Series comparison

-[Qemu-devel] [PULL 00/12] target-arm queue
+[PULL 00/24] target-arm queue
-Not very much here, but several people have fallen over
+Hi; here's a queue of arm patches (plus a few elf2dmp changes);
-the vector operation segfault bug, so let's get the fix
+mostly these are minor cleanups and bugfixes.
 into master.
 thanks
 -- PMM
-The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
+The following changes since commit deaca3fd30d3a8829160f8d3705d65ad83176800:
-  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
+  Merge tag 'pull-vfio-20231018' of https://github.com/legoater/qemu into staging (2023-10-18 06:21:15 -0400)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20231019
-for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
+for you to fetch changes up to 2a052b4ee01b3c413cef2ef49cb780cde17d4ba1:
-  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
+  contrib/elf2dmp: Use g_malloc(), g_new() and g_free() (2023-10-19 14:32:13 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * exynos4210: QOM'ify the Exynos4210 SoC
+ * hw/arm: Move raspberrypi-fw-defs.h to the include/hw/arm/ folder
- * exynos4210: Add DMA support for the Exynos4210
+ * hw/arm/exynos4210: Get arm_boot_info declaration from 'hw/arm/boot'
- * arm_gicv3: Fix writes to ICC_CTLR_EL3
+ * xlnx devices: remove deprecated device reset
- * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
+ * xlnx-bbram: hw/nvram: Use dot in device type name
- * target/arm: Fix vector operation segfault
+ * elf2dmp: fix coverity issues
- * target/arm: Minor improvements to BFXIL, EXTR
+ * elf2dmp: convert to g_malloc, g_new and g_free
  * target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
  * hw/arm: refactor virt PPI logic
  * arm/kvm: convert to kvm_set_one_reg, kvm_get_one_reg
  * target/arm: Permit T32 LDM with single register
  * smmuv3: Advertise SMMUv3.1-XNX
  * target/arm: Implement FEAT_HPMN0
  * Remove some unnecessary include lines
  * target/arm/arm-powerctl: Correctly init CPUs when powered on to lower EL
  * hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
 ----------------------------------------------------------------
-Alistair Francis (1):
+Chris Rauer (1):
-      target/arm: Fix vector operation segfault
+      hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
-Guenter Roeck (1):
+Cornelia Huck (2):
-      hw/arm/exynos4210: Add DMA support for the Exynos4210
+      arm/kvm: convert to kvm_set_one_reg
       arm/kvm: convert to kvm_get_one_reg
-Peter Maydell (5):
+Leif Lindholm (3):
-      arm: Move system_clock_scale to armv7m_systick.h
+      {include/}hw/arm: refactor virt PPI logic
-      arm: Remove unnecessary includes of hw/arm/arm.h
+      include/hw/arm: move BSA definitions to bsa.h
-      arm: Rename hw/arm/arm.h to hw/arm/boot.h
+      hw/arm/sbsa-ref: use bsa.h for PPI definitions
       hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
       hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-Philippe Mathieu-Daudé (3):
+Michal Orzel (1):
-      hw/arm/exynos4: Remove unuseful debug code
+      target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
       hw/arm/exynos4: Use the IEC binary prefix definitions
       hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-Richard Henderson (2):
+Peter Maydell (8):
-      target/arm: Use extract2 for EXTR
+      target/arm: Permit T32 LDM with single register
-      target/arm: Simplify BFXIL expansion
+      hw/arm/smmuv3: Update ID register bit field definitions
       hw/arm/smmuv3: Sort ID register setting into field order
       hw/arm/smmuv3: Advertise SMMUv3.1-XNX feature
       target/arm: Implement FEAT_HPMN0
       target/arm/kvm64.c: Remove unused include
       target/arm/common-semi-target.h: Remove unnecessary boot.h include
       target/arm/arm-powerctl: Correctly init CPUs when powered on to lower EL
- include/hw/arm/allwinner-a10.h    |  2 +-
+Philippe Mathieu-Daudé (1):
- include/hw/arm/aspeed_soc.h       |  1 -
+      hw/arm/exynos4210: Get arm_boot_info declaration from 'hw/arm/boot.h'
  include/hw/arm/bcm2836.h          |  1 -
  include/hw/arm/{arm.h => boot.h}  | 12 +++------
  include/hw/arm/exynos4210.h       |  9 +++++--
  include/hw/arm/fsl-imx25.h        |  2 +-
  include/hw/arm/fsl-imx31.h        |  2 +-
  include/hw/arm/fsl-imx6.h         |  2 +-
  include/hw/arm/fsl-imx6ul.h       |  2 +-
  include/hw/arm/fsl-imx7.h         |  2 +-
  include/hw/arm/virt.h             |  2 +-
  include/hw/arm/xlnx-versal.h      |  2 +-
  include/hw/arm/xlnx-zynqmp.h      |  2 +-
  include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
  hw/arm/armsse.c                   |  2 +-
  hw/arm/armv7m.c                   |  2 +-
  hw/arm/aspeed.c                   |  2 +-
  hw/arm/boot.c                     |  2 +-
  hw/arm/collie.c                   |  2 +-
  hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
  hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
  hw/arm/highbank.c                 |  2 +-
  hw/arm/integratorcp.c             |  2 +-
  hw/arm/mainstone.c                |  2 +-
  hw/arm/microbit.c                 |  2 +-
  hw/arm/mps2-tz.c                  |  2 +-
  hw/arm/mps2.c                     |  2 +-
  hw/arm/msf2-soc.c                 |  1 -
  hw/arm/msf2-som.c                 |  2 +-
  hw/arm/musca.c                    |  2 +-
  hw/arm/musicpal.c                 |  2 +-
  hw/arm/netduino2.c                |  2 +-
  hw/arm/nrf51_soc.c                |  2 +-
  hw/arm/nseries.c                  |  2 +-
  hw/arm/omap1.c                    |  2 +-
  hw/arm/omap2.c                    |  2 +-
  hw/arm/omap_sx1.c                 |  2 +-
  hw/arm/palm.c                     |  2 +-
  hw/arm/raspi.c                    |  2 +-
  hw/arm/realview.c                 |  2 +-
  hw/arm/spitz.c                    |  2 +-
  hw/arm/stellaris.c                |  2 +-
  hw/arm/stm32f205_soc.c            |  2 +-
  hw/arm/strongarm.c                |  2 +-
  hw/arm/tosa.c                     |  2 +-
  hw/arm/versatilepb.c              |  2 +-
  hw/arm/vexpress.c                 |  2 +-
  hw/arm/virt.c                     |  2 +-
  hw/arm/xilinx_zynq.c              |  2 +-
  hw/arm/xlnx-versal.c              |  2 +-
  hw/arm/z2.c                       |  2 +-
  hw/intc/arm_gicv3_cpuif.c         |  6 ++---
  hw/intc/armv7m_nvic.c             |  1 -
  target/arm/arm-semi.c             |  1 -
  target/arm/cpu.c                  |  1 -
  target/arm/cpu64.c                |  1 -
  target/arm/kvm.c                  |  1 -
  target/arm/kvm32.c                |  1 -
  target/arm/kvm64.c                |  1 -
  target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
  target/arm/translate.c            |  4 +--
 files changed, 164 insertions(+), 123 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (96%)
+Suraj Shirvankar (1):
+      contrib/elf2dmp: Use g_malloc(), g_new() and g_free()
+Thomas Huth (1):
+      hw/arm: Move raspberrypi-fw-defs.h to the include/hw/arm/ folder
+Tong Ho (4):
+      xlnx-bbram: hw/nvram: Remove deprecated device reset
+      xlnx-zynqmp-efuse: hw/nvram: Remove deprecated device reset
+      xlnx-versal-efuse: hw/nvram: Remove deprecated device reset
+      xlnx-bbram: hw/nvram: Use dot in device type name
+Viktor Prutyanov (2):
+      elf2dmp: limit print length for sign_rsds
+      elf2dmp: check array bounds in pdb_get_file_size
+ MAINTAINERS                                    |   2 +-
+ docs/system/arm/emulation.rst                  |   1 +
+ hw/arm/smmuv3-internal.h                       |  38 ++++++++
+ include/hw/arm/bsa.h                           |  35 +++++++
+ include/hw/arm/exynos4210.h                    |   2 +-
+ include/hw/{misc => arm}/raspberrypi-fw-defs.h |   0
+ include/hw/arm/virt.h                          |  12 +--
+ include/hw/nvram/xlnx-bbram.h                  |   2 +-
+ target/arm/common-semi-target.h                |   4 +-
+ target/arm/cpu-qom.h                           |   2 -
+ target/arm/cpu.h                               |  22 +++++
+ contrib/elf2dmp/addrspace.c                    |   7 +-
+ contrib/elf2dmp/main.c                         |  11 +--
+ contrib/elf2dmp/pdb.c                          |  32 ++++---
+ contrib/elf2dmp/qemu_elf.c                     |   7 +-
+ hw/arm/boot.c                                  |  95 +++++--------------
+ hw/arm/sbsa-ref.c                              |  21 ++---
+ hw/arm/smmuv3.c                                |   8 +-
+ hw/arm/virt-acpi-build.c                       |  12 +--
+ hw/arm/virt.c                                  |  24 +++--
+ hw/misc/bcm2835_property.c                     |   2 +-
+ hw/nvram/xlnx-bbram.c                          |   8 +-
+ hw/nvram/xlnx-versal-efuse-ctrl.c              |   8 +-
+ hw/nvram/xlnx-zynqmp-efuse.c                   |   8 +-
+ hw/timer/npcm7xx_timer.c                       |   3 +
+ target/arm/arm-powerctl.c                      |  53 +----------
+ target/arm/cpu.c                               |  95 +++++++++++++++++++
+ target/arm/helper.c                            |  19 +---
+ target/arm/kvm.c                               |  28 ++----
+ target/arm/kvm64.c                             | 124 +++++++------------------
+ target/arm/tcg/cpu32.c                         |   4 +
+ target/arm/tcg/cpu64.c                         |   1 +
+ target/arm/tcg/translate.c                     |  37 +++++---
+files changed, 368 insertions(+), 359 deletions(-)
+ create mode 100644 include/hw/arm/bsa.h
+ rename include/hw/{misc => arm}/raspberrypi-fw-defs.h (100%)

-[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
+[PULL 01/24] hw/arm: Move raspberrypi-fw-defs.h to the include/hw/arm/ folder
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Thomas Huth <thuth@redhat.com>
-Commit 89e68b575 "target/arm: Use vector operations for saturation"
+The file is obviously related to the raspberrypi machine, so
-causes this abort() when booting QEMU ARM with a Cortex-A15:
+it should reside in hw/arm/ instead of hw/misc/. And while we're
 at it, also adjust the wildcard in MAINTAINERS so that it covers
 this file, too.
-0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
 0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
 0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
+Message-id: 20231012073458.860187-1-thuth@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 4 ++--
+ MAINTAINERS                                    | 2 +-
-file changed, 2 insertions(+), 2 deletions(-)
+ include/hw/{misc => arm}/raspberrypi-fw-defs.h | 0
  hw/misc/bcm2835_property.c                     | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
  rename include/hw/{misc => arm}/raspberrypi-fw-defs.h (100%)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/MAINTAINERS
-+++ b/target/arm/translate.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ S: Odd Fixes
-             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
+ F: hw/arm/raspi.c
-                            rn_ofs, rm_ofs, vec_size, vec_size,
+ F: hw/arm/raspi_platform.h
-                            (u ? uqadd_op : sqadd_op) + size);
+ F: hw/*/bcm283*
--            break;
+-F: include/hw/arm/raspi*
-+            return 0;
++F: include/hw/arm/rasp*
+ F: include/hw/*/bcm283*
-         case NEON_3R_VQSUB:
+ F: docs/system/arm/raspi.rst
-             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                            rn_ofs, rm_ofs, vec_size, vec_size,
+diff --git a/include/hw/misc/raspberrypi-fw-defs.h b/include/hw/arm/raspberrypi-fw-defs.h
-                            (u ? uqsub_op : sqsub_op) + size);
+similarity index 100%
--            break;
+rename from include/hw/misc/raspberrypi-fw-defs.h
-+            return 0;
+rename to include/hw/arm/raspberrypi-fw-defs.h
+diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
-         case NEON_3R_VMUL: /* VMUL */
+index XXXXXXX..XXXXXXX 100644
-             if (u) {
+--- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/vmstate.h"
  #include "hw/irq.h"
  #include "hw/misc/bcm2835_mbox_defs.h"
 -#include "hw/misc/raspberrypi-fw-defs.h"
 +#include "hw/arm/raspberrypi-fw-defs.h"
  #include "sysemu/dma.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
+[PULL 02/24] hw/arm/exynos4210: Get arm_boot_info declaration from 'hw/arm/boot.h'
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+struct arm_boot_info is declared in "hw/arm/boot.h".
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+By including the correct header we don't need to declare
-Message-id: 20190520214342.13709-5-philmd@redhat.com
+it again in "target/arm/cpu-qom.h".
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20231013130214.95742-1-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/exynos4210.h |  9 +++++++--
+ include/hw/arm/exynos4210.h | 2 +-
- hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
+ target/arm/cpu-qom.h        | 2 --
- hw/arm/exynos4_boards.c     |  9 ++++++---
+files changed, 1 insertion(+), 3 deletions(-)
 files changed, 37 insertions(+), 9 deletions(-)
 diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/exynos4210.h
 +++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
+@@ -XXX,XX +XXX,XX @@
- } Exynos4210Irq;
+ #include "hw/intc/exynos4210_gic.h"
+ #include "hw/intc/exynos4210_combiner.h"
- typedef struct Exynos4210State {
+ #include "hw/core/split-irq.h"
-+    /*< private >*/
+-#include "target/arm/cpu-qom.h"
-+    SysBusDevice parent_obj;
++#include "hw/arm/boot.h"
-+    /*< public >*/
+ #include "qom/object.h"
-     ARMCPU *cpu[EXYNOS4210_NCPUS];
-     Exynos4210Irq irqs;
+ #define EXYNOS4210_NCPUS                    2
-     qemu_irq *irq_table;
+diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
+index XXXXXXX..XXXXXXX 100644
-     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
+--- a/target/arm/cpu-qom.h
- } Exynos4210State;
++++ b/target/arm/cpu-qom.h
+@@ -XXX,XX +XXX,XX @@
-+#define TYPE_EXYNOS4210_SOC "exynos4210"
+ #include "hw/core/cpu.h"
-+#define EXYNOS4210_SOC(obj) \
+ #include "qom/object.h"
-+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
-+
+-struct arm_boot_info;
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
- /* Initialize exynos4210 IRQ subsystem stub */
+ #define TYPE_ARM_CPU "arm-cpu"
- qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
+ OBJECT_DECLARE_CPU_TYPE(ARMCPU, ARMCPUClass, ARM_CPU)
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
      sysbus_connect_irq(busdev, 0, irq);
  }
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 +static void exynos4210_realize(DeviceState *socdev, Error **errp)
  {
 -    Exynos4210State *s = g_new0(Exynos4210State, 1);
 +    Exynos4210State *s = EXYNOS4210_SOC(socdev);
 +    MemoryRegion *system_mem = get_system_memory();
      qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
      SysBusDevice *busdev;
      DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
      pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                   qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = exynos4210_realize;
 +}
 +
 +static const TypeInfo exynos4210_info = {
 +    .name = TYPE_EXYNOS4210_SOC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
 +    type_register_static(&exynos4210_info);
 +}
 +
 +type_init(exynos4210_register_types)
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
  } Exynos4BoardType;
  typedef struct Exynos4BoardState {
 -    Exynos4210State *soc;
 +    Exynos4210State soc;
      MemoryRegion dram0_mem;
      MemoryRegion dram1_mem;
  } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 -    s->soc = exynos4210_init(get_system_memory());
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
 +    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized",
 +                             &error_fatal);
      return s;
  }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                        EXYNOS4_BOARD_SMDKC210);
      lan9215_init(SMDK_LAN9118_BASE_ADDR,
 -            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
 +            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
      arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
  }
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
+[PULL 03/24] xlnx-bbram: hw/nvram: Remove deprecated device reset
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Tong Ho <tong.ho@amd.com>
-It eases code review, unit is explicit.
+This change implements the ResettableClass interface for the device.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Tong Ho <tong.ho@amd.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20190520214342.13709-3-philmd@redhat.com
+Message-id: 20231003052345.199725-1-tong.ho@amd.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4_boards.c | 5 +++--
+ hw/nvram/xlnx-bbram.c | 8 +++++---
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
+--- a/hw/nvram/xlnx-bbram.c
-+++ b/hw/arm/exynos4_boards.c
++++ b/hw/nvram/xlnx-bbram.c
 @@ -XXX,XX +XXX,XX @@
-  */
+  * QEMU model of the Xilinx BBRAM Battery Backed RAM
+  *
- #include "qemu/osdep.h"
+  * Copyright (c) 2014-2021 Xilinx Inc.
-+#include "qemu/units.h"
++ * Copyright (c) 2023 Advanced Micro Devices, Inc.
- #include "qapi/error.h"
+  *
- #include "qemu/error-report.h"
+  * Permission is hereby granted, free of charge, to any person obtaining a copy
- #include "qemu-common.h"
+  * of this software and associated documentation files (the "Software"), to deal
-@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
+@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo bbram_ctrl_regs_info[] = {
      }
  };
- static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
+-static void bbram_ctrl_reset(DeviceState *dev)
--    [EXYNOS4_BOARD_NURI]     = 0x40000000,
++static void bbram_ctrl_reset_hold(Object *obj)
--    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+ {
-+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+-    XlnxBBRam *s = XLNX_BBRAM(dev);
-+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
++    XlnxBBRam *s = XLNX_BBRAM(obj);
- };
+     unsigned int i;
- static struct arm_boot_info exynos4_board_binfo = {
+     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
@@ -XXX,XX +XXX,XX @@ static Property bbram_ctrl_props[] = {
  static void bbram_ctrl_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 -    dc->reset = bbram_ctrl_reset;
 +    rc->phases.hold = bbram_ctrl_reset_hold;
      dc->realize = bbram_ctrl_realize;
      dc->vmsd = &vmstate_bbram_ctrl;
      device_class_set_props(dc, bbram_ctrl_props);
 --
-.20.1
+.34.1

-New patch
+[PULL 04/24] xlnx-zynqmp-efuse: hw/nvram: Remove deprecated device reset
+From: Tong Ho <tong.ho@amd.com>
+This change implements the ResettableClass interface for the device.
+Signed-off-by: Tong Ho <tong.ho@amd.com>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20231004055713.324009-1-tong.ho@amd.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/nvram/xlnx-zynqmp-efuse.c | 8 +++++---
+file changed, 5 insertions(+), 3 deletions(-)
+diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/nvram/xlnx-zynqmp-efuse.c
++++ b/hw/nvram/xlnx-zynqmp-efuse.c
+@@ -XXX,XX +XXX,XX @@
+  * QEMU model of the ZynqMP eFuse
+  *
+  * Copyright (c) 2015 Xilinx Inc.
++ * Copyright (c) 2023 Advanced Micro Devices, Inc.
+  *
+  * Written by Edgar E. Iglesias <edgari@xilinx.com>
+  *
+@@ -XXX,XX +XXX,XX @@ static void zynqmp_efuse_register_reset(RegisterInfo *reg)
+     register_reset(reg);
+ }
+-static void zynqmp_efuse_reset(DeviceState *dev)
++static void zynqmp_efuse_reset_hold(Object *obj)
+ {
+-    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(dev);
++    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
+     unsigned int i;
+     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+@@ -XXX,XX +XXX,XX @@ static Property zynqmp_efuse_props[] = {
+ static void zynqmp_efuse_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
+-    dc->reset = zynqmp_efuse_reset;
++    rc->phases.hold = zynqmp_efuse_reset_hold;
+     dc->realize = zynqmp_efuse_realize;
+     dc->vmsd = &vmstate_efuse;
+     device_class_set_props(dc, zynqmp_efuse_props);
+--
+.34.1

-New patch
+[PULL 05/24] xlnx-versal-efuse: hw/nvram: Remove deprecated device reset
+From: Tong Ho <tong.ho@amd.com>
+This change implements the ResettableClass interface for the device.
+Signed-off-by: Tong Ho <tong.ho@amd.com>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20231004055339.323833-1-tong.ho@amd.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/nvram/xlnx-versal-efuse-ctrl.c | 8 +++++---
+file changed, 5 insertions(+), 3 deletions(-)
+diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
++++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
+@@ -XXX,XX +XXX,XX @@
+  * QEMU model of the Versal eFuse controller
+  *
+  * Copyright (c) 2020 Xilinx Inc.
++ * Copyright (c) 2023 Advanced Micro Devices, Inc.
+  *
+  * Permission is hereby granted, free of charge, to any person obtaining a copy
+  * of this software and associated documentation files (the "Software"), to deal
+@@ -XXX,XX +XXX,XX @@ static void efuse_ctrl_register_reset(RegisterInfo *reg)
+     register_reset(reg);
+ }
+-static void efuse_ctrl_reset(DeviceState *dev)
++static void efuse_ctrl_reset_hold(Object *obj)
+ {
+-    XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(dev);
++    XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
+     unsigned int i;
+     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+@@ -XXX,XX +XXX,XX @@ static Property efuse_ctrl_props[] = {
+ static void efuse_ctrl_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
+-    dc->reset = efuse_ctrl_reset;
++    rc->phases.hold = efuse_ctrl_reset_hold;
+     dc->realize = efuse_ctrl_realize;
+     dc->vmsd = &vmstate_efuse_ctrl;
+     device_class_set_props(dc, efuse_ctrl_props);
+--
+.34.1

-[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
+[PULL 06/24] xlnx-bbram: hw/nvram: Use dot in device type name
-In ich_vmcr_write() we enforce "writes of BPR fields to less than
+From: Tong Ho <tong.ho@amd.com>
 their minimum sets them to the minimum" by doing a "read vbpr and
 write it back" operation.  A typo here meant that we weren't handling
 writes to these fields correctly, because we were reading from VBPR0
 but writing to VBPR1.
+This replaces the comma (,) to dot (.) in the device type name
+so the name can be used with the 'driver=' command line option.
+Signed-off-by: Tong Ho <tong.ho@amd.com>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20231003052139.199665-1-tong.ho@amd.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_cpuif.c | 2 +-
+ include/hw/nvram/xlnx-bbram.h | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/include/hw/nvram/xlnx-bbram.h b/include/hw/nvram/xlnx-bbram.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/include/hw/nvram/xlnx-bbram.h
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/include/hw/nvram/xlnx-bbram.h
-@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@
-     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
-      * by reading and writing back the fields.
+ #define RMAX_XLNX_BBRAM ((0x4c / 4) + 1)
-      */
--    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
+-#define TYPE_XLNX_BBRAM "xlnx,bbram-ctrl"
-+    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
++#define TYPE_XLNX_BBRAM "xlnx.bbram-ctrl"
-     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
+ OBJECT_DECLARE_SIMPLE_TYPE(XlnxBBRam, XLNX_BBRAM);
-     gicv3_cpuif_virt_update(cs);
+ struct XlnxBBRam {
 --
-.20.1
+.34.1

-New patch
+[PULL 07/24] elf2dmp: limit print length for sign_rsds
+From: Viktor Prutyanov <viktor@daynix.com>
+String sign_rsds isn't terminated, so the print length must be limited.
+Fixes: Coverity CID 1521598
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
+Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Message-id: 20230930235317.11469-2-viktor@daynix.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ contrib/elf2dmp/main.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/elf2dmp/main.c
++++ b/contrib/elf2dmp/main.c
+@@ -XXX,XX +XXX,XX @@ static bool pe_check_pdb_name(uint64_t base, void *start_addr,
+     }
+     if (memcmp(&rsds->Signature, sign_rsds, sizeof(sign_rsds))) {
+-        eprintf("CodeView signature is \'%.4s\', \'%s\' expected\n",
++        eprintf("CodeView signature is \'%.4s\', \'%.4s\' expected\n",
+                 rsds->Signature, sign_rsds);
+         return false;
+     }
+--
+.34.1

-[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
+[PULL 08/24] elf2dmp: check array bounds in pdb_get_file_size
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Viktor Prutyanov <viktor@daynix.com>
-The mask implied by the extract is redundant with the one
+Index in file_size array must be checked against num_files, because the
-implied by the deposit.  Also, fix spelling of BFXIL.
+entries we are looking for may be absent in the PDB.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Fixes: Coverity CID 1521597
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
+Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20230930235317.11469-3-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 6 +++---
+ contrib/elf2dmp/pdb.c | 13 +++++++++----
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 9 insertions(+), 4 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/contrib/elf2dmp/pdb.c
-+++ b/target/arm/translate-a64.c
++++ b/contrib/elf2dmp/pdb.c
-@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@
-             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
-             return;
+ static uint32_t pdb_get_file_size(const struct pdb_reader *r, unsigned idx)
-         }
+ {
--        /* opc == 1, BXFIL fall through to deposit */
++    if (idx >= r->ds.toc->num_files) {
--        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
++        return 0;
-+        /* opc == 1, BFXIL fall through to deposit */
++    }
-+        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
++
-         pos = 0;
+     return r->ds.toc->file_size[idx];
-     } else {
+ }
-         /* Handle the ri > si case with a deposit
-@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void *pdb_ds_read_file(struct pdb_reader* r, uint32_t file_number)
-         len = ri;
  static int pdb_init_segments(struct pdb_reader *r)
  {
 -    char *segs;
      unsigned stream_idx = r->segments;
 -    segs = pdb_ds_read_file(r, stream_idx);
 -    if (!segs) {
 +    r->segs = pdb_ds_read_file(r, stream_idx);
 +    if (!r->segs) {
          return 1;
      }
--    if (opc == 1) { /* BFM, BXFIL */
+-    r->segs = segs;
-+    if (opc == 1) { /* BFM, BFXIL */
+     r->segs_size = pdb_get_file_size(r, stream_idx);
-         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
++    if (!r->segs_size) {
-     } else {
++        return 1;
-         /* SBFM or UBFM: We start with zero, and we haven't modified
++    }
      return 0;
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 09/24] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
+From: Michal Orzel <michal.orzel@amd.com>
+On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
+of Xen, a trap from EL2 was observed which is something not reproducible
+on HW (also, Xen does not trap accesses to physical counter).
+This is because gt_counter_access() checks for an incorrect bit (1
+instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
+physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
+When HCR_EL2.E2H is 0:
+ - EL1PCTEN, bit [0]: refers to physical counter
+ - EL1PCEN, bit [1]: refers to physical timer registers
+Drop entire block "if (hcr & HCR_E2H) {...} else {...}" from EL0 case
+and fall through to EL1 case, given that after fixing checking for the
+correct bit, the handling is the same.
+Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
+Signed-off-by: Michal Orzel <michal.orzel@amd.com>
+Tested-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
+Message-id: 20230928094404.20802-1-michal.orzel@amd.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 17 +----------------
+file changed, 1 insertion(+), 16 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
+         if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
+             return CP_ACCESS_TRAP;
+         }
+-
+-        /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */
+-        if (hcr & HCR_E2H) {
+-            if (timeridx == GTIMER_PHYS &&
+-                !extract32(env->cp15.cnthctl_el2, 10, 1)) {
+-                return CP_ACCESS_TRAP_EL2;
+-            }
+-        } else {
+-            /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
+-            if (has_el2 && timeridx == GTIMER_PHYS &&
+-                !extract32(env->cp15.cnthctl_el2, 1, 1)) {
+-                return CP_ACCESS_TRAP_EL2;
+-            }
+-        }
+-        break;
+-
++        /* fall through */
+     case 1:
+         /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
+         if (has_el2 && timeridx == GTIMER_PHYS &&
+--
+.34.1

-[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
+[PULL 10/24] {include/}hw/arm: refactor virt PPI logic
-The header file hw/arm/arm.h now includes only declarations
+From: Leif Lindholm <quic_llindhol@quicinc.com>
 relating to hw/arm/boot.c functionality. Rename it accordingly,
 and adjust its header comment.
-The bulk of this commit was created via
+GIC Private Peripheral Interrupts (PPI) are defined as GIC INTID 16-31.
- perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
+As in, PPI0 is INTID16 .. PPI15 is INTID31.
 Arm's Base System Architecture specification (BSA) lists the mandated and
 recommended private interrupt IDs by INTID, not by PPI index. But current
 definitions in virt define them by PPI index, complicating cross
 referencing.
-In a few cases we can just delete the #include:
+Meanwhile, the PPI(x) macro counterintuitively adds 16 to the input value,
-hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
+converting a PPI index to an INTID.
 include/hw/arm/bcm2836.h did not require it.
+Resolve this by redefining the BSA-allocated PPIs by their INTIDs,
+and replacing the PPI(x) macro with an INTID_TO_PPI(x) one where required.
+Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
+Message-id: 20230919090229.188092-2-quic_llindhol@quicinc.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- include/hw/arm/allwinner-a10.h   | 2 +-
+ include/hw/arm/virt.h    | 14 +++++++-------
- include/hw/arm/aspeed_soc.h      | 1 -
+ hw/arm/virt-acpi-build.c | 12 ++++++------
- include/hw/arm/bcm2836.h         | 1 -
+ hw/arm/virt.c            | 24 ++++++++++++++----------
- include/hw/arm/{arm.h => boot.h} | 8 ++++----
+files changed, 27 insertions(+), 23 deletions(-)
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
-diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
-+++ b/include/hw/arm/allwinner-a10.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
- #include "qemu/error-report.h"
- #include "hw/char/serial.h"
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/timer/allwinner-a10-pit.h"
- #include "hw/intc/allwinner-a10-pic.h"
- #include "hw/net/allwinner_emac.h"
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
-+++ b/include/hw/arm/aspeed_soc.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef ASPEED_SOC_H
- #define ASPEED_SOC_H
--#include "hw/arm/arm.h"
- #include "hw/intc/aspeed_vic.h"
- #include "hw/misc/aspeed_scu.h"
- #include "hw/misc/aspeed_sdmc.h"
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
-+++ b/include/hw/arm/bcm2836.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef BCM2836_H
- #define BCM2836_H
--#include "hw/arm/arm.h"
- #include "hw/arm/bcm2835_peripherals.h"
- #include "hw/intc/bcm2836_control.h"
-diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
-similarity index 98%
-rename from include/hw/arm/arm.h
-rename to include/hw/arm/boot.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/arm.h
-+++ b/include/hw/arm/boot.h
-@@ -XXX,XX +XXX,XX @@
- /*
-- * Misc ARM declarations
-+ * ARM kernel loader.
-  *
-  * Copyright (c) 2006 CodeSourcery.
-  * Written by Paul Brook
-@@ -XXX,XX +XXX,XX @@
-  *
-  */
--#ifndef HW_ARM_H
--#define HW_ARM_H
-+#ifndef HW_ARM_BOOT_H
-+#define HW_ARM_BOOT_H
- #include "exec/memory.h"
- #include "target/arm/cpu-qom.h"
-@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
-                                             const struct arm_boot_info *info,
-                                             hwaddr mvbar_addr);
--#endif /* HW_ARM_H */
-+#endif /* HW_ARM_BOOT_H */
-diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx25.h
-+++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef FSL_IMX25_H
- #define FSL_IMX25_H
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/intc/imx_avic.h"
- #include "hw/misc/imx25_ccm.h"
- #include "hw/char/imx_serial.h"
-diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx31.h
-+++ b/include/hw/arm/fsl-imx31.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef FSL_IMX31_H
- #define FSL_IMX31_H
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/intc/imx_avic.h"
- #include "hw/misc/imx31_ccm.h"
- #include "hw/char/imx_serial.h"
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
-+++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef FSL_IMX6_H
- #define FSL_IMX6_H
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/cpu/a9mpcore.h"
- #include "hw/misc/imx6_ccm.h"
- #include "hw/misc/imx6_src.h"
-diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6ul.h
-+++ b/include/hw/arm/fsl-imx6ul.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef FSL_IMX6UL_H
- #define FSL_IMX6UL_H
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/cpu/a15mpcore.h"
- #include "hw/misc/imx6ul_ccm.h"
- #include "hw/misc/imx6_src.h"
-diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx7.h
-+++ b/include/hw/arm/fsl-imx7.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef FSL_IMX7_H
- #define FSL_IMX7_H
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
- #include "hw/cpu/a15mpcore.h"
- #include "hw/intc/imx_gpcv2.h"
- #include "hw/misc/imx7_ccm.h"
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
 @@ -XXX,XX +XXX,XX @@
- #include "exec/hwaddr.h"
+ #define NUM_VIRTIO_TRANSPORTS 32
- #include "qemu/notify.h"
+ #define NUM_SMMU_IRQS          4
- #include "hw/boards.h"
--#include "hw/arm/arm.h"
+-#define ARCH_GIC_MAINT_IRQ  9
-+#include "hw/arm/boot.h"
++#define ARCH_GIC_MAINT_IRQ  25
- #include "hw/block/flash.h"
- #include "sysemu/kvm.h"
+-#define ARCH_TIMER_VIRT_IRQ   11
- #include "hw/intc/arm_gicv3_common.h"
+-#define ARCH_TIMER_S_EL1_IRQ  13
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+-#define ARCH_TIMER_NS_EL1_IRQ 14
 -#define ARCH_TIMER_NS_EL2_IRQ 10
 +#define ARCH_TIMER_VIRT_IRQ   27
 +#define ARCH_TIMER_S_EL1_IRQ  29
 +#define ARCH_TIMER_NS_EL1_IRQ 30
 +#define ARCH_TIMER_NS_EL2_IRQ 26
 -#define VIRTUAL_PMU_IRQ 7
 +#define VIRTUAL_PMU_IRQ 23
 -#define PPI(irq) ((irq) + 16)
 +#define INTID_TO_PPI(irq) ((irq) - 16)
  /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
  #define PVTIME_SIZE_PER_CPU 64
 diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/hw/arm/virt-acpi-build.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
- #define XLNX_VERSAL_H
+      * The interrupt values are the same with the device tree when adding 16
+      */
- #include "hw/sysbus.h"
+     /* Secure EL1 timer GSIV */
--#include "hw/arm/arm.h"
+-    build_append_int_noprefix(table_data, ARCH_TIMER_S_EL1_IRQ + 16, 4);
-+#include "hw/arm/boot.h"
++    build_append_int_noprefix(table_data, ARCH_TIMER_S_EL1_IRQ, 4);
- #include "hw/intc/arm_gicv3.h"
+     /* Secure EL1 timer Flags */
+     build_append_int_noprefix(table_data, irqflags, 4);
- #define TYPE_XLNX_VERSAL "xlnx-versal"
+     /* Non-Secure EL1 timer GSIV */
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+-    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL1_IRQ + 16, 4);
-index XXXXXXX..XXXXXXX 100644
++    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL1_IRQ, 4);
---- a/include/hw/arm/xlnx-zynqmp.h
+     /* Non-Secure EL1 timer Flags */
-+++ b/include/hw/arm/xlnx-zynqmp.h
+     build_append_int_noprefix(table_data, irqflags |
-@@ -XXX,XX +XXX,XX @@
+UL << 2, /* Always-on Capability */
- #ifndef XLNX_ZYNQMP_H
+);
+     /* Virtual timer GSIV */
- #include "qemu-common.h"
+-    build_append_int_noprefix(table_data, ARCH_TIMER_VIRT_IRQ + 16, 4);
--#include "hw/arm/arm.h"
++    build_append_int_noprefix(table_data, ARCH_TIMER_VIRT_IRQ, 4);
-+#include "hw/arm/boot.h"
+     /* Virtual Timer Flags */
- #include "hw/intc/arm_gic.h"
+     build_append_int_noprefix(table_data, irqflags, 4);
- #include "hw/net/cadence_gem.h"
+     /* Non-Secure EL2 timer GSIV */
- #include "hw/char/cadence_uart.h"
+-    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_IRQ + 16, 4);
-diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
++    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_IRQ, 4);
-index XXXXXXX..XXXXXXX 100644
+     /* Non-Secure EL2 timer Flags */
---- a/hw/arm/armsse.c
+     build_append_int_noprefix(table_data, irqflags, 4);
-+++ b/hw/arm/armsse.c
+     /* CntReadBase Physical address */
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
- #include "hw/sysbus.h"
+     for (i = 0; i < MACHINE(vms)->smp.cpus; i++) {
- #include "hw/registerfields.h"
+         ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
- #include "hw/arm/armsse.h"
+         uint64_t physical_base_address = 0, gich = 0, gicv = 0;
--#include "hw/arm/arm.h"
+-        uint32_t vgic_interrupt = vms->virt ? PPI(ARCH_GIC_MAINT_IRQ) : 0;
-+#include "hw/arm/boot.h"
++        uint32_t vgic_interrupt = vms->virt ? ARCH_GIC_MAINT_IRQ : 0;
+         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
- /* Format of the System Information block SYS_CONFIG register */
+-                                             PPI(VIRTUAL_PMU_IRQ) : 0;
- typedef enum SysConfigFormat {
++                                             VIRTUAL_PMU_IRQ : 0;
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
-index XXXXXXX..XXXXXXX 100644
+         if (vms->gic_version == VIRT_GIC_VERSION_2) {
---- a/hw/arm/armv7m.c
+             physical_base_address = memmap[VIRT_GIC_CPU].base;
 +++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "elf.h"
  #include "sysemu/qtest.h"
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "exec/address-spaces.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/aspeed.h"
  #include "hw/arm/aspeed_soc.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include <libfdt.h>
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/linux-boot-if.h"
  #include "sysemu/kvm.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/collie.c b/hw/arm/collie.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/collie.c
 +++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/boards.h"
  #include "strongarm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "exec/address-spaces.h"
  #include "cpu.h"
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "hw/arm/exynos4210.h"
  #include "hw/sd/sdhci.h"
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
  #include "net/net.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/exynos4210.h"
  #include "hw/net/lan9118.h"
 diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/highbank.c
 +++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/loader.h"
  #include "net/net.h"
  #include "sysemu/kvm.h"
 diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/integratorcp.c
 +++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/misc/arm_integrator_debug.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
 diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mainstone.c
 +++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "hw/net/smc91c111.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/microbit.c
 +++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-soc.c
 +++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/units.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
  #include "exec/address-spaces.h"
  #include "hw/char/serial.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-som.c
 +++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/msf2-soc.h"
  #include "cpu.h"
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armsse.h"
  #include "hw/boards.h"
  #include "hw/char/pl011.h"
 diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musicpal.c
 +++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduino2.c
 +++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "qemu/error-report.h"
  #include "hw/arm/stm32f205_soc.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  static void netduino2_init(MachineState *machine)
  {
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nrf51_soc.c
 +++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
  #include "hw/misc/unimp.h"
 diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nseries.c
 +++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bswap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/omap.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/irq.h"
  #include "ui/console.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap1.c
 +++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/soc_dma.h"
 diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap2.c
 +++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/qtest.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "qemu/timer.h"
 diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap_sx1.c
 +++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "sysemu/qtest.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/palm.c b/hw/arm/palm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/palm.c
 +++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/input/tsc2xxx.h"
  #include "hw/loader.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "hw/boards.h"
  #include "hw/loader.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
 diff --git a/hw/arm/realview.c b/hw/arm/realview.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/realview.c
 +++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/net/smc91c111.h"
 diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/spitz.c
 +++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "hw/pcmcia.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/sysbus.h"
  #include "hw/ssi/ssi.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "qemu/timer.h"
  #include "hw/i2c/i2c.h"
  #include "net/net.h"
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f205_soc.c
 +++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/stm32f205_soc.h"
 diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/strongarm.c
 +++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "strongarm.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "chardev/char-fe.h"
  #include "chardev/char-serial.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/tosa.c
 +++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/sharpsl.h"
  #include "hw/pcmcia.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/versatilepb.c
 +++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/vexpress.c
 +++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
- #include "qemu/option.h"
+     }
- #include "qapi/error.h"
+     qemu_fdt_setprop(ms->fdt, "/timer", "always-on", NULL, 0);
- #include "hw/sysbus.h"
+     qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",
--#include "hw/arm/arm.h"
+-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_S_EL1_IRQ, irqflags,
-+#include "hw/arm/boot.h"
+-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL1_IRQ, irqflags,
- #include "hw/arm/primecell.h"
+-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_VIRT_IRQ, irqflags,
- #include "hw/arm/virt.h"
+-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL2_IRQ, irqflags);
- #include "hw/block/flash.h"
++                           GIC_FDT_IRQ_TYPE_PPI,
-diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
++                           INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,
-index XXXXXXX..XXXXXXX 100644
++                           GIC_FDT_IRQ_TYPE_PPI,
---- a/hw/arm/xilinx_zynq.c
++                           INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,
-+++ b/hw/arm/xilinx_zynq.c
++                           GIC_FDT_IRQ_TYPE_PPI,
-@@ -XXX,XX +XXX,XX @@
++                           INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,
- #include "qemu-common.h"
++                           GIC_FDT_IRQ_TYPE_PPI,
- #include "cpu.h"
++                           INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);
- #include "hw/sysbus.h"
+ }
--#include "hw/arm/arm.h"
-+#include "hw/arm/boot.h"
+ static void fdt_add_cpu_nodes(const VirtMachineState *vms)
- #include "net/net.h"
+@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
- #include "exec/address-spaces.h"
+      */
- #include "sysemu/sysemu.h"
+     for (i = 0; i < smp_cpus; i++) {
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
-index XXXXXXX..XXXXXXX 100644
+-        int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
---- a/hw/arm/xlnx-versal.c
++        int intidbase = NUM_IRQS + i * GIC_INTERNAL;
-+++ b/hw/arm/xlnx-versal.c
+         /* Mapping from the output timer irq lines from the CPU to the
-@@ -XXX,XX +XXX,XX @@
+          * GIC PPI inputs we use for the virt board.
- #include "net/net.h"
+          */
- #include "sysemu/sysemu.h"
+@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
- #include "sysemu/kvm.h"
+         for (unsigned irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
--#include "hw/arm/arm.h"
+             qdev_connect_gpio_out(cpudev, irq,
-+#include "hw/arm/boot.h"
+                                   qdev_get_gpio_in(vms->gic,
- #include "kvm_arm.h"
+-                                                   ppibase + timer_irq[irq]));
- #include "hw/misc/unimp.h"
++                                                   intidbase + timer_irq[irq]));
- #include "hw/intc/arm_gicv3_common.h"
+         }
-diff --git a/hw/arm/z2.c b/hw/arm/z2.c
-index XXXXXXX..XXXXXXX 100644
+         if (vms->gic_version != VIRT_GIC_VERSION_2) {
---- a/hw/arm/z2.c
+             qemu_irq irq = qdev_get_gpio_in(vms->gic,
-+++ b/hw/arm/z2.c
+-                                            ppibase + ARCH_GIC_MAINT_IRQ);
-@@ -XXX,XX +XXX,XX @@
++                                            intidbase + ARCH_GIC_MAINT_IRQ);
- #include "qemu/osdep.h"
+             qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
- #include "hw/hw.h"
+, irq);
- #include "hw/arm/pxa.h"
+         } else if (vms->virt) {
--#include "hw/arm/arm.h"
+             qemu_irq irq = qdev_get_gpio_in(vms->gic,
-+#include "hw/arm/boot.h"
+-                                            ppibase + ARCH_GIC_MAINT_IRQ);
- #include "hw/i2c/i2c.h"
++                                            intidbase + ARCH_GIC_MAINT_IRQ);
- #include "hw/ssi/ssi.h"
+             sysbus_connect_irq(gicbusdev, i + 4 * smp_cpus, irq);
- #include "hw/boards.h"
+         }
          qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
 -                                    qdev_get_gpio_in(vms->gic, ppibase
 +                                    qdev_get_gpio_in(vms->gic, intidbase
                                                       + VIRTUAL_PMU_IRQ));
          sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms, MemoryRegion *sysmem)
              if (pmu) {
                  assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
                  if (kvm_irqchip_in_kernel()) {
 -                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
 +                    kvm_arm_pmu_set_irq(cpu, VIRTUAL_PMU_IRQ);
                  }
                  kvm_arm_pmu_init(cpu);
              }
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
+[PULL 11/24] include/hw/arm: move BSA definitions to bsa.h
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Leif Lindholm <quic_llindhol@quicinc.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+virt.h defines a number of IRQs that are ultimately described by Arm's
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Base System Architecture specification. Move these to a dedicated header
-Message-id: 20190520214342.13709-2-philmd@redhat.com
+so that they can be reused by other platforms that do the same.
 Include that header from virt.h to minimise churn.
 While we're moving the definitions, sort them into numerical order,
 and add the ARCH_TIMER_NS_EL2_VIRT_IRQ definition used by sbsa-ref
 and which will eventually be needed by virt also.
 Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
 Message-id: 20230919090229.188092-3-quic_llindhol@quicinc.com
 [PMM: Remove unused PPI_TO_INTID macro; sort numerically;
  add ARCH_TIMER_NS_EL2_VIRT_IRQ]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4_boards.c | 24 ------------------------
+ include/hw/arm/bsa.h  | 35 +++++++++++++++++++++++++++++++++++
-file changed, 24 deletions(-)
+ include/hw/arm/virt.h | 12 +-----------
 files changed, 36 insertions(+), 11 deletions(-)
  create mode 100644 include/hw/arm/bsa.h
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+diff --git a/include/hw/arm/bsa.h b/include/hw/arm/bsa.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/bsa.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Common definitions for Arm Base System Architecture (BSA) platforms.
 + *
 + * Copyright (c) 2015 Linaro Limited
 + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms and conditions of the GNU General Public License,
 + * version 2 or later, as published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
 + * more details.
 + *
 + * You should have received a copy of the GNU General Public License along with
 + * this program.  If not, see <http://www.gnu.org/licenses/>.
 + *
 + */
 +
 +#ifndef QEMU_ARM_BSA_H
 +#define QEMU_ARM_BSA_H
 +
 +/* These are architectural INTID values */
 +#define VIRTUAL_PMU_IRQ            23
 +#define ARCH_GIC_MAINT_IRQ         25
 +#define ARCH_TIMER_NS_EL2_IRQ      26
 +#define ARCH_TIMER_VIRT_IRQ        27
 +#define ARCH_TIMER_NS_EL2_VIRT_IRQ 28
 +#define ARCH_TIMER_S_EL1_IRQ       29
 +#define ARCH_TIMER_NS_EL1_IRQ      30
 +
 +#define INTID_TO_PPI(irq) ((irq) - 16)
 +
 +#endif /* QEMU_ARM_BSA_H */
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
+--- a/include/hw/arm/virt.h
-+++ b/hw/arm/exynos4_boards.c
++++ b/include/hw/arm/virt.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/net/lan9118.h"
+ #include "qemu/notify.h"
  #include "hw/boards.h"
+ #include "hw/arm/boot.h"
--#undef DEBUG
++#include "hw/arm/bsa.h"
  #include "hw/block/flash.h"
  #include "sysemu/kvm.h"
  #include "hw/intc/arm_gicv3_common.h"
@@ -XXX,XX +XXX,XX @@
  #define NUM_VIRTIO_TRANSPORTS 32
  #define NUM_SMMU_IRQS          4
 -#define ARCH_GIC_MAINT_IRQ  25
 -
--//#define DEBUG
+-#define ARCH_TIMER_VIRT_IRQ   27
 -#define ARCH_TIMER_S_EL1_IRQ  29
 -#define ARCH_TIMER_NS_EL1_IRQ 30
 -#define ARCH_TIMER_NS_EL2_IRQ 26
 -
--#ifdef DEBUG
+-#define VIRTUAL_PMU_IRQ 23
 -    #undef PRINT_DEBUG
 -    #define  PRINT_DEBUG(fmt, args...) \
 -        do { \
 -            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
 -        } while (0)
 -#else
 -    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
 -#endif
 -
- #define SMDK_LAN9118_BASE_ADDR      0x05000000
+-#define INTID_TO_PPI(irq) ((irq) - 16)
  typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_board_binfo.gic_cpu_if_addr =
              EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 -    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
 -            " kernel_filename: %s\n"
 -            " kernel_cmdline: %s\n"
 -            " initrd_filename: %s\n",
 -            exynos4_board_ram_size[board_type] / 1048576,
 -            exynos4_board_ram_size[board_type],
 -            machine->kernel_filename,
 -            machine->kernel_cmdline,
 -            machine->initrd_filename);
 -
-     exynos4_boards_init_ram(s, get_system_memory(),
+ /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
-                             exynos4_board_ram_size[board_type]);
+ #define PVTIME_SIZE_PER_CPU 64
 --
-.20.1
+.34.1

-New patch
+[PULL 12/24] hw/arm/sbsa-ref: use bsa.h for PPI definitions
+From: Leif Lindholm <quic_llindhol@quicinc.com>
+Use the private peripheral interrupt definitions from bsa.h instead of
+defining them locally. Refactor to use the INTIDs defined there instead
+of the PPI# used previously.
+Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
+Message-id: 20230919090229.188092-4-quic_llindhol@quicinc.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/sbsa-ref.c | 21 +++++++++------------
+file changed, 9 insertions(+), 12 deletions(-)
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/sbsa-ref.c
++++ b/hw/arm/sbsa-ref.c
+@@ -XXX,XX +XXX,XX @@
+  * ARM SBSA Reference Platform emulation
+  *
+  * Copyright (c) 2018 Linaro Limited
++ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+  * Written by Hongbo Zhang <hongbo.zhang@linaro.org>
+  *
+  * This program is free software; you can redistribute it and/or modify it
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "kvm_arm.h"
+ #include "hw/arm/boot.h"
++#include "hw/arm/bsa.h"
+ #include "hw/arm/fdt.h"
+ #include "hw/arm/smmuv3.h"
+ #include "hw/block/flash.h"
+@@ -XXX,XX +XXX,XX @@
+ #define NUM_SMMU_IRQS   4
+ #define NUM_SATA_PORTS  6
+-#define VIRTUAL_PMU_IRQ        7
+-#define ARCH_GIC_MAINT_IRQ     9
+-#define ARCH_TIMER_VIRT_IRQ    11
+-#define ARCH_TIMER_S_EL1_IRQ   13
+-#define ARCH_TIMER_NS_EL1_IRQ  14
+-#define ARCH_TIMER_NS_EL2_IRQ  10
+-#define ARCH_TIMER_NS_EL2_VIRT_IRQ  12
+-
+ enum {
+     SBSA_FLASH,
+     SBSA_MEM,
+@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
+      */
+     for (i = 0; i < smp_cpus; i++) {
+         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
+-        int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
++        int intidbase = NUM_IRQS + i * GIC_INTERNAL;
+         int irq;
+         /*
+          * Mapping from the output timer irq lines from the CPU to the
+@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
+         for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
+             qdev_connect_gpio_out(cpudev, irq,
+                                   qdev_get_gpio_in(sms->gic,
+-                                                   ppibase + timer_irq[irq]));
++                                                   intidbase + timer_irq[irq]));
+         }
+         qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt", 0,
+-                                    qdev_get_gpio_in(sms->gic, ppibase
++                                    qdev_get_gpio_in(sms->gic,
++                                                     intidbase
+                                                      + ARCH_GIC_MAINT_IRQ));
++
+         qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
+-                                    qdev_get_gpio_in(sms->gic, ppibase
++                                    qdev_get_gpio_in(sms->gic,
++                                                     intidbase
+                                                      + VIRTUAL_PMU_IRQ));
+         sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
+--
+.34.1

-New patch
+[PULL 13/24] arm/kvm: convert to kvm_set_one_reg
+From: Cornelia Huck <cohuck@redhat.com>
 We can neaten the code by switching to the kvm_set_one_reg function.
 Reviewed-by: Gavin Shan <gshan@redhat.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20231010142453.224369-2-cohuck@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/kvm.c   | 13 +++------
  target/arm/kvm64.c | 66 +++++++++++++---------------------------------
 files changed, 21 insertions(+), 58 deletions(-)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
      bool ok = true;
      for (i = 0; i < cpu->cpreg_array_len; i++) {
 -        struct kvm_one_reg r;
          uint64_t regidx = cpu->cpreg_indexes[i];
          uint32_t v32;
          int ret;
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
              continue;
          }
 -        r.id = regidx;
          switch (regidx & KVM_REG_SIZE_MASK) {
          case KVM_REG_SIZE_U32:
              v32 = cpu->cpreg_values[i];
 -            r.addr = (uintptr_t)&v32;
 +            ret = kvm_set_one_reg(cs, regidx, &v32);
              break;
          case KVM_REG_SIZE_U64:
 -            r.addr = (uintptr_t)(cpu->cpreg_values + i);
 +            ret = kvm_set_one_reg(cs, regidx, cpu->cpreg_values + i);
              break;
          default:
              g_assert_not_reached();
          }
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
          if (ret) {
              /* We might fail for "unknown register" and also for
               * "you tried to set a register which is constant with
@@ -XXX,XX +XXX,XX @@ void kvm_arm_get_virtual_time(CPUState *cs)
  void kvm_arm_put_virtual_time(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
 -    struct kvm_one_reg reg = {
 -        .id = KVM_REG_ARM_TIMER_CNT,
 -        .addr = (uintptr_t)&cpu->kvm_vtime,
 -    };
      int ret;
      if (!cpu->kvm_vtime_dirty) {
          return;
      }
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
      if (ret) {
          error_report("Failed to set KVM_REG_ARM_TIMER_CNT");
          abort();
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static int kvm_arm_sve_set_vls(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
      uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
 -    struct kvm_one_reg reg = {
 -        .id = KVM_REG_ARM64_SVE_VLS,
 -        .addr = (uint64_t)&vls[0],
 -    };
      assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
 -    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    return kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_VLS, &vls[0]);
  }
  #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
  static int kvm_arch_put_fpsimd(CPUState *cs)
  {
      CPUARMState *env = &ARM_CPU(cs)->env;
 -    struct kvm_one_reg reg;
      int i, ret;
      for (i = 0; i < 32; i++) {
          uint64_t *q = aa64_vfp_qreg(env, i);
  #if HOST_BIG_ENDIAN
          uint64_t fp_val[2] = { q[1], q[0] };
 -        reg.addr = (uintptr_t)fp_val;
 +        ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]),
 +                                                        fp_val);
  #else
 -        reg.addr = (uintptr_t)q;
 +        ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
  #endif
 -        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
      CPUARMState *env = &cpu->env;
      uint64_t tmp[ARM_MAX_VQ * 2];
      uint64_t *r;
 -    struct kvm_one_reg reg;
      int n, ret;
      for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
          r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
 -        reg.addr = (uintptr_t)r;
 -        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
      for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
          r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
                          DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 -        reg.addr = (uintptr_t)r;
 -        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
      r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
                      DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 -    reg.addr = (uintptr_t)r;
 -    reg.id = KVM_REG_ARM64_SVE_FFR(0);
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
  int kvm_arch_put_registers(CPUState *cs, int level)
  {
 -    struct kvm_one_reg reg;
      uint64_t val;
      uint32_t fpr;
      int i, ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      }
      for (i = 0; i < 31; i++) {
 -        reg.id = AARCH64_CORE_REG(regs.regs[i]);
 -        reg.addr = (uintptr_t) &env->xregs[i];
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
 +                              &env->xregs[i]);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
       */
      aarch64_save_sp(env, 1);
 -    reg.id = AARCH64_CORE_REG(regs.sp);
 -    reg.addr = (uintptr_t) &env->sp_el[0];
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
      if (ret) {
          return ret;
      }
 -    reg.id = AARCH64_CORE_REG(sp_el1);
 -    reg.addr = (uintptr_t) &env->sp_el[1];
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      } else {
          val = cpsr_read(env);
      }
 -    reg.id = AARCH64_CORE_REG(regs.pstate);
 -    reg.addr = (uintptr_t) &val;
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
      if (ret) {
          return ret;
      }
 -    reg.id = AARCH64_CORE_REG(regs.pc);
 -    reg.addr = (uintptr_t) &env->pc;
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
      if (ret) {
          return ret;
      }
 -    reg.id = AARCH64_CORE_REG(elr_el1);
 -    reg.addr = (uintptr_t) &env->elr_el[1];
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      /* KVM 0-4 map to QEMU banks 1-5 */
      for (i = 0; i < KVM_NR_SPSR; i++) {
 -        reg.id = AARCH64_CORE_REG(spsr[i]);
 -        reg.addr = (uintptr_t) &env->banked_spsr[i + 1];
 -        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
 +                              &env->banked_spsr[i + 1]);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          return ret;
      }
 -    reg.addr = (uintptr_t)(&fpr);
      fpr = vfp_get_fpsr(env);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
      if (ret) {
          return ret;
      }
 -    reg.addr = (uintptr_t)(&fpr);
      fpr = vfp_get_fpcr(env);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
      if (ret) {
          return ret;
      }
 --
 .34.1

-New patch
+[PULL 14/24] arm/kvm: convert to kvm_get_one_reg
+From: Cornelia Huck <cohuck@redhat.com>
 We can neaten the code by switching the callers that work on a
 CPUstate to the kvm_get_one_reg function.
 Reviewed-by: Gavin Shan <gshan@redhat.com>
 Signed-off-by: Cornelia Huck <cohuck@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20231010142453.224369-3-cohuck@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/kvm.c   | 15 +++---------
  target/arm/kvm64.c | 57 ++++++++++++----------------------------------
 files changed, 18 insertions(+), 54 deletions(-)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool write_kvmstate_to_list(ARMCPU *cpu)
      bool ok = true;
      for (i = 0; i < cpu->cpreg_array_len; i++) {
 -        struct kvm_one_reg r;
          uint64_t regidx = cpu->cpreg_indexes[i];
          uint32_t v32;
          int ret;
 -        r.id = regidx;
 -
          switch (regidx & KVM_REG_SIZE_MASK) {
          case KVM_REG_SIZE_U32:
 -            r.addr = (uintptr_t)&v32;
 -            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
 +            ret = kvm_get_one_reg(cs, regidx, &v32);
              if (!ret) {
                  cpu->cpreg_values[i] = v32;
              }
              break;
          case KVM_REG_SIZE_U64:
 -            r.addr = (uintptr_t)(cpu->cpreg_values + i);
 -            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
 +            ret = kvm_get_one_reg(cs, regidx, cpu->cpreg_values + i);
              break;
          default:
              g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
  void kvm_arm_get_virtual_time(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
 -    struct kvm_one_reg reg = {
 -        .id = KVM_REG_ARM_TIMER_CNT,
 -        .addr = (uintptr_t)&cpu->kvm_vtime,
 -    };
      int ret;
      if (cpu->kvm_vtime_dirty) {
          return;
      }
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
      if (ret) {
          error_report("Failed to get KVM_REG_ARM_TIMER_CNT");
          abort();
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
  static int kvm_arch_get_fpsimd(CPUState *cs)
  {
      CPUARMState *env = &ARM_CPU(cs)->env;
 -    struct kvm_one_reg reg;
      int i, ret;
      for (i = 0; i < 32; i++) {
          uint64_t *q = aa64_vfp_qreg(env, i);
 -        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        reg.addr = (uintptr_t)q;
 -        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        ret = kvm_get_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
          if (ret) {
              return ret;
          } else {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
 -    struct kvm_one_reg reg;
      uint64_t *r;
      int n, ret;
      for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
          r = &env->vfp.zregs[n].d[0];
 -        reg.addr = (uintptr_t)r;
 -        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
 -        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
      for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
          r = &env->vfp.pregs[n].p[0];
 -        reg.addr = (uintptr_t)r;
 -        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
 -        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
      }
      r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
 -    reg.addr = (uintptr_t)r;
 -    reg.id = KVM_REG_ARM64_SVE_FFR(0);
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
  int kvm_arch_get_registers(CPUState *cs)
  {
 -    struct kvm_one_reg reg;
      uint64_t val;
      unsigned int el;
      uint32_t fpr;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      CPUARMState *env = &cpu->env;
      for (i = 0; i < 31; i++) {
 -        reg.id = AARCH64_CORE_REG(regs.regs[i]);
 -        reg.addr = (uintptr_t) &env->xregs[i];
 -        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
 +                              &env->xregs[i]);
          if (ret) {
              return ret;
          }
      }
 -    reg.id = AARCH64_CORE_REG(regs.sp);
 -    reg.addr = (uintptr_t) &env->sp_el[0];
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
      if (ret) {
          return ret;
      }
 -    reg.id = AARCH64_CORE_REG(sp_el1);
 -    reg.addr = (uintptr_t) &env->sp_el[1];
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
      if (ret) {
          return ret;
      }
 -    reg.id = AARCH64_CORE_REG(regs.pstate);
 -    reg.addr = (uintptr_t) &val;
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
       */
      aarch64_restore_sp(env, 1);
 -    reg.id = AARCH64_CORE_REG(regs.pc);
 -    reg.addr = (uintptr_t) &env->pc;
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          aarch64_sync_64_to_32(env);
      }
 -    reg.id = AARCH64_CORE_REG(elr_el1);
 -    reg.addr = (uintptr_t) &env->elr_el[1];
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
       * KVM SPSRs 0-4 map to QEMU banks 1-5
       */
      for (i = 0; i < KVM_NR_SPSR; i++) {
 -        reg.id = AARCH64_CORE_REG(spsr[i]);
 -        reg.addr = (uintptr_t) &env->banked_spsr[i + 1];
 -        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
 +                              &env->banked_spsr[i + 1]);
          if (ret) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          return ret;
      }
 -    reg.addr = (uintptr_t)(&fpr);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
      if (ret) {
          return ret;
      }
      vfp_set_fpsr(env, fpr);
 -    reg.addr = (uintptr_t)(&fpr);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
      if (ret) {
          return ret;
      }
 --
 .34.1

-[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
+[PULL 15/24] target/arm: Permit T32 LDM with single register
-The system_clock_scale global is used only by the armv7m systick
+For the Thumb T32 encoding of LDM, if only a single register is
-device; move the extern declaration to the armv7m_systick.h header,
+specified in the register list this instruction is UNPREDICTABLE,
-and expand the comment to explain what it is and that it should
+with the following choices:
-ideally be replaced with a different approach.
+ * instruction UNDEFs
  * instruction is a NOP
  * instruction loads a single register
  * instruction loads an unspecified set of registers
+Currently we choose to UNDEF (a behaviour chosen in commit
+b222545dbf30 in 2019; previously we treated it as "load the
+specified single register").
+Unfortunately there is real world code out there (which shipped in at
+least Android 11, 12 and 13) which incorrectly uses this
+UNPREDICTABLE insn on the assumption that it does a single register
+load, which is (presumably) what it happens to do on real hardware,
+and is also what it does on the equivalent A32 encoding.
+Revert to the pre-4b222545dbf30 behaviour of not UNDEFing
+for this T32 encoding.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1799
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
+Message-id: 20230927101853.39288-1-peter.maydell@linaro.org
 ---
- include/hw/arm/arm.h              |  4 ----
+ target/arm/tcg/translate.c | 37 +++++++++++++++++++++++--------------
- include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
+file changed, 23 insertions(+), 14 deletions(-)
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
+diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/arm.h
+--- a/target/arm/tcg/translate.c
-+++ b/include/hw/arm/arm.h
++++ b/target/arm/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static void op_addr_block_post(DisasContext *s, arg_ldst_block *a,
-                                             const struct arm_boot_info *info,
+     }
-                                             hwaddr mvbar_addr);
+ }
--/* Multiplication factor to convert from system clock ticks to qemu timer
+-static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
--   ticks.  */
++static bool op_stm(DisasContext *s, arg_ldst_block *a)
--extern int system_clock_scale;
+ {
--
+     int i, j, n, list, mem_idx;
- #endif /* HW_ARM_H */
+     bool user = a->u;
-diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
+@@ -XXX,XX +XXX,XX @@ static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/timer/armv7m_systick.h
+     list = a->list;
-+++ b/include/hw/timer/armv7m_systick.h
+     n = ctpop16(list);
-@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
+-    if (n < min_n || a->rn == 15) {
-     qemu_irq irq;
++    /*
- } SysTickState;
++     * This is UNPREDICTABLE for n < 1 in all encodings, and we choose
++     * to UNDEF. In the T32 STM encoding n == 1 is also UNPREDICTABLE,
-+/*
++     * but hardware treats it like the A32 version and implements the
-+ * Multiplication factor to convert from system clock ticks to qemu timer
++     * single-register-store, and some in-the-wild (buggy) software
-+ * ticks. This should be set (by board code, usually) to a value
++     * assumes that, so we don't UNDEF on that case.
-+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
++     */
-+ * in Hz of the CPU.
++    if (n < 1 || a->rn == 15) {
-+ *
+         unallocated_encoding(s);
-+ * This value is used by the systick device when it is running in
+         return true;
-+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+     }
-+ * set how fast the timer should tick.
+@@ -XXX,XX +XXX,XX @@ static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
-+ *
-+ * TODO: we should refactor this so that rather than using a global
+ static bool trans_STM(DisasContext *s, arg_ldst_block *a)
-+ * we use a device property or something similar. This is complicated
+ {
-+ * because (a) the property would need to be plumbed through from the
+-    /* BitCount(list) < 1 is UNPREDICTABLE */
-+ * board code down through various layers to the systick device
+-    return op_stm(s, a, 1);
-+ * and (b) the property needs to be modifiable after realize, because
++    return op_stm(s, a);
-+ * the stellaris board uses this to implement the behaviour where the
+ }
-+ * guest can reprogram the PLL registers to downclock the CPU, and the
-+ * systick device needs to react accordingly. Possibly this should
+ static bool trans_STM_t32(DisasContext *s, arg_ldst_block *a)
-+ * be deferred until we have a good API for modelling clock trees.
+@@ -XXX,XX +XXX,XX @@ static bool trans_STM_t32(DisasContext *s, arg_ldst_block *a)
-+ */
+         unallocated_encoding(s);
-+extern int system_clock_scale;
+         return true;
-+
+     }
- #endif
+-    /* BitCount(list) < 2 is UNPREDICTABLE */
 -    return op_stm(s, a, 2);
 +    return op_stm(s, a);
  }
 -static bool do_ldm(DisasContext *s, arg_ldst_block *a, int min_n)
 +static bool do_ldm(DisasContext *s, arg_ldst_block *a)
  {
      int i, j, n, list, mem_idx;
      bool loaded_base;
@@ -XXX,XX +XXX,XX @@ static bool do_ldm(DisasContext *s, arg_ldst_block *a, int min_n)
      list = a->list;
      n = ctpop16(list);
 -    if (n < min_n || a->rn == 15) {
 +    /*
 +     * This is UNPREDICTABLE for n < 1 in all encodings, and we choose
 +     * to UNDEF. In the T32 LDM encoding n == 1 is also UNPREDICTABLE,
 +     * but hardware treats it like the A32 version and implements the
 +     * single-register-load, and some in-the-wild (buggy) software
 +     * assumes that, so we don't UNDEF on that case.
 +     */
 +    if (n < 1 || a->rn == 15) {
          unallocated_encoding(s);
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_a32(DisasContext *s, arg_ldst_block *a)
          unallocated_encoding(s);
          return true;
      }
 -    /* BitCount(list) < 1 is UNPREDICTABLE */
 -    return do_ldm(s, a, 1);
 +    return do_ldm(s, a);
  }
  static bool trans_LDM_t32(DisasContext *s, arg_ldst_block *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_t32(DisasContext *s, arg_ldst_block *a)
          unallocated_encoding(s);
          return true;
      }
 -    /* BitCount(list) < 2 is UNPREDICTABLE */
 -    return do_ldm(s, a, 2);
 +    return do_ldm(s, a);
  }
  static bool trans_LDM_t16(DisasContext *s, arg_ldst_block *a)
  {
      /* Writeback is conditional on the base register not being loaded.  */
      a->w = !(a->list & (1 << a->rn));
 -    /* BitCount(list) < 1 is UNPREDICTABLE */
 -    return do_ldm(s, a, 1);
 +    return do_ldm(s, a);
  }
  static bool trans_CLRM(DisasContext *s, arg_CLRM *a)
 --
-.20.1
+.34.1

-New patch
+[PULL 16/24] hw/arm/smmuv3: Update ID register bit field definitions
+Update the SMMUv3 ID register bit field definitions to the
+set in the most recent specification (IHI0700 F.a).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20230914145705.1648377-2-peter.maydell@linaro.org
+---
+ hw/arm/smmuv3-internal.h | 38 ++++++++++++++++++++++++++++++++++++++
+file changed, 38 insertions(+)
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/smmuv3-internal.h
++++ b/hw/arm/smmuv3-internal.h
+@@ -XXX,XX +XXX,XX @@ REG32(IDR0,                0x0)
+     FIELD(IDR0, S1P,         1 , 1)
+     FIELD(IDR0, TTF,         2 , 2)
+     FIELD(IDR0, COHACC,      4 , 1)
++    FIELD(IDR0, BTM,         5 , 1)
++    FIELD(IDR0, HTTU,        6 , 2)
++    FIELD(IDR0, DORMHINT,    8 , 1)
++    FIELD(IDR0, HYP,         9 , 1)
++    FIELD(IDR0, ATS,         10, 1)
++    FIELD(IDR0, NS1ATS,      11, 1)
+     FIELD(IDR0, ASID16,      12, 1)
++    FIELD(IDR0, MSI,         13, 1)
++    FIELD(IDR0, SEV,         14, 1)
++    FIELD(IDR0, ATOS,        15, 1)
++    FIELD(IDR0, PRI,         16, 1)
++    FIELD(IDR0, VMW,         17, 1)
+     FIELD(IDR0, VMID16,      18, 1)
++    FIELD(IDR0, CD2L,        19, 1)
++    FIELD(IDR0, VATOS,       20, 1)
+     FIELD(IDR0, TTENDIAN,    21, 2)
++    FIELD(IDR0, ATSRECERR,   23, 1)
+     FIELD(IDR0, STALL_MODEL, 24, 2)
+     FIELD(IDR0, TERM_MODEL,  26, 1)
+     FIELD(IDR0, STLEVEL,     27, 2)
++    FIELD(IDR0, RME_IMPL,    30, 1)
+ REG32(IDR1,                0x4)
+     FIELD(IDR1, SIDSIZE,      0 , 6)
++    FIELD(IDR1, SSIDSIZE,     6 , 5)
++    FIELD(IDR1, PRIQS,        11, 5)
+     FIELD(IDR1, EVENTQS,      16, 5)
+     FIELD(IDR1, CMDQS,        21, 5)
++    FIELD(IDR1, ATTR_PERMS_OVR, 26, 1)
++    FIELD(IDR1, ATTR_TYPES_OVR, 27, 1)
++    FIELD(IDR1, REL,          28, 1)
++    FIELD(IDR1, QUEUES_PRESET, 29, 1)
++    FIELD(IDR1, TABLES_PRESET, 30, 1)
++    FIELD(IDR1, ECMDQ,        31, 1)
+ #define SMMU_IDR1_SIDSIZE 16
+ #define SMMU_CMDQS   19
+ #define SMMU_EVENTQS 19
+ REG32(IDR2,                0x8)
++     FIELD(IDR2, BA_VATOS, 0, 10)
++
+ REG32(IDR3,                0xc)
+      FIELD(IDR3, HAD,         2, 1);
++     FIELD(IDR3, PBHA,        3, 1);
++     FIELD(IDR3, XNX,         4, 1);
++     FIELD(IDR3, PPS,         5, 1);
++     FIELD(IDR3, MPAM,        7, 1);
++     FIELD(IDR3, FWB,         8, 1);
++     FIELD(IDR3, STT,         9, 1);
+      FIELD(IDR3, RIL,        10, 1);
+      FIELD(IDR3, BBML,       11, 2);
++     FIELD(IDR3, E0PD,       13, 1);
++     FIELD(IDR3, PTWNNC,     14, 1);
++     FIELD(IDR3, DPT,        15, 1);
++
+ REG32(IDR4,                0x10)
++
+ REG32(IDR5,                0x14)
+      FIELD(IDR5, OAS,         0, 3);
+      FIELD(IDR5, GRAN4K,      4, 1);
+      FIELD(IDR5, GRAN16K,     5, 1);
+      FIELD(IDR5, GRAN64K,     6, 1);
++     FIELD(IDR5, VAX,        10, 2);
++     FIELD(IDR5, STALL_MAX,  16, 16);
+ #define SMMU_IDR5_OAS 4
+--
+.34.1

-[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
+[PULL 17/24] hw/arm/smmuv3: Sort ID register setting into field order
-The ICC_CTLR_EL3 register includes some bits which are aliases
+In smmuv3_init_regs() when we set the various bits in the ID
-of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
+registers, we do this almost in order of the fields in the
-to keep those bits in the cs->icc_ctlr_el1[] struct fields.
+registers, but not quite. Move the initialization of
-Unfortunately a missing '~' in the code to update the bits
+SMMU_IDR3.RIL and SMMU_IDR5.OAS into their correct places.
 in those fields meant that writing to ICC_CTLR_EL3 would corrupt
 the ICC_CLTR_EL1 register values.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20230914145705.1648377-3-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_cpuif.c | 4 ++--
+ hw/arm/smmuv3.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/hw/arm/smmuv3.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
-     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
+     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
+     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
-     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
--    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+-    s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
-+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
-     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
++    s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
-         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
+     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
-     }
-@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
++    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
-         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
+     /* 4K, 16K and 64K granule support */
-     }
+     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
+     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1);
--    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
-+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+-    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
-     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
-         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
+     s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
-     }
+     s->cmdq.prod = 0;
 --
-.20.1
+.34.1

-New patch
+[PULL 18/24] hw/arm/smmuv3: Advertise SMMUv3.1-XNX feature
+The SMMUv3.1-XNX feature is mandatory for an SMMUv3.1 if S2P is
+supported, so we should theoretically have implemented it as part of
+the recent S2P work.  Fortunately, for us the implementation is a
+no-op.
+This feature is about interpretation of the stage 2 page table
+descriptor XN bits, which control execute permissions.
+For QEMU, the permission bits passed to an IOMMU (via MemTxAttrs and
+IOMMUAccessFlags) only indicate read and write; we do not distinguish
+data reads from instruction reads outside the CPU proper.  In the
+SMMU architecture's terms, our interconnect between the client device
+and the SMMU doesn't have the ability to convey the INST attribute,
+and we therefore use the default value of "data" for this attribute.
+We also do not support the bits in the Stream Table Entry that can
+override the on-the-bus transaction attribute permissions (we do not
+set SMMU_IDR1.ATTR_PERMS_OVR=1).
+These two things together mean that for our implementation, it never
+has to deal with transactions with the INST attribute, and so it can
+correctly ignore the XN bits entirely.  So we already implement
+FEAT_XNX's "XN field is now 2 bits, not 1" behaviour to the extent
+that we need to.
+Advertise the presence of the feature in SMMU_IDR3.XNX.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20230914145705.1648377-4-peter.maydell@linaro.org
+---
+ hw/arm/smmuv3.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
+     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
+     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
++    if (FIELD_EX32(s->idr[0], IDR0, S2P)) {
++        /* XNX is a stage-2-specific feature */
++        s->idr[3] = FIELD_DP32(s->idr[3], IDR3, XNX, 1);
++    }
+     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
+     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
+--
+.34.1

-New patch
+[PULL 19/24] target/arm: Implement FEAT_HPMN0
+FEAT_HPMN0 is a small feature which defines that it is valid for
+MDCR_EL2.HPMN to be set to 0, meaning "no PMU event counters provided
+to an EL1 guest" (previously this setting was reserved). QEMU's
+implementation almost gets HPMN == 0 right, but we need to fix
+one check in pmevcntr_is_64_bit(). That is enough for us to
+advertise the feature in the 'max' CPU.
+(We don't need to make the behaviour conditional on feature
+presence, because the FEAT_HPMN0 behaviour is within the range
+of permitted UNPREDICTABLE behaviour for a non-FEAT_HPMN0
+implementation.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230921185445.3339214-1-peter.maydell@linaro.org
+---
+ docs/system/arm/emulation.rst | 1 +
+ target/arm/helper.c           | 2 +-
+ target/arm/tcg/cpu32.c        | 4 ++++
+ target/arm/tcg/cpu64.c        | 1 +
+files changed, 7 insertions(+), 1 deletion(-)
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/emulation.rst
++++ b/docs/system/arm/emulation.rst
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ - FEAT_HCX (Support for the HCRX_EL2 register)
+ - FEAT_HPDS (Hierarchical permission disables)
+ - FEAT_HPDS2 (Translation table page-based hardware attributes)
++- FEAT_HPMN0 (Setting of MDCR_EL2.HPMN to zero)
+ - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
+ - FEAT_IDST (ID space trap handling)
+ - FEAT_IESB (Implicit error synchronization event)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static bool pmevcntr_is_64_bit(CPUARMState *env, int counter)
+         bool hlp = env->cp15.mdcr_el2 & MDCR_HLP;
+         int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
+-        if (hpmn != 0 && counter >= hpmn) {
++        if (counter >= hpmn) {
+             return hlp;
+         }
+     }
+diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/cpu32.c
++++ b/target/arm/tcg/cpu32.c
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
+     t = FIELD_DP32(t, ID_DFR0, COPSDBG, 9);       /* FEAT_Debugv8p4 */
+     t = FIELD_DP32(t, ID_DFR0, PERFMON, 6);       /* FEAT_PMUv3p5 */
+     cpu->isar.id_dfr0 = t;
++
++    t = cpu->isar.id_dfr1;
++    t = FIELD_DP32(t, ID_DFR1, HPMN0, 1);         /* FEAT_HPMN0 */
++    cpu->isar.id_dfr1 = t;
+ }
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/cpu64.c
++++ b/target/arm/tcg/cpu64.c
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
+     t = cpu->isar.id_aa64dfr0;
+     t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 9);  /* FEAT_Debugv8p4 */
+     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 6);    /* FEAT_PMUv3p5 */
++    t = FIELD_DP64(t, ID_AA64DFR0, HPMN0, 1);     /* FEAT_HPMN0 */
+     cpu->isar.id_aa64dfr0 = t;
+     t = cpu->isar.id_aa64smfr0;
+--
+.34.1

-[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
+[PULL 20/24] target/arm/kvm64.c: Remove unused include
-The hw/arm/arm.h header now only includes declarations relating
+The include of hw/arm/virt.h in kvm64.c is unnecessary and also a
-to boot.c code, so it is only needed by Arm board or SoC code.
+layering violation since the generic KVM code shouldn't need to know
-Remove some unnecessary inclusions of it from target/arm files
+anything about board-specifics.  The include line is an accidental
-and from hw/intc/armv7m_nvic.c.
+leftover from commit 15613357ba53a4763, where we cleaned up the code
 to not depend on virt board internals but forgot to also remove the
 now-redundant include line.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Gavin Shan <gshan@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
+Message-id: 20230925110429.3917202-1-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 1 -
+ target/arm/kvm64.c | 1 -
- target/arm/arm-semi.c | 1 -
+file changed, 1 deletion(-)
  target/arm/cpu.c      | 1 -
  target/arm/cpu64.c    | 1 -
  target/arm/kvm.c      | 1 -
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@
- #include "cpu.h"
- #include "hw/sysbus.h"
- #include "qemu/timer.h"
--#include "hw/arm/arm.h"
- #include "hw/intc/armv7m_nvic.h"
- #include "target/arm/cpu.h"
- #include "exec/exec-all.h"
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@
- #else
- #include "qemu-common.h"
- #include "exec/gdbstub.h"
--#include "hw/arm/arm.h"
- #include "qemu/cutils.h"
- #endif
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #if !defined(CONFIG_USER_ONLY)
- #include "hw/loader.h"
- #endif
--#include "hw/arm/arm.h"
- #include "sysemu/sysemu.h"
- #include "sysemu/hw_accel.h"
- #include "kvm_arm.h"
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@
- #if !defined(CONFIG_USER_ONLY)
- #include "hw/loader.h"
- #endif
--#include "hw/arm/arm.h"
- #include "sysemu/sysemu.h"
- #include "sysemu/kvm.h"
- #include "kvm_arm.h"
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
-+++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@
- #include "cpu.h"
- #include "trace.h"
- #include "internals.h"
--#include "hw/arm/arm.h"
- #include "hw/pci/pci.h"
- #include "exec/memattrs.h"
- #include "exec/address-spaces.h"
-diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm32.c
-+++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/kvm.h"
- #include "kvm_arm.h"
- #include "internals.h"
--#include "hw/arm/arm.h"
- #include "qemu/log.h"
- static inline void set_feature(uint64_t *features, int feature)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/kvm.h"
- #include "kvm_arm.h"
  #include "internals.h"
--#include "hw/arm/arm.h"
+ #include "hw/acpi/acpi.h"
  #include "hw/acpi/ghes.h"
 -#include "hw/arm/virt.h"
  static bool have_guest_debug;
 --
-.20.1
+.34.1

-New patch
+[PULL 21/24] target/arm/common-semi-target.h: Remove unnecessary boot.h include
+The hw/arm/boot.h include in common-semi-target.h is not actually
+needed, and it's a bit odd because it pulls a hw/arm header into a
+target/arm file.
+This include was originally needed because the semihosting code used
+the arm_boot_info struct to get the base address of the RAM in system
+emulation, to use in a (bad) heuristic for the return values for the
+SYS_HEAPINFO semihosting call.  We've since overhauled how we
+calculate the HEAPINFO values in system emulation, and the code no
+longer uses the arm_boot_info struct.
+Remove the now-redundant include line, and instead directly include
+the cpu-qom.h header that we were previously getting via boot.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230925112219.3919261-1-peter.maydell@linaro.org
+---
+ target/arm/common-semi-target.h | 4 +---
+file changed, 1 insertion(+), 3 deletions(-)
+diff --git a/target/arm/common-semi-target.h b/target/arm/common-semi-target.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/common-semi-target.h
++++ b/target/arm/common-semi-target.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef TARGET_ARM_COMMON_SEMI_TARGET_H
+ #define TARGET_ARM_COMMON_SEMI_TARGET_H
+-#ifndef CONFIG_USER_ONLY
+-#include "hw/arm/boot.h"
+-#endif
++#include "target/arm/cpu-qom.h"
+ static inline target_ulong common_semi_arg(CPUState *cs, int argno)
+ {
+--
+.34.1

-New patch
+[PULL 22/24] target/arm/arm-powerctl: Correctly init CPUs when powered on to lower EL
+The code for powering on a CPU in arm-powerctl.c has two separate
 use cases:
  * emulation of a real hardware power controller
  * emulation of firmware interfaces (primarily PSCI) with
    CPU on/off APIs
 For the first case, we only need to reset the CPU and set its
 starting PC and X0.  For the second case, because we're emulating the
 firmware we need to ensure that it's in the state that the firmware
 provides.  In particular, when we reset to a lower EL than the
 highest one we are emulating, we need to put the CPU into a state
 that permits correct running at that lower EL.  We already do a
 little of this in arm-powerctl.c (for instance we set SCR_HCE to
 enable the HVC insn) but we don't do enough of it.  This means that
 in the case where we are emulating EL3 but also providing emulated
 PSCI the guest will crash when a secondary core tries to use a
 feature that needs an SCR_EL3 bit to be set, such as MTE or PAuth.
 The hw/arm/boot.c code also has to support this "start guest code in
 an EL that's lower than the highest emulated EL" case in order to do
 direct guest kernel booting; it has all the necessary initialization
 code to set the SCR_EL3 bits.  Pull the relevant boot.c code out into
 a separate function so we can share it between there and
 arm-powerctl.c.
 This refactoring has a few code changes that look like they
 might be behaviour changes but aren't:
  * if info->secure_boot is false and info->secure_board_setup is
    true, then the old code would start the first CPU in Hyp
    mode but without changing SCR.NS and NSACR.{CP11,CP10}.
    This was wrong behaviour because there's no such thing
    as Secure Hyp mode. The new code will leave the CPU in SVC.
    (There is no board which sets secure_boot to false and
    secure_board_setup to true, so this isn't a behaviour
    change for any of our boards.)
  * we don't explicitly clear SCR.NS when arm-powerctl.c
    does a CPU-on to EL3. This was a no-op because CPU reset
    will reset to NS == 0.
 And some real behaviour changes:
  * we no longer set HCR_EL2.RW when booting into EL2: the guest
    can and should do that themselves before dropping into their
    EL1 code. (arm-powerctl and boot did this differently; I
    opted to use the logic from arm-powerctl, which only sets
    HCR_EL2.RW when it's directly starting the guest in EL1,
    because it's more correct, and I don't expect guests to be
    accidentally depending on our having set the RW bit for them.)
  * if we are booting a CPU into AArch32 Secure SVC then we won't
    set SCR.HCE any more. This affects only the vexpress-a15 and
    raspi2b machine types. Guests booting in this case will either:
     - be able to set SCR.HCE themselves as part of moving from
       Secure SVC into NS Hyp mode
     - will move from Secure SVC to NS SVC, and won't care about
       behaviour of the HVC insn
     - will stay in Secure SVC, and won't care about HVC
  * on an arm-powerctl CPU-on we will now set the SCR bits for
    pauth/mte/sve/sme/hcx/fgt features
 The first two of these are very minor and I don't expect guest
 code to trip over them, so I didn't judge it worth convoluting
 the code in an attempt to keep exactly the same boot.c behaviour.
 The third change fixes issue 1899.
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1899
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230926155619.4028618-1-peter.maydell@linaro.org
 ---
  target/arm/cpu.h          | 22 +++++++++
  hw/arm/boot.c             | 95 ++++++++++-----------------------------
  target/arm/arm-powerctl.c | 53 +---------------------
  target/arm/cpu.c          | 95 +++++++++++++++++++++++++++++++++++++++
 files changed, 141 insertions(+), 124 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
  int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
                               int cpuid, DumpState *s);
 +/**
 + * arm_emulate_firmware_reset: Emulate firmware CPU reset handling
 + * @cpu: CPU (which must have been freshly reset)
 + * @target_el: exception level to put the CPU into
 + * @secure: whether to put the CPU in secure state
 + *
 + * When QEMU is directly running a guest kernel at a lower level than
 + * EL3 it implicitly emulates some aspects of the guest firmware.
 + * This includes that on reset we need to configure the parts of the
 + * CPU corresponding to EL3 so that the real guest code can run at its
 + * lower exception level. This function does that post-reset CPU setup,
 + * for when we do direct boot of a guest kernel, and for when we
 + * emulate PSCI and similar firmware interfaces starting a CPU at a
 + * lower exception level.
 + *
 + * @target_el must be an EL implemented by the CPU between 1 and 3.
 + * We do not support dropping into a Secure EL other than 3.
 + *
 + * It is the responsibility of the caller to call arm_rebuild_hflags().
 + */
 +void arm_emulate_firmware_reset(CPUState *cpustate, int target_el);
 +
  #ifdef TARGET_AARCH64
  int aarch64_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
              cpu_set_pc(cs, entry);
          } else {
 -            /* If we are booting Linux then we need to check whether we are
 -             * booting into secure or non-secure state and adjust the state
 -             * accordingly.  Out of reset, ARM is defined to be in secure state
 -             * (SCR.NS = 0), we change that here if non-secure boot has been
 -             * requested.
 +            /*
 +             * If we are booting Linux then we might need to do so at:
 +             *  - AArch64 NS EL2 or NS EL1
 +             *  - AArch32 Secure SVC (EL3)
 +             *  - AArch32 NS Hyp (EL2)
 +             *  - AArch32 NS SVC (EL1)
 +             * Configure the CPU in the way boot firmware would do to
 +             * drop us down to the appropriate level.
               */
 -            if (arm_feature(env, ARM_FEATURE_EL3)) {
 -                /* AArch64 is defined to come out of reset into EL3 if enabled.
 -                 * If we are booting Linux then we need to adjust our EL as
 -                 * Linux expects us to be in EL2 or EL1.  AArch32 resets into
 -                 * SVC, which Linux expects, so no privilege/exception level to
 -                 * adjust.
 -                 */
 -                if (env->aarch64) {
 -                    env->cp15.scr_el3 |= SCR_RW;
 -                    if (arm_feature(env, ARM_FEATURE_EL2)) {
 -                        env->cp15.hcr_el2 |= HCR_RW;
 -                        env->pstate = PSTATE_MODE_EL2h;
 -                    } else {
 -                        env->pstate = PSTATE_MODE_EL1h;
 -                    }
 -                    if (cpu_isar_feature(aa64_pauth, cpu)) {
 -                        env->cp15.scr_el3 |= SCR_API | SCR_APK;
 -                    }
 -                    if (cpu_isar_feature(aa64_mte, cpu)) {
 -                        env->cp15.scr_el3 |= SCR_ATA;
 -                    }
 -                    if (cpu_isar_feature(aa64_sve, cpu)) {
 -                        env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
 -                        env->vfp.zcr_el[3] = 0xf;
 -                    }
 -                    if (cpu_isar_feature(aa64_sme, cpu)) {
 -                        env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
 -                        env->cp15.scr_el3 |= SCR_ENTP2;
 -                        env->vfp.smcr_el[3] = 0xf;
 -                    }
 -                    if (cpu_isar_feature(aa64_hcx, cpu)) {
 -                        env->cp15.scr_el3 |= SCR_HXEN;
 -                    }
 -                    if (cpu_isar_feature(aa64_fgt, cpu)) {
 -                        env->cp15.scr_el3 |= SCR_FGTEN;
 -                    }
 +            int target_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
 -                    /* AArch64 kernels never boot in secure mode */
 -                    assert(!info->secure_boot);
 -                    /* This hook is only supported for AArch32 currently:
 -                     * bootloader_aarch64[] will not call the hook, and
 -                     * the code above has already dropped us into EL2 or EL1.
 -                     */
 -                    assert(!info->secure_board_setup);
 -                }
 -
 -                if (arm_feature(env, ARM_FEATURE_EL2)) {
 -                    /* If we have EL2 then Linux expects the HVC insn to work */
 -                    env->cp15.scr_el3 |= SCR_HCE;
 -                }
 -
 -                /* Set to non-secure if not a secure boot */
 -                if (!info->secure_boot &&
 -                    (cs != first_cpu || !info->secure_board_setup)) {
 -                    /* Linux expects non-secure state */
 -                    env->cp15.scr_el3 |= SCR_NS;
 -                    /* Set NSACR.{CP11,CP10} so NS can access the FPU */
 -                    env->cp15.nsacr |= 3 << 10;
 -                }
 -            }
 -
 -            if (!env->aarch64 && !info->secure_boot &&
 -                arm_feature(env, ARM_FEATURE_EL2)) {
 +            if (env->aarch64) {
                  /*
 -                 * This is an AArch32 boot not to Secure state, and
 -                 * we have Hyp mode available, so boot the kernel into
 -                 * Hyp mode. This is not how the CPU comes out of reset,
 -                 * so we need to manually put it there.
 +                 * AArch64 kernels never boot in secure mode, and we don't
 +                 * support the secure_board_setup hook for AArch64.
                   */
 -                cpsr_write(env, ARM_CPU_MODE_HYP, CPSR_M, CPSRWriteRaw);
 +                assert(!info->secure_boot);
 +                assert(!info->secure_board_setup);
 +            } else {
 +                if (arm_feature(env, ARM_FEATURE_EL3) &&
 +                    (info->secure_boot ||
 +                     (info->secure_board_setup && cs == first_cpu))) {
 +                    /* Start this CPU in Secure SVC */
 +                    target_el = 3;
 +                }
              }
 +            arm_emulate_firmware_reset(cs, target_el);
 +
              if (cs == first_cpu) {
                  AddressSpace *as = arm_boot_address_space(cpu, info);
 diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-powerctl.c
 +++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
      /* Initialize the cpu we are turning on */
      cpu_reset(target_cpu_state);
 +    arm_emulate_firmware_reset(target_cpu_state, info->target_el);
      target_cpu_state->halted = 0;
 -    if (info->target_aa64) {
 -        if ((info->target_el < 3) && arm_feature(&target_cpu->env,
 -                                                 ARM_FEATURE_EL3)) {
 -            /*
 -             * As target mode is AArch64, we need to set lower
 -             * exception level (the requested level 2) to AArch64
 -             */
 -            target_cpu->env.cp15.scr_el3 |= SCR_RW;
 -        }
 -
 -        if ((info->target_el < 2) && arm_feature(&target_cpu->env,
 -                                                 ARM_FEATURE_EL2)) {
 -            /*
 -             * As target mode is AArch64, we need to set lower
 -             * exception level (the requested level 1) to AArch64
 -             */
 -            target_cpu->env.cp15.hcr_el2 |= HCR_RW;
 -        }
 -
 -        target_cpu->env.pstate = aarch64_pstate_mode(info->target_el, true);
 -    } else {
 -        /* We are requested to boot in AArch32 mode */
 -        static const uint32_t mode_for_el[] = { 0,
 -                                                ARM_CPU_MODE_SVC,
 -                                                ARM_CPU_MODE_HYP,
 -                                                ARM_CPU_MODE_SVC };
 -
 -        cpsr_write(&target_cpu->env, mode_for_el[info->target_el], CPSR_M,
 -                   CPSRWriteRaw);
 -    }
 -
 -    if (info->target_el == 3) {
 -        /* Processor is in secure mode */
 -        target_cpu->env.cp15.scr_el3 &= ~SCR_NS;
 -    } else {
 -        /* Processor is not in secure mode */
 -        target_cpu->env.cp15.scr_el3 |= SCR_NS;
 -
 -        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
 -        target_cpu->env.cp15.nsacr |= 3 << 10;
 -
 -        /*
 -         * If QEMU is providing the equivalent of EL3 firmware, then we need
 -         * to make sure a CPU targeting EL2 comes out of reset with a
 -         * functional HVC insn.
 -         */
 -        if (arm_feature(&target_cpu->env, ARM_FEATURE_EL3)
 -            && info->target_el == 2) {
 -            target_cpu->env.cp15.scr_el3 |= SCR_HCE;
 -        }
 -    }
 -
      /* We check if the started CPU is now at the correct level */
      assert(info->target_el == arm_current_el(&target_cpu->env));
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
      }
  }
 +void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
 +{
 +    ARMCPU *cpu = ARM_CPU(cpustate);
 +    CPUARMState *env = &cpu->env;
 +    bool have_el3 = arm_feature(env, ARM_FEATURE_EL3);
 +    bool have_el2 = arm_feature(env, ARM_FEATURE_EL2);
 +
 +    /*
 +     * Check we have the EL we're aiming for. If that is the
 +     * highest implemented EL, then cpu_reset has already done
 +     * all the work.
 +     */
 +    switch (target_el) {
 +    case 3:
 +        assert(have_el3);
 +        return;
 +    case 2:
 +        assert(have_el2);
 +        if (!have_el3) {
 +            return;
 +        }
 +        break;
 +    case 1:
 +        if (!have_el3 && !have_el2) {
 +            return;
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    if (have_el3) {
 +        /*
 +         * Set the EL3 state so code can run at EL2. This should match
 +         * the requirements set by Linux in its booting spec.
 +         */
 +        if (env->aarch64) {
 +            env->cp15.scr_el3 |= SCR_RW;
 +            if (cpu_isar_feature(aa64_pauth, cpu)) {
 +                env->cp15.scr_el3 |= SCR_API | SCR_APK;
 +            }
 +            if (cpu_isar_feature(aa64_mte, cpu)) {
 +                env->cp15.scr_el3 |= SCR_ATA;
 +            }
 +            if (cpu_isar_feature(aa64_sve, cpu)) {
 +                env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
 +                env->vfp.zcr_el[3] = 0xf;
 +            }
 +            if (cpu_isar_feature(aa64_sme, cpu)) {
 +                env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
 +                env->cp15.scr_el3 |= SCR_ENTP2;
 +                env->vfp.smcr_el[3] = 0xf;
 +            }
 +            if (cpu_isar_feature(aa64_hcx, cpu)) {
 +                env->cp15.scr_el3 |= SCR_HXEN;
 +            }
 +            if (cpu_isar_feature(aa64_fgt, cpu)) {
 +                env->cp15.scr_el3 |= SCR_FGTEN;
 +            }
 +        }
 +
 +        if (target_el == 2) {
 +            /* If the guest is at EL2 then Linux expects the HVC insn to work */
 +            env->cp15.scr_el3 |= SCR_HCE;
 +        }
 +
 +        /* Put CPU into non-secure state */
 +        env->cp15.scr_el3 |= SCR_NS;
 +        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
 +        env->cp15.nsacr |= 3 << 10;
 +    }
 +
 +    if (have_el2 && target_el < 2) {
 +        /* Set EL2 state so code can run at EL1. */
 +        if (env->aarch64) {
 +            env->cp15.hcr_el2 |= HCR_RW;
 +        }
 +    }
 +
 +    /* Set the CPU to the desired state */
 +    if (env->aarch64) {
 +        env->pstate = aarch64_pstate_mode(target_el, true);
 +    } else {
 +        static const uint32_t mode_for_el[] = {
 +            0,
 +            ARM_CPU_MODE_SVC,
 +            ARM_CPU_MODE_HYP,
 +            ARM_CPU_MODE_SVC,
 +        };
 +
 +        cpsr_write(env, mode_for_el[target_el], CPSR_M, CPSRWriteRaw);
 +    }
 +}
 +
 +
  #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
  static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
 --
 .34.1

-[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
+[PULL 23/24] hw/timer/npcm7xx_timer: Prevent timer from counting down past zero
-From: Guenter Roeck <linux@roeck-us.net>
+From: Chris Rauer <crauer@google.com>
-QEMU already supports pl330. Instantiate it for Exynos4210.
+The counter register is only 24-bits and counts down.  If the timer is
 running but the qtimer to reset it hasn't fired off yet, there is a chance
 the regster read can return an invalid result.
-Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
+Signed-off-by: Chris Rauer <crauer@google.com>
+Message-id: 20230922181411.2697135-1-crauer@google.com
 / {
     soc: soc {
         amba {
             pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
+ hw/timer/npcm7xx_timer.c | 3 +++
-file changed, 26 insertions(+)
+file changed, 3 insertions(+)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/hw/timer/npcm7xx_timer.c
-+++ b/hw/arm/exynos4210.c
++++ b/hw/timer/npcm7xx_timer.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int64_t npcm7xx_timer_count_to_ns(NPCM7xxTimer *t, uint32_t count)
- /* EHCI */
+ /* Convert a time interval in nanoseconds to a timer cycle count. */
- #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
+ static uint32_t npcm7xx_timer_ns_to_count(NPCM7xxTimer *t, int64_t ns)
 +/* DMA */
 +#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
 +#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
 +#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
 +
  static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
 +static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
 +{
 +    SysBusDevice *busdev;
 +    DeviceState *dev;
 +
 +    dev = qdev_create(NULL, "pl330");
 +    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
 +    qdev_init_nofail(dev);
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, base);
 +    sysbus_connect_irq(busdev, 0, irq);
 +}
 +
  Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
  {
-     Exynos4210State *s = g_new0(Exynos4210State, 1);
++    if (ns < 0) {
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
++        return 0;
-     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
++    }
-             s->irq_table[exynos4210_get_irq(28, 3)]);
+     return clock_ns_to_ticks(t->ctrl->clock, ns) /
+         npcm7xx_tcsr_prescaler(t->tcsr);
 +    /*** DMA controllers ***/
 +    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
 +    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
 +                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
 +
      return s;
  }
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
+[PULL 24/24] contrib/elf2dmp: Use g_malloc(), g_new() and g_free()
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Suraj Shirvankar <surajshirvankar@gmail.com>
-This is, after all, how we implement extract2 in tcg/aarch64.
+QEMU coding style uses the glib memory allocation APIs, not
 the raw libc malloc/free. Switch the allocation and free
 calls in elf2dmp to use these functions (dropping the now-unneeded
 checks for failure).
+Signed-off-by: Suraj Shirvankar <surajshirvankar@gmail.com>
+Message-id: 169753938460.23804.11418813007617535750-1@git.sr.ht
+[PMM: also remove NULL checks from g_malloc() calls;
+ beef up commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
+ contrib/elf2dmp/addrspace.c |  7 ++-----
-file changed, 20 insertions(+), 18 deletions(-)
+ contrib/elf2dmp/main.c      |  9 +++------
  contrib/elf2dmp/pdb.c       | 19 ++++++++-----------
  contrib/elf2dmp/qemu_elf.c  |  7 ++-----
 files changed, 15 insertions(+), 27 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/contrib/elf2dmp/addrspace.c
-+++ b/target/arm/translate-a64.c
++++ b/contrib/elf2dmp/addrspace.c
-@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
              } else {
                  tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
              }
 -        } else if (rm == rn) { /* ROR */
 -            tcg_rm = cpu_reg(s, rm);
 -            if (sf) {
 -                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
 -            } else {
 -                TCGv_i32 tmp = tcg_temp_new_i32();
 -                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
 -                tcg_gen_rotri_i32(tmp, tmp, imm);
 -                tcg_gen_extu_i32_i64(tcg_rd, tmp);
 -                tcg_temp_free_i32(tmp);
 -            }
          } else {
 -            tcg_rm = read_cpu_reg(s, rm, sf);
 -            tcg_rn = read_cpu_reg(s, rn, sf);
 -            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
 -            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
 -            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
 -            if (!sf) {
 -                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
 +            tcg_rm = cpu_reg(s, rm);
 +            tcg_rn = cpu_reg(s, rn);
 +
 +            if (sf) {
 +                /* Specialization to ROR happens in EXTRACT2.  */
 +                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
 +            } else {
 +                TCGv_i32 t0 = tcg_temp_new_i32();
 +
 +                tcg_gen_extrl_i64_i32(t0, tcg_rm);
 +                if (rm == rn) {
 +                    tcg_gen_rotri_i32(t0, t0, imm);
 +                } else {
 +                    TCGv_i32 t1 = tcg_temp_new_i32();
 +                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
 +                    tcg_gen_extract2_i32(t0, t0, t1, imm);
 +                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
+-    ps->block = malloc(sizeof(*ps->block) * ps->block_nr);
+-    if (!ps->block) {
+-        return 1;
+-    }
++    ps->block = g_new(struct pa_block, ps->block_nr);
+     for (i = 0; i < phdr_nr; i++) {
+         if (phdr[i].p_type == PT_LOAD) {
+@@ -XXX,XX +XXX,XX @@ int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
+ void pa_space_destroy(struct pa_space *ps)
+ {
+     ps->block_nr = 0;
+-    free(ps->block);
++    g_free(ps->block);
+ }
+ void va_space_set_dtb(struct va_space *vs, uint64_t dtb)
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/elf2dmp/main.c
++++ b/contrib/elf2dmp/main.c
+@@ -XXX,XX +XXX,XX @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
+         }
+     }
+-    kdbg = malloc(kdbg_hdr.Size);
+-    if (!kdbg) {
+-        return NULL;
+-    }
++    kdbg = g_malloc(kdbg_hdr.Size);
+     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
+         eprintf("Failed to extract entire KDBG\n");
+-        free(kdbg);
++        g_free(kdbg);
+         return NULL;
+     }
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+     }
+ out_kdbg:
+-    free(kdbg);
++    g_free(kdbg);
+ out_pdb:
+     pdb_exit(&pdb);
+ out_pdb_file:
+diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/elf2dmp/pdb.c
++++ b/contrib/elf2dmp/pdb.c
+@@ -XXX,XX +XXX,XX @@ uint64_t pdb_resolve(uint64_t img_base, struct pdb_reader *r, const char *name)
+ static void pdb_reader_ds_exit(struct pdb_reader *r)
+ {
+-    free(r->ds.toc);
++    g_free(r->ds.toc);
+ }
+ static void pdb_exit_symbols(struct pdb_reader *r)
+ {
+-    free(r->modimage);
+-    free(r->symbols);
++    g_free(r->modimage);
++    g_free(r->symbols);
+ }
+ static void pdb_exit_segments(struct pdb_reader *r)
+ {
+-    free(r->segs);
++    g_free(r->segs);
+ }
+ static void *pdb_ds_read(const PDB_DS_HEADER *header,
+@@ -XXX,XX +XXX,XX @@ static void *pdb_ds_read(const PDB_DS_HEADER *header,
+     nBlocks = (size + header->block_size - 1) / header->block_size;
+-    buffer = malloc(nBlocks * header->block_size);
+-    if (!buffer) {
+-        return NULL;
+-    }
++    buffer = g_malloc(nBlocks * header->block_size);
+     for (i = 0; i < nBlocks; i++) {
+         memcpy(buffer + i * header->block_size, (const char *)header +
+@@ -XXX,XX +XXX,XX @@ static int pdb_init_symbols(struct pdb_reader *r)
+     return 0;
+ out_symbols:
+-    free(symbols);
++    g_free(symbols);
+     return err;
+ }
+@@ -XXX,XX +XXX,XX @@ static int pdb_reader_init(struct pdb_reader *r, void *data)
+ out_sym:
+     pdb_exit_symbols(r);
+ out_root:
+-    free(r->ds.root);
++    g_free(r->ds.root);
+ out_ds:
+     pdb_reader_ds_exit(r);
+@@ -XXX,XX +XXX,XX @@ static void pdb_reader_exit(struct pdb_reader *r)
+ {
+     pdb_exit_segments(r);
+     pdb_exit_symbols(r);
+-    free(r->ds.root);
++    g_free(r->ds.root);
+     pdb_reader_ds_exit(r);
+ }
+diff --git a/contrib/elf2dmp/qemu_elf.c b/contrib/elf2dmp/qemu_elf.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/elf2dmp/qemu_elf.c
++++ b/contrib/elf2dmp/qemu_elf.c
+@@ -XXX,XX +XXX,XX @@ static int init_states(QEMU_Elf *qe)
+     printf("%zu CPU states has been found\n", cpu_nr);
+-    qe->state = malloc(sizeof(*qe->state) * cpu_nr);
+-    if (!qe->state) {
+-        return 1;
+-    }
++    qe->state = g_new(QEMUCPUState*, cpu_nr);
+     cpu_nr = 0;
+@@ -XXX,XX +XXX,XX @@ static int init_states(QEMU_Elf *qe)
+ static void exit_states(QEMU_Elf *qe)
+ {
+-    free(qe->state);
++    g_free(qe->state);
+ }
+ static bool check_ehdr(QEMU_Elf *qe)
 --
-.20.1
+.34.1

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1

Hi; here's a queue of arm patches (plus a few elf2dmp changes);
mostly these are minor cleanups and bugfixes.

thanks
-- PMM

The following changes since commit deaca3fd30d3a8829160f8d3705d65ad83176800:

Merge tag 'pull-vfio-20231018' of https://github.com/legoater/qemu into staging (2023-10-18 06:21:15 -0400)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20231019

for you to fetch changes up to 2a052b4ee01b3c413cef2ef49cb780cde17d4ba1:

contrib/elf2dmp: Use g_malloc(), g_new() and g_free() (2023-10-19 14:32:13 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Move raspberrypi-fw-defs.h to the include/hw/arm/ folder
 * hw/arm/exynos4210: Get arm_boot_info declaration from 'hw/arm/boot'
 * xlnx devices: remove deprecated device reset
 * xlnx-bbram: hw/nvram: Use dot in device type name
 * elf2dmp: fix coverity issues
 * elf2dmp: convert to g_malloc, g_new and g_free
 * target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
 * hw/arm: refactor virt PPI logic
 * arm/kvm: convert to kvm_set_one_reg, kvm_get_one_reg
 * target/arm: Permit T32 LDM with single register
 * smmuv3: Advertise SMMUv3.1-XNX
 * target/arm: Implement FEAT_HPMN0
 * Remove some unnecessary include lines
 * target/arm/arm-powerctl: Correctly init CPUs when powered on to lower EL
 * hw/timer/npcm7xx_timer: Prevent timer from counting down past zero

----------------------------------------------------------------
Chris Rauer (1):
      hw/timer/npcm7xx_timer: Prevent timer from counting down past zero

Cornelia Huck (2):
      arm/kvm: convert to kvm_set_one_reg
      arm/kvm: convert to kvm_get_one_reg

Leif Lindholm (3):
      {include/}hw/arm: refactor virt PPI logic
      include/hw/arm: move BSA definitions to bsa.h
      hw/arm/sbsa-ref: use bsa.h for PPI definitions

Michal Orzel (1):
      target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

Peter Maydell (8):
      target/arm: Permit T32 LDM with single register
      hw/arm/smmuv3: Update ID register bit field definitions
      hw/arm/smmuv3: Sort ID register setting into field order
      hw/arm/smmuv3: Advertise SMMUv3.1-XNX feature
      target/arm: Implement FEAT_HPMN0
      target/arm/kvm64.c: Remove unused include
      target/arm/common-semi-target.h: Remove unnecessary boot.h include
      target/arm/arm-powerctl: Correctly init CPUs when powered on to lower EL

Philippe Mathieu-Daudé (1):
      hw/arm/exynos4210: Get arm_boot_info declaration from 'hw/arm/boot.h'

Suraj Shirvankar (1):
      contrib/elf2dmp: Use g_malloc(), g_new() and g_free()

Thomas Huth (1):
      hw/arm: Move raspberrypi-fw-defs.h to the include/hw/arm/ folder

Tong Ho (4):
      xlnx-bbram: hw/nvram: Remove deprecated device reset
      xlnx-zynqmp-efuse: hw/nvram: Remove deprecated device reset
      xlnx-versal-efuse: hw/nvram: Remove deprecated device reset
      xlnx-bbram: hw/nvram: Use dot in device type name

Viktor Prutyanov (2):
      elf2dmp: limit print length for sign_rsds
      elf2dmp: check array bounds in pdb_get_file_size

MAINTAINERS                                    |   2 +-
 docs/system/arm/emulation.rst                  |   1 +
 hw/arm/smmuv3-internal.h                       |  38 ++++++++
 include/hw/arm/bsa.h                           |  35 +++++++
 include/hw/arm/exynos4210.h                    |   2 +-
 include/hw/{misc => arm}/raspberrypi-fw-defs.h |   0
 include/hw/arm/virt.h                          |  12 +--
 include/hw/nvram/xlnx-bbram.h                  |   2 +-
 target/arm/common-semi-target.h                |   4 +-
 target/arm/cpu-qom.h                           |   2 -
 target/arm/cpu.h                               |  22 +++++
 contrib/elf2dmp/addrspace.c                    |   7 +-
 contrib/elf2dmp/main.c                         |  11 +--
 contrib/elf2dmp/pdb.c                          |  32 ++++---
 contrib/elf2dmp/qemu_elf.c                     |   7 +-
 hw/arm/boot.c                                  |  95 +++++--------------
 hw/arm/sbsa-ref.c                              |  21 ++---
 hw/arm/smmuv3.c                                |   8 +-
 hw/arm/virt-acpi-build.c                       |  12 +--
 hw/arm/virt.c                                  |  24 +++--
 hw/misc/bcm2835_property.c                     |   2 +-
 hw/nvram/xlnx-bbram.c                          |   8 +-
 hw/nvram/xlnx-versal-efuse-ctrl.c              |   8 +-
 hw/nvram/xlnx-zynqmp-efuse.c                   |   8 +-
 hw/timer/npcm7xx_timer.c                       |   3 +
 target/arm/arm-powerctl.c                      |  53 +----------
 target/arm/cpu.c                               |  95 +++++++++++++++++++
 target/arm/helper.c                            |  19 +---
 target/arm/kvm.c                               |  28 ++----
 target/arm/kvm64.c                             | 124 +++++++------------------
 target/arm/tcg/cpu32.c                         |   4 +
 target/arm/tcg/cpu64.c                         |   1 +
 target/arm/tcg/translate.c                     |  37 +++++---
 33 files changed, 368 insertions(+), 359 deletions(-)
 create mode 100644 include/hw/arm/bsa.h
 rename include/hw/{misc => arm}/raspberrypi-fw-defs.h (100%)

From: Thomas Huth <thuth@redhat.com>

The file is obviously related to the raspberrypi machine, so
it should reside in hw/arm/ instead of hw/misc/. And while we're
at it, also adjust the wildcard in MAINTAINERS so that it covers
this file, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231012073458.860187-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                                    | 2 +-
 include/hw/{misc => arm}/raspberrypi-fw-defs.h | 0
 hw/misc/bcm2835_property.c                     | 2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename include/hw/{misc => arm}/raspberrypi-fw-defs.h (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Odd Fixes
 F: hw/arm/raspi.c
 F: hw/arm/raspi_platform.h
 F: hw/*/bcm283*
-F: include/hw/arm/raspi*
+F: include/hw/arm/rasp*
 F: include/hw/*/bcm283*
 F: docs/system/arm/raspi.rst
 
diff --git a/include/hw/misc/raspberrypi-fw-defs.h b/include/hw/arm/raspberrypi-fw-defs.h
similarity index 100%
rename from include/hw/misc/raspberrypi-fw-defs.h
rename to include/hw/arm/raspberrypi-fw-defs.h
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "hw/irq.h"
 #include "hw/misc/bcm2835_mbox_defs.h"
-#include "hw/misc/raspberrypi-fw-defs.h"
+#include "hw/arm/raspberrypi-fw-defs.h"
 #include "sysemu/dma.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

struct arm_boot_info is declared in "hw/arm/boot.h".
By including the correct header we don't need to declare
it again in "target/arm/cpu-qom.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20231013130214.95742-1-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h | 2 +-
 target/arm/cpu-qom.h        | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/exynos4210_gic.h"
 #include "hw/intc/exynos4210_combiner.h"
 #include "hw/core/split-irq.h"
-#include "target/arm/cpu-qom.h"
+#include "hw/arm/boot.h"
 #include "qom/object.h"
 
 #define EXYNOS4210_NCPUS                    2
diff --git a/target/arm/cpu-qom.h b/target/arm/cpu-qom.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-qom.h
+++ b/target/arm/cpu-qom.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/core/cpu.h"
 #include "qom/object.h"
 
-struct arm_boot_info;
-
 #define TYPE_ARM_CPU "arm-cpu"
 
 OBJECT_DECLARE_CPU_TYPE(ARMCPU, ARMCPUClass, ARM_CPU)
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

This change implements the ResettableClass interface for the device.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231003052345.199725-1-tong.ho@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-bbram.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-bbram.c
+++ b/hw/nvram/xlnx-bbram.c
@@ -XXX,XX +XXX,XX @@
  * QEMU model of the Xilinx BBRAM Battery Backed RAM
  *
  * Copyright (c) 2014-2021 Xilinx Inc.
+ * Copyright (c) 2023 Advanced Micro Devices, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo bbram_ctrl_regs_info[] = {
     }
 };
 
-static void bbram_ctrl_reset(DeviceState *dev)
+static void bbram_ctrl_reset_hold(Object *obj)
 {
-    XlnxBBRam *s = XLNX_BBRAM(dev);
+    XlnxBBRam *s = XLNX_BBRAM(obj);
     unsigned int i;
 
     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
@@ -XXX,XX +XXX,XX @@ static Property bbram_ctrl_props[] = {
 static void bbram_ctrl_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
-    dc->reset = bbram_ctrl_reset;
+    rc->phases.hold = bbram_ctrl_reset_hold;
     dc->realize = bbram_ctrl_realize;
     dc->vmsd = &vmstate_bbram_ctrl;
     device_class_set_props(dc, bbram_ctrl_props);
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

This change implements the ResettableClass interface for the device.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20231004055713.324009-1-tong.ho@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-zynqmp-efuse.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-zynqmp-efuse.c
+++ b/hw/nvram/xlnx-zynqmp-efuse.c
@@ -XXX,XX +XXX,XX @@
  * QEMU model of the ZynqMP eFuse
  *
  * Copyright (c) 2015 Xilinx Inc.
+ * Copyright (c) 2023 Advanced Micro Devices, Inc.
  *
  * Written by Edgar E. Iglesias <edgari@xilinx.com>
  *
@@ -XXX,XX +XXX,XX @@ static void zynqmp_efuse_register_reset(RegisterInfo *reg)
     register_reset(reg);
 }
 
-static void zynqmp_efuse_reset(DeviceState *dev)
+static void zynqmp_efuse_reset_hold(Object *obj)
 {
-    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(dev);
+    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
     unsigned int i;
 
     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
@@ -XXX,XX +XXX,XX @@ static Property zynqmp_efuse_props[] = {
 static void zynqmp_efuse_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
-    dc->reset = zynqmp_efuse_reset;
+    rc->phases.hold = zynqmp_efuse_reset_hold;
     dc->realize = zynqmp_efuse_realize;
     dc->vmsd = &vmstate_efuse;
     device_class_set_props(dc, zynqmp_efuse_props);
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

This change implements the ResettableClass interface for the device.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20231004055339.323833-1-tong.ho@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-versal-efuse-ctrl.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
+++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
@@ -XXX,XX +XXX,XX @@
  * QEMU model of the Versal eFuse controller
  *
  * Copyright (c) 2020 Xilinx Inc.
+ * Copyright (c) 2023 Advanced Micro Devices, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -XXX,XX +XXX,XX @@ static void efuse_ctrl_register_reset(RegisterInfo *reg)
     register_reset(reg);
 }
 
-static void efuse_ctrl_reset(DeviceState *dev)
+static void efuse_ctrl_reset_hold(Object *obj)
 {
-    XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(dev);
+    XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
     unsigned int i;
 
     for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
@@ -XXX,XX +XXX,XX @@ static Property efuse_ctrl_props[] = {
 static void efuse_ctrl_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
-    dc->reset = efuse_ctrl_reset;
+    rc->phases.hold = efuse_ctrl_reset_hold;
     dc->realize = efuse_ctrl_realize;
     dc->vmsd = &vmstate_efuse_ctrl;
     device_class_set_props(dc, efuse_ctrl_props);
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Index in file_size array must be checked against num_files, because the
entries we are looking for may be absent in the PDB.

Fixes: Coverity CID 1521597
Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230930235317.11469-3-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pdb.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pdb.c
+++ b/contrib/elf2dmp/pdb.c
@@ -XXX,XX +XXX,XX @@
 
 static uint32_t pdb_get_file_size(const struct pdb_reader *r, unsigned idx)
 {
+    if (idx >= r->ds.toc->num_files) {
+        return 0;
+    }
+
     return r->ds.toc->file_size[idx];
 }
 
@@ -XXX,XX +XXX,XX @@ static void *pdb_ds_read_file(struct pdb_reader* r, uint32_t file_number)
 
 static int pdb_init_segments(struct pdb_reader *r)
 {
-    char *segs;
     unsigned stream_idx = r->segments;
 
-    segs = pdb_ds_read_file(r, stream_idx);
-    if (!segs) {
+    r->segs = pdb_ds_read_file(r, stream_idx);
+    if (!r->segs) {
         return 1;
     }
 
-    r->segs = segs;
     r->segs_size = pdb_get_file_size(r, stream_idx);
+    if (!r->segs_size) {
+        return 1;
+    }
 
     return 0;
 }
-- 
2.34.1

From: Michal Orzel <michal.orzel@amd.com>

On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
of Xen, a trap from EL2 was observed which is something not reproducible
on HW (also, Xen does not trap accesses to physical counter).

This is because gt_counter_access() checks for an incorrect bit (1
instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
When HCR_EL2.E2H is 0:
 - EL1PCTEN, bit [0]: refers to physical counter
 - EL1PCEN, bit [1]: refers to physical timer registers

Drop entire block "if (hcr & HCR_E2H) {...} else {...}" from EL0 case
and fall through to EL1 case, given that after fixing checking for the
correct bit, the handling is the same.

Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Tested-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Message-id: 20230928094404.20802-1-michal.orzel@amd.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
         if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) {
             return CP_ACCESS_TRAP;
         }
-
-        /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */
-        if (hcr & HCR_E2H) {
-            if (timeridx == GTIMER_PHYS &&
-                !extract32(env->cp15.cnthctl_el2, 10, 1)) {
-                return CP_ACCESS_TRAP_EL2;
-            }
-        } else {
-            /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
-            if (has_el2 && timeridx == GTIMER_PHYS &&
-                !extract32(env->cp15.cnthctl_el2, 1, 1)) {
-                return CP_ACCESS_TRAP_EL2;
-            }
-        }
-        break;
-
+        /* fall through */
     case 1:
         /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
         if (has_el2 && timeridx == GTIMER_PHYS &&
-- 
2.34.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

GIC Private Peripheral Interrupts (PPI) are defined as GIC INTID 16-31.
As in, PPI0 is INTID16 .. PPI15 is INTID31.
Arm's Base System Architecture specification (BSA) lists the mandated and
recommended private interrupt IDs by INTID, not by PPI index. But current
definitions in virt define them by PPI index, complicating cross
referencing.

Meanwhile, the PPI(x) macro counterintuitively adds 16 to the input value,
converting a PPI index to an INTID.

Resolve this by redefining the BSA-allocated PPIs by their INTIDs,
and replacing the PPI(x) macro with an INTID_TO_PPI(x) one where required.

Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Message-id: 20230919090229.188092-2-quic_llindhol@quicinc.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h    | 14 +++++++-------
 hw/arm/virt-acpi-build.c | 12 ++++++------
 hw/arm/virt.c            | 24 ++++++++++++++----------
 3 files changed, 27 insertions(+), 23 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #define NUM_VIRTIO_TRANSPORTS 32
 #define NUM_SMMU_IRQS          4
 
-#define ARCH_GIC_MAINT_IRQ  9
+#define ARCH_GIC_MAINT_IRQ  25
 
-#define ARCH_TIMER_VIRT_IRQ   11
-#define ARCH_TIMER_S_EL1_IRQ  13
-#define ARCH_TIMER_NS_EL1_IRQ 14
-#define ARCH_TIMER_NS_EL2_IRQ 10
+#define ARCH_TIMER_VIRT_IRQ   27
+#define ARCH_TIMER_S_EL1_IRQ  29
+#define ARCH_TIMER_NS_EL1_IRQ 30
+#define ARCH_TIMER_NS_EL2_IRQ 26
 
-#define VIRTUAL_PMU_IRQ 7
+#define VIRTUAL_PMU_IRQ 23
 
-#define PPI(irq) ((irq) + 16)
+#define INTID_TO_PPI(irq) ((irq) - 16)
 
 /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
 #define PVTIME_SIZE_PER_CPU 64
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_gtdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
      * The interrupt values are the same with the device tree when adding 16
      */
     /* Secure EL1 timer GSIV */
-    build_append_int_noprefix(table_data, ARCH_TIMER_S_EL1_IRQ + 16, 4);
+    build_append_int_noprefix(table_data, ARCH_TIMER_S_EL1_IRQ, 4);
     /* Secure EL1 timer Flags */
     build_append_int_noprefix(table_data, irqflags, 4);
     /* Non-Secure EL1 timer GSIV */
-    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL1_IRQ + 16, 4);
+    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL1_IRQ, 4);
     /* Non-Secure EL1 timer Flags */
     build_append_int_noprefix(table_data, irqflags |
                               1UL << 2, /* Always-on Capability */
                               4);
     /* Virtual timer GSIV */
-    build_append_int_noprefix(table_data, ARCH_TIMER_VIRT_IRQ + 16, 4);
+    build_append_int_noprefix(table_data, ARCH_TIMER_VIRT_IRQ, 4);
     /* Virtual Timer Flags */
     build_append_int_noprefix(table_data, irqflags, 4);
     /* Non-Secure EL2 timer GSIV */
-    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_IRQ + 16, 4);
+    build_append_int_noprefix(table_data, ARCH_TIMER_NS_EL2_IRQ, 4);
     /* Non-Secure EL2 timer Flags */
     build_append_int_noprefix(table_data, irqflags, 4);
     /* CntReadBase Physical address */
@@ -XXX,XX +XXX,XX @@ build_madt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     for (i = 0; i < MACHINE(vms)->smp.cpus; i++) {
         ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
         uint64_t physical_base_address = 0, gich = 0, gicv = 0;
-        uint32_t vgic_interrupt = vms->virt ? PPI(ARCH_GIC_MAINT_IRQ) : 0;
+        uint32_t vgic_interrupt = vms->virt ? ARCH_GIC_MAINT_IRQ : 0;
         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
-                                             PPI(VIRTUAL_PMU_IRQ) : 0;
+                                             VIRTUAL_PMU_IRQ : 0;
 
         if (vms->gic_version == VIRT_GIC_VERSION_2) {
             physical_base_address = memmap[VIRT_GIC_CPU].base;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_timer_nodes(const VirtMachineState *vms)
     }
     qemu_fdt_setprop(ms->fdt, "/timer", "always-on", NULL, 0);
     qemu_fdt_setprop_cells(ms->fdt, "/timer", "interrupts",
-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_S_EL1_IRQ, irqflags,
-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL1_IRQ, irqflags,
-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_VIRT_IRQ, irqflags,
-                       GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL2_IRQ, irqflags);
+                           GIC_FDT_IRQ_TYPE_PPI,
+                           INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ), irqflags,
+                           GIC_FDT_IRQ_TYPE_PPI,
+                           INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ), irqflags,
+                           GIC_FDT_IRQ_TYPE_PPI,
+                           INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ), irqflags,
+                           GIC_FDT_IRQ_TYPE_PPI,
+                           INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ), irqflags);
 }
 
 static void fdt_add_cpu_nodes(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
      */
     for (i = 0; i < smp_cpus; i++) {
         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
-        int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
+        int intidbase = NUM_IRQS + i * GIC_INTERNAL;
         /* Mapping from the output timer irq lines from the CPU to the
          * GIC PPI inputs we use for the virt board.
          */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
         for (unsigned irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
             qdev_connect_gpio_out(cpudev, irq,
                                   qdev_get_gpio_in(vms->gic,
-                                                   ppibase + timer_irq[irq]));
+                                                   intidbase + timer_irq[irq]));
         }
 
         if (vms->gic_version != VIRT_GIC_VERSION_2) {
             qemu_irq irq = qdev_get_gpio_in(vms->gic,
-                                            ppibase + ARCH_GIC_MAINT_IRQ);
+                                            intidbase + ARCH_GIC_MAINT_IRQ);
             qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
                                         0, irq);
         } else if (vms->virt) {
             qemu_irq irq = qdev_get_gpio_in(vms->gic,
-                                            ppibase + ARCH_GIC_MAINT_IRQ);
+                                            intidbase + ARCH_GIC_MAINT_IRQ);
             sysbus_connect_irq(gicbusdev, i + 4 * smp_cpus, irq);
         }
 
         qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
-                                    qdev_get_gpio_in(vms->gic, ppibase
+                                    qdev_get_gpio_in(vms->gic, intidbase
                                                      + VIRTUAL_PMU_IRQ));
 
         sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms, MemoryRegion *sysmem)
             if (pmu) {
                 assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
                 if (kvm_irqchip_in_kernel()) {
-                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
+                    kvm_arm_pmu_set_irq(cpu, VIRTUAL_PMU_IRQ);
                 }
                 kvm_arm_pmu_init(cpu);
             }
-- 
2.34.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

virt.h defines a number of IRQs that are ultimately described by Arm's
Base System Architecture specification. Move these to a dedicated header
so that they can be reused by other platforms that do the same.
Include that header from virt.h to minimise churn.

While we're moving the definitions, sort them into numerical order,
and add the ARCH_TIMER_NS_EL2_VIRT_IRQ definition used by sbsa-ref
and which will eventually be needed by virt also.

Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Message-id: 20230919090229.188092-3-quic_llindhol@quicinc.com
[PMM: Remove unused PPI_TO_INTID macro; sort numerically;
 add ARCH_TIMER_NS_EL2_VIRT_IRQ]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bsa.h  | 35 +++++++++++++++++++++++++++++++++++
 include/hw/arm/virt.h | 12 +-----------
 2 files changed, 36 insertions(+), 11 deletions(-)
 create mode 100644 include/hw/arm/bsa.h

diff --git a/include/hw/arm/bsa.h b/include/hw/arm/bsa.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/bsa.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Common definitions for Arm Base System Architecture (BSA) platforms.
+ *
+ * Copyright (c) 2015 Linaro Limited
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2 or later, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#ifndef QEMU_ARM_BSA_H
+#define QEMU_ARM_BSA_H
+
+/* These are architectural INTID values */
+#define VIRTUAL_PMU_IRQ            23
+#define ARCH_GIC_MAINT_IRQ         25
+#define ARCH_TIMER_NS_EL2_IRQ      26
+#define ARCH_TIMER_VIRT_IRQ        27
+#define ARCH_TIMER_NS_EL2_VIRT_IRQ 28
+#define ARCH_TIMER_S_EL1_IRQ       29
+#define ARCH_TIMER_NS_EL1_IRQ      30
+
+#define INTID_TO_PPI(irq) ((irq) - 16)
+
+#endif /* QEMU_ARM_BSA_H */
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/notify.h"
 #include "hw/boards.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/bsa.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
@@ -XXX,XX +XXX,XX @@
 #define NUM_VIRTIO_TRANSPORTS 32
 #define NUM_SMMU_IRQS          4
 
-#define ARCH_GIC_MAINT_IRQ  25
-
-#define ARCH_TIMER_VIRT_IRQ   27
-#define ARCH_TIMER_S_EL1_IRQ  29
-#define ARCH_TIMER_NS_EL1_IRQ 30
-#define ARCH_TIMER_NS_EL2_IRQ 26
-
-#define VIRTUAL_PMU_IRQ 23
-
-#define INTID_TO_PPI(irq) ((irq) - 16)
-
 /* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
 #define PVTIME_SIZE_PER_CPU 64
 
-- 
2.34.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

Use the private peripheral interrupt definitions from bsa.h instead of
defining them locally. Refactor to use the INTIDs defined there instead
of the PPI# used previously.

Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Message-id: 20230919090229.188092-4-quic_llindhol@quicinc.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
  * ARM SBSA Reference Platform emulation
  *
  * Copyright (c) 2018 Linaro Limited
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  * Written by Hongbo Zhang <hongbo.zhang@linaro.org>
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "kvm_arm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/bsa.h"
 #include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/block/flash.h"
@@ -XXX,XX +XXX,XX @@
 #define NUM_SMMU_IRQS   4
 #define NUM_SATA_PORTS  6
 
-#define VIRTUAL_PMU_IRQ        7
-#define ARCH_GIC_MAINT_IRQ     9
-#define ARCH_TIMER_VIRT_IRQ    11
-#define ARCH_TIMER_S_EL1_IRQ   13
-#define ARCH_TIMER_NS_EL1_IRQ  14
-#define ARCH_TIMER_NS_EL2_IRQ  10
-#define ARCH_TIMER_NS_EL2_VIRT_IRQ  12
-
 enum {
     SBSA_FLASH,
     SBSA_MEM,
@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
      */
     for (i = 0; i < smp_cpus; i++) {
         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
-        int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
+        int intidbase = NUM_IRQS + i * GIC_INTERNAL;
         int irq;
         /*
          * Mapping from the output timer irq lines from the CPU to the
@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
         for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
             qdev_connect_gpio_out(cpudev, irq,
                                   qdev_get_gpio_in(sms->gic,
-                                                   ppibase + timer_irq[irq]));
+                                                   intidbase + timer_irq[irq]));
         }
 
         qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt", 0,
-                                    qdev_get_gpio_in(sms->gic, ppibase
+                                    qdev_get_gpio_in(sms->gic,
+                                                     intidbase
                                                      + ARCH_GIC_MAINT_IRQ));
+
         qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
-                                    qdev_get_gpio_in(sms->gic, ppibase
+                                    qdev_get_gpio_in(sms->gic,
+                                                     intidbase
                                                      + VIRTUAL_PMU_IRQ));
 
         sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
-- 
2.34.1

From: Cornelia Huck <cohuck@redhat.com>

We can neaten the code by switching to the kvm_set_one_reg function.

Reviewed-by: Gavin Shan <gshan@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231010142453.224369-2-cohuck@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c   | 13 +++------
 target/arm/kvm64.c | 66 +++++++++++++---------------------------------
 2 files changed, 21 insertions(+), 58 deletions(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
     bool ok = true;
 
     for (i = 0; i < cpu->cpreg_array_len; i++) {
-        struct kvm_one_reg r;
         uint64_t regidx = cpu->cpreg_indexes[i];
         uint32_t v32;
         int ret;
@@ -XXX,XX +XXX,XX @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
             continue;
         }
 
-        r.id = regidx;
         switch (regidx & KVM_REG_SIZE_MASK) {
         case KVM_REG_SIZE_U32:
             v32 = cpu->cpreg_values[i];
-            r.addr = (uintptr_t)&v32;
+            ret = kvm_set_one_reg(cs, regidx, &v32);
             break;
         case KVM_REG_SIZE_U64:
-            r.addr = (uintptr_t)(cpu->cpreg_values + i);
+            ret = kvm_set_one_reg(cs, regidx, cpu->cpreg_values + i);
             break;
         default:
             g_assert_not_reached();
         }
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
         if (ret) {
             /* We might fail for "unknown register" and also for
              * "you tried to set a register which is constant with
@@ -XXX,XX +XXX,XX @@ void kvm_arm_get_virtual_time(CPUState *cs)
 void kvm_arm_put_virtual_time(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-    struct kvm_one_reg reg = {
-        .id = KVM_REG_ARM_TIMER_CNT,
-        .addr = (uintptr_t)&cpu->kvm_vtime,
-    };
     int ret;
 
     if (!cpu->kvm_vtime_dirty) {
         return;
     }
 
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
     if (ret) {
         error_report("Failed to set KVM_REG_ARM_TIMER_CNT");
         abort();
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static int kvm_arm_sve_set_vls(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
-    struct kvm_one_reg reg = {
-        .id = KVM_REG_ARM64_SVE_VLS,
-        .addr = (uint64_t)&vls[0],
-    };
 
     assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
 
-    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    return kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_VLS, &vls[0]);
 }
 
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
@@ -XXX,XX +XXX,XX @@ static void kvm_inject_arm_sea(CPUState *c)
 static int kvm_arch_put_fpsimd(CPUState *cs)
 {
     CPUARMState *env = &ARM_CPU(cs)->env;
-    struct kvm_one_reg reg;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
         uint64_t *q = aa64_vfp_qreg(env, i);
 #if HOST_BIG_ENDIAN
         uint64_t fp_val[2] = { q[1], q[0] };
-        reg.addr = (uintptr_t)fp_val;
+        ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]),
+                                                        fp_val);
 #else
-        reg.addr = (uintptr_t)q;
+        ret = kvm_set_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
 #endif
-        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
     CPUARMState *env = &cpu->env;
     uint64_t tmp[ARM_MAX_VQ * 2];
     uint64_t *r;
-    struct kvm_one_reg reg;
     int n, ret;
 
     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
         r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
-        reg.addr = (uintptr_t)r;
-        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
         r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
                         DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-        reg.addr = (uintptr_t)r;
-        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
 
     r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
                     DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-    reg.addr = (uintptr_t)r;
-    reg.id = KVM_REG_ARM64_SVE_FFR(0);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_sve(CPUState *cs)
 
 int kvm_arch_put_registers(CPUState *cs, int level)
 {
-    struct kvm_one_reg reg;
     uint64_t val;
     uint32_t fpr;
     int i, ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     }
 
     for (i = 0; i < 31; i++) {
-        reg.id = AARCH64_CORE_REG(regs.regs[i]);
-        reg.addr = (uintptr_t) &env->xregs[i];
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
+                              &env->xregs[i]);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      */
     aarch64_save_sp(env, 1);
 
-    reg.id = AARCH64_CORE_REG(regs.sp);
-    reg.addr = (uintptr_t) &env->sp_el[0];
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
     if (ret) {
         return ret;
     }
 
-    reg.id = AARCH64_CORE_REG(sp_el1);
-    reg.addr = (uintptr_t) &env->sp_el[1];
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     } else {
         val = cpsr_read(env);
     }
-    reg.id = AARCH64_CORE_REG(regs.pstate);
-    reg.addr = (uintptr_t) &val;
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
     if (ret) {
         return ret;
     }
 
-    reg.id = AARCH64_CORE_REG(regs.pc);
-    reg.addr = (uintptr_t) &env->pc;
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
     if (ret) {
         return ret;
     }
 
-    reg.id = AARCH64_CORE_REG(elr_el1);
-    reg.addr = (uintptr_t) &env->elr_el[1];
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 
     /* KVM 0-4 map to QEMU banks 1-5 */
     for (i = 0; i < KVM_NR_SPSR; i++) {
-        reg.id = AARCH64_CORE_REG(spsr[i]);
-        reg.addr = (uintptr_t) &env->banked_spsr[i + 1];
-        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        ret = kvm_set_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
+                              &env->banked_spsr[i + 1]);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    reg.addr = (uintptr_t)(&fpr);
     fpr = vfp_get_fpsr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
     if (ret) {
         return ret;
     }
 
-    reg.addr = (uintptr_t)(&fpr);
     fpr = vfp_get_fpcr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    ret = kvm_set_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
     if (ret) {
         return ret;
     }
-- 
2.34.1

From: Cornelia Huck <cohuck@redhat.com>

We can neaten the code by switching the callers that work on a
CPUstate to the kvm_get_one_reg function.

Reviewed-by: Gavin Shan <gshan@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20231010142453.224369-3-cohuck@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c   | 15 +++---------
 target/arm/kvm64.c | 57 ++++++++++++----------------------------------
 2 files changed, 18 insertions(+), 54 deletions(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool write_kvmstate_to_list(ARMCPU *cpu)
     bool ok = true;
 
     for (i = 0; i < cpu->cpreg_array_len; i++) {
-        struct kvm_one_reg r;
         uint64_t regidx = cpu->cpreg_indexes[i];
         uint32_t v32;
         int ret;
 
-        r.id = regidx;
-
         switch (regidx & KVM_REG_SIZE_MASK) {
         case KVM_REG_SIZE_U32:
-            r.addr = (uintptr_t)&v32;
-            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
+            ret = kvm_get_one_reg(cs, regidx, &v32);
             if (!ret) {
                 cpu->cpreg_values[i] = v32;
             }
             break;
         case KVM_REG_SIZE_U64:
-            r.addr = (uintptr_t)(cpu->cpreg_values + i);
-            ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
+            ret = kvm_get_one_reg(cs, regidx, cpu->cpreg_values + i);
             break;
         default:
             g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu)
 void kvm_arm_get_virtual_time(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-    struct kvm_one_reg reg = {
-        .id = KVM_REG_ARM_TIMER_CNT,
-        .addr = (uintptr_t)&cpu->kvm_vtime,
-    };
     int ret;
 
     if (cpu->kvm_vtime_dirty) {
         return;
     }
 
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, KVM_REG_ARM_TIMER_CNT, &cpu->kvm_vtime);
     if (ret) {
         error_report("Failed to get KVM_REG_ARM_TIMER_CNT");
         abort();
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 static int kvm_arch_get_fpsimd(CPUState *cs)
 {
     CPUARMState *env = &ARM_CPU(cs)->env;
-    struct kvm_one_reg reg;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)q;
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        ret = kvm_get_one_reg(cs, AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]), q);
         if (ret) {
             return ret;
         } else {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-    struct kvm_one_reg reg;
     uint64_t *r;
     int n, ret;
 
     for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
         r = &env->vfp.zregs[n].d[0];
-        reg.addr = (uintptr_t)r;
-        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_ZREG(n, 0), r);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
 
     for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
         r = &env->vfp.pregs[n].p[0];
-        reg.addr = (uintptr_t)r;
-        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_PREG(n, 0), r);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
     }
 
     r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
-    reg.addr = (uintptr_t)r;
-    reg.id = KVM_REG_ARM64_SVE_FFR(0);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, KVM_REG_ARM64_SVE_FFR(0), r);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_sve(CPUState *cs)
 
 int kvm_arch_get_registers(CPUState *cs)
 {
-    struct kvm_one_reg reg;
     uint64_t val;
     unsigned int el;
     uint32_t fpr;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     CPUARMState *env = &cpu->env;
 
     for (i = 0; i < 31; i++) {
-        reg.id = AARCH64_CORE_REG(regs.regs[i]);
-        reg.addr = (uintptr_t) &env->xregs[i];
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.regs[i]),
+                              &env->xregs[i]);
         if (ret) {
             return ret;
         }
     }
 
-    reg.id = AARCH64_CORE_REG(regs.sp);
-    reg.addr = (uintptr_t) &env->sp_el[0];
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.sp), &env->sp_el[0]);
     if (ret) {
         return ret;
     }
 
-    reg.id = AARCH64_CORE_REG(sp_el1);
-    reg.addr = (uintptr_t) &env->sp_el[1];
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(sp_el1), &env->sp_el[1]);
     if (ret) {
         return ret;
     }
 
-    reg.id = AARCH64_CORE_REG(regs.pstate);
-    reg.addr = (uintptr_t) &val;
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pstate), &val);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      */
     aarch64_restore_sp(env, 1);
 
-    reg.id = AARCH64_CORE_REG(regs.pc);
-    reg.addr = (uintptr_t) &env->pc;
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(regs.pc), &env->pc);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         aarch64_sync_64_to_32(env);
     }
 
-    reg.id = AARCH64_CORE_REG(elr_el1);
-    reg.addr = (uintptr_t) &env->elr_el[1];
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(elr_el1), &env->elr_el[1]);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      * KVM SPSRs 0-4 map to QEMU banks 1-5
      */
     for (i = 0; i < KVM_NR_SPSR; i++) {
-        reg.id = AARCH64_CORE_REG(spsr[i]);
-        reg.addr = (uintptr_t) &env->banked_spsr[i + 1];
-        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        ret = kvm_get_one_reg(cs, AARCH64_CORE_REG(spsr[i]),
+                              &env->banked_spsr[i + 1]);
         if (ret) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         return ret;
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpsr), &fpr);
     if (ret) {
         return ret;
     }
     vfp_set_fpsr(env, fpr);
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    ret = kvm_get_one_reg(cs, AARCH64_SIMD_CTRL_REG(fp_regs.fpcr), &fpr);
     if (ret) {
         return ret;
     }
-- 
2.34.1

For the Thumb T32 encoding of LDM, if only a single register is
specified in the register list this instruction is UNPREDICTABLE,
with the following choices:
 * instruction UNDEFs
 * instruction is a NOP
 * instruction loads a single register
 * instruction loads an unspecified set of registers

Currently we choose to UNDEF (a behaviour chosen in commit
4b222545dbf30 in 2019; previously we treated it as "load the
specified single register").

Unfortunately there is real world code out there (which shipped in at
least Android 11, 12 and 13) which incorrectly uses this
UNPREDICTABLE insn on the assumption that it does a single register
load, which is (presumably) what it happens to do on real hardware,
and is also what it does on the equivalent A32 encoding.

Revert to the pre-4b222545dbf30 behaviour of not UNDEFing
for this T32 encoding.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1799
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230927101853.39288-1-peter.maydell@linaro.org
---
 target/arm/tcg/translate.c | 37 +++++++++++++++++++++++--------------
 1 file changed, 23 insertions(+), 14 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void op_addr_block_post(DisasContext *s, arg_ldst_block *a,
     }
 }
 
-static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
+static bool op_stm(DisasContext *s, arg_ldst_block *a)
 {
     int i, j, n, list, mem_idx;
     bool user = a->u;
@@ -XXX,XX +XXX,XX @@ static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
 
     list = a->list;
     n = ctpop16(list);
-    if (n < min_n || a->rn == 15) {
+    /*
+     * This is UNPREDICTABLE for n < 1 in all encodings, and we choose
+     * to UNDEF. In the T32 STM encoding n == 1 is also UNPREDICTABLE,
+     * but hardware treats it like the A32 version and implements the
+     * single-register-store, and some in-the-wild (buggy) software
+     * assumes that, so we don't UNDEF on that case.
+     */
+    if (n < 1 || a->rn == 15) {
         unallocated_encoding(s);
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool op_stm(DisasContext *s, arg_ldst_block *a, int min_n)
 
 static bool trans_STM(DisasContext *s, arg_ldst_block *a)
 {
-    /* BitCount(list) < 1 is UNPREDICTABLE */
-    return op_stm(s, a, 1);
+    return op_stm(s, a);
 }
 
 static bool trans_STM_t32(DisasContext *s, arg_ldst_block *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_STM_t32(DisasContext *s, arg_ldst_block *a)
         unallocated_encoding(s);
         return true;
     }
-    /* BitCount(list) < 2 is UNPREDICTABLE */
-    return op_stm(s, a, 2);
+    return op_stm(s, a);
 }
 
-static bool do_ldm(DisasContext *s, arg_ldst_block *a, int min_n)
+static bool do_ldm(DisasContext *s, arg_ldst_block *a)
 {
     int i, j, n, list, mem_idx;
     bool loaded_base;
@@ -XXX,XX +XXX,XX @@ static bool do_ldm(DisasContext *s, arg_ldst_block *a, int min_n)
 
     list = a->list;
     n = ctpop16(list);
-    if (n < min_n || a->rn == 15) {
+    /*
+     * This is UNPREDICTABLE for n < 1 in all encodings, and we choose
+     * to UNDEF. In the T32 LDM encoding n == 1 is also UNPREDICTABLE,
+     * but hardware treats it like the A32 version and implements the
+     * single-register-load, and some in-the-wild (buggy) software
+     * assumes that, so we don't UNDEF on that case.
+     */
+    if (n < 1 || a->rn == 15) {
         unallocated_encoding(s);
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_a32(DisasContext *s, arg_ldst_block *a)
         unallocated_encoding(s);
         return true;
     }
-    /* BitCount(list) < 1 is UNPREDICTABLE */
-    return do_ldm(s, a, 1);
+    return do_ldm(s, a);
 }
 
 static bool trans_LDM_t32(DisasContext *s, arg_ldst_block *a)
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_t32(DisasContext *s, arg_ldst_block *a)
         unallocated_encoding(s);
         return true;
     }
-    /* BitCount(list) < 2 is UNPREDICTABLE */
-    return do_ldm(s, a, 2);
+    return do_ldm(s, a);
 }
 
 static bool trans_LDM_t16(DisasContext *s, arg_ldst_block *a)
 {
     /* Writeback is conditional on the base register not being loaded.  */
     a->w = !(a->list & (1 << a->rn));
-    /* BitCount(list) < 1 is UNPREDICTABLE */
-    return do_ldm(s, a, 1);
+    return do_ldm(s, a);
 }
 
 static bool trans_CLRM(DisasContext *s, arg_CLRM *a)
-- 
2.34.1

Update the SMMUv3 ID register bit field definitions to the
set in the most recent specification (IHI0700 F.a).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230914145705.1648377-2-peter.maydell@linaro.org
---
 hw/arm/smmuv3-internal.h | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ REG32(IDR0,                0x0)
     FIELD(IDR0, S1P,         1 , 1)
     FIELD(IDR0, TTF,         2 , 2)
     FIELD(IDR0, COHACC,      4 , 1)
+    FIELD(IDR0, BTM,         5 , 1)
+    FIELD(IDR0, HTTU,        6 , 2)
+    FIELD(IDR0, DORMHINT,    8 , 1)
+    FIELD(IDR0, HYP,         9 , 1)
+    FIELD(IDR0, ATS,         10, 1)
+    FIELD(IDR0, NS1ATS,      11, 1)
     FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, MSI,         13, 1)
+    FIELD(IDR0, SEV,         14, 1)
+    FIELD(IDR0, ATOS,        15, 1)
+    FIELD(IDR0, PRI,         16, 1)
+    FIELD(IDR0, VMW,         17, 1)
     FIELD(IDR0, VMID16,      18, 1)
+    FIELD(IDR0, CD2L,        19, 1)
+    FIELD(IDR0, VATOS,       20, 1)
     FIELD(IDR0, TTENDIAN,    21, 2)
+    FIELD(IDR0, ATSRECERR,   23, 1)
     FIELD(IDR0, STALL_MODEL, 24, 2)
     FIELD(IDR0, TERM_MODEL,  26, 1)
     FIELD(IDR0, STLEVEL,     27, 2)
+    FIELD(IDR0, RME_IMPL,    30, 1)
 
 REG32(IDR1,                0x4)
     FIELD(IDR1, SIDSIZE,      0 , 6)
+    FIELD(IDR1, SSIDSIZE,     6 , 5)
+    FIELD(IDR1, PRIQS,        11, 5)
     FIELD(IDR1, EVENTQS,      16, 5)
     FIELD(IDR1, CMDQS,        21, 5)
+    FIELD(IDR1, ATTR_PERMS_OVR, 26, 1)
+    FIELD(IDR1, ATTR_TYPES_OVR, 27, 1)
+    FIELD(IDR1, REL,          28, 1)
+    FIELD(IDR1, QUEUES_PRESET, 29, 1)
+    FIELD(IDR1, TABLES_PRESET, 30, 1)
+    FIELD(IDR1, ECMDQ,        31, 1)
 
 #define SMMU_IDR1_SIDSIZE 16
 #define SMMU_CMDQS   19
 #define SMMU_EVENTQS 19
 
 REG32(IDR2,                0x8)
+     FIELD(IDR2, BA_VATOS, 0, 10)
+
 REG32(IDR3,                0xc)
      FIELD(IDR3, HAD,         2, 1);
+     FIELD(IDR3, PBHA,        3, 1);
+     FIELD(IDR3, XNX,         4, 1);
+     FIELD(IDR3, PPS,         5, 1);
+     FIELD(IDR3, MPAM,        7, 1);
+     FIELD(IDR3, FWB,         8, 1);
+     FIELD(IDR3, STT,         9, 1);
      FIELD(IDR3, RIL,        10, 1);
      FIELD(IDR3, BBML,       11, 2);
+     FIELD(IDR3, E0PD,       13, 1);
+     FIELD(IDR3, PTWNNC,     14, 1);
+     FIELD(IDR3, DPT,        15, 1);
+
 REG32(IDR4,                0x10)
+
 REG32(IDR5,                0x14)
      FIELD(IDR5, OAS,         0, 3);
      FIELD(IDR5, GRAN4K,      4, 1);
      FIELD(IDR5, GRAN16K,     5, 1);
      FIELD(IDR5, GRAN64K,     6, 1);
+     FIELD(IDR5, VAX,        10, 2);
+     FIELD(IDR5, STALL_MAX,  16, 16);
 
 #define SMMU_IDR5_OAS 4
 
-- 
2.34.1

In smmuv3_init_regs() when we set the various bits in the ID
registers, we do this almost in order of the fields in the
registers, but not quite. Move the initialization of
SMMU_IDR3.RIL and SMMU_IDR5.OAS into their correct places.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230914145705.1648377-3-peter.maydell@linaro.org
---
 hw/arm/smmuv3.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
 
-    s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
+    s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
 
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
     /* 4K, 16K and 64K granule support */
     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1);
     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
-    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
 
     s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
     s->cmdq.prod = 0;
-- 
2.34.1

The SMMUv3.1-XNX feature is mandatory for an SMMUv3.1 if S2P is
supported, so we should theoretically have implemented it as part of
the recent S2P work.  Fortunately, for us the implementation is a
no-op.

This feature is about interpretation of the stage 2 page table
descriptor XN bits, which control execute permissions.

For QEMU, the permission bits passed to an IOMMU (via MemTxAttrs and
IOMMUAccessFlags) only indicate read and write; we do not distinguish
data reads from instruction reads outside the CPU proper.  In the
SMMU architecture's terms, our interconnect between the client device
and the SMMU doesn't have the ability to convey the INST attribute,
and we therefore use the default value of "data" for this attribute.

We also do not support the bits in the Stream Table Entry that can
override the on-the-bus transaction attribute permissions (we do not
set SMMU_IDR1.ATTR_PERMS_OVR=1).

These two things together mean that for our implementation, it never
has to deal with transactions with the INST attribute, and so it can
correctly ignore the XN bits entirely.  So we already implement
FEAT_XNX's "XN field is now 2 bits, not 1" behaviour to the extent
that we need to.

Advertise the presence of the feature in SMMU_IDR3.XNX.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230914145705.1648377-4-peter.maydell@linaro.org
---
 hw/arm/smmuv3.c | 4 ++++
 1 file changed, 4 insertions(+)

FEAT_HPMN0 is a small feature which defines that it is valid for
MDCR_EL2.HPMN to be set to 0, meaning "no PMU event counters provided
to an EL1 guest" (previously this setting was reserved). QEMU's
implementation almost gets HPMN == 0 right, but we need to fix
one check in pmevcntr_is_64_bit(). That is enough for us to
advertise the feature in the 'max' CPU.

(We don't need to make the behaviour conditional on feature
presence, because the FEAT_HPMN0 behaviour is within the range
of permitted UNPREDICTABLE behaviour for a non-FEAT_HPMN0
implementation.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230921185445.3339214-1-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/helper.c           | 2 +-
 target/arm/tcg/cpu32.c        | 4 ++++
 target/arm/tcg/cpu64.c        | 1 +
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_HCX (Support for the HCRX_EL2 register)
 - FEAT_HPDS (Hierarchical permission disables)
 - FEAT_HPDS2 (Translation table page-based hardware attributes)
+- FEAT_HPMN0 (Setting of MDCR_EL2.HPMN to zero)
 - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
 - FEAT_IDST (ID space trap handling)
 - FEAT_IESB (Implicit error synchronization event)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool pmevcntr_is_64_bit(CPUARMState *env, int counter)
         bool hlp = env->cp15.mdcr_el2 & MDCR_HLP;
         int hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
 
-        if (hpmn != 0 && counter >= hpmn) {
+        if (counter >= hpmn) {
             return hlp;
         }
     }
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
     t = FIELD_DP32(t, ID_DFR0, COPSDBG, 9);       /* FEAT_Debugv8p4 */
     t = FIELD_DP32(t, ID_DFR0, PERFMON, 6);       /* FEAT_PMUv3p5 */
     cpu->isar.id_dfr0 = t;
+
+    t = cpu->isar.id_dfr1;
+    t = FIELD_DP32(t, ID_DFR1, HPMN0, 1);         /* FEAT_HPMN0 */
+    cpu->isar.id_dfr1 = t;
 }
 
 /* CPU models. These are not needed for the AArch64 linux-user build. */
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = cpu->isar.id_aa64dfr0;
     t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 9);  /* FEAT_Debugv8p4 */
     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 6);    /* FEAT_PMUv3p5 */
+    t = FIELD_DP64(t, ID_AA64DFR0, HPMN0, 1);     /* FEAT_HPMN0 */
     cpu->isar.id_aa64dfr0 = t;
 
     t = cpu->isar.id_aa64smfr0;
-- 
2.34.1

The hw/arm/boot.h include in common-semi-target.h is not actually
needed, and it's a bit odd because it pulls a hw/arm header into a
target/arm file.

This include was originally needed because the semihosting code used
the arm_boot_info struct to get the base address of the RAM in system
emulation, to use in a (bad) heuristic for the return values for the
SYS_HEAPINFO semihosting call.  We've since overhauled how we
calculate the HEAPINFO values in system emulation, and the code no
longer uses the arm_boot_info struct.

Remove the now-redundant include line, and instead directly include
the cpu-qom.h header that we were previously getting via boot.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230925112219.3919261-1-peter.maydell@linaro.org
---
 target/arm/common-semi-target.h | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/arm/common-semi-target.h b/target/arm/common-semi-target.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/common-semi-target.h
+++ b/target/arm/common-semi-target.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_COMMON_SEMI_TARGET_H
 #define TARGET_ARM_COMMON_SEMI_TARGET_H
 
-#ifndef CONFIG_USER_ONLY
-#include "hw/arm/boot.h"
-#endif
+#include "target/arm/cpu-qom.h"
 
 static inline target_ulong common_semi_arg(CPUState *cs, int argno)
 {
-- 
2.34.1

The code for powering on a CPU in arm-powerctl.c has two separate
use cases:
 * emulation of a real hardware power controller
 * emulation of firmware interfaces (primarily PSCI) with
   CPU on/off APIs

For the first case, we only need to reset the CPU and set its
starting PC and X0.  For the second case, because we're emulating the
firmware we need to ensure that it's in the state that the firmware
provides.  In particular, when we reset to a lower EL than the
highest one we are emulating, we need to put the CPU into a state
that permits correct running at that lower EL.  We already do a
little of this in arm-powerctl.c (for instance we set SCR_HCE to
enable the HVC insn) but we don't do enough of it.  This means that
in the case where we are emulating EL3 but also providing emulated
PSCI the guest will crash when a secondary core tries to use a
feature that needs an SCR_EL3 bit to be set, such as MTE or PAuth.

The hw/arm/boot.c code also has to support this "start guest code in
an EL that's lower than the highest emulated EL" case in order to do
direct guest kernel booting; it has all the necessary initialization
code to set the SCR_EL3 bits.  Pull the relevant boot.c code out into
a separate function so we can share it between there and
arm-powerctl.c.

This refactoring has a few code changes that look like they
might be behaviour changes but aren't:
 * if info->secure_boot is false and info->secure_board_setup is
   true, then the old code would start the first CPU in Hyp
   mode but without changing SCR.NS and NSACR.{CP11,CP10}.
   This was wrong behaviour because there's no such thing
   as Secure Hyp mode. The new code will leave the CPU in SVC.
   (There is no board which sets secure_boot to false and
   secure_board_setup to true, so this isn't a behaviour
   change for any of our boards.)
 * we don't explicitly clear SCR.NS when arm-powerctl.c
   does a CPU-on to EL3. This was a no-op because CPU reset
   will reset to NS == 0.

And some real behaviour changes:
 * we no longer set HCR_EL2.RW when booting into EL2: the guest
   can and should do that themselves before dropping into their
   EL1 code. (arm-powerctl and boot did this differently; I
   opted to use the logic from arm-powerctl, which only sets
   HCR_EL2.RW when it's directly starting the guest in EL1,
   because it's more correct, and I don't expect guests to be
   accidentally depending on our having set the RW bit for them.)
 * if we are booting a CPU into AArch32 Secure SVC then we won't
   set SCR.HCE any more. This affects only the vexpress-a15 and
   raspi2b machine types. Guests booting in this case will either:
    - be able to set SCR.HCE themselves as part of moving from
      Secure SVC into NS Hyp mode
    - will move from Secure SVC to NS SVC, and won't care about
      behaviour of the HVC insn
    - will stay in Secure SVC, and won't care about HVC
 * on an arm-powerctl CPU-on we will now set the SCR bits for
   pauth/mte/sve/sme/hcx/fgt features

The first two of these are very minor and I don't expect guest
code to trip over them, so I didn't judge it worth convoluting
the code in an attempt to keep exactly the same boot.c behaviour.
The third change fixes issue 1899.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1899
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230926155619.4028618-1-peter.maydell@linaro.org
---
 target/arm/cpu.h          | 22 +++++++++
 hw/arm/boot.c             | 95 ++++++++++-----------------------------
 target/arm/arm-powerctl.c | 53 +---------------------
 target/arm/cpu.c          | 95 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 141 insertions(+), 124 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
 int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
                              int cpuid, DumpState *s);
 
+/**
+ * arm_emulate_firmware_reset: Emulate firmware CPU reset handling
+ * @cpu: CPU (which must have been freshly reset)
+ * @target_el: exception level to put the CPU into
+ * @secure: whether to put the CPU in secure state
+ *
+ * When QEMU is directly running a guest kernel at a lower level than
+ * EL3 it implicitly emulates some aspects of the guest firmware.
+ * This includes that on reset we need to configure the parts of the
+ * CPU corresponding to EL3 so that the real guest code can run at its
+ * lower exception level. This function does that post-reset CPU setup,
+ * for when we do direct boot of a guest kernel, and for when we
+ * emulate PSCI and similar firmware interfaces starting a CPU at a
+ * lower exception level.
+ *
+ * @target_el must be an EL implemented by the CPU between 1 and 3.
+ * We do not support dropping into a Secure EL other than 3.
+ *
+ * It is the responsibility of the caller to call arm_rebuild_hflags().
+ */
+void arm_emulate_firmware_reset(CPUState *cpustate, int target_el);
+
 #ifdef TARGET_AARCH64
 int aarch64_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
 
             cpu_set_pc(cs, entry);
         } else {
-            /* If we are booting Linux then we need to check whether we are
-             * booting into secure or non-secure state and adjust the state
-             * accordingly.  Out of reset, ARM is defined to be in secure state
-             * (SCR.NS = 0), we change that here if non-secure boot has been
-             * requested.
+            /*
+             * If we are booting Linux then we might need to do so at:
+             *  - AArch64 NS EL2 or NS EL1
+             *  - AArch32 Secure SVC (EL3)
+             *  - AArch32 NS Hyp (EL2)
+             *  - AArch32 NS SVC (EL1)
+             * Configure the CPU in the way boot firmware would do to
+             * drop us down to the appropriate level.
              */
-            if (arm_feature(env, ARM_FEATURE_EL3)) {
-                /* AArch64 is defined to come out of reset into EL3 if enabled.
-                 * If we are booting Linux then we need to adjust our EL as
-                 * Linux expects us to be in EL2 or EL1.  AArch32 resets into
-                 * SVC, which Linux expects, so no privilege/exception level to
-                 * adjust.
-                 */
-                if (env->aarch64) {
-                    env->cp15.scr_el3 |= SCR_RW;
-                    if (arm_feature(env, ARM_FEATURE_EL2)) {
-                        env->cp15.hcr_el2 |= HCR_RW;
-                        env->pstate = PSTATE_MODE_EL2h;
-                    } else {
-                        env->pstate = PSTATE_MODE_EL1h;
-                    }
-                    if (cpu_isar_feature(aa64_pauth, cpu)) {
-                        env->cp15.scr_el3 |= SCR_API | SCR_APK;
-                    }
-                    if (cpu_isar_feature(aa64_mte, cpu)) {
-                        env->cp15.scr_el3 |= SCR_ATA;
-                    }
-                    if (cpu_isar_feature(aa64_sve, cpu)) {
-                        env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
-                        env->vfp.zcr_el[3] = 0xf;
-                    }
-                    if (cpu_isar_feature(aa64_sme, cpu)) {
-                        env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
-                        env->cp15.scr_el3 |= SCR_ENTP2;
-                        env->vfp.smcr_el[3] = 0xf;
-                    }
-                    if (cpu_isar_feature(aa64_hcx, cpu)) {
-                        env->cp15.scr_el3 |= SCR_HXEN;
-                    }
-                    if (cpu_isar_feature(aa64_fgt, cpu)) {
-                        env->cp15.scr_el3 |= SCR_FGTEN;
-                    }
+            int target_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
 
-                    /* AArch64 kernels never boot in secure mode */
-                    assert(!info->secure_boot);
-                    /* This hook is only supported for AArch32 currently:
-                     * bootloader_aarch64[] will not call the hook, and
-                     * the code above has already dropped us into EL2 or EL1.
-                     */
-                    assert(!info->secure_board_setup);
-                }
-
-                if (arm_feature(env, ARM_FEATURE_EL2)) {
-                    /* If we have EL2 then Linux expects the HVC insn to work */
-                    env->cp15.scr_el3 |= SCR_HCE;
-                }
-
-                /* Set to non-secure if not a secure boot */
-                if (!info->secure_boot &&
-                    (cs != first_cpu || !info->secure_board_setup)) {
-                    /* Linux expects non-secure state */
-                    env->cp15.scr_el3 |= SCR_NS;
-                    /* Set NSACR.{CP11,CP10} so NS can access the FPU */
-                    env->cp15.nsacr |= 3 << 10;
-                }
-            }
-
-            if (!env->aarch64 && !info->secure_boot &&
-                arm_feature(env, ARM_FEATURE_EL2)) {
+            if (env->aarch64) {
                 /*
-                 * This is an AArch32 boot not to Secure state, and
-                 * we have Hyp mode available, so boot the kernel into
-                 * Hyp mode. This is not how the CPU comes out of reset,
-                 * so we need to manually put it there.
+                 * AArch64 kernels never boot in secure mode, and we don't
+                 * support the secure_board_setup hook for AArch64.
                  */
-                cpsr_write(env, ARM_CPU_MODE_HYP, CPSR_M, CPSRWriteRaw);
+                assert(!info->secure_boot);
+                assert(!info->secure_board_setup);
+            } else {
+                if (arm_feature(env, ARM_FEATURE_EL3) &&
+                    (info->secure_boot ||
+                     (info->secure_board_setup && cs == first_cpu))) {
+                    /* Start this CPU in Secure SVC */
+                    target_el = 3;
+                }
             }
 
+            arm_emulate_firmware_reset(cs, target_el);
+
             if (cs == first_cpu) {
                 AddressSpace *as = arm_boot_address_space(cpu, info);
 
diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ static void arm_set_cpu_on_async_work(CPUState *target_cpu_state,
 
     /* Initialize the cpu we are turning on */
     cpu_reset(target_cpu_state);
+    arm_emulate_firmware_reset(target_cpu_state, info->target_el);
     target_cpu_state->halted = 0;
 
-    if (info->target_aa64) {
-        if ((info->target_el < 3) && arm_feature(&target_cpu->env,
-                                                 ARM_FEATURE_EL3)) {
-            /*
-             * As target mode is AArch64, we need to set lower
-             * exception level (the requested level 2) to AArch64
-             */
-            target_cpu->env.cp15.scr_el3 |= SCR_RW;
-        }
-
-        if ((info->target_el < 2) && arm_feature(&target_cpu->env,
-                                                 ARM_FEATURE_EL2)) {
-            /*
-             * As target mode is AArch64, we need to set lower
-             * exception level (the requested level 1) to AArch64
-             */
-            target_cpu->env.cp15.hcr_el2 |= HCR_RW;
-        }
-
-        target_cpu->env.pstate = aarch64_pstate_mode(info->target_el, true);
-    } else {
-        /* We are requested to boot in AArch32 mode */
-        static const uint32_t mode_for_el[] = { 0,
-                                                ARM_CPU_MODE_SVC,
-                                                ARM_CPU_MODE_HYP,
-                                                ARM_CPU_MODE_SVC };
-
-        cpsr_write(&target_cpu->env, mode_for_el[info->target_el], CPSR_M,
-                   CPSRWriteRaw);
-    }
-
-    if (info->target_el == 3) {
-        /* Processor is in secure mode */
-        target_cpu->env.cp15.scr_el3 &= ~SCR_NS;
-    } else {
-        /* Processor is not in secure mode */
-        target_cpu->env.cp15.scr_el3 |= SCR_NS;
-
-        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
-        target_cpu->env.cp15.nsacr |= 3 << 10;
-
-        /*
-         * If QEMU is providing the equivalent of EL3 firmware, then we need
-         * to make sure a CPU targeting EL2 comes out of reset with a
-         * functional HVC insn.
-         */
-        if (arm_feature(&target_cpu->env, ARM_FEATURE_EL3)
-            && info->target_el == 2) {
-            target_cpu->env.cp15.scr_el3 |= SCR_HCE;
-        }
-    }
-
     /* We check if the started CPU is now at the correct level */
     assert(info->target_el == arm_current_el(&target_cpu->env));
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj)
     }
 }
 
+void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
+{
+    ARMCPU *cpu = ARM_CPU(cpustate);
+    CPUARMState *env = &cpu->env;
+    bool have_el3 = arm_feature(env, ARM_FEATURE_EL3);
+    bool have_el2 = arm_feature(env, ARM_FEATURE_EL2);
+
+    /*
+     * Check we have the EL we're aiming for. If that is the
+     * highest implemented EL, then cpu_reset has already done
+     * all the work.
+     */
+    switch (target_el) {
+    case 3:
+        assert(have_el3);
+        return;
+    case 2:
+        assert(have_el2);
+        if (!have_el3) {
+            return;
+        }
+        break;
+    case 1:
+        if (!have_el3 && !have_el2) {
+            return;
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (have_el3) {
+        /*
+         * Set the EL3 state so code can run at EL2. This should match
+         * the requirements set by Linux in its booting spec.
+         */
+        if (env->aarch64) {
+            env->cp15.scr_el3 |= SCR_RW;
+            if (cpu_isar_feature(aa64_pauth, cpu)) {
+                env->cp15.scr_el3 |= SCR_API | SCR_APK;
+            }
+            if (cpu_isar_feature(aa64_mte, cpu)) {
+                env->cp15.scr_el3 |= SCR_ATA;
+            }
+            if (cpu_isar_feature(aa64_sve, cpu)) {
+                env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
+                env->vfp.zcr_el[3] = 0xf;
+            }
+            if (cpu_isar_feature(aa64_sme, cpu)) {
+                env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
+                env->cp15.scr_el3 |= SCR_ENTP2;
+                env->vfp.smcr_el[3] = 0xf;
+            }
+            if (cpu_isar_feature(aa64_hcx, cpu)) {
+                env->cp15.scr_el3 |= SCR_HXEN;
+            }
+            if (cpu_isar_feature(aa64_fgt, cpu)) {
+                env->cp15.scr_el3 |= SCR_FGTEN;
+            }
+        }
+
+        if (target_el == 2) {
+            /* If the guest is at EL2 then Linux expects the HVC insn to work */
+            env->cp15.scr_el3 |= SCR_HCE;
+        }
+
+        /* Put CPU into non-secure state */
+        env->cp15.scr_el3 |= SCR_NS;
+        /* Set NSACR.{CP11,CP10} so NS can access the FPU */
+        env->cp15.nsacr |= 3 << 10;
+    }
+
+    if (have_el2 && target_el < 2) {
+        /* Set EL2 state so code can run at EL1. */
+        if (env->aarch64) {
+            env->cp15.hcr_el2 |= HCR_RW;
+        }
+    }
+
+    /* Set the CPU to the desired state */
+    if (env->aarch64) {
+        env->pstate = aarch64_pstate_mode(target_el, true);
+    } else {
+        static const uint32_t mode_for_el[] = {
+            0,
+            ARM_CPU_MODE_SVC,
+            ARM_CPU_MODE_HYP,
+            ARM_CPU_MODE_SVC,
+        };
+
+        cpsr_write(env, mode_for_el[target_el], CPSR_M, CPSRWriteRaw);
+    }
+}
+
+
 #if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
 
 static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-- 
2.34.1

From: Chris Rauer <crauer@google.com>

The counter register is only 24-bits and counts down.  If the timer is
running but the qtimer to reset it hasn't fired off yet, there is a chance
the regster read can return an invalid result.

Signed-off-by: Chris Rauer <crauer@google.com>
Message-id: 20230922181411.2697135-1-crauer@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/npcm7xx_timer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/npcm7xx_timer.c
+++ b/hw/timer/npcm7xx_timer.c
@@ -XXX,XX +XXX,XX @@ static int64_t npcm7xx_timer_count_to_ns(NPCM7xxTimer *t, uint32_t count)
 /* Convert a time interval in nanoseconds to a timer cycle count. */
 static uint32_t npcm7xx_timer_ns_to_count(NPCM7xxTimer *t, int64_t ns)
 {
+    if (ns < 0) {
+        return 0;
+    }
     return clock_ns_to_ticks(t->ctrl->clock, ns) /
         npcm7xx_tcsr_prescaler(t->tcsr);
 }
-- 
2.34.1

From: Suraj Shirvankar <surajshirvankar@gmail.com>

QEMU coding style uses the glib memory allocation APIs, not
the raw libc malloc/free. Switch the allocation and free
calls in elf2dmp to use these functions (dropping the now-unneeded
checks for failure).

Signed-off-by: Suraj Shirvankar <surajshirvankar@gmail.com>
Message-id: 169753938460.23804.11418813007617535750-1@git.sr.ht
[PMM: also remove NULL checks from g_malloc() calls;
 beef up commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/addrspace.c |  7 ++-----
 contrib/elf2dmp/main.c      |  9 +++------
 contrib/elf2dmp/pdb.c       | 19 ++++++++-----------
 contrib/elf2dmp/qemu_elf.c  |  7 ++-----
 4 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/addrspace.c
+++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@ int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
         }
     }
 
-    ps->block = malloc(sizeof(*ps->block) * ps->block_nr);
-    if (!ps->block) {
-        return 1;
-    }
+    ps->block = g_new(struct pa_block, ps->block_nr);
 
     for (i = 0; i < phdr_nr; i++) {
         if (phdr[i].p_type == PT_LOAD) {
@@ -XXX,XX +XXX,XX @@ int pa_space_create(struct pa_space *ps, QEMU_Elf *qemu_elf)
 void pa_space_destroy(struct pa_space *ps)
 {
     ps->block_nr = 0;
-    free(ps->block);
+    g_free(ps->block);
 }
 
 void va_space_set_dtb(struct va_space *vs, uint64_t dtb)
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static KDDEBUGGER_DATA64 *get_kdbg(uint64_t KernBase, struct pdb_reader *pdb,
         }
     }
 
-    kdbg = malloc(kdbg_hdr.Size);
-    if (!kdbg) {
-        return NULL;
-    }
+    kdbg = g_malloc(kdbg_hdr.Size);
 
     if (va_space_rw(vs, KdDebuggerDataBlock, kdbg, kdbg_hdr.Size, 0)) {
         eprintf("Failed to extract entire KDBG\n");
-        free(kdbg);
+        g_free(kdbg);
         return NULL;
     }
 
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     }
 
 out_kdbg:
-    free(kdbg);
+    g_free(kdbg);
 out_pdb:
     pdb_exit(&pdb);
 out_pdb_file:
diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pdb.c
+++ b/contrib/elf2dmp/pdb.c
@@ -XXX,XX +XXX,XX @@ uint64_t pdb_resolve(uint64_t img_base, struct pdb_reader *r, const char *name)
 
 static void pdb_reader_ds_exit(struct pdb_reader *r)
 {
-    free(r->ds.toc);
+    g_free(r->ds.toc);
 }
 
 static void pdb_exit_symbols(struct pdb_reader *r)
 {
-    free(r->modimage);
-    free(r->symbols);
+    g_free(r->modimage);
+    g_free(r->symbols);
 }
 
 static void pdb_exit_segments(struct pdb_reader *r)
 {
-    free(r->segs);
+    g_free(r->segs);
 }
 
 static void *pdb_ds_read(const PDB_DS_HEADER *header,
@@ -XXX,XX +XXX,XX @@ static void *pdb_ds_read(const PDB_DS_HEADER *header,
 
     nBlocks = (size + header->block_size - 1) / header->block_size;
 
-    buffer = malloc(nBlocks * header->block_size);
-    if (!buffer) {
-        return NULL;
-    }
+    buffer = g_malloc(nBlocks * header->block_size);
 
     for (i = 0; i < nBlocks; i++) {
         memcpy(buffer + i * header->block_size, (const char *)header +
@@ -XXX,XX +XXX,XX @@ static int pdb_init_symbols(struct pdb_reader *r)
     return 0;
 
 out_symbols:
-    free(symbols);
+    g_free(symbols);
 
     return err;
 }
@@ -XXX,XX +XXX,XX @@ static int pdb_reader_init(struct pdb_reader *r, void *data)
 out_sym:
     pdb_exit_symbols(r);
 out_root:
-    free(r->ds.root);
+    g_free(r->ds.root);
 out_ds:
     pdb_reader_ds_exit(r);
 
@@ -XXX,XX +XXX,XX @@ static void pdb_reader_exit(struct pdb_reader *r)
 {
     pdb_exit_segments(r);
     pdb_exit_symbols(r);
-    free(r->ds.root);
+    g_free(r->ds.root);
     pdb_reader_ds_exit(r);
 }
 
diff --git a/contrib/elf2dmp/qemu_elf.c b/contrib/elf2dmp/qemu_elf.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/qemu_elf.c
+++ b/contrib/elf2dmp/qemu_elf.c
@@ -XXX,XX +XXX,XX @@ static int init_states(QEMU_Elf *qe)
 
     printf("%zu CPU states has been found\n", cpu_nr);
 
-    qe->state = malloc(sizeof(*qe->state) * cpu_nr);
-    if (!qe->state) {
-        return 1;
-    }
+    qe->state = g_new(QEMUCPUState*, cpu_nr);
 
     cpu_nr = 0;
 
@@ -XXX,XX +XXX,XX @@ static int init_states(QEMU_Elf *qe)
 
 static void exit_states(QEMU_Elf *qe)
 {
-    free(qe->state);
+    g_free(qe->state);
 }
 
 static bool check_ehdr(QEMU_Elf *qe)
-- 
2.34.1