Series comparison

-[Qemu-devel] [PULL 00/15] target-arm queue
+[Qemu-devel] [PULL 00/12] target-arm queue
-A mixed bag, all bug fixes or similar small stuff.
+Not very much here, but several people have fallen over
 the vector operation segfault bug, so let's get the fix
 into master.
 thanks
 -- PMM
+The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
-The following changes since commit 19eb2d4e736dc895f31fbd6b520e514f10cc08e0:
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
   Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2019-05-07 10:43:32 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190507
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
-for you to fetch changes up to 63159601fb3e396b28da14cbb71e50ed3f5a0331:
+for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
-  target/arm: Stop using variable length array in dc_zva (2019-05-07 12:55:04 +0100)
+  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Stop using variable length array in dc_zva
+ * exynos4210: QOM'ify the Exynos4210 SoC
- * Implement M-profile XPSR GE bits
+ * exynos4210: Add DMA support for the Exynos4210
- * Don't enable ARMV7M_EXCP_DEBUG from reset
+ * arm_gicv3: Fix writes to ICC_CTLR_EL3
- * armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
+ * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
- * armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
+ * target/arm: Fix vector operation segfault
- * fix various minor issues to allow building for Windows-on-ARM64
+ * target/arm: Minor improvements to BFXIL, EXTR
  * aspeed: Set SDRAM size
  * Allow system registers for KVM guests to be changed by QEMU code
  * raspi: Diagnose requests for too much RAM
  * virt: Support firmware configuration with -blockdev
 ----------------------------------------------------------------
-Cao Jiaxi (4):
+Alistair Francis (1):
-      QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
+      target/arm: Fix vector operation segfault
       qga: Fix mingw compilation warnings on enum conversion
       util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
       osdep: Fix mingw compilation regarding stdio formats
-Joel Stanley (1):
+Guenter Roeck (1):
-      arm: aspeed: Set SDRAM size
+      hw/arm/exynos4210: Add DMA support for the Exynos4210
-Markus Armbruster (3):
+Peter Maydell (5):
-      pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
+      arm: Move system_clock_scale to armv7m_systick.h
-      pflash_cfi01: New pflash_cfi01_legacy_drive()
+      arm: Remove unnecessary includes of hw/arm/arm.h
-      hw/arm/virt: Support firmware configuration with -blockdev
+      arm: Rename hw/arm/arm.h to hw/arm/boot.h
       hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
       hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-Peter Maydell (7):
+Philippe Mathieu-Daudé (3):
-      hw/arm/raspi: Diagnose requests for too much RAM
+      hw/arm/exynos4: Remove unuseful debug code
-      arm: Allow system registers for KVM guests to be changed by QEMU code
+      hw/arm/exynos4: Use the IEC binary prefix definitions
-      hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
+      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
       hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
       hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
       target/arm: Implement XPSR GE bits
       target/arm: Stop using variable length array in dc_zva
- contrib/libvhost-user/libvhost-user.h |   2 +-
+Richard Henderson (2):
- include/hw/arm/aspeed.h               |   1 +
+      target/arm: Use extract2 for EXTR
- include/hw/arm/virt.h                 |   2 +
+      target/arm: Simplify BFXIL expansion
  include/hw/block/flash.h              |   1 +
  include/qemu/compiler.h               |   2 +-
  include/qemu/osdep.h                  |  10 +-
  scripts/cocci-macro-file.h            |   7 +-
  target/arm/cpu.h                      |  13 ++-
  hw/arm/aspeed.c                       |   8 ++
  hw/arm/raspi.c                        |   7 ++
  hw/arm/virt.c                         | 202 ++++++++++++++++++++++------------
  hw/block/pflash_cfi01.c               |  28 +++++
  hw/i386/pc_sysfw.c                    |  18 +--
  hw/intc/armv7m_nvic.c                 |  40 ++++++-
  qga/commands-win32.c                  |   2 +-
  target/arm/helper.c                   |  47 +++++++-
  target/arm/kvm.c                      |   8 ++
  target/arm/kvm32.c                    |  20 +---
  target/arm/kvm64.c                    |   2 +
  target/arm/machine.c                  |   2 +-
  util/cacheinfo.c                      |   2 +-
 files changed, 294 insertions(+), 130 deletions(-)
+ include/hw/arm/allwinner-a10.h    |  2 +-
+ include/hw/arm/aspeed_soc.h       |  1 -
+ include/hw/arm/bcm2836.h          |  1 -
+ include/hw/arm/{arm.h => boot.h}  | 12 +++------
+ include/hw/arm/exynos4210.h       |  9 +++++--
+ include/hw/arm/fsl-imx25.h        |  2 +-
+ include/hw/arm/fsl-imx31.h        |  2 +-
+ include/hw/arm/fsl-imx6.h         |  2 +-
+ include/hw/arm/fsl-imx6ul.h       |  2 +-
+ include/hw/arm/fsl-imx7.h         |  2 +-
+ include/hw/arm/virt.h             |  2 +-
+ include/hw/arm/xlnx-versal.h      |  2 +-
+ include/hw/arm/xlnx-zynqmp.h      |  2 +-
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
+ hw/arm/armsse.c                   |  2 +-
+ hw/arm/armv7m.c                   |  2 +-
+ hw/arm/aspeed.c                   |  2 +-
+ hw/arm/boot.c                     |  2 +-
+ hw/arm/collie.c                   |  2 +-
+ hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
+ hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
+ hw/arm/highbank.c                 |  2 +-
+ hw/arm/integratorcp.c             |  2 +-
+ hw/arm/mainstone.c                |  2 +-
+ hw/arm/microbit.c                 |  2 +-
+ hw/arm/mps2-tz.c                  |  2 +-
+ hw/arm/mps2.c                     |  2 +-
+ hw/arm/msf2-soc.c                 |  1 -
+ hw/arm/msf2-som.c                 |  2 +-
+ hw/arm/musca.c                    |  2 +-
+ hw/arm/musicpal.c                 |  2 +-
+ hw/arm/netduino2.c                |  2 +-
+ hw/arm/nrf51_soc.c                |  2 +-
+ hw/arm/nseries.c                  |  2 +-
+ hw/arm/omap1.c                    |  2 +-
+ hw/arm/omap2.c                    |  2 +-
+ hw/arm/omap_sx1.c                 |  2 +-
+ hw/arm/palm.c                     |  2 +-
+ hw/arm/raspi.c                    |  2 +-
+ hw/arm/realview.c                 |  2 +-
+ hw/arm/spitz.c                    |  2 +-
+ hw/arm/stellaris.c                |  2 +-
+ hw/arm/stm32f205_soc.c            |  2 +-
+ hw/arm/strongarm.c                |  2 +-
+ hw/arm/tosa.c                     |  2 +-
+ hw/arm/versatilepb.c              |  2 +-
+ hw/arm/vexpress.c                 |  2 +-
+ hw/arm/virt.c                     |  2 +-
+ hw/arm/xilinx_zynq.c              |  2 +-
+ hw/arm/xlnx-versal.c              |  2 +-
+ hw/arm/z2.c                       |  2 +-
+ hw/intc/arm_gicv3_cpuif.c         |  6 ++---
+ hw/intc/armv7m_nvic.c             |  1 -
+ target/arm/arm-semi.c             |  1 -
+ target/arm/cpu.c                  |  1 -
+ target/arm/cpu64.c                |  1 -
+ target/arm/kvm.c                  |  1 -
+ target/arm/kvm32.c                |  1 -
+ target/arm/kvm64.c                |  1 -
+ target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
+ target/arm/translate.c            |  4 +--
+files changed, 164 insertions(+), 123 deletions(-)
+ rename include/hw/arm/{arm.h => boot.h} (96%)

-[Qemu-devel] [PULL 10/15] osdep: Fix mingw compilation regarding stdio formats
+[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
-From: Cao Jiaxi <driver1998@foxmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-I encountered the following compilation error on mingw:
+This is, after all, how we implement extract2 in tcg/aarch64.
-/mnt/d/qemu/include/qemu/osdep.h:97:9: error: '__USE_MINGW_ANSI_STDIO' macro redefined [-Werror,-Wmacro-redefined]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
- #define __USE_MINGW_ANSI_STDIO 1
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-        ^
+Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
 /mnt/d/llvm-mingw/aarch64-w64-mingw32/include/_mingw.h:433:9: note: previous definition is here
  #define __USE_MINGW_ANSI_STDIO 0      /* was not defined so it should be 0 */
 It turns out that __USE_MINGW_ANSI_STDIO must be set before any
 system headers are included, not just before stdio.h.
 Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Message-id: 20190503003719.10233-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qemu/osdep.h | 10 +++++-----
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
-file changed, 5 insertions(+), 5 deletions(-)
+file changed, 20 insertions(+), 18 deletions(-)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
+--- a/target/arm/translate-a64.c
-+++ b/include/qemu/osdep.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
+@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
- #endif
+             } else {
- #endif
+                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
+             }
-+/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
+-        } else if (rm == rn) { /* ROR */
-+#ifdef __MINGW32__
+-            tcg_rm = cpu_reg(s, rm);
-+#define __USE_MINGW_ANSI_STDIO 1
+-            if (sf) {
-+#endif
+-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
 -            } else {
 -                TCGv_i32 tmp = tcg_temp_new_i32();
 -                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
 -                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
- #include <stdarg.h>
++            if (sf) {
- #include <stddef.h>
++                /* Specialization to ROR happens in EXTRACT2.  */
- #include <stdbool.h>
++                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
- #include <stdint.h>
++            } else {
- #include <sys/types.h>
++                TCGv_i32 t0 = tcg_temp_new_i32();
- #include <stdlib.h>
++
--
++                tcg_gen_extrl_i64_i32(t0, tcg_rm);
--/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
++                if (rm == rn) {
--#ifdef __MINGW32__
++                    tcg_gen_rotri_i32(t0, t0, imm);
--#define __USE_MINGW_ANSI_STDIO 1
++                } else {
--#endif
++                    TCGv_i32 t1 = tcg_temp_new_i32();
- #include <stdio.h>
++                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
++                    tcg_gen_extract2_i32(t0, t0, t1, imm);
- #include <string.h>
++                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
 --
 .20.1

-[Qemu-devel] [PULL 01/15] pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
+[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
-From: Markus Armbruster <armbru@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The loop does two things: map legacy -drive to properties, and collect
+The mask implied by the extract is redundant with the one
-all the backends for use after the loop.  The next patch will factor
+implied by the deposit.  Also, fix spelling of BFXIL.
 out the former for reuse in hw/arm/virt.c.  To make that easier,
 rearrange the loop so it does the first thing first, and the second
 thing second.
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Laszlo Ersek <lersek@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Message-id: 20190416091348.26075-2-armbru@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i386/pc_sysfw.c | 24 +++++++++++-------------
+ target/arm/translate-a64.c | 6 +++---
-file changed, 11 insertions(+), 13 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/pc_sysfw.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/i386/pc_sysfw.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
+             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
-     /* Map legacy -drive if=pflash to machine properties */
+             return;
      for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
 -        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
          pflash_drv = drive_get(IF_PFLASH, 0, i);
 -        if (!pflash_drv) {
 -            continue;
 +        if (pflash_drv) {
 +            loc_push_none(&loc);
 +            qemu_opts_loc_restore(pflash_drv->opts);
 +            if (pflash_cfi01_get_blk(pcms->flash[i])) {
 +                error_report("clashes with -machine");
 +                exit(1);
 +            }
 +            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
 +                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
 +            loc_pop(&loc);
          }
--        loc_push_none(&loc);
+-        /* opc == 1, BXFIL fall through to deposit */
--        qemu_opts_loc_restore(pflash_drv->opts);
+-        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
--        if (pflash_blk[i]) {
++        /* opc == 1, BFXIL fall through to deposit */
--            error_report("clashes with -machine");
++        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
--            exit(1);
+         pos = 0;
--        }
+     } else {
--        pflash_blk[i] = blk_by_legacy_dinfo(pflash_drv);
+         /* Handle the ri > si case with a deposit
--        qdev_prop_set_drive(DEVICE(pcms->flash[i]),
+@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
--                            "drive", pflash_blk[i], &error_fatal);
+         len = ri;
 -        loc_pop(&loc);
 +        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
      }
-     /* Reject gaps */
+-    if (opc == 1) { /* BFM, BXFIL */
 +    if (opc == 1) { /* BFM, BFXIL */
          tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
      } else {
          /* SBFM or UBFM: We start with zero, and we haven't modified
 --
 .20.1

-[Qemu-devel] [PULL 09/15] util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
+[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
-From: Cao Jiaxi <driver1998@foxmail.com>
+From: Alistair Francis <alistair.francis@wdc.com>
-Windows ARM64 uses LLP64 model, which breaks current assumptions.
+Commit 89e68b575 "target/arm: Use vector operations for saturation"
 causes this abort() when booting QEMU ARM with a Cortex-A15:
-Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
+0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
 0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
 0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
 0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20190503003707.10185-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/cacheinfo.c | 2 +-
+ target/arm/translate.c | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/util/cacheinfo.c b/util/cacheinfo.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/cacheinfo.c
+--- a/target/arm/translate.c
-+++ b/util/cacheinfo.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
- static void arch_cache_info(int *isize, int *dsize)
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
- {
+                            rn_ofs, rm_ofs, vec_size, vec_size,
-     if (*isize == 0 || *dsize == 0) {
+                            (u ? uqadd_op : sqadd_op) + size);
--        unsigned long ctr;
+-            break;
-+        uint64_t ctr;
++            return 0;
-         /* The real cache geometry is in CCSIDR_EL1/CLIDR_EL1/CSSELR_EL1,
+         case NEON_3R_VQSUB:
-            but (at least under Linux) these are marked protected by the
+             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                             rn_ofs, rm_ofs, vec_size, vec_size,
                             (u ? uqsub_op : sqsub_op) + size);
 -            break;
 +            return 0;
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
 --
 .20.1

-[Qemu-devel] [PULL 15/15] target/arm: Stop using variable length array in dc_zva
+[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
-Currently the dc_zva helper function uses a variable length
+The system_clock_scale global is used only by the armv7m systick
-array. In fact we know (as the comment above remarks) that
+device; move the extern declaration to the armv7m_systick.h header,
-the length of this array is bounded because the architecture
+and expand the comment to explain what it is and that it should
-limits the block size and QEMU limits the target page size.
+ideally be replaced with a different approach.
 Use a fixed array size and assert that we don't run off it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190503120448.13385-1-peter.maydell@linaro.org
+Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 8 ++++++--
+ include/hw/arm/arm.h              |  4 ----
-file changed, 6 insertions(+), 2 deletions(-)
+ include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/arm/arm.h
-+++ b/target/arm/helper.c
++++ b/include/hw/arm/arm.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
- #include "qemu/osdep.h"
+                                             const struct arm_boot_info *info,
-+#include "qemu/units.h"
+                                             hwaddr mvbar_addr);
- #include "target/arm/idau.h"
- #include "trace.h"
+-/* Multiplication factor to convert from system clock ticks to qemu timer
- #include "cpu.h"
+-   ticks.  */
-@@ -XXX,XX +XXX,XX @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
+-extern int system_clock_scale;
-          * We know that in fact for any v8 CPU the page size is at least 4K
+-
-          * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
+ #endif /* HW_ARM_H */
-          * 1K as an artefact of legacy v5 subpage support being present in the
+diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
--         * same QEMU executable.
+index XXXXXXX..XXXXXXX 100644
-+         * same QEMU executable. So in practice the hostaddr[] array has
+--- a/include/hw/timer/armv7m_systick.h
-+         * two entries, given the current setting of TARGET_PAGE_BITS_MIN.
++++ b/include/hw/timer/armv7m_systick.h
-          */
+@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
-         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
+     qemu_irq irq;
--        void *hostaddr[maxidx];
+ } SysTickState;
-+        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
-         int try, i;
++/*
-         unsigned mmu_idx = cpu_mmu_index(env, false);
++ * Multiplication factor to convert from system clock ticks to qemu timer
-         TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
++ * ticks. This should be set (by board code, usually) to a value
++ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
-+        assert(maxidx <= ARRAY_SIZE(hostaddr));
++ * in Hz of the CPU.
 + *
 + * This value is used by the systick device when it is running in
 + * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
 + * set how fast the timer should tick.
 + *
 + * TODO: we should refactor this so that rather than using a global
 + * we use a device property or something similar. This is complicated
 + * because (a) the property would need to be plumbed through from the
 + * board code down through various layers to the systick device
 + * and (b) the property needs to be modifiable after realize, because
 + * the stellaris board uses this to implement the behaviour where the
 + * guest can reprogram the PLL registers to downclock the CPU, and the
 + * systick device needs to react accordingly. Possibly this should
 + * be deferred until we have a good API for modelling clock trees.
 + */
 +extern int system_clock_scale;
 +
-         for (try = 0; try < 2; try++) {
+ #endif
              for (i = 0; i < maxidx; i++) {
 --
 .20.1

-[Qemu-devel] [PULL 05/15] arm: Allow system registers for KVM guests to be changed by QEMU code
+[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
-At the moment the Arm implementations of kvm_arch_{get,put}_registers()
+The hw/arm/arm.h header now only includes declarations relating
-don't support having QEMU change the values of system registers
+to boot.c code, so it is only needed by Arm board or SoC code.
-(aka coprocessor registers for AArch32). This is because although
+Remove some unnecessary inclusions of it from target/arm files
-kvm_arch_get_registers() calls write_list_to_cpustate() to
+and from hw/intc/armv7m_nvic.c.
 update the CPU state struct fields (so QEMU code can read the
 values in the usual way), kvm_arch_put_registers() does not
 call write_cpustate_to_list(), meaning that any changes to
 the CPU state struct fields will not be passed back to KVM.
 The rationale for this design is documented in a comment in the
 AArch32 kvm_arch_put_registers() -- writing the values in the
 cpregs list into the CPU state struct is "lossy" because the
 write of a register might not succeed, and so if we blindly
 copy the CPU state values back again we will incorrectly
 change register values for the guest. The assumption was that
 no QEMU code would need to write to the registers.
 However, when we implemented debug support for KVM guests, we
 broke that assumption: the code to handle "set the guest up
 to take a breakpoint exception" does so by updating various
 guest registers including ESR_EL1.
 Support this by making kvm_arch_put_registers() synchronize
 CPU state back into the list. We sync only those registers
 where the initial write succeeds, which should be sufficient.
 This commit is the same as commit 823e1b3818f9b10b824ddc which we
 had to revert in commit 942f99c825fc94c8b1a4, except that the bug
 which was preventing EDK2 guest firmware running has been fixed:
 kvm_arm_reset_vcpu() now calls write_list_to_cpustate().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |  9 ++++++++-
+ hw/intc/armv7m_nvic.c | 1 -
- target/arm/helper.c  | 27 +++++++++++++++++++++++++--
+ target/arm/arm-semi.c | 1 -
- target/arm/kvm.c     |  8 ++++++++
+ target/arm/cpu.c      | 1 -
- target/arm/kvm32.c   | 20 ++------------------
+ target/arm/cpu64.c    | 1 -
- target/arm/kvm64.c   |  2 ++
+ target/arm/kvm.c      | 1 -
- target/arm/machine.c |  2 +-
+ target/arm/kvm32.c    | 1 -
-files changed, 46 insertions(+), 22 deletions(-)
+ target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/target/arm/cpu.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
+@@ -XXX,XX +XXX,XX @@
- /**
+ #include "cpu.h"
-  * write_cpustate_to_list:
+ #include "hw/sysbus.h"
-  * @cpu: ARMCPU
+ #include "qemu/timer.h"
-+ * @kvm_sync: true if this is for syncing back to KVM
+-#include "hw/arm/arm.h"
-  *
+ #include "hw/intc/armv7m_nvic.h"
-  * For each register listed in the ARMCPU cpreg_indexes list, write
+ #include "target/arm/cpu.h"
-  * its value from the ARMCPUState structure into the cpreg_values list.
+ #include "exec/exec-all.h"
-  * This is used to copy info from TCG's working data structures into
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
   * KVM or for outbound migration.
   *
 + * @kvm_sync is true if we are doing this in order to sync the
 + * register state back to KVM. In this case we will only update
 + * values in the list if the previous list->cpustate sync actually
 + * successfully wrote the CPU state. Otherwise we will keep the value
 + * that is in the list.
 + *
   * Returns: true if all register values were read correctly,
   * false if some register was unknown or could not be read.
   * Note that we do not stop early on failure -- we will attempt
   * reading all registers in the list.
   */
 -bool write_cpustate_to_list(ARMCPU *cpu);
 +bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  #define ARM_CPUID_TI915T      0x54029152
  #define ARM_CPUID_TI925T      0x54029252
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/arm-semi.c
-+++ b/target/arm/helper.c
++++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@
-     return true;
+ #else
- }
+ #include "qemu-common.h"
+ #include "exec/gdbstub.h"
--bool write_cpustate_to_list(ARMCPU *cpu)
+-#include "hw/arm/arm.h"
-+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
+ #include "qemu/cutils.h"
- {
+ #endif
-     /* Write the coprocessor state from cpu->env to the (index,value) list. */
-     int i;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
+index XXXXXXX..XXXXXXX 100644
-     for (i = 0; i < cpu->cpreg_array_len; i++) {
+--- a/target/arm/cpu.c
-         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
++++ b/target/arm/cpu.c
-         const ARMCPRegInfo *ri;
+@@ -XXX,XX +XXX,XX @@
-+        uint64_t newval;
+ #if !defined(CONFIG_USER_ONLY)
+ #include "hw/loader.h"
-         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
+ #endif
-         if (!ri) {
+-#include "hw/arm/arm.h"
-@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
+ #include "sysemu/sysemu.h"
-         if (ri->type & ARM_CP_NO_RAW) {
+ #include "sysemu/hw_accel.h"
-             continue;
+ #include "kvm_arm.h"
-         }
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
--        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/arm/cpu64.c
-+        newval = read_raw_cp_reg(&cpu->env, ri);
++++ b/target/arm/cpu64.c
-+        if (kvm_sync) {
+@@ -XXX,XX +XXX,XX @@
-+            /*
+ #if !defined(CONFIG_USER_ONLY)
-+             * Only sync if the previous list->cpustate sync succeeded.
+ #include "hw/loader.h"
-+             * Rather than tracking the success/failure state for every
+ #endif
-+             * item in the list, we just recheck "does the raw write we must
+-#include "hw/arm/arm.h"
-+             * have made in write_list_to_cpustate() read back OK" here.
+ #include "sysemu/sysemu.h"
-+             */
+ #include "sysemu/kvm.h"
-+            uint64_t oldval = cpu->cpreg_values[i];
+ #include "kvm_arm.h"
 +
 +            if (oldval == newval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, oldval);
 +            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, newval);
 +        }
 +        cpu->cpreg_values[i] = newval;
      }
      return ok;
  }
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ void kvm_arm_reset_vcpu(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@
-         fprintf(stderr, "write_kvmstate_to_list failed\n");
+ #include "cpu.h"
-         abort();
+ #include "trace.h"
-     }
+ #include "internals.h"
-+    /*
+-#include "hw/arm/arm.h"
-+     * Sync the reset values also into the CPUState. This is necessary
+ #include "hw/pci/pci.h"
-+     * because the next thing we do will be a kvm_arch_put_registers()
+ #include "exec/memattrs.h"
-+     * which will update the list values from the CPUState before copying
+ #include "exec/address-spaces.h"
 +     * the list values back to KVM. It's OK to ignore failure returns here
 +     * for the same reason we do so in kvm_arch_get_registers().
 +     */
 +    write_list_to_cpustate(cpu);
  }
  /*
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
+@@ -XXX,XX +XXX,XX @@
-         return ret;
+ #include "sysemu/kvm.h"
-     }
+ #include "kvm_arm.h"
+ #include "internals.h"
--    /* Note that we do not call write_cpustate_to_list()
+-#include "hw/arm/arm.h"
--     * here, so we are only writing the tuple list back to
+ #include "qemu/log.h"
--     * KVM. This is safe because nothing can change the
--     * CPUARMState cp15 fields (in particular gdb accesses cannot)
+ static inline void set_feature(uint64_t *features, int feature)
 -     * and so there are no changes to sync. In fact syncing would
 -     * be wrong at this point: for a constant register where TCG and
 -     * KVM disagree about its value, the preceding write_list_to_cpustate()
 -     * would not have had any effect on the CPUARMState value (since the
 -     * register is read-only), and a write_cpustate_to_list() here would
 -     * then try to write the TCG value back into KVM -- this would either
 -     * fail or incorrectly change the value the guest sees.
 -     *
 -     * If we ever want to allow the user to modify cp15 registers via
 -     * the gdb stub, we would need to be more clever here (for instance
 -     * tracking the set of registers kvm_arch_get_registers() successfully
 -     * managed to update the CPUARMState with, and only allowing those
 -     * to be written back up into the kernel).
 -     */
 +    write_cpustate_to_list(cpu, true);
 +
      if (!write_list_to_kvmstate(cpu, level)) {
          return EINVAL;
      }
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
+@@ -XXX,XX +XXX,XX @@
-         return ret;
+ #include "sysemu/kvm.h"
-     }
+ #include "kvm_arm.h"
+ #include "internals.h"
-+    write_cpustate_to_list(cpu, true);
+-#include "hw/arm/arm.h"
-+
-     if (!write_list_to_kvmstate(cpu, level)) {
+ static bool have_guest_debug;
-         return EINVAL;
      }
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
              abort();
          }
      } else {
 -        if (!write_cpustate_to_list(cpu)) {
 +        if (!write_cpustate_to_list(cpu, false)) {
              /* This should never fail. */
              abort();
          }
 --
 .20.1

-[Qemu-devel] [PULL 03/15] hw/arm/virt: Support firmware configuration with -blockdev
+[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
-From: Markus Armbruster <armbru@redhat.com>
+The header file hw/arm/arm.h now includes only declarations
 relating to hw/arm/boot.c functionality. Rename it accordingly,
 and adjust its header comment.
-The ARM virt machines put firmware in flash memory.  To configure it,
+The bulk of this commit was created via
-you use -drive if=pflash,unit=0,... and optionally -drive
+ perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
 if=pflash,unit=1,...
-Why two -drive?  This permits setting up one part of the flash memory
+In a few cases we can just delete the #include:
-read-only, and the other part read/write.  It also makes upgrading
+hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
-firmware on the host easier.  Below the hood, we get two separate
+include/hw/arm/bcm2836.h did not require it.
 flash devices, because we were too lazy to improve our flash device
 models to support sector protection.
-The problem at hand is to do the same with -blockdev somehow, as one
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-more step towards deprecating -drive.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
  include/hw/arm/allwinner-a10.h   | 2 +-
  include/hw/arm/aspeed_soc.h      | 1 -
  include/hw/arm/bcm2836.h         | 1 -
  include/hw/arm/{arm.h => boot.h} | 8 ++++----
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
-We recently solved this problem for x86 PC machines, in commit
+diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
-ebc29e1beab.  See the commit message for design rationale.
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/allwinner-a10.h
-This commit solves it for ARM virt basically the same way: new machine
++++ b/include/hw/arm/allwinner-a10.h
-properties pflash0, pflash1 forward to the onboard flash devices'
+@@ -XXX,XX +XXX,XX @@
-properties.  Requires creating the onboard devices in the
+ #include "qemu-common.h"
-.instance_init() method virt_instance_init().  The existing code to
+ #include "qemu/error-report.h"
-pick up drives defined with -drive if=pflash is replaced by code to
+ #include "hw/char/serial.h"
-desugar into the machine properties.
+-#include "hw/arm/arm.h"
++#include "hw/arm/boot.h"
-There are a few behavioral differences, though:
+ #include "hw/timer/allwinner-a10-pit.h"
+ #include "hw/intc/allwinner-a10-pic.h"
-* The flash devices are always present (x86: only present if
+ #include "hw/net/allwinner_emac.h"
-  configured)
+diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+index XXXXXXX..XXXXXXX 100644
-* Flash base addresses and sizes are fixed (x86: sizes depend on
+--- a/include/hw/arm/aspeed_soc.h
-  images, mapped back to back below a fixed address)
++++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@
-* -bios configures contents of first pflash (x86: -bios configures ROM
+ #ifndef ASPEED_SOC_H
-   contents)
+ #define ASPEED_SOC_H
-* -bios is rejected when first pflash is also configured with -machine
+-#include "hw/arm/arm.h"
-   pflash0=... (x86: bios is silently ignored then)
+ #include "hw/intc/aspeed_vic.h"
+ #include "hw/misc/aspeed_scu.h"
-* -machine pflash1=... does not require -machine pflash0=... (x86: it
+ #include "hw/misc/aspeed_sdmc.h"
-   does).
+diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+index XXXXXXX..XXXXXXX 100644
-The actual code is a bit simpler than for x86 mostly due to the first
+--- a/include/hw/arm/bcm2836.h
-two differences.
++++ b/include/hw/arm/bcm2836.h
+@@ -XXX,XX +XXX,XX @@
-Before the patch, all the action is in create_flash(), called from the
+ #ifndef BCM2836_H
-machine's .init() method machvirt_init():
+ #define BCM2836_H
-    main()
+-#include "hw/arm/arm.h"
-        machine_run_board_init()
+ #include "hw/arm/bcm2835_peripherals.h"
-            machvirt_init()
+ #include "hw/intc/bcm2836_control.h"
-                create_flash()
-                    create_one_flash() for flash[0]
+diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
-                        create
+similarity index 98%
-                        configure
+rename from include/hw/arm/arm.h
-                            includes obeying -drive if=pflash,unit=0
+rename to include/hw/arm/boot.h
-                        realize
+index XXXXXXX..XXXXXXX 100644
-                        map
+--- a/include/hw/arm/arm.h
-                        fall back to -bios
++++ b/include/hw/arm/boot.h
-                    create_one_flash() for flash[1]
+@@ -XXX,XX +XXX,XX @@
-                        create
+ /*
-                        configure
+- * Misc ARM declarations
-                            includes obeying -drive if=pflash,unit=1
++ * ARM kernel loader.
-                        realize
+  *
-                        map
+  * Copyright (c) 2006 CodeSourcery.
-                    update FDT
+  * Written by Paul Brook
+@@ -XXX,XX +XXX,XX @@
-To make the machine properties work, we need to move device creation
+  *
-to its .instance_init() method virt_instance_init().
+  */
-Another complication is machvirt_init()'s computation of
+-#ifndef HW_ARM_H
-@firmware_loaded: it predicts what create_flash() will do.  Instead of
+-#define HW_ARM_H
-predicting what create_flash()'s replacement virt_firmware_init() will
++#ifndef HW_ARM_BOOT_H
-do, I decided to have virt_firmware_init() return what it did.
++#define HW_ARM_BOOT_H
-Requires calling it a bit earlier.
+ #include "exec/memory.h"
-Resulting call tree:
+ #include "target/arm/cpu-qom.h"
+@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
-    main()
+                                             const struct arm_boot_info *info,
-        current_machine = object_new()
+                                             hwaddr mvbar_addr);
-            ...
-                virt_instance_init()
+-#endif /* HW_ARM_H */
-                    virt_flash_create()
++#endif /* HW_ARM_BOOT_H */
-                        virt_flash_create1() for flash[0]
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-                            create
+index XXXXXXX..XXXXXXX 100644
-                            configure: set defaults
+--- a/include/hw/arm/fsl-imx25.h
-                            become child of machine [NEW]
++++ b/include/hw/arm/fsl-imx25.h
-                            add machine prop pflash0 as alias for drive [NEW]
+@@ -XXX,XX +XXX,XX @@
-                        virt_flash_create1() for flash[1]
+ #ifndef FSL_IMX25_H
-                            create
+ #define FSL_IMX25_H
-                            configure: set defaults
-                            become child of machine [NEW]
+-#include "hw/arm/arm.h"
-                            add machine prop pflash1 as alias for drive [NEW]
++#include "hw/arm/boot.h"
-        for all machine props from the command line: machine_set_property()
+ #include "hw/intc/imx_avic.h"
-            ...
+ #include "hw/misc/imx25_ccm.h"
-                property_set_alias() for machine props pflash0, pflash1
+ #include "hw/char/imx_serial.h"
-                    ...
+diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
-                        set_drive() for cfi.pflash01 prop drive
+index XXXXXXX..XXXXXXX 100644
-                            this is how -machine pflash0=... etc set
+--- a/include/hw/arm/fsl-imx31.h
-        machine_run_board_init(current_machine);
++++ b/include/hw/arm/fsl-imx31.h
-            virt_firmware_init()
+@@ -XXX,XX +XXX,XX @@
-                pflash_cfi01_legacy_drive()
+ #ifndef FSL_IMX31_H
-                    legacy -drive if=pflash,unit=0 and =1 [NEW]
+ #define FSL_IMX31_H
-                virt_flash_map()
-                    virt_flash_map1() for flash[0]
+-#include "hw/arm/arm.h"
-                        configure: num-blocks
++#include "hw/arm/boot.h"
-                        realize
+ #include "hw/intc/imx_avic.h"
-                        map
+ #include "hw/misc/imx31_ccm.h"
-                    virt_flash_map1() for flash[1]
+ #include "hw/char/imx_serial.h"
-                        configure: num-blocks
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
-                        realize
+index XXXXXXX..XXXXXXX 100644
-                        map
+--- a/include/hw/arm/fsl-imx6.h
-                fall back to -bios
++++ b/include/hw/arm/fsl-imx6.h
-            virt_flash_fdt()
+@@ -XXX,XX +XXX,XX @@
-                update FDT
+ #ifndef FSL_IMX6_H
+ #define FSL_IMX6_H
-You have László to thank for making me explain this in detail.
+-#include "hw/arm/arm.h"
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
++#include "hw/arm/boot.h"
-Acked-by: Laszlo Ersek <lersek@redhat.com>
+ #include "hw/cpu/a9mpcore.h"
-Message-id: 20190416091348.26075-4-armbru@redhat.com
+ #include "hw/misc/imx6_ccm.h"
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+ #include "hw/misc/imx6_src.h"
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
----
+index XXXXXXX..XXXXXXX 100644
- include/hw/arm/virt.h |   2 +
+--- a/include/hw/arm/fsl-imx6ul.h
- hw/arm/virt.c         | 202 +++++++++++++++++++++++++++---------------
++++ b/include/hw/arm/fsl-imx6ul.h
-files changed, 132 insertions(+), 72 deletions(-)
+@@ -XXX,XX +XXX,XX @@
+ #ifndef FSL_IMX6UL_H
  #define FSL_IMX6UL_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/cpu/a15mpcore.h"
  #include "hw/misc/imx6ul_ccm.h"
  #include "hw/misc/imx6_src.h"
 diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx7.h
 +++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX7_H
  #define FSL_IMX7_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/cpu/a15mpcore.h"
  #include "hw/intc/imx_gpcv2.h"
  #include "hw/misc/imx7_ccm.h"
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
 @@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
  #include "qemu/notify.h"
  #include "hw/boards.h"
- #include "hw/arm/arm.h"
+-#include "hw/arm/arm.h"
-+#include "hw/block/flash.h"
++#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "sysemu/kvm.h"
  #include "hw/intc/arm_gicv3_common.h"
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+index XXXXXXX..XXXXXXX 100644
-     Notifier machine_done;
+--- a/include/hw/arm/xlnx-versal.h
-     DeviceState *platform_bus_dev;
++++ b/include/hw/arm/xlnx-versal.h
-     FWCfgState *fw_cfg;
+@@ -XXX,XX +XXX,XX @@
-+    PFlashCFI01 *flash[2];
+ #define XLNX_VERSAL_H
-     bool secure;
-     bool highmem;
+ #include "hw/sysbus.h"
-     bool highmem_ecam;
+-#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/arm_gicv3.h"
  #define TYPE_XLNX_VERSAL "xlnx-versal"
 diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/xlnx-zynqmp.h
 +++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
  #ifndef XLNX_ZYNQMP_H
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/arm_gic.h"
  #include "hw/net/cadence_gem.h"
  #include "hw/char/cadence_uart.h"
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/registerfields.h"
  #include "hw/arm/armsse.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  /* Format of the System Information block SYS_CONFIG register */
  typedef enum SysConfigFormat {
 diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armv7m.c
 +++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "elf.h"
  #include "sysemu/qtest.h"
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "exec/address-spaces.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/aspeed.h"
  #include "hw/arm/aspeed_soc.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include <libfdt.h>
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/linux-boot-if.h"
  #include "sysemu/kvm.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/collie.c b/hw/arm/collie.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/collie.c
 +++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/boards.h"
  #include "strongarm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "exec/address-spaces.h"
  #include "cpu.h"
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "hw/arm/exynos4210.h"
  #include "hw/sd/sdhci.h"
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
  #include "net/net.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/exynos4210.h"
  #include "hw/net/lan9118.h"
 diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/highbank.c
 +++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "net/net.h"
  #include "sysemu/kvm.h"
 diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/integratorcp.c
 +++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/misc/arm_integrator_debug.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
 diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mainstone.c
 +++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "hw/net/smc91c111.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/microbit.c
 +++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-soc.c
 +++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/units.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
  #include "exec/address-spaces.h"
  #include "hw/char/serial.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-som.c
 +++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/msf2-soc.h"
  #include "cpu.h"
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armsse.h"
  #include "hw/boards.h"
  #include "hw/char/pl011.h"
 diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musicpal.c
 +++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduino2.c
 +++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "qemu/error-report.h"
  #include "hw/arm/stm32f205_soc.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  static void netduino2_init(MachineState *machine)
  {
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nrf51_soc.c
 +++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
  #include "hw/misc/unimp.h"
 diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nseries.c
 +++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bswap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/omap.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/irq.h"
  #include "ui/console.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap1.c
 +++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/soc_dma.h"
 diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap2.c
 +++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/qtest.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "qemu/timer.h"
 diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap_sx1.c
 +++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "sysemu/qtest.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/palm.c b/hw/arm/palm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/palm.c
 +++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/input/tsc2xxx.h"
  #include "hw/loader.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "hw/boards.h"
  #include "hw/loader.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
 diff --git a/hw/arm/realview.c b/hw/arm/realview.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/realview.c
 +++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/net/smc91c111.h"
 diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/spitz.c
 +++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "hw/pcmcia.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/sysbus.h"
  #include "hw/ssi/ssi.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "qemu/timer.h"
  #include "hw/i2c/i2c.h"
  #include "net/net.h"
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f205_soc.c
 +++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/stm32f205_soc.h"
 diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/strongarm.c
 +++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "strongarm.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "chardev/char-fe.h"
  #include "chardev/char-serial.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/tosa.c
 +++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/sharpsl.h"
  #include "hw/pcmcia.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/versatilepb.c
 +++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/vexpress.c
 +++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
 @@ -XXX,XX +XXX,XX @@
+ #include "qemu/option.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/arm/virt.h"
  #include "hw/block/flash.h"
 diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xilinx_zynq.c
 +++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
- #include "qemu/units.h"
+ #include "hw/hw.h"
-+#include "qemu/option.h"
+ #include "hw/arm/pxa.h"
- #include "qapi/error.h"
+-#include "hw/arm/arm.h"
- #include "hw/sysbus.h"
++#include "hw/arm/boot.h"
- #include "hw/arm/arm.h"
+ #include "hw/i2c/i2c.h"
-@@ -XXX,XX +XXX,XX @@ static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
+ #include "hw/ssi/ssi.h"
-     }
+ #include "hw/boards.h"
  }
 -static void create_one_flash(const char *name, hwaddr flashbase,
 -                             hwaddr flashsize, const char *file,
 -                             MemoryRegion *sysmem)
 +#define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
 +
 +static PFlashCFI01 *virt_flash_create1(VirtMachineState *vms,
 +                                        const char *name,
 +                                        const char *alias_prop_name)
  {
 -    /* Create and map a single flash device. We use the same
 -     * parameters as the flash devices on the Versatile Express board.
 +    /*
 +     * Create a single flash device.  We use the same parameters as
 +     * the flash devices on the Versatile Express board.
       */
 -    DriveInfo *dinfo = drive_get_next(IF_PFLASH);
      DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
 -    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 -    const uint64_t sectorlength = 256 * 1024;
 -    if (dinfo) {
 -        qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
 -                            &error_abort);
 -    }
 -
 -    qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength);
 -    qdev_prop_set_uint64(dev, "sector-length", sectorlength);
 +    qdev_prop_set_uint64(dev, "sector-length", VIRT_FLASH_SECTOR_SIZE);
      qdev_prop_set_uint8(dev, "width", 4);
      qdev_prop_set_uint8(dev, "device-width", 2);
      qdev_prop_set_bit(dev, "big-endian", false);
@@ -XXX,XX +XXX,XX @@ static void create_one_flash(const char *name, hwaddr flashbase,
      qdev_prop_set_uint16(dev, "id2", 0x00);
      qdev_prop_set_uint16(dev, "id3", 0x00);
      qdev_prop_set_string(dev, "name", name);
 -    qdev_init_nofail(dev);
 -
 -    memory_region_add_subregion(sysmem, flashbase,
 -                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
 -
 -    if (file) {
 -        char *fn;
 -        int image_size;
 -
 -        if (drive_get(IF_PFLASH, 0, 0)) {
 -            error_report("The contents of the first flash device may be "
 -                         "specified with -bios or with -drive if=pflash... "
 -                         "but you cannot use both options at once");
 -            exit(1);
 -        }
 -        fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, file);
 -        if (!fn) {
 -            error_report("Could not find ROM image '%s'", file);
 -            exit(1);
 -        }
 -        image_size = load_image_mr(fn, sysbus_mmio_get_region(sbd, 0));
 -        g_free(fn);
 -        if (image_size < 0) {
 -            error_report("Could not load ROM image '%s'", file);
 -            exit(1);
 -        }
 -    }
 +    object_property_add_child(OBJECT(vms), name, OBJECT(dev),
 +                              &error_abort);
 +    object_property_add_alias(OBJECT(vms), alias_prop_name,
 +                              OBJECT(dev), "drive", &error_abort);
 +    return PFLASH_CFI01(dev);
  }
 -static void create_flash(const VirtMachineState *vms,
 -                         MemoryRegion *sysmem,
 -                         MemoryRegion *secure_sysmem)
 +static void virt_flash_create(VirtMachineState *vms)
  {
 -    /* Create two flash devices to fill the VIRT_FLASH space in the memmap.
 -     * Any file passed via -bios goes in the first of these.
 +    vms->flash[0] = virt_flash_create1(vms, "virt.flash0", "pflash0");
 +    vms->flash[1] = virt_flash_create1(vms, "virt.flash1", "pflash1");
 +}
 +
 +static void virt_flash_map1(PFlashCFI01 *flash,
 +                            hwaddr base, hwaddr size,
 +                            MemoryRegion *sysmem)
 +{
 +    DeviceState *dev = DEVICE(flash);
 +
 +    assert(size % VIRT_FLASH_SECTOR_SIZE == 0);
 +    assert(size / VIRT_FLASH_SECTOR_SIZE <= UINT32_MAX);
 +    qdev_prop_set_uint32(dev, "num-blocks", size / VIRT_FLASH_SECTOR_SIZE);
 +    qdev_init_nofail(dev);
 +
 +    memory_region_add_subregion(sysmem, base,
 +                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
 +                                                       0));
 +}
 +
 +static void virt_flash_map(VirtMachineState *vms,
 +                           MemoryRegion *sysmem,
 +                           MemoryRegion *secure_sysmem)
 +{
 +    /*
 +     * Map two flash devices to fill the VIRT_FLASH space in the memmap.
       * sysmem is the system memory space. secure_sysmem is the secure view
       * of the system, and the first flash device should be made visible only
       * there. The second flash device is visible to both secure and nonsecure.
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
       */
      hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
      hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
 -    char *nodename;
 -    create_one_flash("virt.flash0", flashbase, flashsize,
 -                     bios_name, secure_sysmem);
 -    create_one_flash("virt.flash1", flashbase + flashsize, flashsize,
 -                     NULL, sysmem);
 +    virt_flash_map1(vms->flash[0], flashbase, flashsize,
 +                    secure_sysmem);
 +    virt_flash_map1(vms->flash[1], flashbase + flashsize, flashsize,
 +                    sysmem);
 +}
 +
 +static void virt_flash_fdt(VirtMachineState *vms,
 +                           MemoryRegion *sysmem,
 +                           MemoryRegion *secure_sysmem)
 +{
 +    hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
 +    hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
 +    char *nodename;
      if (sysmem == secure_sysmem) {
          /* Report both flash devices as a single node in the DT */
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
          qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
          g_free(nodename);
      } else {
 -        /* Report the devices as separate nodes so we can mark one as
 +        /*
 +         * Report the devices as separate nodes so we can mark one as
           * only visible to the secure world.
           */
          nodename = g_strdup_printf("/secflash@%" PRIx64, flashbase);
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
      }
  }
 +static bool virt_firmware_init(VirtMachineState *vms,
 +                               MemoryRegion *sysmem,
 +                               MemoryRegion *secure_sysmem)
 +{
 +    int i;
 +    BlockBackend *pflash_blk0;
 +
 +    /* Map legacy -drive if=pflash to machine properties */
 +    for (i = 0; i < ARRAY_SIZE(vms->flash); i++) {
 +        pflash_cfi01_legacy_drive(vms->flash[i],
 +                                  drive_get(IF_PFLASH, 0, i));
 +    }
 +
 +    virt_flash_map(vms, sysmem, secure_sysmem);
 +
 +    pflash_blk0 = pflash_cfi01_get_blk(vms->flash[0]);
 +
 +    if (bios_name) {
 +        char *fname;
 +        MemoryRegion *mr;
 +        int image_size;
 +
 +        if (pflash_blk0) {
 +            error_report("The contents of the first flash device may be "
 +                         "specified with -bios or with -drive if=pflash... "
 +                         "but you cannot use both options at once");
 +            exit(1);
 +        }
 +
 +        /* Fall back to -bios */
 +
 +        fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
 +        if (!fname) {
 +            error_report("Could not find ROM image '%s'", bios_name);
 +            exit(1);
 +        }
 +        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(vms->flash[0]), 0);
 +        image_size = load_image_mr(fname, mr);
 +        g_free(fname);
 +        if (image_size < 0) {
 +            error_report("Could not load ROM image '%s'", bios_name);
 +            exit(1);
 +        }
 +    }
 +
 +    return pflash_blk0 || bios_name;
 +}
 +
  static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
  {
      hwaddr base = vms->memmap[VIRT_FW_CFG].base;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      MemoryRegion *secure_sysmem = NULL;
      int n, virt_max_cpus;
      MemoryRegion *ram = g_new(MemoryRegion, 1);
 -    bool firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0);
 +    bool firmware_loaded;
      bool aarch64 = true;
      /*
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
          exit(1);
      }
 +    if (vms->secure) {
 +        if (kvm_enabled()) {
 +            error_report("mach-virt: KVM does not support Security extensions");
 +            exit(1);
 +        }
 +
 +        /*
 +         * The Secure view of the world is the same as the NonSecure,
 +         * but with a few extra devices. Create it as a container region
 +         * containing the system memory at low priority; any secure-only
 +         * devices go in at higher priority and take precedence.
 +         */
 +        secure_sysmem = g_new(MemoryRegion, 1);
 +        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
 +                           UINT64_MAX);
 +        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
 +    }
 +
 +    firmware_loaded = virt_firmware_init(vms, sysmem,
 +                                         secure_sysmem ?: sysmem);
 +
      /* If we have an EL3 boot ROM then the assumption is that it will
       * implement PSCI itself, so disable QEMU's internal implementation
       * so it doesn't get in the way. Instead of starting secondary
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
          exit(1);
      }
 -    if (vms->secure) {
 -        if (kvm_enabled()) {
 -            error_report("mach-virt: KVM does not support Security extensions");
 -            exit(1);
 -        }
 -
 -        /* The Secure view of the world is the same as the NonSecure,
 -         * but with a few extra devices. Create it as a container region
 -         * containing the system memory at low priority; any secure-only
 -         * devices go in at higher priority and take precedence.
 -         */
 -        secure_sysmem = g_new(MemoryRegion, 1);
 -        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
 -                           UINT64_MAX);
 -        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
 -    }
 -
      create_fdt(vms);
      possible_cpus = mc->possible_cpu_arch_ids(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                      &machine->device_memory->mr);
      }
 -    create_flash(vms, sysmem, secure_sysmem ? secure_sysmem : sysmem);
 +    virt_flash_fdt(vms, sysmem, secure_sysmem);
      create_gic(vms, pic);
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                      NULL);
      vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
  }
  static const TypeInfo virt_machine_info = {
 --
 .20.1

-[Qemu-devel] [PULL 14/15] target/arm: Implement XPSR GE bits
+[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-In the M-profile architecture, if the CPU implements the DSP extension
+In ich_vmcr_write() we enforce "writes of BPR fields to less than
-then the XPSR has GE bits, in the same way as the A-profile CPSR. When
+their minimum sets them to the minimum" by doing a "read vbpr and
-we added DSP extension support we forgot to add support for reading
+write it back" operation.  A typo here meant that we weren't handling
-and writing the GE bits, which are stored in env->GE. We did put in
+writes to these fields correctly, because we were reading from VBPR0
-the code to add XPSR_GE to the mask of bits to update in the v7m_msr
+but writing to VBPR1.
 helper, but forgot it in v7m_mrs. We also must not allow the XPSR we
 pull off the stack on exception return to set the nonexistent GE bits.
 Correct these errors:
  * read and write env->GE in xpsr_read() and xpsr_write()
  * only set GE bits on exception return if DSP present
  * read GE bits for MRS if DSP present
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190430131439.25251-5-peter.maydell@linaro.org
+Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    |  4 ++++
+ hw/intc/arm_gicv3_cpuif.c | 2 +-
- target/arm/helper.c | 12 ++++++++++--
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 14 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/target/arm/cpu.h
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t xpsr_read(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
+     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
-         | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
+      * by reading and writing back the fields.
-         | ((env->condexec_bits & 0xfc) << 8)
+      */
-+        | (env->GE << 16)
+-    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
-         | env->v7m.exception;
++    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
- }
+     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
-@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+     gicv3_cpuif_virt_update(cs);
      if (mask & XPSR_Q) {
          env->QF = ((val & XPSR_Q) != 0);
      }
 +    if (mask & XPSR_GE) {
 +        env->GE = (val & XPSR_GE) >> 16;
 +    }
      if (mask & XPSR_T) {
          env->thumb = ((val & XPSR_T) != 0);
      }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
  {
      CPUARMState *env = &cpu->env;
      uint32_t excret;
 -    uint32_t xpsr;
 +    uint32_t xpsr, xpsr_mask;
      bool ufault = false;
      bool sfault = false;
      bool return_to_sp_process;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          }
          *frame_sp_p = frameptr;
      }
 +
 +    xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
 +    if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
 +        xpsr_mask &= ~XPSR_GE;
 +    }
      /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
 -    xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA));
 +    xpsr_write(env, xpsr, xpsr_mask);
      if (env->v7m.secure) {
          bool sfpa = xpsr & XPSR_SFPA;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
          }
          if (!(reg & 4)) {
              mask |= XPSR_NZCV | XPSR_Q; /* APSR */
 +            if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
 +                mask |= XPSR_GE;
 +            }
          }
          /* EPSR reads as zero */
          return xpsr_read(env) & mask;
 --
 .20.1

-[Qemu-devel] [PULL 13/15] hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
+[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-The M-profile architecture specifies that the DebugMonitor exception
+The ICC_CTLR_EL3 register includes some bits which are aliases
-should be initially disabled, not enabled. It should be controlled
+of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
-by the DEMCR register's MON_EN bit, but we don't implement that
+to keep those bits in the cs->icc_ctlr_el1[] struct fields.
-register yet (like most of the debug architecture for M-profile).
+Unfortunately a missing '~' in the code to update the bits
+in those fields meant that writing to ICC_CTLR_EL3 would corrupt
-Note that BKPT instructions will still work, because they
+the ICC_CLTR_EL1 register values.
 will be escalated to HardFault.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190430131439.25251-4-peter.maydell@linaro.org
+Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 4 +++-
+ hw/intc/arm_gicv3_cpuif.c | 4 ++--
-file changed, 3 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-      * the System Handler Control register
+     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
-      */
-     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
+     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
--    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
+-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
++    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
-     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
+     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
-+    /* DebugMonitor is enabled via DEMCR.MON_EN */
+     }
-+    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
+@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+
+         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
-     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
+     }
-     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
-     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
+-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
 +    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
      if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
          cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
      }
 --
 .20.1

-[Qemu-devel] [PULL 08/15] qga: Fix mingw compilation warnings on enum conversion
+[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
-From: Cao Jiaxi <driver1998@foxmail.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The win2qemu[] is supposed to be the conversion table to convert between
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-STORAGE_BUS_TYPE in Windows SDK and GuestDiskBusType in qga.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20190520214342.13709-2-philmd@redhat.com
 But it was incorrectly written that it forces to set a GuestDiskBusType
 value to STORAGE_BUS_TYPE, which generates an enum conversion warning in clang.
 Suggested-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20190503003650.10137-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- qga/commands-win32.c | 2 +-
+ hw/arm/exynos4_boards.c | 24 ------------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 24 deletions(-)
-diff --git a/qga/commands-win32.c b/qga/commands-win32.c
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/qga/commands-win32.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/qga/commands-win32.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ void qmp_guest_file_flush(int64_t handle, Error **errp)
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/lan9118.h"
- #ifdef CONFIG_QGA_NTDDSCSI
+ #include "hw/boards.h"
--static STORAGE_BUS_TYPE win2qemu[] = {
+-#undef DEBUG
-+static GuestDiskBusType win2qemu[] = {
+-
-     [BusTypeUnknown] = GUEST_DISK_BUS_TYPE_UNKNOWN,
+-//#define DEBUG
-     [BusTypeScsi] = GUEST_DISK_BUS_TYPE_SCSI,
+-
-     [BusTypeAtapi] = GUEST_DISK_BUS_TYPE_IDE,
+-#ifdef DEBUG
 -    #undef PRINT_DEBUG
 -    #define  PRINT_DEBUG(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -#else
 -    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
 -#endif
 -
  #define SMDK_LAN9118_BASE_ADDR      0x05000000
  typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_board_binfo.gic_cpu_if_addr =
              EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 -    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
 -            " kernel_filename: %s\n"
 -            " kernel_cmdline: %s\n"
 -            " initrd_filename: %s\n",
 -            exynos4_board_ram_size[board_type] / 1048576,
 -            exynos4_board_ram_size[board_type],
 -            machine->kernel_filename,
 -            machine->kernel_cmdline,
 -            machine->initrd_filename);
 -
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 --
 .20.1

-[Qemu-devel] [PULL 04/15] hw/arm/raspi: Diagnose requests for too much RAM
+[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
-The Raspberry Pi boards have a physical memory map which does
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
 not allow for more than 1GB of RAM. Currently if the user tries
 to ask for more then we fail in a confusing way:
-$ qemu-system-aarch64 --machine raspi3 -m 8G
+It eases code review, unit is explicit.
 Unexpected error in visit_type_uintN() at qapi/qapi-visit-core.c:164:
 qemu-system-aarch64: Parameter 'vcram-base' expects uint32_t
 Aborted (core dumped)
-Catch this earlier and diagnose it with a more friendly message:
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-$ qemu-system-aarch64 --machine raspi3 -m 8G
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-qemu-system-aarch64: Requested ram size is too large for this machine: maximum is 1GB
+Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/exynos4_boards.c | 5 +++--
 file changed, 3 insertions(+), 2 deletions(-)
-Fixes: https://bugs.launchpad.net/qemu/+bug/1794187
+diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
 ---
  hw/arm/raspi.c | 7 +++++++
 file changed, 7 insertions(+)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/arm/raspi.c
++++ b/hw/arm/exynos4_boards.c
 @@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qemu/units.h"
  #include "qapi/error.h"
+ #include "qemu/error-report.h"
  #include "qemu-common.h"
- #include "cpu.h"
+@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+ };
-     BusState *bus;
-     DeviceState *carddev;
+ static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
+-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-+    if (machine->ram_size > 1 * GiB) {
+-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-+        error_report("Requested ram size is too large for this machine: "
++    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
-+                     "maximum is 1GB");
++    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
-+        exit(1);
+ };
-+    }
-+
+ static struct arm_boot_info exynos4_board_binfo = {
      object_initialize(&s->soc, sizeof(s->soc),
                        version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
 --
 .20.1

-[Qemu-devel] [PULL 06/15] arm: aspeed: Set SDRAM size
+[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
-From: Joel Stanley <joel@jms.id.au>
+From: Guenter Roeck <linux@roeck-us.net>
-We currently use Qemu's default of 128MB. As we know how much ram each
+QEMU already supports pl330. Instantiate it for Exynos4210.
 machine ships with, make it easier on users by setting a default.
-It can still be overridden with -m on the command line.
+Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+/ {
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+    soc: soc {
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+        amba {
-Message-id: 20190503022958.1394-1-joel@jms.id.au
+            pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190520214342.13709-4-philmd@redhat.com
+[PMD: Do not set default qdev properties, create the controllers in the SoC
+      rather than the board (Peter Maydell), add dtsi in commit message]
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed.h | 1 +
+ hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
- hw/arm/aspeed.c         | 8 ++++++++
+file changed, 26 insertions(+)
 files changed, 9 insertions(+)
-diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed.h
+--- a/hw/arm/exynos4210.c
-+++ b/include/hw/arm/aspeed.h
++++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
      const char *spi_model;
      uint32_t num_cs;
      void (*i2c_init)(AspeedBoardState *bmc);
 +    uint32_t ram;
  } AspeedBoardConfig;
  #define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/block-backend.h"
+ /* EHCI */
- #include "hw/loader.h"
+ #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
- #include "qemu/error-report.h"
-+#include "qemu/units.h"
++/* DMA */
++#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
- static struct arm_boot_info aspeed_board_binfo = {
++#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
-     .board_id = -1, /* device-tree-only board */
++#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
-@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
++
-     mc->no_floppy = 1;
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
-     mc->no_cdrom = 1;
+x09, 0x00, 0x00, 0x00 };
-     mc->no_parallel = 1;
-+    if (board->ram) {
+@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
-+        mc->default_ram_size = board->ram;
+     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 +    }
      amc->board = board;
  }
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
++static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
-         .spi_model = "mx25l25635e",
++{
-         .num_cs    = 1,
++    SysBusDevice *busdev;
-         .i2c_init  = palmetto_bmc_i2c_init,
++    DeviceState *dev;
-+        .ram       = 256 * MiB,
++
-     }, {
++    dev = qdev_create(NULL, "pl330");
-         .name      = MACHINE_TYPE_NAME("ast2500-evb"),
++    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
-         .desc      = "Aspeed AST2500 EVB (ARM1176)",
++    qdev_init_nofail(dev);
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
++    busdev = SYS_BUS_DEVICE(dev);
-         .spi_model = "mx25l25635e",
++    sysbus_mmio_map(busdev, 0, base);
-         .num_cs    = 1,
++    sysbus_connect_irq(busdev, 0, irq);
-         .i2c_init  = ast2500_evb_i2c_init,
++}
-+        .ram       = 512 * MiB,
++
-     }, {
+ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-         .name      = MACHINE_TYPE_NAME("romulus-bmc"),
+ {
-         .desc      = "OpenPOWER Romulus BMC (ARM1176)",
+     Exynos4210State *s = g_new0(Exynos4210State, 1);
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
+@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-         .spi_model = "mx66l1g45g",
+     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
-         .num_cs    = 2,
+             s->irq_table[exynos4210_get_irq(28, 3)]);
-         .i2c_init  = romulus_bmc_i2c_init,
-+        .ram       = 512 * MiB,
++    /*** DMA controllers ***/
-     }, {
++    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
-         .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
-         .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
++    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
-         .spi_model = "mx66l1g45g",
++    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
-         .num_cs    = 2,
++                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-         .i2c_init  = witherspoon_bmc_i2c_init,
++
-+        .ram       = 512 * MiB,
+     return s;
-     },
+ }
  };
 --
 .20.1

-[Qemu-devel] [PULL 02/15] pflash_cfi01: New pflash_cfi01_legacy_drive()
+[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-From: Markus Armbruster <armbru@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Factored out of pc_system_firmware_init() so the next commit can reuse
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-it in hw/arm/virt.c.
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20190520214342.13709-5-philmd@redhat.com
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190416091348.26075-3-armbru@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/block/flash.h |  1 +
+ include/hw/arm/exynos4210.h |  9 +++++++--
- hw/block/pflash_cfi01.c  | 28 ++++++++++++++++++++++++++++
+ hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
- hw/i386/pc_sysfw.c       | 16 ++--------------
+ hw/arm/exynos4_boards.c     |  9 ++++++---
-files changed, 31 insertions(+), 14 deletions(-)
+files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/block/flash.h
+--- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/block/flash.h
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
-                                    int be);
+ } Exynos4210Irq;
- BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl);
- MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
+ typedef struct Exynos4210State {
-+void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
++    /*< private >*/
++    SysBusDevice parent_obj;
- /* pflash_cfi02.c */
++    /*< public >*/
+     ARMCPU *cpu[EXYNOS4210_NCPUS];
-diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
+     Exynos4210Irq irqs;
      qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/pflash_cfi01.c
+--- a/hw/arm/exynos4210.c
-+++ b/hw/block/pflash_cfi01.c
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
- #include "qapi/error.h"
+     sysbus_connect_irq(busdev, 0, irq);
  #include "qemu/timer.h"
  #include "qemu/bitops.h"
 +#include "qemu/error-report.h"
  #include "qemu/host-utils.h"
  #include "qemu/log.h"
 +#include "qemu/option.h"
  #include "hw/sysbus.h"
 +#include "sysemu/blockdev.h"
  #include "sysemu/sysemu.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
      return &fl->mem;
  }
-+/*
+-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-+ * Handle -drive if=pflash for machines that use properties.
++static void exynos4210_realize(DeviceState *socdev, Error **errp)
-+ * If @dinfo is null, do nothing.
+ {
-+ * Else if @fl's property "drive" is already set, fatal error.
+-    Exynos4210State *s = g_new0(Exynos4210State, 1);
-+ * Else set it to the BlockBackend with @dinfo.
++    Exynos4210State *s = EXYNOS4210_SOC(socdev);
-+ */
++    MemoryRegion *system_mem = get_system_memory();
-+void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
+     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
-+    Location loc;
++    DeviceClass *dc = DEVICE_CLASS(klass);
 +
-+    if (!dinfo) {
++    dc->realize = exynos4210_realize;
 +        return;
 +    }
 +
 +    loc_push_none(&loc);
 +    qemu_opts_loc_restore(dinfo->opts);
 +    if (fl->blk) {
 +        error_report("clashes with -machine");
 +        exit(1);
 +    }
 +    qdev_prop_set_drive(DEVICE(fl), "drive",
 +                        blk_by_legacy_dinfo(dinfo), &error_fatal);
 +    loc_pop(&loc);
 +}
 +
- static void postload_update_cb(void *opaque, int running, RunState state)
++static const TypeInfo exynos4210_info = {
- {
++    .name = TYPE_EXYNOS4210_SOC,
-     PFlashCFI01 *pfl = opaque;
++    .parent = TYPE_SYS_BUS_DEVICE,
-diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
++    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
 +    type_register_static(&exynos4210_info);
 +}
 +
 +type_init(exynos4210_register_types)
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/pc_sysfw.c
+--- a/hw/arm/exynos4_boards.c
-+++ b/hw/i386/pc_sysfw.c
++++ b/hw/arm/exynos4_boards.c
-@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
+@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
- {
+ } Exynos4BoardType;
-     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
-     int i;
+ typedef struct Exynos4BoardState {
--    DriveInfo *pflash_drv;
+-    Exynos4210State *soc;
-     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
++    Exynos4210State soc;
--    Location loc;
+     MemoryRegion dram0_mem;
+     MemoryRegion dram1_mem;
-     if (!pcmc->pci_enabled) {
+ } Exynos4BoardState;
-         old_pc_system_rom_init(rom_memory, true);
+@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
-@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
+     exynos4_boards_init_ram(s, get_system_memory(),
+                             exynos4_board_ram_size[board_type]);
-     /* Map legacy -drive if=pflash to machine properties */
-     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
+-    s->soc = exynos4210_init(get_system_memory());
--        pflash_drv = drive_get(IF_PFLASH, 0, i);
++    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
--        if (pflash_drv) {
++    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
--            loc_push_none(&loc);
++    object_property_set_bool(OBJECT(&s->soc), true, "realized",
--            qemu_opts_loc_restore(pflash_drv->opts);
++                             &error_fatal);
--            if (pflash_cfi01_get_blk(pcms->flash[i])) {
--                error_report("clashes with -machine");
+     return s;
--                exit(1);
+ }
--            }
+@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
--            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
+                                                       EXYNOS4_BOARD_SMDKC210);
--                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
--            loc_pop(&loc);
+     lan9215_init(SMDK_LAN9118_BASE_ADDR,
--        }
+-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
-+        pflash_cfi01_legacy_drive(pcms->flash[i],
++            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
-+                                  drive_get(IF_PFLASH, 0, i));
+     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
-         pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
+ }
      }
 --
 .20.1

-[Qemu-devel] [PULL 07/15] QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
+Deleted patch
-From: Cao Jiaxi <driver1998@foxmail.com>
-gcc_struct is for x86 only, and it generates an warning on ARM64 Clang/MinGW targets.
-Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20190503003618.10089-1-driver1998@foxmail.com
-[PMM: dropped the slirp change as slirp is now a submodule]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- contrib/libvhost-user/libvhost-user.h | 2 +-
- include/qemu/compiler.h               | 2 +-
- scripts/cocci-macro-file.h            | 7 ++++++-
-files changed, 8 insertions(+), 3 deletions(-)
-diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
-index XXXXXXX..XXXXXXX 100644
---- a/contrib/libvhost-user/libvhost-user.h
-+++ b/contrib/libvhost-user/libvhost-user.h
-@@ -XXX,XX +XXX,XX @@ typedef struct VhostUserInflight {
-     uint16_t queue_size;
- } VhostUserInflight;
--#if defined(_WIN32)
-+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
- # define VU_PACKED __attribute__((gcc_struct, packed))
- #else
- # define VU_PACKED __attribute__((packed))
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
-+++ b/include/qemu/compiler.h
-@@ -XXX,XX +XXX,XX @@
- #define QEMU_SENTINEL __attribute__((sentinel))
--#if defined(_WIN32)
-+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
- # define QEMU_PACKED __attribute__((gcc_struct, packed))
- #else
- # define QEMU_PACKED __attribute__((packed))
-diff --git a/scripts/cocci-macro-file.h b/scripts/cocci-macro-file.h
-index XXXXXXX..XXXXXXX 100644
---- a/scripts/cocci-macro-file.h
-+++ b/scripts/cocci-macro-file.h
-@@ -XXX,XX +XXX,XX @@
- #define QEMU_NORETURN __attribute__ ((__noreturn__))
- #define QEMU_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
- #define QEMU_SENTINEL __attribute__((sentinel))
--#define QEMU_PACKED __attribute__((gcc_struct, packed))
-+
-+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
-+# define QEMU_PACKED __attribute__((gcc_struct, packed))
-+#else
-+# define QEMU_PACKED __attribute__((packed))
-+#endif
- #define cat(x,y) x ## y
- #define cat2(x,y) cat(x,y)
---
-.20.1

-[Qemu-devel] [PULL 11/15] hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
+Deleted patch
-Rule R_CQRV says that if two pending interrupts have the same
-group priority then ties are broken by looking at the subpriority.
-We had a comment describing this but had forgotten to actually
-implement the subpriority comparison. Correct the omission.
-(The further tie break rules of "lowest exception number" and
-"secure before non-secure" are handled implicitly by the order
-in which we iterate through the exceptions in the loops.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190430131439.25251-2-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 9 +++++++--
-file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-     int active_prio = NVIC_NOEXC_PRIO;
-     int pend_irq = 0;
-     bool pending_is_s_banked = false;
-+    int pend_subprio = 0;
-     /* R_CQRV: precedence is by:
-      *  - lowest group priority; if both the same then
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-     for (i = 1; i < s->num_irq; i++) {
-         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
-             VecInfo *vec;
--            int prio;
-+            int prio, subprio;
-             bool targets_secure;
-             if (bank == M_REG_S) {
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-             }
-             prio = exc_group_prio(s, vec->prio, targets_secure);
--            if (vec->enabled && vec->pending && prio < pend_prio) {
-+            subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
-+            if (vec->enabled && vec->pending &&
-+                ((prio < pend_prio) ||
-+                 (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
-                 pend_prio = prio;
-+                pend_subprio = subprio;
-                 pend_irq = i;
-                 pending_is_s_banked = (bank == M_REG_S);
-             }
---
-.20.1

-[Qemu-devel] [PULL 12/15] hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
+Deleted patch
-The non-secure versions of the BFAR and BFSR registers are
-supposed to be RAZ/WI if AICR.BFHFNMINS == 0; we were
-incorrectly allowing NS code to access the real values.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190430131439.25251-3-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 27 ++++++++++++++++++++++++---
-file changed, 24 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-             goto bad_offset;
-         }
-+        if (!attrs.secure &&
-+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
-+            return 0;
-+        }
-         return cpu->env.v7m.bfar;
-     case 0xd3c: /* Aux Fault Status.  */
-         /* TODO: Implement fault status registers.  */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
-             goto bad_offset;
-         }
-+        if (!attrs.secure &&
-+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
-+            return;
-+        }
-         cpu->env.v7m.bfar = value;
-         return;
-     case 0xd3c: /* Aux Fault Status.  */
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
-             val = 0;
-             break;
-         };
--        /* The BFSR bits [15:8] are shared between security states
--         * and we store them in the NS copy
-+        /*
-+         * The BFSR bits [15:8] are shared between security states
-+         * and we store them in the NS copy. They are RAZ/WI for
-+         * NS code if AIRCR.BFHFNMINS is 0.
-          */
-         val = s->cpu->env.v7m.cfsr[attrs.secure];
--        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
-+        if (!attrs.secure &&
-+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
-+            val &= ~R_V7M_CFSR_BFSR_MASK;
-+        } else {
-+            val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
-+        }
-         val = extract32(val, (offset - 0xd28) * 8, size * 8);
-         break;
-     case 0xfe0 ... 0xfff: /* ID.  */
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
-          */
-         value <<= ((offset - 0xd28) * 8);
-+        if (!attrs.secure &&
-+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
-+            /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
-+            value &= ~R_V7M_CFSR_BFSR_MASK;
-+        }
-+
-         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
-         if (attrs.secure) {
-             /* The BFSR bits [15:8] are shared between security states
---
-.20.1

A mixed bag, all bug fixes or similar small stuff.

thanks
-- PMM

The following changes since commit 19eb2d4e736dc895f31fbd6b520e514f10cc08e0:

Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2019-05-07 10:43:32 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190507

for you to fetch changes up to 63159601fb3e396b28da14cbb71e50ed3f5a0331:

target/arm: Stop using variable length array in dc_zva (2019-05-07 12:55:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * Stop using variable length array in dc_zva
 * Implement M-profile XPSR GE bits
 * Don't enable ARMV7M_EXCP_DEBUG from reset
 * armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
 * armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
 * fix various minor issues to allow building for Windows-on-ARM64
 * aspeed: Set SDRAM size
 * Allow system registers for KVM guests to be changed by QEMU code
 * raspi: Diagnose requests for too much RAM
 * virt: Support firmware configuration with -blockdev

----------------------------------------------------------------
Cao Jiaxi (4):
      QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
      qga: Fix mingw compilation warnings on enum conversion
      util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
      osdep: Fix mingw compilation regarding stdio formats

Joel Stanley (1):
      arm: aspeed: Set SDRAM size

Markus Armbruster (3):
      pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
      pflash_cfi01: New pflash_cfi01_legacy_drive()
      hw/arm/virt: Support firmware configuration with -blockdev

Peter Maydell (7):
      hw/arm/raspi: Diagnose requests for too much RAM
      arm: Allow system registers for KVM guests to be changed by QEMU code
      hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
      hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
      hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
      target/arm: Implement XPSR GE bits
      target/arm: Stop using variable length array in dc_zva

From: Markus Armbruster <armbru@redhat.com>

The loop does two things: map legacy -drive to properties, and collect
all the backends for use after the loop.  The next patch will factor
out the former for reuse in hw/arm/virt.c.  To make that easier,
rearrange the loop so it does the first thing first, and the second
thing second.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190416091348.26075-2-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/pc_sysfw.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 
     /* Map legacy -drive if=pflash to machine properties */
     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
-        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
         pflash_drv = drive_get(IF_PFLASH, 0, i);
-        if (!pflash_drv) {
-            continue;
+        if (pflash_drv) {
+            loc_push_none(&loc);
+            qemu_opts_loc_restore(pflash_drv->opts);
+            if (pflash_cfi01_get_blk(pcms->flash[i])) {
+                error_report("clashes with -machine");
+                exit(1);
+            }
+            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
+                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
+            loc_pop(&loc);
         }
-        loc_push_none(&loc);
-        qemu_opts_loc_restore(pflash_drv->opts);
-        if (pflash_blk[i]) {
-            error_report("clashes with -machine");
-            exit(1);
-        }
-        pflash_blk[i] = blk_by_legacy_dinfo(pflash_drv);
-        qdev_prop_set_drive(DEVICE(pcms->flash[i]),
-                            "drive", pflash_blk[i], &error_fatal);
-        loc_pop(&loc);
+        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
     }
 
     /* Reject gaps */
-- 
2.20.1

From: Markus Armbruster <armbru@redhat.com>

Factored out of pc_system_firmware_init() so the next commit can reuse
it in hw/arm/virt.c.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190416091348.26075-3-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/block/flash.h |  1 +
 hw/block/pflash_cfi01.c  | 28 ++++++++++++++++++++++++++++
 hw/i386/pc_sysfw.c       | 16 ++--------------
 3 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -XXX,XX +XXX,XX @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
                                    int be);
 BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl);
 MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
+void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
 
 /* pflash_cfi02.c */
 
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
+#include "qemu/error-report.h"
 #include "qemu/host-utils.h"
 #include "qemu/log.h"
+#include "qemu/option.h"
 #include "hw/sysbus.h"
+#include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
 #include "trace.h"
 
@@ -XXX,XX +XXX,XX @@ MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
     return &fl->mem;
 }
 
+/*
+ * Handle -drive if=pflash for machines that use properties.
+ * If @dinfo is null, do nothing.
+ * Else if @fl's property "drive" is already set, fatal error.
+ * Else set it to the BlockBackend with @dinfo.
+ */
+void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
+{
+    Location loc;
+
+    if (!dinfo) {
+        return;
+    }
+
+    loc_push_none(&loc);
+    qemu_opts_loc_restore(dinfo->opts);
+    if (fl->blk) {
+        error_report("clashes with -machine");
+        exit(1);
+    }
+    qdev_prop_set_drive(DEVICE(fl), "drive",
+                        blk_by_legacy_dinfo(dinfo), &error_fatal);
+    loc_pop(&loc);
+}
+
 static void postload_update_cb(void *opaque, int running, RunState state)
 {
     PFlashCFI01 *pfl = opaque;
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 {
     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
     int i;
-    DriveInfo *pflash_drv;
     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
-    Location loc;
 
     if (!pcmc->pci_enabled) {
         old_pc_system_rom_init(rom_memory, true);
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 
     /* Map legacy -drive if=pflash to machine properties */
     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
-        pflash_drv = drive_get(IF_PFLASH, 0, i);
-        if (pflash_drv) {
-            loc_push_none(&loc);
-            qemu_opts_loc_restore(pflash_drv->opts);
-            if (pflash_cfi01_get_blk(pcms->flash[i])) {
-                error_report("clashes with -machine");
-                exit(1);
-            }
-            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
-                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
-            loc_pop(&loc);
-        }
+        pflash_cfi01_legacy_drive(pcms->flash[i],
+                                  drive_get(IF_PFLASH, 0, i));
         pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
     }
 
-- 
2.20.1

From: Markus Armbruster <armbru@redhat.com>

The ARM virt machines put firmware in flash memory.  To configure it,
you use -drive if=pflash,unit=0,... and optionally -drive
if=pflash,unit=1,...

Why two -drive?  This permits setting up one part of the flash memory
read-only, and the other part read/write.  It also makes upgrading
firmware on the host easier.  Below the hood, we get two separate
flash devices, because we were too lazy to improve our flash device
models to support sector protection.

The problem at hand is to do the same with -blockdev somehow, as one
more step towards deprecating -drive.

We recently solved this problem for x86 PC machines, in commit
ebc29e1beab.  See the commit message for design rationale.

This commit solves it for ARM virt basically the same way: new machine
properties pflash0, pflash1 forward to the onboard flash devices'
properties.  Requires creating the onboard devices in the
.instance_init() method virt_instance_init().  The existing code to
pick up drives defined with -drive if=pflash is replaced by code to
desugar into the machine properties.

There are a few behavioral differences, though:

* The flash devices are always present (x86: only present if
  configured)

* Flash base addresses and sizes are fixed (x86: sizes depend on
  images, mapped back to back below a fixed address)

* -bios configures contents of first pflash (x86: -bios configures ROM
   contents)

* -bios is rejected when first pflash is also configured with -machine
   pflash0=... (x86: bios is silently ignored then)

* -machine pflash1=... does not require -machine pflash0=... (x86: it
   does).

The actual code is a bit simpler than for x86 mostly due to the first
two differences.

Before the patch, all the action is in create_flash(), called from the
machine's .init() method machvirt_init():

main()
        machine_run_board_init()
            machvirt_init()
                create_flash()
                    create_one_flash() for flash[0]
                        create
                        configure
                            includes obeying -drive if=pflash,unit=0
                        realize
                        map
                        fall back to -bios
                    create_one_flash() for flash[1]
                        create
                        configure
                            includes obeying -drive if=pflash,unit=1
                        realize
                        map
                    update FDT

To make the machine properties work, we need to move device creation
to its .instance_init() method virt_instance_init().

Another complication is machvirt_init()'s computation of
@firmware_loaded: it predicts what create_flash() will do.  Instead of
predicting what create_flash()'s replacement virt_firmware_init() will
do, I decided to have virt_firmware_init() return what it did.
Requires calling it a bit earlier.

Resulting call tree:

main()
        current_machine = object_new()
            ...
                virt_instance_init()
                    virt_flash_create()
                        virt_flash_create1() for flash[0]
                            create
                            configure: set defaults
                            become child of machine [NEW]
                            add machine prop pflash0 as alias for drive [NEW]
                        virt_flash_create1() for flash[1]
                            create
                            configure: set defaults
                            become child of machine [NEW]
                            add machine prop pflash1 as alias for drive [NEW]
        for all machine props from the command line: machine_set_property()
            ...
                property_set_alias() for machine props pflash0, pflash1
                    ...
                        set_drive() for cfi.pflash01 prop drive
                            this is how -machine pflash0=... etc set
        machine_run_board_init(current_machine);
            virt_firmware_init()
                pflash_cfi01_legacy_drive()
                    legacy -drive if=pflash,unit=0 and =1 [NEW]
                virt_flash_map()
                    virt_flash_map1() for flash[0]
                        configure: num-blocks
                        realize
                        map
                    virt_flash_map1() for flash[1]
                        configure: num-blocks
                        realize
                        map
                fall back to -bios
            virt_flash_fdt()
                update FDT

You have László to thank for making me explain this in detail.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20190416091348.26075-4-armbru@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |   2 +
 hw/arm/virt.c         | 202 +++++++++++++++++++++++++++---------------
 2 files changed, 132 insertions(+), 72 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/notify.h"
 #include "hw/boards.h"
 #include "hw/arm/arm.h"
+#include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct {
     Notifier machine_done;
     DeviceState *platform_bus_dev;
     FWCfgState *fw_cfg;
+    PFlashCFI01 *flash[2];
     bool secure;
     bool highmem;
     bool highmem_ecam;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
     }
 }
 
-static void create_one_flash(const char *name, hwaddr flashbase,
-                             hwaddr flashsize, const char *file,
-                             MemoryRegion *sysmem)
+#define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
+
+static PFlashCFI01 *virt_flash_create1(VirtMachineState *vms,
+                                        const char *name,
+                                        const char *alias_prop_name)
 {
-    /* Create and map a single flash device. We use the same
-     * parameters as the flash devices on the Versatile Express board.
+    /*
+     * Create a single flash device.  We use the same parameters as
+     * the flash devices on the Versatile Express board.
      */
-    DriveInfo *dinfo = drive_get_next(IF_PFLASH);
     DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    const uint64_t sectorlength = 256 * 1024;
 
-    if (dinfo) {
-        qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
-                            &error_abort);
-    }
-
-    qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength);
-    qdev_prop_set_uint64(dev, "sector-length", sectorlength);
+    qdev_prop_set_uint64(dev, "sector-length", VIRT_FLASH_SECTOR_SIZE);
     qdev_prop_set_uint8(dev, "width", 4);
     qdev_prop_set_uint8(dev, "device-width", 2);
     qdev_prop_set_bit(dev, "big-endian", false);
@@ -XXX,XX +XXX,XX @@ static void create_one_flash(const char *name, hwaddr flashbase,
     qdev_prop_set_uint16(dev, "id2", 0x00);
     qdev_prop_set_uint16(dev, "id3", 0x00);
     qdev_prop_set_string(dev, "name", name);
-    qdev_init_nofail(dev);
-
-    memory_region_add_subregion(sysmem, flashbase,
-                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
-
-    if (file) {
-        char *fn;
-        int image_size;
-
-        if (drive_get(IF_PFLASH, 0, 0)) {
-            error_report("The contents of the first flash device may be "
-                         "specified with -bios or with -drive if=pflash... "
-                         "but you cannot use both options at once");
-            exit(1);
-        }
-        fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, file);
-        if (!fn) {
-            error_report("Could not find ROM image '%s'", file);
-            exit(1);
-        }
-        image_size = load_image_mr(fn, sysbus_mmio_get_region(sbd, 0));
-        g_free(fn);
-        if (image_size < 0) {
-            error_report("Could not load ROM image '%s'", file);
-            exit(1);
-        }
-    }
+    object_property_add_child(OBJECT(vms), name, OBJECT(dev),
+                              &error_abort);
+    object_property_add_alias(OBJECT(vms), alias_prop_name,
+                              OBJECT(dev), "drive", &error_abort);
+    return PFLASH_CFI01(dev);
 }
 
-static void create_flash(const VirtMachineState *vms,
-                         MemoryRegion *sysmem,
-                         MemoryRegion *secure_sysmem)
+static void virt_flash_create(VirtMachineState *vms)
 {
-    /* Create two flash devices to fill the VIRT_FLASH space in the memmap.
-     * Any file passed via -bios goes in the first of these.
+    vms->flash[0] = virt_flash_create1(vms, "virt.flash0", "pflash0");
+    vms->flash[1] = virt_flash_create1(vms, "virt.flash1", "pflash1");
+}
+
+static void virt_flash_map1(PFlashCFI01 *flash,
+                            hwaddr base, hwaddr size,
+                            MemoryRegion *sysmem)
+{
+    DeviceState *dev = DEVICE(flash);
+
+    assert(size % VIRT_FLASH_SECTOR_SIZE == 0);
+    assert(size / VIRT_FLASH_SECTOR_SIZE <= UINT32_MAX);
+    qdev_prop_set_uint32(dev, "num-blocks", size / VIRT_FLASH_SECTOR_SIZE);
+    qdev_init_nofail(dev);
+
+    memory_region_add_subregion(sysmem, base,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
+                                                       0));
+}
+
+static void virt_flash_map(VirtMachineState *vms,
+                           MemoryRegion *sysmem,
+                           MemoryRegion *secure_sysmem)
+{
+    /*
+     * Map two flash devices to fill the VIRT_FLASH space in the memmap.
      * sysmem is the system memory space. secure_sysmem is the secure view
      * of the system, and the first flash device should be made visible only
      * there. The second flash device is visible to both secure and nonsecure.
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
      */
     hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
     hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
-    char *nodename;
 
-    create_one_flash("virt.flash0", flashbase, flashsize,
-                     bios_name, secure_sysmem);
-    create_one_flash("virt.flash1", flashbase + flashsize, flashsize,
-                     NULL, sysmem);
+    virt_flash_map1(vms->flash[0], flashbase, flashsize,
+                    secure_sysmem);
+    virt_flash_map1(vms->flash[1], flashbase + flashsize, flashsize,
+                    sysmem);
+}
+
+static void virt_flash_fdt(VirtMachineState *vms,
+                           MemoryRegion *sysmem,
+                           MemoryRegion *secure_sysmem)
+{
+    hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
+    hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
+    char *nodename;
 
     if (sysmem == secure_sysmem) {
         /* Report both flash devices as a single node in the DT */
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
         qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
         g_free(nodename);
     } else {
-        /* Report the devices as separate nodes so we can mark one as
+        /*
+         * Report the devices as separate nodes so we can mark one as
          * only visible to the secure world.
          */
         nodename = g_strdup_printf("/secflash@%" PRIx64, flashbase);
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
     }
 }
 
+static bool virt_firmware_init(VirtMachineState *vms,
+                               MemoryRegion *sysmem,
+                               MemoryRegion *secure_sysmem)
+{
+    int i;
+    BlockBackend *pflash_blk0;
+
+    /* Map legacy -drive if=pflash to machine properties */
+    for (i = 0; i < ARRAY_SIZE(vms->flash); i++) {
+        pflash_cfi01_legacy_drive(vms->flash[i],
+                                  drive_get(IF_PFLASH, 0, i));
+    }
+
+    virt_flash_map(vms, sysmem, secure_sysmem);
+
+    pflash_blk0 = pflash_cfi01_get_blk(vms->flash[0]);
+
+    if (bios_name) {
+        char *fname;
+        MemoryRegion *mr;
+        int image_size;
+
+        if (pflash_blk0) {
+            error_report("The contents of the first flash device may be "
+                         "specified with -bios or with -drive if=pflash... "
+                         "but you cannot use both options at once");
+            exit(1);
+        }
+
+        /* Fall back to -bios */
+
+        fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+        if (!fname) {
+            error_report("Could not find ROM image '%s'", bios_name);
+            exit(1);
+        }
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(vms->flash[0]), 0);
+        image_size = load_image_mr(fname, mr);
+        g_free(fname);
+        if (image_size < 0) {
+            error_report("Could not load ROM image '%s'", bios_name);
+            exit(1);
+        }
+    }
+
+    return pflash_blk0 || bios_name;
+}
+
 static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
 {
     hwaddr base = vms->memmap[VIRT_FW_CFG].base;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     MemoryRegion *secure_sysmem = NULL;
     int n, virt_max_cpus;
     MemoryRegion *ram = g_new(MemoryRegion, 1);
-    bool firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0);
+    bool firmware_loaded;
     bool aarch64 = true;
 
     /*
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
+    if (vms->secure) {
+        if (kvm_enabled()) {
+            error_report("mach-virt: KVM does not support Security extensions");
+            exit(1);
+        }
+
+        /*
+         * The Secure view of the world is the same as the NonSecure,
+         * but with a few extra devices. Create it as a container region
+         * containing the system memory at low priority; any secure-only
+         * devices go in at higher priority and take precedence.
+         */
+        secure_sysmem = g_new(MemoryRegion, 1);
+        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
+                           UINT64_MAX);
+        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
+    }
+
+    firmware_loaded = virt_firmware_init(vms, sysmem,
+                                         secure_sysmem ?: sysmem);
+
     /* If we have an EL3 boot ROM then the assumption is that it will
      * implement PSCI itself, so disable QEMU's internal implementation
      * so it doesn't get in the way. Instead of starting secondary
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
-    if (vms->secure) {
-        if (kvm_enabled()) {
-            error_report("mach-virt: KVM does not support Security extensions");
-            exit(1);
-        }
-
-        /* The Secure view of the world is the same as the NonSecure,
-         * but with a few extra devices. Create it as a container region
-         * containing the system memory at low priority; any secure-only
-         * devices go in at higher priority and take precedence.
-         */
-        secure_sysmem = g_new(MemoryRegion, 1);
-        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
-                           UINT64_MAX);
-        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
-    }
-
     create_fdt(vms);
 
     possible_cpus = mc->possible_cpu_arch_ids(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                     &machine->device_memory->mr);
     }
 
-    create_flash(vms, sysmem, secure_sysmem ? secure_sysmem : sysmem);
+    virt_flash_fdt(vms, sysmem, secure_sysmem);
 
     create_gic(vms, pic);
 
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                     NULL);
 
     vms->irqmap = a15irqmap;
+
+    virt_flash_create(vms);
 }
 
 static const TypeInfo virt_machine_info = {
-- 
2.20.1

The Raspberry Pi boards have a physical memory map which does
not allow for more than 1GB of RAM. Currently if the user tries
to ask for more then we fail in a confusing way:

$ qemu-system-aarch64 --machine raspi3 -m 8G
Unexpected error in visit_type_uintN() at qapi/qapi-visit-core.c:164:
qemu-system-aarch64: Parameter 'vcram-base' expects uint32_t
Aborted (core dumped)

Catch this earlier and diagnose it with a more friendly message:
$ qemu-system-aarch64 --machine raspi3 -m 8G
qemu-system-aarch64: Requested ram size is too large for this machine: maximum is 1GB

Fixes: https://bugs.launchpad.net/qemu/+bug/1794187
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
---
 hw/arm/raspi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
+    if (machine->ram_size > 1 * GiB) {
+        error_report("Requested ram size is too large for this machine: "
+                     "maximum is 1GB");
+        exit(1);
+    }
+
     object_initialize(&s->soc, sizeof(s->soc),
                       version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
-- 
2.20.1

At the moment the Arm implementations of kvm_arch_{get,put}_registers()
don't support having QEMU change the values of system registers
(aka coprocessor registers for AArch32). This is because although
kvm_arch_get_registers() calls write_list_to_cpustate() to
update the CPU state struct fields (so QEMU code can read the
values in the usual way), kvm_arch_put_registers() does not
call write_cpustate_to_list(), meaning that any changes to
the CPU state struct fields will not be passed back to KVM.

The rationale for this design is documented in a comment in the
AArch32 kvm_arch_put_registers() -- writing the values in the
cpregs list into the CPU state struct is "lossy" because the
write of a register might not succeed, and so if we blindly
copy the CPU state values back again we will incorrectly
change register values for the guest. The assumption was that
no QEMU code would need to write to the registers.

However, when we implemented debug support for KVM guests, we
broke that assumption: the code to handle "set the guest up
to take a breakpoint exception" does so by updating various
guest registers including ESR_EL1.

Support this by making kvm_arch_put_registers() synchronize
CPU state back into the list. We sync only those registers
where the initial write succeeds, which should be sufficient.

This commit is the same as commit 823e1b3818f9b10b824ddc which we
had to revert in commit 942f99c825fc94c8b1a4, except that the bug
which was preventing EDK2 guest firmware running has been fixed:
kvm_arm_reset_vcpu() now calls write_list_to_cpustate().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Eric Auger <eric.auger@redhat.com>
---
 target/arm/cpu.h     |  9 ++++++++-
 target/arm/helper.c  | 27 +++++++++++++++++++++++++--
 target/arm/kvm.c     |  8 ++++++++
 target/arm/kvm32.c   | 20 ++------------------
 target/arm/kvm64.c   |  2 ++
 target/arm/machine.c |  2 +-
 6 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
 /**
  * write_cpustate_to_list:
  * @cpu: ARMCPU
+ * @kvm_sync: true if this is for syncing back to KVM
  *
  * For each register listed in the ARMCPU cpreg_indexes list, write
  * its value from the ARMCPUState structure into the cpreg_values list.
  * This is used to copy info from TCG's working data structures into
  * KVM or for outbound migration.
  *
+ * @kvm_sync is true if we are doing this in order to sync the
+ * register state back to KVM. In this case we will only update
+ * values in the list if the previous list->cpustate sync actually
+ * successfully wrote the CPU state. Otherwise we will keep the value
+ * that is in the list.
+ *
  * Returns: true if all register values were read correctly,
  * false if some register was unknown or could not be read.
  * Note that we do not stop early on failure -- we will attempt
  * reading all registers in the list.
  */
-bool write_cpustate_to_list(ARMCPU *cpu);
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 
 #define ARM_CPUID_TI915T      0x54029152
 #define ARM_CPUID_TI925T      0x54029252
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
     return true;
 }
 
-bool write_cpustate_to_list(ARMCPU *cpu)
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
 {
     /* Write the coprocessor state from cpu->env to the (index,value) list. */
     int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
     for (i = 0; i < cpu->cpreg_array_len; i++) {
         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
         const ARMCPRegInfo *ri;
+        uint64_t newval;
 
         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
         if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
         if (ri->type & ARM_CP_NO_RAW) {
             continue;
         }
-        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
+
+        newval = read_raw_cp_reg(&cpu->env, ri);
+        if (kvm_sync) {
+            /*
+             * Only sync if the previous list->cpustate sync succeeded.
+             * Rather than tracking the success/failure state for every
+             * item in the list, we just recheck "does the raw write we must
+             * have made in write_list_to_cpustate() read back OK" here.
+             */
+            uint64_t oldval = cpu->cpreg_values[i];
+
+            if (oldval == newval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, oldval);
+            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, newval);
+        }
+        cpu->cpreg_values[i] = newval;
     }
     return ok;
 }
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_reset_vcpu(ARMCPU *cpu)
         fprintf(stderr, "write_kvmstate_to_list failed\n");
         abort();
     }
+    /*
+     * Sync the reset values also into the CPUState. This is necessary
+     * because the next thing we do will be a kvm_arch_put_registers()
+     * which will update the list values from the CPUState before copying
+     * the list values back to KVM. It's OK to ignore failure returns here
+     * for the same reason we do so in kvm_arch_get_registers().
+     */
+    write_list_to_cpustate(cpu);
 }
 
 /*
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    /* Note that we do not call write_cpustate_to_list()
-     * here, so we are only writing the tuple list back to
-     * KVM. This is safe because nothing can change the
-     * CPUARMState cp15 fields (in particular gdb accesses cannot)
-     * and so there are no changes to sync. In fact syncing would
-     * be wrong at this point: for a constant register where TCG and
-     * KVM disagree about its value, the preceding write_list_to_cpustate()
-     * would not have had any effect on the CPUARMState value (since the
-     * register is read-only), and a write_cpustate_to_list() here would
-     * then try to write the TCG value back into KVM -- this would either
-     * fail or incorrectly change the value the guest sees.
-     *
-     * If we ever want to allow the user to modify cp15 registers via
-     * the gdb stub, we would need to be more clever here (for instance
-     * tracking the set of registers kvm_arch_get_registers() successfully
-     * managed to update the CPUARMState with, and only allowing those
-     * to be written back up into the kernel).
-     */
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
             abort();
         }
     } else {
-        if (!write_cpustate_to_list(cpu)) {
+        if (!write_cpustate_to_list(cpu, false)) {
             /* This should never fail. */
             abort();
         }
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

We currently use Qemu's default of 128MB. As we know how much ram each
machine ships with, make it easier on users by setting a default.

It can still be overridden with -m on the command line.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190503022958.1394-1-joel@jms.id.au
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed.h | 1 +
 hw/arm/aspeed.c         | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
     const char *spi_model;
     uint32_t num_cs;
     void (*i2c_init)(AspeedBoardState *bmc);
+    uint32_t ram;
 } AspeedBoardConfig;
 
 #define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/block-backend.h"
 #include "hw/loader.h"
 #include "qemu/error-report.h"
+#include "qemu/units.h"
 
 static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
+    if (board->ram) {
+        mc->default_ram_size = board->ram;
+    }
     amc->board = board;
 }
 
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
         .i2c_init  = palmetto_bmc_i2c_init,
+        .ram       = 256 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("ast2500-evb"),
         .desc      = "Aspeed AST2500 EVB (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
         .i2c_init  = ast2500_evb_i2c_init,
+        .ram       = 512 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("romulus-bmc"),
         .desc      = "OpenPOWER Romulus BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
         .i2c_init  = romulus_bmc_i2c_init,
+        .ram       = 512 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
         .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
         .i2c_init  = witherspoon_bmc_i2c_init,
+        .ram       = 512 * MiB,
     },
 };
 
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

gcc_struct is for x86 only, and it generates an warning on ARM64 Clang/MinGW targets.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003618.10089-1-driver1998@foxmail.com
[PMM: dropped the slirp change as slirp is now a submodule]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/libvhost-user/libvhost-user.h | 2 +-
 include/qemu/compiler.h               | 2 +-
 scripts/cocci-macro-file.h            | 7 ++++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/libvhost-user.h
+++ b/contrib/libvhost-user/libvhost-user.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostUserInflight {
     uint16_t queue_size;
 } VhostUserInflight;
 
-#if defined(_WIN32)
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define VU_PACKED __attribute__((gcc_struct, packed))
 #else
 # define VU_PACKED __attribute__((packed))
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 
 #define QEMU_SENTINEL __attribute__((sentinel))
 
-#if defined(_WIN32)
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define QEMU_PACKED __attribute__((gcc_struct, packed))
 #else
 # define QEMU_PACKED __attribute__((packed))
diff --git a/scripts/cocci-macro-file.h b/scripts/cocci-macro-file.h
index XXXXXXX..XXXXXXX 100644
--- a/scripts/cocci-macro-file.h
+++ b/scripts/cocci-macro-file.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_NORETURN __attribute__ ((__noreturn__))
 #define QEMU_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
 #define QEMU_SENTINEL __attribute__((sentinel))
-#define QEMU_PACKED __attribute__((gcc_struct, packed))
+
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
+# define QEMU_PACKED __attribute__((gcc_struct, packed))
+#else
+# define QEMU_PACKED __attribute__((packed))
+#endif
 
 #define cat(x,y) x ## y
 #define cat2(x,y) cat(x,y)
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

The win2qemu[] is supposed to be the conversion table to convert between
STORAGE_BUS_TYPE in Windows SDK and GuestDiskBusType in qga.

But it was incorrectly written that it forces to set a GuestDiskBusType
value to STORAGE_BUS_TYPE, which generates an enum conversion warning in clang.

Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003650.10137-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qga/commands-win32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -XXX,XX +XXX,XX @@ void qmp_guest_file_flush(int64_t handle, Error **errp)
 
 #ifdef CONFIG_QGA_NTDDSCSI
 
-static STORAGE_BUS_TYPE win2qemu[] = {
+static GuestDiskBusType win2qemu[] = {
     [BusTypeUnknown] = GUEST_DISK_BUS_TYPE_UNKNOWN,
     [BusTypeScsi] = GUEST_DISK_BUS_TYPE_SCSI,
     [BusTypeAtapi] = GUEST_DISK_BUS_TYPE_IDE,
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

Windows ARM64 uses LLP64 model, which breaks current assumptions.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003707.10185-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cacheinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/cacheinfo.c b/util/cacheinfo.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheinfo.c
+++ b/util/cacheinfo.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static void arch_cache_info(int *isize, int *dsize)
 {
     if (*isize == 0 || *dsize == 0) {
-        unsigned long ctr;
+        uint64_t ctr;
 
         /* The real cache geometry is in CCSIDR_EL1/CLIDR_EL1/CSSELR_EL1,
            but (at least under Linux) these are marked protected by the
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

I encountered the following compilation error on mingw:

/mnt/d/qemu/include/qemu/osdep.h:97:9: error: '__USE_MINGW_ANSI_STDIO' macro redefined [-Werror,-Wmacro-redefined]
 #define __USE_MINGW_ANSI_STDIO 1
        ^
/mnt/d/llvm-mingw/aarch64-w64-mingw32/include/_mingw.h:433:9: note: previous definition is here
 #define __USE_MINGW_ANSI_STDIO 0      /* was not defined so it should be 0 */

It turns out that __USE_MINGW_ANSI_STDIO must be set before any
system headers are included, not just before stdio.h.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-id: 20190503003719.10233-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/osdep.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
 #endif
 #endif
 
+/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
+#ifdef __MINGW32__
+#define __USE_MINGW_ANSI_STDIO 1
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <sys/types.h>
 #include <stdlib.h>
-
-/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
-#ifdef __MINGW32__
-#define __USE_MINGW_ANSI_STDIO 1
-#endif
 #include <stdio.h>
 
 #include <string.h>
-- 
2.20.1

Rule R_CQRV says that if two pending interrupts have the same
group priority then ties are broken by looking at the subpriority.
We had a comment describing this but had forgotten to actually
implement the subpriority comparison. Correct the omission.

(The further tie break rules of "lowest exception number" and
"secure before non-secure" are handled implicitly by the order
in which we iterate through the exceptions in the loops.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-2-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
     int active_prio = NVIC_NOEXC_PRIO;
     int pend_irq = 0;
     bool pending_is_s_banked = false;
+    int pend_subprio = 0;
 
     /* R_CQRV: precedence is by:
      *  - lowest group priority; if both the same then
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
     for (i = 1; i < s->num_irq; i++) {
         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
             VecInfo *vec;
-            int prio;
+            int prio, subprio;
             bool targets_secure;
 
             if (bank == M_REG_S) {
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
             }
 
             prio = exc_group_prio(s, vec->prio, targets_secure);
-            if (vec->enabled && vec->pending && prio < pend_prio) {
+            subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
+            if (vec->enabled && vec->pending &&
+                ((prio < pend_prio) ||
+                 (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
                 pend_prio = prio;
+                pend_subprio = subprio;
                 pend_irq = i;
                 pending_is_s_banked = (bank == M_REG_S);
             }
-- 
2.20.1

The non-secure versions of the BFAR and BFSR registers are
supposed to be RAZ/WI if AICR.BFHFNMINS == 0; we were
incorrectly allowing NS code to access the real values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-3-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            return 0;
+        }
         return cpu->env.v7m.bfar;
     case 0xd3c: /* Aux Fault Status.  */
         /* TODO: Implement fault status registers.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            return;
+        }
         cpu->env.v7m.bfar = value;
         return;
     case 0xd3c: /* Aux Fault Status.  */
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
             val = 0;
             break;
         };
-        /* The BFSR bits [15:8] are shared between security states
-         * and we store them in the NS copy
+        /*
+         * The BFSR bits [15:8] are shared between security states
+         * and we store them in the NS copy. They are RAZ/WI for
+         * NS code if AIRCR.BFHFNMINS is 0.
          */
         val = s->cpu->env.v7m.cfsr[attrs.secure];
-        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            val &= ~R_V7M_CFSR_BFSR_MASK;
+        } else {
+            val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        }
         val = extract32(val, (offset - 0xd28) * 8, size * 8);
         break;
     case 0xfe0 ... 0xfff: /* ID.  */
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
          */
         value <<= ((offset - 0xd28) * 8);
 
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
+            value &= ~R_V7M_CFSR_BFSR_MASK;
+        }
+
         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
         if (attrs.secure) {
             /* The BFSR bits [15:8] are shared between security states
-- 
2.20.1

The M-profile architecture specifies that the DebugMonitor exception
should be initially disabled, not enabled. It should be controlled
by the DEMCR register's MON_EN bit, but we don't implement that
register yet (like most of the debug architecture for M-profile).

Note that BKPT instructions will still work, because they
will be escalated to HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-4-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
      * the System Handler Control register
      */
     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
-    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
 
+    /* DebugMonitor is enabled via DEMCR.MON_EN */
+    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
+
     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
-- 
2.20.1

In the M-profile architecture, if the CPU implements the DSP extension
then the XPSR has GE bits, in the same way as the A-profile CPSR. When
we added DSP extension support we forgot to add support for reading
and writing the GE bits, which are stored in env->GE. We did put in
the code to add XPSR_GE to the mask of bits to update in the v7m_msr
helper, but forgot it in v7m_mrs. We also must not allow the XPSR we
pull off the stack on exception return to set the nonexistent GE bits.
Correct these errors:
 * read and write env->GE in xpsr_read() and xpsr_write()
 * only set GE bits on exception return if DSP present
 * read GE bits for MRS if DSP present

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-5-peter.maydell@linaro.org
---
 target/arm/cpu.h    |  4 ++++
 target/arm/helper.c | 12 ++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t xpsr_read(CPUARMState *env)
         | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
         | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
         | ((env->condexec_bits & 0xfc) << 8)
+        | (env->GE << 16)
         | env->v7m.exception;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
     if (mask & XPSR_Q) {
         env->QF = ((val & XPSR_Q) != 0);
     }
+    if (mask & XPSR_GE) {
+        env->GE = (val & XPSR_GE) >> 16;
+    }
     if (mask & XPSR_T) {
         env->thumb = ((val & XPSR_T) != 0);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
     uint32_t excret;
-    uint32_t xpsr;
+    uint32_t xpsr, xpsr_mask;
     bool ufault = false;
     bool sfault = false;
     bool return_to_sp_process;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         }
         *frame_sp_p = frameptr;
     }
+
+    xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
+    if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
+        xpsr_mask &= ~XPSR_GE;
+    }
     /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
-    xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA));
+    xpsr_write(env, xpsr, xpsr_mask);
 
     if (env->v7m.secure) {
         bool sfpa = xpsr & XPSR_SFPA;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
         }
         if (!(reg & 4)) {
             mask |= XPSR_NZCV | XPSR_Q; /* APSR */
+            if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
+                mask |= XPSR_GE;
+            }
         }
         /* EPSR reads as zero */
         return xpsr_read(env) & mask;
-- 
2.20.1

Currently the dc_zva helper function uses a variable length
array. In fact we know (as the comment above remarks) that
the length of this array is bounded because the architecture
limits the block size and QEMU limits the target page size.
Use a fixed array size and assert that we don't run off it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190503120448.13385-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "target/arm/idau.h"
 #include "trace.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
          * We know that in fact for any v8 CPU the page size is at least 4K
          * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
          * 1K as an artefact of legacy v5 subpage support being present in the
-         * same QEMU executable.
+         * same QEMU executable. So in practice the hostaddr[] array has
+         * two entries, given the current setting of TARGET_PAGE_BITS_MIN.
          */
         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
-        void *hostaddr[maxidx];
+        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
         int try, i;
         unsigned mmu_idx = cpu_mmu_index(env, false);
         TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 
+        assert(maxidx <= ARRAY_SIZE(hostaddr));
+
         for (try = 0; try < 2; try++) {
 
             for (i = 0; i < maxidx; i++) {
-- 
2.20.1

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1