQs */
         s->base.is_jmp = DISAS_EXIT;
         return;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_rfe(DisasContext *s, TCGv_i32 pc, TCGv_i32 cpsr)
      * appropriately depending on the new Thumb bit, so it must
      * be called after storing the new PC.
      */
+    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+        gen_io_start();
+    }
     gen_helper_cpsr_write_eret(cpu_env, cpsr);
+    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+        gen_io_end();
+    }
     tcg_temp_free_i32(cpsr);
     /* Must exit loop to check un-masked IRQs */
     s->base.is_jmp = DISAS_EXIT;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                 if (exc_return) {
                     /* Restore CPSR from SPSR.  */
                     tmp = load_cpu_field(spsr);
+                    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+                        gen_io_start();
+                    }
                     gen_helper_cpsr_write_eret(cpu_env, tmp);
+                    if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+                        gen_io_end();
+                    }
                     tcg_temp_free_i32(tmp);
                     /* Must exit loop to check un-masked IRQs */
                     s->base.is_jmp = DISAS_EXIT;
-- 
2.17.0

From: Aaron Lindsay <alindsay@codeaurora.org>

This is a bug fix to ensure 64-bit reads of these registers don't read
adjacent data.

Signed-off-by: Aaron Lindsay <alindsay@codeaurora.org>
Message-id: 1523997485-1905-13-git-send-email-alindsay@codeaurora.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 4 ++--
 target/arm/helper.c | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t c9_data;
         uint64_t c9_pmcr; /* performance monitor control register */
         uint64_t c9_pmcnten; /* perf monitor counter enables */
-        uint32_t c9_pmovsr; /* perf monitor overflow status */
-        uint32_t c9_pmuserenr; /* perf monitor user enable */
+        uint64_t c9_pmovsr; /* perf monitor overflow status */
+        uint64_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint64_t c9_pminten; /* perf monitor interrupt enables */
         union { /* Memory attribute redirection */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcnten),
       .writefn = pmcntenclr_write },
     { .name = "PMOVSR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 3,
-      .access = PL0_RW, .fieldoffset = offsetof(CPUARMState, cp15.c9_pmovsr),
+      .access = PL0_RW,
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmovsr),
       .accessfn = pmreg_access,
       .writefn = pmovsr_write,
       .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .accessfn = pmreg_access_xevcntr },
     { .name = "PMUSERENR", .cp = 15, .crn = 9, .crm = 14, .opc1 = 0, .opc2 = 0,
       .access = PL0_R | PL1_RW, .accessfn = access_tpm,
-      .fieldoffset = offsetof(CPUARMState, cp15.c9_pmuserenr),
+      .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmuserenr),
       .resetvalue = 0,
       .writefn = pmuserenr_write, .raw_writefn = raw_write },
     { .name = "PMUSERENR_EL0", .state = ARM_CP_STATE_AA64,
-- 
2.17.0

In commit 210f47840dd62, we changed the bcm2836 SoC object to
always create a CPU of the correct type for that SoC model. This
makes the default_cpu_type settings in the MachineClass structs
for the raspi2 and raspi3 boards redundant. We didn't change
those at the time because it would have meant a temporary
regression in a corner case of error handling if the user
requested a non-existing CPU type. The -cpu parse handling
changes in 2278b93941d42c3 mean that it no longer implicitly
depends on default_cpu_type for this to work, so we can now
delete the redundant default_cpu_type fields.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180420155547.9497-1-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_parallel = 1;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
-    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_parallel = 1;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
-    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
-- 
2.17.0

Currently we use memory_region_init_ram_nomigrate() to create
the "highbank.sysram" memory region, and we don't manually
register it with vmstate_register_ram(). This currently
means that its contents are migrated but as a ram block
whose name is the empty string; in future it may mean they
are not migrated at all. Use memory_region_init_ram() instead.

Note that this is a cross-version migration compatibility
break for the "highbank" and "midway" machines.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180420124835.7268-2-peter.maydell@linaro.org
---
 hw/arm/highbank.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id)
     memory_region_add_subregion(sysmem, 0, dram);
 
     sysram = g_new(MemoryRegion, 1);
-    memory_region_init_ram_nomigrate(sysram, NULL, "highbank.sysram", 0x8000,
+    memory_region_init_ram(sysram, NULL, "highbank.sysram", 0x8000,
                            &error_fatal);
     memory_region_add_subregion(sysmem, 0xfff88000, sysram);
     if (bios_name != NULL) {
-- 
2.17.0

Currently we use memory_region_init_ram_nomigrate() to create
the "aspeed.boot_rom" memory region, and we don't manually
register it with vmstate_register_ram(). This currently
means that its contents are migrated but as a ram block
whose name is the empty string; in future it may mean they
are not migrated at all. Use memory_region_init_ram() instead.

Note that would be a cross-version migration compatibility break
for the "palmetto-bmc", "ast2500-evb" and "romulus-bmc" machines,
but migration is currently broken for them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180420124835.7268-3-peter.maydell@linaro.org
---
 hw/arm/aspeed.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
          * SoC and 128MB for the AST2500 SoC, which is twice as big as
          * needed by the flash modules of the Aspeed machines.
          */
-        memory_region_init_rom_nomigrate(boot_rom, OBJECT(bmc), "aspeed.boot_rom",
+        memory_region_init_rom(boot_rom, OBJECT(bmc), "aspeed.boot_rom",
                                fl->size, &error_abort);
         memory_region_add_subregion(get_system_memory(), FIRMWARE_ADDR,
                                     boot_rom);
-- 
2.17.0

Currently we use vmstate_register_ram_global() for the SRAM;
this is not a good idea for devices, because it means that
you can only ever create one instance of the device, as
the second instance would get a RAM block name clash.
Instead, use memory_region_init_ram(), which automatically
registers the RAM block with a local-to-the-device name.

Note that this would be a cross-version migration compatibility break
for the "palmetto-bmc", "ast2500-evb" and "romulus-bmc" machines,
but migration is currently broken for them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180420124835.7268-4-peter.maydell@linaro.org
---
 hw/arm/aspeed_soc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     }
 
     /* SRAM */
-    memory_region_init_ram_nomigrate(&s->sram, OBJECT(dev), "aspeed.sram",
+    memory_region_init_ram(&s->sram, OBJECT(dev), "aspeed.sram",
                            sc->info->sram_size, &err);
     if (err) {
         error_propagate(errp, err);
         return;
     }
-    vmstate_register_ram_global(&s->sram);
     memory_region_add_subregion(get_system_memory(), ASPEED_SOC_SRAM_BASE,
                                 &s->sram);
 
-- 
2.17.0

From: Cédric Le Goater <clg@kaod.org>

commit 1d3e65aa7ac5 ("hw/timer: Add value matching support to
aspeed_timer") increased the vmstate version of aspeed.timer because
the state had changed, but it also bumped the version of the
VMSTATE_STRUCT_ARRAY under the aspeed.timerctrl which did not need to.

Change back this version to fix migration.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20180423101433.17759-1-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/aspeed_timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_timer_state = {
         VMSTATE_UINT32(ctrl, AspeedTimerCtrlState),
         VMSTATE_UINT32(ctrl2, AspeedTimerCtrlState),
         VMSTATE_STRUCT_ARRAY(timers, AspeedTimerCtrlState,
-                             ASPEED_TIMER_NR_TIMERS, 2, vmstate_aspeed_timer,
+                             ASPEED_TIMER_NR_TIMERS, 1, vmstate_aspeed_timer,
                              AspeedTimer),
         VMSTATE_END_OF_LIST()
     }
-- 
2.17.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

SNOOP_NONE state handle is moved above in the if ladder, as it's same
as SNOOP_STRIPPING during data cycles.

Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 1524119244-1240-1-git-send-email-saipava@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
         if (fifo8_is_empty(&s->tx_fifo)) {
             xilinx_spips_update_ixr(s);
             return;
-        } else if (s->snoop_state == SNOOP_STRIPING) {
+        } else if (s->snoop_state == SNOOP_STRIPING ||
+                   s->snoop_state == SNOOP_NONE) {
             for (i = 0; i < num_effective_busses(s); ++i) {
                 tx_rx[i] = fifo8_pop(&s->tx_fifo);
             }
-- 
2.17.0

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
             return;
         }
-        /* opc == 1, BXFIL fall through to deposit */
-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
+        /* opc == 1, BFXIL fall through to deposit */
+        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
         pos = 0;
     } else {
         /* Handle the ri > si case with a deposit
@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
         len = ri;
     }
 
-    if (opc == 1) { /* BFM, BXFIL */
+    if (opc == 1) { /* BFM, BFXIL */
         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
     } else {
         /* SBFM or UBFM: We start with zero, and we haven't modified
-- 
2.20.1

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1