Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream' into staging

Xilinx queue

# gpg: Signature made Fri 26 Jan 2018 10:17:01 GMT
# gpg:                using RSA key 0x29C596780F6BCA83
# gpg: Good signature from "Edgar E. Iglesias (Xilinx key) <edgar.iglesias@xilinx.com>"
# gpg:                 aka "Edgar E. Iglesias <edgar.iglesias@gmail.com>"
# Primary key fingerprint: AC44 FEDC 14F7 F1EB EDBF  4151 29C5 9678 0F6B CA83

* remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream:
  xlnx-zynqmp: Connect the IPI device to the ZynqMP SoC
  xlnx-zynqmp-pmu: Connect the IPI device to the PMU
  xlnx-zynqmp-ipi: Initial version of the Xilinx IPI device
  xlnx-zynqmp-pmu: Connect the PMU interrupt controller
  xlnx-pmu-iomod-intc: Add the PMU Interrupt controller
  aarch64-softmmu.mak: Use an ARM specific config
  xlnx-zynqmp-pmu: Add the CPU and memory
  xlnx-zynqmp-pmu: Initial commit of the ZynqMP PMU
  microblaze: boot.c: Don't try to find NULL file

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

10 files changed, 1156 insertions, 3 deletions

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index 2794e086d6..1c896bafb4 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -13,7 +13,7 @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
+obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index 325642058b..ca398c4159 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -50,6 +50,9 @@
 #define DPDMA_ADDR          0xfd4c0000
 #define DPDMA_IRQ           116
 
+#define IPI_ADDR            0xFF300000
+#define IPI_IRQ             64
+
 static const uint64_t gem_addr[XLNX_ZYNQMP_NUM_GEMS] = {
     0xFF0B0000, 0xFF0C0000, 0xFF0D0000, 0xFF0E0000,
 };
@@ -183,6 +186,9 @@ static void xlnx_zynqmp_init(Object *obj)
 
     object_initialize(&s->dpdma, sizeof(s->dpdma), TYPE_XLNX_DPDMA);
     qdev_set_parent_bus(DEVICE(&s->dpdma), sysbus_get_default());
+
+    object_initialize(&s->ipi, sizeof(s->ipi), TYPE_XLNX_ZYNQMP_IPI);
+    qdev_set_parent_bus(DEVICE(&s->ipi), sysbus_get_default());
 }
 
 static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
@@ -454,6 +460,14 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
                              &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->dpdma), 0, DPDMA_ADDR);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->dpdma), 0, gic_spi[DPDMA_IRQ]);
+
+    object_property_set_bool(OBJECT(&s->ipi), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->ipi), 0, IPI_ADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->ipi), 0, gic_spi[IPI_IRQ]);
 }
 
 static Property xlnx_zynqmp_props[] = {
diff --git a/hw/display/Makefile.objs b/hw/display/Makefile.objs
index 551c050a6a..d3a4cb396e 100644
--- a/hw/display/Makefile.objs
+++ b/hw/display/Makefile.objs
@@ -40,4 +40,4 @@ virtio-gpu.o-libs += $(VIRGL_LIBS)
 virtio-gpu-3d.o-cflags := $(VIRGL_CFLAGS)
 virtio-gpu-3d.o-libs += $(VIRGL_LIBS)
 obj-$(CONFIG_DPCD) += dpcd.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx_dp.o
+obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx_dp.o
diff --git a/hw/dma/Makefile.objs b/hw/dma/Makefile.objs
index 0b3a009b87..c2afecbf73 100644
--- a/hw/dma/Makefile.objs
+++ b/hw/dma/Makefile.objs
@@ -9,6 +9,7 @@ common-obj-$(CONFIG_ZYNQ_DEVCFG) += xlnx-zynq-devcfg.o
 common-obj-$(CONFIG_ETRAXFS) += etraxfs_dma.o
 common-obj-$(CONFIG_STP2000) += sparc32_dma.o
 obj-$(CONFIG_XLNX_ZYNQMP) += xlnx_dpdma.o
+obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx_dpdma.o
 
 obj-$(CONFIG_OMAP) += omap_dma.o soc_dma.o
 obj-$(CONFIG_PXA2XX) += pxa2xx_dma.o
diff --git a/hw/intc/Makefile.objs b/hw/intc/Makefile.objs
index ae358569a1..571e094a14 100644
--- a/hw/intc/Makefile.objs
+++ b/hw/intc/Makefile.objs
@@ -3,6 +3,8 @@ common-obj-$(CONFIG_I8259) += i8259_common.o i8259.o
 common-obj-$(CONFIG_PL190) += pl190.o
 common-obj-$(CONFIG_PUV3) += puv3_intc.o
 common-obj-$(CONFIG_XILINX) += xilinx_intc.o
+common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-pmu-iomod-intc.o
+common-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp-ipi.o
 common-obj-$(CONFIG_ETRAXFS) += etraxfs_pic.o
 common-obj-$(CONFIG_IMX) += imx_avic.o
 common-obj-$(CONFIG_LM32) += lm32_pic.o
diff --git a/hw/intc/xlnx-pmu-iomod-intc.c b/hw/intc/xlnx-pmu-iomod-intc.c
new file mode 100644
index 0000000000..59235351ba
--- /dev/null
+++ b/hw/intc/xlnx-pmu-iomod-intc.c
@@ -0,0 +1,554 @@
+/*
+ * QEMU model of Xilinx I/O Module Interrupt Controller
+ *
+ * Copyright (c) 2013 Xilinx Inc
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ * Written by Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "hw/intc/xlnx-pmu-iomod-intc.h"
+
+#ifndef XLNX_PMU_IO_INTC_ERR_DEBUG
+#define XLNX_PMU_IO_INTC_ERR_DEBUG 0
+#endif
+
+#define DB_PRINT_L(lvl, fmt, args...) do {\
+    if (XLNX_PMU_IO_INTC_ERR_DEBUG >= lvl) {\
+        qemu_log(TYPE_XLNX_PMU_IO_INTC ": %s:" fmt, __func__, ## args);\
+    } \
+} while (0)
+
+#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
+
+REG32(IRQ_MODE, 0xc)
+REG32(GPO0, 0x10)
+    FIELD(GPO0, MAGIC_WORD_1, 24, 8)
+    FIELD(GPO0, MAGIC_WORD_2, 16, 8)
+    FIELD(GPO0, FT_INJECT_FAILURE, 13, 3)
+    FIELD(GPO0, DISABLE_RST_FTSM, 12, 1)
+    FIELD(GPO0, RST_FTSM, 11, 1)
+    FIELD(GPO0, CLR_FTSTS, 10, 1)
+    FIELD(GPO0, RST_ON_SLEEP, 9, 1)
+    FIELD(GPO0, DISABLE_TRACE_COMP, 8, 1)
+    FIELD(GPO0, PIT3_PRESCALE, 7, 1)
+    FIELD(GPO0, PIT2_PRESCALE, 5, 2)
+    FIELD(GPO0, PIT1_PRESCALE, 3, 2)
+    FIELD(GPO0, PIT0_PRESCALE, 1, 2)
+    FIELD(GPO0, DEBUG_REMAP, 0, 1)
+REG32(GPO1, 0x14)
+    FIELD(GPO1, MIO_5, 5, 1)
+    FIELD(GPO1, MIO_4, 4, 1)
+    FIELD(GPO1, MIO_3, 3, 1)
+    FIELD(GPO1, MIO_2, 2, 1)
+    FIELD(GPO1, MIO_1, 1, 1)
+    FIELD(GPO1, MIO_0, 0, 1)
+REG32(GPO2, 0x18)
+    FIELD(GPO2, DAP_RPU_WAKE_ACK, 9, 1)
+    FIELD(GPO2, DAP_FP_WAKE_ACK, 8, 1)
+    FIELD(GPO2, PS_STATUS, 7, 1)
+    FIELD(GPO2, PCAP_EN, 6, 1)
+REG32(GPO3, 0x1c)
+    FIELD(GPO3, PL_GPO_31, 31, 1)
+    FIELD(GPO3, PL_GPO_30, 30, 1)
+    FIELD(GPO3, PL_GPO_29, 29, 1)
+    FIELD(GPO3, PL_GPO_28, 28, 1)
+    FIELD(GPO3, PL_GPO_27, 27, 1)
+    FIELD(GPO3, PL_GPO_26, 26, 1)
+    FIELD(GPO3, PL_GPO_25, 25, 1)
+    FIELD(GPO3, PL_GPO_24, 24, 1)
+    FIELD(GPO3, PL_GPO_23, 23, 1)
+    FIELD(GPO3, PL_GPO_22, 22, 1)
+    FIELD(GPO3, PL_GPO_21, 21, 1)
+    FIELD(GPO3, PL_GPO_20, 20, 1)
+    FIELD(GPO3, PL_GPO_19, 19, 1)
+    FIELD(GPO3, PL_GPO_18, 18, 1)
+    FIELD(GPO3, PL_GPO_17, 17, 1)
+    FIELD(GPO3, PL_GPO_16, 16, 1)
+    FIELD(GPO3, PL_GPO_15, 15, 1)
+    FIELD(GPO3, PL_GPO_14, 14, 1)
+    FIELD(GPO3, PL_GPO_13, 13, 1)
+    FIELD(GPO3, PL_GPO_12, 12, 1)
+    FIELD(GPO3, PL_GPO_11, 11, 1)
+    FIELD(GPO3, PL_GPO_10, 10, 1)
+    FIELD(GPO3, PL_GPO_9, 9, 1)
+    FIELD(GPO3, PL_GPO_8, 8, 1)
+    FIELD(GPO3, PL_GPO_7, 7, 1)
+    FIELD(GPO3, PL_GPO_6, 6, 1)
+    FIELD(GPO3, PL_GPO_5, 5, 1)
+    FIELD(GPO3, PL_GPO_4, 4, 1)
+    FIELD(GPO3, PL_GPO_3, 3, 1)
+    FIELD(GPO3, PL_GPO_2, 2, 1)
+    FIELD(GPO3, PL_GPO_1, 1, 1)
+    FIELD(GPO3, PL_GPO_0, 0, 1)
+REG32(GPI0, 0x20)
+    FIELD(GPI0, RFT_ECC_FATAL_ERR, 31, 1)
+    FIELD(GPI0, RFT_VOTER_ERR, 30, 1)
+    FIELD(GPI0, RFT_COMPARE_ERR_23, 29, 1)
+    FIELD(GPI0, RFT_COMPARE_ERR_13, 28, 1)
+    FIELD(GPI0, RFT_COMPARE_ERR_12, 27, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_23_B, 26, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_13_B, 25, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_12_B, 24, 1)
+    FIELD(GPI0, RFT_MISMATCH_STATE, 23, 1)
+    FIELD(GPI0, RFT_MISMATCH_CPU, 22, 1)
+    FIELD(GPI0, RFT_SLEEP_RESET, 19, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_23_A, 18, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_13_A, 17, 1)
+    FIELD(GPI0, RFT_LS_MISMATCH_12_A, 16, 1)
+    FIELD(GPI0, NFT_ECC_FATAL_ERR, 15, 1)
+    FIELD(GPI0, NFT_VOTER_ERR, 14, 1)
+    FIELD(GPI0, NFT_COMPARE_ERR_23, 13, 1)
+    FIELD(GPI0, NFT_COMPARE_ERR_13, 12, 1)
+    FIELD(GPI0, NFT_COMPARE_ERR_12, 11, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_23_B, 10, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_13_B, 9, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_12_B, 8, 1)
+    FIELD(GPI0, NFT_MISMATCH_STATE, 7, 1)
+    FIELD(GPI0, NFT_MISMATCH_CPU, 6, 1)
+    FIELD(GPI0, NFT_SLEEP_RESET, 3, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_23_A, 2, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_13_A, 1, 1)
+    FIELD(GPI0, NFT_LS_MISMATCH_12_A, 0, 1)
+REG32(GPI1, 0x24)
+    FIELD(GPI1, APB_AIB_ERROR, 31, 1)
+    FIELD(GPI1, AXI_AIB_ERROR, 30, 1)
+    FIELD(GPI1, ERROR_2, 29, 1)
+    FIELD(GPI1, ERROR_1, 28, 1)
+    FIELD(GPI1, ACPU_3_DBG_PWRUP, 23, 1)
+    FIELD(GPI1, ACPU_2_DBG_PWRUP, 22, 1)
+    FIELD(GPI1, ACPU_1_DBG_PWRUP, 21, 1)
+    FIELD(GPI1, ACPU_0_DBG_PWRUP, 20, 1)
+    FIELD(GPI1, FPD_WAKE_GIC_PROXY, 16, 1)
+    FIELD(GPI1, MIO_WAKE_5, 15, 1)
+    FIELD(GPI1, MIO_WAKE_4, 14, 1)
+    FIELD(GPI1, MIO_WAKE_3, 13, 1)
+    FIELD(GPI1, MIO_WAKE_2, 12, 1)
+    FIELD(GPI1, MIO_WAKE_1, 11, 1)
+    FIELD(GPI1, MIO_WAKE_0, 10, 1)
+    FIELD(GPI1, DAP_RPU_WAKE, 9, 1)
+    FIELD(GPI1, DAP_FPD_WAKE, 8, 1)
+    FIELD(GPI1, USB_1_WAKE, 7, 1)
+    FIELD(GPI1, USB_0_WAKE, 6, 1)
+    FIELD(GPI1, R5_1_WAKE, 5, 1)
+    FIELD(GPI1, R5_0_WAKE, 4, 1)
+    FIELD(GPI1, ACPU_3_WAKE, 3, 1)
+    FIELD(GPI1, ACPU_2_WAKE, 2, 1)
+    FIELD(GPI1, ACPU_1_WAKE, 1, 1)
+    FIELD(GPI1, ACPU_0_WAKE, 0, 1)
+REG32(GPI2, 0x28)
+    FIELD(GPI2, VCC_INT_FP_DISCONNECT, 31, 1)
+    FIELD(GPI2, VCC_INT_DISCONNECT, 30, 1)
+    FIELD(GPI2, VCC_AUX_DISCONNECT, 29, 1)
+    FIELD(GPI2, DBG_ACPU3_RST_REQ, 23, 1)
+    FIELD(GPI2, DBG_ACPU2_RST_REQ, 22, 1)
+    FIELD(GPI2, DBG_ACPU1_RST_REQ, 21, 1)
+    FIELD(GPI2, DBG_ACPU0_RST_REQ, 20, 1)
+    FIELD(GPI2, CP_ACPU3_RST_REQ, 19, 1)
+    FIELD(GPI2, CP_ACPU2_RST_REQ, 18, 1)
+    FIELD(GPI2, CP_ACPU1_RST_REQ, 17, 1)
+    FIELD(GPI2, CP_ACPU0_RST_REQ, 16, 1)
+    FIELD(GPI2, DBG_RCPU1_RST_REQ, 9, 1)
+    FIELD(GPI2, DBG_RCPU0_RST_REQ, 8, 1)
+    FIELD(GPI2, R5_1_SLEEP, 5, 1)
+    FIELD(GPI2, R5_0_SLEEP, 4, 1)
+    FIELD(GPI2, ACPU_3_SLEEP, 3, 1)
+    FIELD(GPI2, ACPU_2_SLEEP, 2, 1)
+    FIELD(GPI2, ACPU_1_SLEEP, 1, 1)
+    FIELD(GPI2, ACPU_0_SLEEP, 0, 1)
+REG32(GPI3, 0x2c)
+    FIELD(GPI3, PL_GPI_31, 31, 1)
+    FIELD(GPI3, PL_GPI_30, 30, 1)
+    FIELD(GPI3, PL_GPI_29, 29, 1)
+    FIELD(GPI3, PL_GPI_28, 28, 1)
+    FIELD(GPI3, PL_GPI_27, 27, 1)
+    FIELD(GPI3, PL_GPI_26, 26, 1)
+    FIELD(GPI3, PL_GPI_25, 25, 1)
+    FIELD(GPI3, PL_GPI_24, 24, 1)
+    FIELD(GPI3, PL_GPI_23, 23, 1)
+    FIELD(GPI3, PL_GPI_22, 22, 1)
+    FIELD(GPI3, PL_GPI_21, 21, 1)
+    FIELD(GPI3, PL_GPI_20, 20, 1)
+    FIELD(GPI3, PL_GPI_19, 19, 1)
+    FIELD(GPI3, PL_GPI_18, 18, 1)
+    FIELD(GPI3, PL_GPI_17, 17, 1)
+    FIELD(GPI3, PL_GPI_16, 16, 1)
+    FIELD(GPI3, PL_GPI_15, 15, 1)
+    FIELD(GPI3, PL_GPI_14, 14, 1)
+    FIELD(GPI3, PL_GPI_13, 13, 1)
+    FIELD(GPI3, PL_GPI_12, 12, 1)
+    FIELD(GPI3, PL_GPI_11, 11, 1)
+    FIELD(GPI3, PL_GPI_10, 10, 1)
+    FIELD(GPI3, PL_GPI_9, 9, 1)
+    FIELD(GPI3, PL_GPI_8, 8, 1)
+    FIELD(GPI3, PL_GPI_7, 7, 1)
+    FIELD(GPI3, PL_GPI_6, 6, 1)
+    FIELD(GPI3, PL_GPI_5, 5, 1)
+    FIELD(GPI3, PL_GPI_4, 4, 1)
+    FIELD(GPI3, PL_GPI_3, 3, 1)
+    FIELD(GPI3, PL_GPI_2, 2, 1)
+    FIELD(GPI3, PL_GPI_1, 1, 1)
+    FIELD(GPI3, PL_GPI_0, 0, 1)
+REG32(IRQ_STATUS, 0x30)
+    FIELD(IRQ_STATUS, CSU_PMU_SEC_LOCK, 31, 1)
+    FIELD(IRQ_STATUS, INV_ADDR, 29, 1)
+    FIELD(IRQ_STATUS, PWR_DN_REQ, 28, 1)
+    FIELD(IRQ_STATUS, PWR_UP_REQ, 27, 1)
+    FIELD(IRQ_STATUS, SW_RST_REQ, 26, 1)
+    FIELD(IRQ_STATUS, HW_RST_REQ, 25, 1)
+    FIELD(IRQ_STATUS, ISO_REQ, 24, 1)
+    FIELD(IRQ_STATUS, FW_REQ, 23, 1)
+    FIELD(IRQ_STATUS, IPI3, 22, 1)
+    FIELD(IRQ_STATUS, IPI2, 21, 1)
+    FIELD(IRQ_STATUS, IPI1, 20, 1)
+    FIELD(IRQ_STATUS, IPI0, 19, 1)
+    FIELD(IRQ_STATUS, RTC_ALARM, 18, 1)
+    FIELD(IRQ_STATUS, RTC_EVERY_SECOND, 17, 1)
+    FIELD(IRQ_STATUS, CORRECTABLE_ECC, 16, 1)
+    FIELD(IRQ_STATUS, GPI3, 14, 1)
+    FIELD(IRQ_STATUS, GPI2, 13, 1)
+    FIELD(IRQ_STATUS, GPI1, 12, 1)
+    FIELD(IRQ_STATUS, GPI0, 11, 1)
+    FIELD(IRQ_STATUS, PIT3, 6, 1)
+    FIELD(IRQ_STATUS, PIT2, 5, 1)
+    FIELD(IRQ_STATUS, PIT1, 4, 1)
+    FIELD(IRQ_STATUS, PIT0, 3, 1)
+REG32(IRQ_PENDING, 0x34)
+    FIELD(IRQ_PENDING, CSU_PMU_SEC_LOCK, 31, 1)
+    FIELD(IRQ_PENDING, INV_ADDR, 29, 1)
+    FIELD(IRQ_PENDING, PWR_DN_REQ, 28, 1)
+    FIELD(IRQ_PENDING, PWR_UP_REQ, 27, 1)
+    FIELD(IRQ_PENDING, SW_RST_REQ, 26, 1)
+    FIELD(IRQ_PENDING, HW_RST_REQ, 25, 1)
+    FIELD(IRQ_PENDING, ISO_REQ, 24, 1)
+    FIELD(IRQ_PENDING, FW_REQ, 23, 1)
+    FIELD(IRQ_PENDING, IPI3, 22, 1)
+    FIELD(IRQ_PENDING, IPI2, 21, 1)
+    FIELD(IRQ_PENDING, IPI1, 20, 1)
+    FIELD(IRQ_PENDING, IPI0, 19, 1)
+    FIELD(IRQ_PENDING, RTC_ALARM, 18, 1)
+    FIELD(IRQ_PENDING, RTC_EVERY_SECOND, 17, 1)
+    FIELD(IRQ_PENDING, CORRECTABLE_ECC, 16, 1)
+    FIELD(IRQ_PENDING, GPI3, 14, 1)
+    FIELD(IRQ_PENDING, GPI2, 13, 1)
+    FIELD(IRQ_PENDING, GPI1, 12, 1)
+    FIELD(IRQ_PENDING, GPI0, 11, 1)
+    FIELD(IRQ_PENDING, PIT3, 6, 1)
+    FIELD(IRQ_PENDING, PIT2, 5, 1)
+    FIELD(IRQ_PENDING, PIT1, 4, 1)
+    FIELD(IRQ_PENDING, PIT0, 3, 1)
+REG32(IRQ_ENABLE, 0x38)
+    FIELD(IRQ_ENABLE, CSU_PMU_SEC_LOCK, 31, 1)
+    FIELD(IRQ_ENABLE, INV_ADDR, 29, 1)
+    FIELD(IRQ_ENABLE, PWR_DN_REQ, 28, 1)
+    FIELD(IRQ_ENABLE, PWR_UP_REQ, 27, 1)
+    FIELD(IRQ_ENABLE, SW_RST_REQ, 26, 1)
+    FIELD(IRQ_ENABLE, HW_RST_REQ, 25, 1)
+    FIELD(IRQ_ENABLE, ISO_REQ, 24, 1)
+    FIELD(IRQ_ENABLE, FW_REQ, 23, 1)
+    FIELD(IRQ_ENABLE, IPI3, 22, 1)
+    FIELD(IRQ_ENABLE, IPI2, 21, 1)
+    FIELD(IRQ_ENABLE, IPI1, 20, 1)
+    FIELD(IRQ_ENABLE, IPI0, 19, 1)
+    FIELD(IRQ_ENABLE, RTC_ALARM, 18, 1)
+    FIELD(IRQ_ENABLE, RTC_EVERY_SECOND, 17, 1)
+    FIELD(IRQ_ENABLE, CORRECTABLE_ECC, 16, 1)
+    FIELD(IRQ_ENABLE, GPI3, 14, 1)
+    FIELD(IRQ_ENABLE, GPI2, 13, 1)
+    FIELD(IRQ_ENABLE, GPI1, 12, 1)
+    FIELD(IRQ_ENABLE, GPI0, 11, 1)
+    FIELD(IRQ_ENABLE, PIT3, 6, 1)
+    FIELD(IRQ_ENABLE, PIT2, 5, 1)
+    FIELD(IRQ_ENABLE, PIT1, 4, 1)
+    FIELD(IRQ_ENABLE, PIT0, 3, 1)
+REG32(IRQ_ACK, 0x3c)
+    FIELD(IRQ_ACK, CSU_PMU_SEC_LOCK, 31, 1)
+    FIELD(IRQ_ACK, INV_ADDR, 29, 1)
+    FIELD(IRQ_ACK, PWR_DN_REQ, 28, 1)
+    FIELD(IRQ_ACK, PWR_UP_REQ, 27, 1)
+    FIELD(IRQ_ACK, SW_RST_REQ, 26, 1)
+    FIELD(IRQ_ACK, HW_RST_REQ, 25, 1)
+    FIELD(IRQ_ACK, ISO_REQ, 24, 1)
+    FIELD(IRQ_ACK, FW_REQ, 23, 1)
+    FIELD(IRQ_ACK, IPI3, 22, 1)
+    FIELD(IRQ_ACK, IPI2, 21, 1)
+    FIELD(IRQ_ACK, IPI1, 20, 1)
+    FIELD(IRQ_ACK, IPI0, 19, 1)
+    FIELD(IRQ_ACK, RTC_ALARM, 18, 1)
+    FIELD(IRQ_ACK, RTC_EVERY_SECOND, 17, 1)
+    FIELD(IRQ_ACK, CORRECTABLE_ECC, 16, 1)
+    FIELD(IRQ_ACK, GPI3, 14, 1)
+    FIELD(IRQ_ACK, GPI2, 13, 1)
+    FIELD(IRQ_ACK, GPI1, 12, 1)
+    FIELD(IRQ_ACK, GPI0, 11, 1)
+    FIELD(IRQ_ACK, PIT3, 6, 1)
+    FIELD(IRQ_ACK, PIT2, 5, 1)
+    FIELD(IRQ_ACK, PIT1, 4, 1)
+    FIELD(IRQ_ACK, PIT0, 3, 1)
+REG32(PIT0_PRELOAD, 0x40)
+REG32(PIT0_COUNTER, 0x44)
+REG32(PIT0_CONTROL, 0x48)
+    FIELD(PIT0_CONTROL, PRELOAD, 1, 1)
+    FIELD(PIT0_CONTROL, EN, 0, 1)
+REG32(PIT1_PRELOAD, 0x50)
+REG32(PIT1_COUNTER, 0x54)
+REG32(PIT1_CONTROL, 0x58)
+    FIELD(PIT1_CONTROL, PRELOAD, 1, 1)
+    FIELD(PIT1_CONTROL, EN, 0, 1)
+REG32(PIT2_PRELOAD, 0x60)
+REG32(PIT2_COUNTER, 0x64)
+REG32(PIT2_CONTROL, 0x68)
+    FIELD(PIT2_CONTROL, PRELOAD, 1, 1)
+    FIELD(PIT2_CONTROL, EN, 0, 1)
+REG32(PIT3_PRELOAD, 0x70)
+REG32(PIT3_COUNTER, 0x74)
+REG32(PIT3_CONTROL, 0x78)
+    FIELD(PIT3_CONTROL, PRELOAD, 1, 1)
+    FIELD(PIT3_CONTROL, EN, 0, 1)
+
+static void xlnx_pmu_io_irq_update(XlnxPMUIOIntc *s)
+{
+    bool irq_out;
+
+    s->regs[R_IRQ_PENDING] = s->regs[R_IRQ_STATUS] & s->regs[R_IRQ_ENABLE];
+    irq_out = !!s->regs[R_IRQ_PENDING];
+
+    DB_PRINT("Setting IRQ output = %d\n", irq_out);
+
+    qemu_set_irq(s->parent_irq, irq_out);
+}
+
+static void xlnx_pmu_io_irq_enable_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(reg->opaque);
+
+    xlnx_pmu_io_irq_update(s);
+}
+
+static void xlnx_pmu_io_irq_ack_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(reg->opaque);
+    uint32_t val = val64;
+
+    /* Only clear */
+    val &= s->regs[R_IRQ_STATUS];
+    s->regs[R_IRQ_STATUS] ^= val;
+
+    /* Active level triggered interrupts stay high.  */
+    s->regs[R_IRQ_STATUS] |= s->irq_raw & ~s->cfg.level_edge;
+
+    xlnx_pmu_io_irq_update(s);
+}
+
+static const RegisterAccessInfo xlnx_pmu_io_intc_regs_info[] = {
+    {   .name = "IRQ_MODE",  .addr = A_IRQ_MODE,
+        .rsvd = 0xffffffff,
+    },{ .name = "GPO0",  .addr = A_GPO0,
+    },{ .name = "GPO1",  .addr = A_GPO1,
+        .rsvd = 0xffffffc0,
+    },{ .name = "GPO2",  .addr = A_GPO2,
+        .rsvd = 0xfffffc3f,
+    },{ .name = "GPO3",  .addr = A_GPO3,
+    },{ .name = "GPI0",  .addr = A_GPI0,
+        .rsvd = 0x300030,
+        .ro = 0xffcfffcf,
+    },{ .name = "GPI1",  .addr = A_GPI1,
+        .rsvd = 0xf0e0000,
+        .ro = 0xf0f1ffff,
+    },{ .name = "GPI2",  .addr = A_GPI2,
+        .rsvd = 0x1f00fcc0,
+        .ro = 0xe0ff033f,
+    },{ .name = "GPI3",  .addr = A_GPI3,
+        .ro = 0xffffffff,
+    },{ .name = "IRQ_STATUS",  .addr = A_IRQ_STATUS,
+        .rsvd = 0x40008787,
+        .ro = 0xbfff7878,
+    },{ .name = "IRQ_PENDING",  .addr = A_IRQ_PENDING,
+        .rsvd = 0x40008787,
+        .ro = 0xdfff7ff8,
+    },{ .name = "IRQ_ENABLE",  .addr = A_IRQ_ENABLE,
+        .rsvd = 0x40008787,
+        .ro = 0x7800,
+        .post_write = xlnx_pmu_io_irq_enable_postw,
+    },{ .name = "IRQ_ACK",  .addr = A_IRQ_ACK,
+        .rsvd = 0x40008787,
+        .post_write = xlnx_pmu_io_irq_ack_postw,
+    },{ .name = "PIT0_PRELOAD",  .addr = A_PIT0_PRELOAD,
+        .ro = 0xffffffff,
+    },{ .name = "PIT0_COUNTER",  .addr = A_PIT0_COUNTER,
+        .ro = 0xffffffff,
+    },{ .name = "PIT0_CONTROL",  .addr = A_PIT0_CONTROL,
+        .rsvd = 0xfffffffc,
+    },{ .name = "PIT1_PRELOAD",  .addr = A_PIT1_PRELOAD,
+        .ro = 0xffffffff,
+    },{ .name = "PIT1_COUNTER",  .addr = A_PIT1_COUNTER,
+        .ro = 0xffffffff,
+    },{ .name = "PIT1_CONTROL",  .addr = A_PIT1_CONTROL,
+        .rsvd = 0xfffffffc,
+    },{ .name = "PIT2_PRELOAD",  .addr = A_PIT2_PRELOAD,
+        .ro = 0xffffffff,
+    },{ .name = "PIT2_COUNTER",  .addr = A_PIT2_COUNTER,
+        .ro = 0xffffffff,
+    },{ .name = "PIT2_CONTROL",  .addr = A_PIT2_CONTROL,
+        .rsvd = 0xfffffffc,
+    },{ .name = "PIT3_PRELOAD",  .addr = A_PIT3_PRELOAD,
+        .ro = 0xffffffff,
+    },{ .name = "PIT3_COUNTER",  .addr = A_PIT3_COUNTER,
+        .ro = 0xffffffff,
+    },{ .name = "PIT3_CONTROL",  .addr = A_PIT3_CONTROL,
+        .rsvd = 0xfffffffc,
+    }
+};
+
+static void irq_handler(void *opaque, int irq, int level)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(opaque);
+    uint32_t mask = 1 << irq;
+    uint32_t prev = s->irq_raw;
+    uint32_t temp;
+
+    s->irq_raw &= ~mask;
+    s->irq_raw |= (!!level) << irq;
+
+    /* Turn active-low into active-high.  */
+    s->irq_raw ^= (~s->cfg.positive);
+    s->irq_raw &= mask;
+
+    if (s->cfg.level_edge & mask) {
+        /* Edge triggered.  */
+        temp = (prev ^ s->irq_raw) & s->irq_raw;
+    } else {
+        /* Level triggered.  */
+        temp = s->irq_raw;
+    }
+    s->regs[R_IRQ_STATUS] |= temp;
+
+    xlnx_pmu_io_irq_update(s);
+}
+
+static void xlnx_pmu_io_intc_reset(DeviceState *dev)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(dev);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    xlnx_pmu_io_irq_update(s);
+}
+
+static const MemoryRegionOps xlnx_pmu_io_intc_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static Property xlnx_pmu_io_intc_properties[] = {
+    DEFINE_PROP_UINT32("intc-intr-size", XlnxPMUIOIntc, cfg.intr_size, 0),
+    DEFINE_PROP_UINT32("intc-level-edge", XlnxPMUIOIntc, cfg.level_edge, 0),
+    DEFINE_PROP_UINT32("intc-positive", XlnxPMUIOIntc, cfg.positive, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xlnx_pmu_io_intc_realize(DeviceState *dev, Error **errp)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(dev);
+
+    /* Internal interrupts are edge triggered */
+    s->cfg.level_edge <<= 16;
+    s->cfg.level_edge |= 0xffff;
+
+    /* Internal interrupts are positive. */
+    s->cfg.positive <<= 16;
+    s->cfg.positive |= 0xffff;
+
+    /* Max 16 external interrupts. */
+    assert(s->cfg.intr_size <= 16);
+
+    qdev_init_gpio_in(dev, irq_handler, 16 + s->cfg.intr_size);
+}
+
+static void xlnx_pmu_io_intc_init(Object *obj)
+{
+    XlnxPMUIOIntc *s = XLNX_PMU_IO_INTC(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
+
+    memory_region_init(&s->iomem, obj, TYPE_XLNX_PMU_IO_INTC,
+                       XLNXPMUIOINTC_R_MAX * 4);
+    reg_array =
+        register_init_block32(DEVICE(obj), xlnx_pmu_io_intc_regs_info,
+                              ARRAY_SIZE(xlnx_pmu_io_intc_regs_info),
+                              s->regs_info, s->regs,
+                              &xlnx_pmu_io_intc_ops,
+                              XLNX_PMU_IO_INTC_ERR_DEBUG,
+                              XLNXPMUIOINTC_R_MAX * 4);
+    memory_region_add_subregion(&s->iomem,
+                                0x0,
+                                &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+
+    sysbus_init_irq(sbd, &s->parent_irq);
+}
+
+static const VMStateDescription vmstate_xlnx_pmu_io_intc = {
+    .name = TYPE_XLNX_PMU_IO_INTC,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxPMUIOIntc, XLNXPMUIOINTC_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void xlnx_pmu_io_intc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = xlnx_pmu_io_intc_reset;
+    dc->realize = xlnx_pmu_io_intc_realize;
+    dc->vmsd = &vmstate_xlnx_pmu_io_intc;
+    dc->props = xlnx_pmu_io_intc_properties;
+}
+
+static const TypeInfo xlnx_pmu_io_intc_info = {
+    .name          = TYPE_XLNX_PMU_IO_INTC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxPMUIOIntc),
+    .class_init    = xlnx_pmu_io_intc_class_init,
+    .instance_init = xlnx_pmu_io_intc_init,
+};
+
+static void xlnx_pmu_io_intc_register_types(void)
+{
+    type_register_static(&xlnx_pmu_io_intc_info);
+}
+
+type_init(xlnx_pmu_io_intc_register_types)
diff --git a/hw/intc/xlnx-zynqmp-ipi.c b/hw/intc/xlnx-zynqmp-ipi.c
new file mode 100644
index 0000000000..aa50a8ac08
--- /dev/null
+++ b/hw/intc/xlnx-zynqmp-ipi.c
@@ -0,0 +1,377 @@
+/*
+ * QEMU model of the IPI Inter Processor Interrupt block
+ *
+ * Copyright (c) 2014 Xilinx Inc.
+ *
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ * Written by Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "hw/intc/xlnx-zynqmp-ipi.h"
+
+#ifndef XLNX_ZYNQMP_IPI_ERR_DEBUG
+#define XLNX_ZYNQMP_IPI_ERR_DEBUG 0
+#endif
+
+#define DB_PRINT_L(lvl, fmt, args...) do {\
+    if (XLNX_ZYNQMP_IPI_ERR_DEBUG >= lvl) {\
+        qemu_log(TYPE_XLNX_ZYNQMP_IPI ": %s:" fmt, __func__, ## args);\
+    } \
+} while (0)
+
+#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
+
+REG32(IPI_TRIG, 0x0)
+    FIELD(IPI_TRIG, PL_3, 27, 1)
+    FIELD(IPI_TRIG, PL_2, 26, 1)
+    FIELD(IPI_TRIG, PL_1, 25, 1)
+    FIELD(IPI_TRIG, PL_0, 24, 1)
+    FIELD(IPI_TRIG, PMU_3, 19, 1)
+    FIELD(IPI_TRIG, PMU_2, 18, 1)
+    FIELD(IPI_TRIG, PMU_1, 17, 1)
+    FIELD(IPI_TRIG, PMU_0, 16, 1)
+    FIELD(IPI_TRIG, RPU_1, 9, 1)
+    FIELD(IPI_TRIG, RPU_0, 8, 1)
+    FIELD(IPI_TRIG, APU, 0, 1)
+REG32(IPI_OBS, 0x4)
+    FIELD(IPI_OBS, PL_3, 27, 1)
+    FIELD(IPI_OBS, PL_2, 26, 1)
+    FIELD(IPI_OBS, PL_1, 25, 1)
+    FIELD(IPI_OBS, PL_0, 24, 1)
+    FIELD(IPI_OBS, PMU_3, 19, 1)
+    FIELD(IPI_OBS, PMU_2, 18, 1)
+    FIELD(IPI_OBS, PMU_1, 17, 1)
+    FIELD(IPI_OBS, PMU_0, 16, 1)
+    FIELD(IPI_OBS, RPU_1, 9, 1)
+    FIELD(IPI_OBS, RPU_0, 8, 1)
+    FIELD(IPI_OBS, APU, 0, 1)
+REG32(IPI_ISR, 0x10)
+    FIELD(IPI_ISR, PL_3, 27, 1)
+    FIELD(IPI_ISR, PL_2, 26, 1)
+    FIELD(IPI_ISR, PL_1, 25, 1)
+    FIELD(IPI_ISR, PL_0, 24, 1)
+    FIELD(IPI_ISR, PMU_3, 19, 1)
+    FIELD(IPI_ISR, PMU_2, 18, 1)
+    FIELD(IPI_ISR, PMU_1, 17, 1)
+    FIELD(IPI_ISR, PMU_0, 16, 1)
+    FIELD(IPI_ISR, RPU_1, 9, 1)
+    FIELD(IPI_ISR, RPU_0, 8, 1)
+    FIELD(IPI_ISR, APU, 0, 1)
+REG32(IPI_IMR, 0x14)
+    FIELD(IPI_IMR, PL_3, 27, 1)
+    FIELD(IPI_IMR, PL_2, 26, 1)
+    FIELD(IPI_IMR, PL_1, 25, 1)
+    FIELD(IPI_IMR, PL_0, 24, 1)
+    FIELD(IPI_IMR, PMU_3, 19, 1)
+    FIELD(IPI_IMR, PMU_2, 18, 1)
+    FIELD(IPI_IMR, PMU_1, 17, 1)
+    FIELD(IPI_IMR, PMU_0, 16, 1)
+    FIELD(IPI_IMR, RPU_1, 9, 1)
+    FIELD(IPI_IMR, RPU_0, 8, 1)
+    FIELD(IPI_IMR, APU, 0, 1)
+REG32(IPI_IER, 0x18)
+    FIELD(IPI_IER, PL_3, 27, 1)
+    FIELD(IPI_IER, PL_2, 26, 1)
+    FIELD(IPI_IER, PL_1, 25, 1)
+    FIELD(IPI_IER, PL_0, 24, 1)
+    FIELD(IPI_IER, PMU_3, 19, 1)
+    FIELD(IPI_IER, PMU_2, 18, 1)
+    FIELD(IPI_IER, PMU_1, 17, 1)
+    FIELD(IPI_IER, PMU_0, 16, 1)
+    FIELD(IPI_IER, RPU_1, 9, 1)
+    FIELD(IPI_IER, RPU_0, 8, 1)
+    FIELD(IPI_IER, APU, 0, 1)
+REG32(IPI_IDR, 0x1c)
+    FIELD(IPI_IDR, PL_3, 27, 1)
+    FIELD(IPI_IDR, PL_2, 26, 1)
+    FIELD(IPI_IDR, PL_1, 25, 1)
+    FIELD(IPI_IDR, PL_0, 24, 1)
+    FIELD(IPI_IDR, PMU_3, 19, 1)
+    FIELD(IPI_IDR, PMU_2, 18, 1)
+    FIELD(IPI_IDR, PMU_1, 17, 1)
+    FIELD(IPI_IDR, PMU_0, 16, 1)
+    FIELD(IPI_IDR, RPU_1, 9, 1)
+    FIELD(IPI_IDR, RPU_0, 8, 1)
+    FIELD(IPI_IDR, APU, 0, 1)
+
+/* APU
+ * RPU_0
+ * RPU_1
+ * PMU_0
+ * PMU_1
+ * PMU_2
+ * PMU_3
+ * PL_0
+ * PL_1
+ * PL_2
+ * PL_3
+ */
+int index_array[NUM_IPIS] = {0, 8, 9, 16, 17, 18, 19, 24, 25, 26, 27};
+static const char *index_array_names[NUM_IPIS] = {"APU", "RPU_0", "RPU_1",
+                                                  "PMU_0", "PMU_1", "PMU_2",
+                                                  "PMU_3", "PL_0", "PL_1",
+                                                  "PL_2", "PL_3"};
+
+static void xlnx_zynqmp_ipi_set_trig(XlnxZynqMPIPI *s, uint32_t val)
+{
+    int i, ipi_index, ipi_mask;
+
+    for (i = 0; i < NUM_IPIS; i++) {
+        ipi_index = index_array[i];
+        ipi_mask = (1 << ipi_index);
+        DB_PRINT("Setting %s=%d\n", index_array_names[i],
+                 !!(val & ipi_mask));
+        qemu_set_irq(s->irq_trig_out[i], !!(val & ipi_mask));
+    }
+}
+
+static void xlnx_zynqmp_ipi_set_obs(XlnxZynqMPIPI *s, uint32_t val)
+{
+    int i, ipi_index, ipi_mask;
+
+    for (i = 0; i < NUM_IPIS; i++) {
+        ipi_index = index_array[i];
+        ipi_mask = (1 << ipi_index);
+        DB_PRINT("Setting %s=%d\n", index_array_names[i],
+                 !!(val & ipi_mask));
+        qemu_set_irq(s->irq_obs_out[i], !!(val & ipi_mask));
+    }
+}
+
+static void xlnx_zynqmp_ipi_update_irq(XlnxZynqMPIPI *s)
+{
+    bool pending = s->regs[R_IPI_ISR] & ~s->regs[R_IPI_IMR];
+
+    DB_PRINT("irq=%d isr=%x mask=%x\n",
+             pending, s->regs[R_IPI_ISR], s->regs[R_IPI_IMR]);
+    qemu_set_irq(s->irq, pending);
+}
+
+static uint64_t xlnx_zynqmp_ipi_trig_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+
+    xlnx_zynqmp_ipi_set_trig(s, val64);
+
+    return val64;
+}
+
+static void xlnx_zynqmp_ipi_trig_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+
+    /* TRIG generates a pulse on the outbound signals. We use the
+     * post-write callback to bring the signal back-down.
+     */
+    s->regs[R_IPI_TRIG] = 0;
+
+    xlnx_zynqmp_ipi_set_trig(s, 0);
+}
+
+static uint64_t xlnx_zynqmp_ipi_isr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+
+    xlnx_zynqmp_ipi_set_obs(s, val64);
+
+    return val64;
+}
+
+static void xlnx_zynqmp_ipi_isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+
+    xlnx_zynqmp_ipi_update_irq(s);
+}
+
+static uint64_t xlnx_zynqmp_ipi_ier_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IPI_IMR] &= ~val;
+    xlnx_zynqmp_ipi_update_irq(s);
+    return 0;
+}
+
+static uint64_t xlnx_zynqmp_ipi_idr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IPI_IMR] |= val;
+    xlnx_zynqmp_ipi_update_irq(s);
+    return 0;
+}
+
+static const RegisterAccessInfo xlnx_zynqmp_ipi_regs_info[] = {
+    {   .name = "IPI_TRIG",  .addr = A_IPI_TRIG,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xf0f0fcfe,
+        .pre_write = xlnx_zynqmp_ipi_trig_prew,
+        .post_write = xlnx_zynqmp_ipi_trig_postw,
+    },{ .name = "IPI_OBS",  .addr = A_IPI_OBS,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xffffffff,
+    },{ .name = "IPI_ISR",  .addr = A_IPI_ISR,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xf0f0fcfe,
+        .w1c = 0xf0f0301,
+        .pre_write = xlnx_zynqmp_ipi_isr_prew,
+        .post_write = xlnx_zynqmp_ipi_isr_postw,
+    },{ .name = "IPI_IMR",  .addr = A_IPI_IMR,
+        .reset = 0xf0f0301,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xffffffff,
+    },{ .name = "IPI_IER",  .addr = A_IPI_IER,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xf0f0fcfe,
+        .pre_write = xlnx_zynqmp_ipi_ier_prew,
+    },{ .name = "IPI_IDR",  .addr = A_IPI_IDR,
+        .rsvd = 0xf0f0fcfe,
+        .ro = 0xf0f0fcfe,
+        .pre_write = xlnx_zynqmp_ipi_idr_prew,
+    }
+};
+
+static void xlnx_zynqmp_ipi_reset(DeviceState *dev)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(dev);
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    xlnx_zynqmp_ipi_update_irq(s);
+}
+
+static void xlnx_zynqmp_ipi_handler(void *opaque, int n, int level)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(opaque);
+    uint32_t val = (!!level) << n;
+
+    DB_PRINT("IPI input irq[%d]=%d\n", n, level);
+
+    s->regs[R_IPI_ISR] |= val;
+    xlnx_zynqmp_ipi_set_obs(s, s->regs[R_IPI_ISR]);
+    xlnx_zynqmp_ipi_update_irq(s);
+}
+
+static void xlnx_zynqmp_obs_handler(void *opaque, int n, int level)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(opaque);
+
+    DB_PRINT("OBS input irq[%d]=%d\n", n, level);
+
+    s->regs[R_IPI_OBS] &= ~(1ULL << n);
+    s->regs[R_IPI_OBS] |= (level << n);
+}
+
+static const MemoryRegionOps xlnx_zynqmp_ipi_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void xlnx_zynqmp_ipi_realize(DeviceState *dev, Error **errp)
+{
+    qdev_init_gpio_in_named(dev, xlnx_zynqmp_ipi_handler, "IPI_INPUTS", 32);
+    qdev_init_gpio_in_named(dev, xlnx_zynqmp_obs_handler, "OBS_INPUTS", 32);
+}
+
+static void xlnx_zynqmp_ipi_init(Object *obj)
+{
+    XlnxZynqMPIPI *s = XLNX_ZYNQMP_IPI(obj);
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
+    char *irq_name;
+    int i;
+
+    memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_IPI,
+                       R_XLNX_ZYNQMP_IPI_MAX * 4);
+    reg_array =
+        register_init_block32(DEVICE(obj), xlnx_zynqmp_ipi_regs_info,
+                              ARRAY_SIZE(xlnx_zynqmp_ipi_regs_info),
+                              s->regs_info, s->regs,
+                              &xlnx_zynqmp_ipi_ops,
+                              XLNX_ZYNQMP_IPI_ERR_DEBUG,
+                              R_XLNX_ZYNQMP_IPI_MAX * 4);
+    memory_region_add_subregion(&s->iomem,
+                                0x0,
+                                &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+
+    for (i = 0; i < NUM_IPIS; i++) {
+        qdev_init_gpio_out_named(dev, &s->irq_trig_out[i],
+                                 index_array_names[i], 1);
+
+        irq_name = g_strdup_printf("OBS_%s", index_array_names[i]);
+        qdev_init_gpio_out_named(dev, &s->irq_obs_out[i],
+                                 irq_name, 1);
+        g_free(irq_name);
+    }
+}
+
+static const VMStateDescription vmstate_zynqmp_pmu_ipi = {
+    .name = TYPE_XLNX_ZYNQMP_IPI,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPIPI, R_XLNX_ZYNQMP_IPI_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void xlnx_zynqmp_ipi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = xlnx_zynqmp_ipi_reset;
+    dc->realize = xlnx_zynqmp_ipi_realize;
+    dc->vmsd = &vmstate_zynqmp_pmu_ipi;
+}
+
+static const TypeInfo xlnx_zynqmp_ipi_info = {
+    .name          = TYPE_XLNX_ZYNQMP_IPI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxZynqMPIPI),
+    .class_init    = xlnx_zynqmp_ipi_class_init,
+    .instance_init = xlnx_zynqmp_ipi_init,
+};
+
+static void xlnx_zynqmp_ipi_register_types(void)
+{
+    type_register_static(&xlnx_zynqmp_ipi_info);
+}
+
+type_init(xlnx_zynqmp_ipi_register_types)
diff --git a/hw/microblaze/Makefile.objs b/hw/microblaze/Makefile.objs
index b2517d87fe..ae9fd40de7 100644
--- a/hw/microblaze/Makefile.objs
+++ b/hw/microblaze/Makefile.objs
@@ -1,3 +1,4 @@
 obj-y += petalogix_s3adsp1800_mmu.o
 obj-y += petalogix_ml605_mmu.o
+obj-y += xlnx-zynqmp-pmu.o
 obj-y += boot.o
diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c
index 457a08a2fe..35bfeda7aa 100644
--- a/hw/microblaze/boot.c
+++ b/hw/microblaze/boot.c
@@ -124,7 +124,7 @@ void microblaze_load_kernel(MicroBlazeCPU *cpu, hwaddr ddr_base,
     kernel_cmdline = qemu_opt_get(machine_opts, "append");
     dtb_arg = qemu_opt_get(machine_opts, "dtb");
     /* default to pcbios dtb as passed by machine_init */
-    if (!dtb_arg) {
+    if (!dtb_arg && dtb_filename) {
         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename);
     }
 
diff --git a/hw/microblaze/xlnx-zynqmp-pmu.c b/hw/microblaze/xlnx-zynqmp-pmu.c
new file mode 100644
index 0000000000..999a5657cf
--- /dev/null
+++ b/hw/microblaze/xlnx-zynqmp-pmu.c
@@ -0,0 +1,204 @@
+/*
+ * Xilinx Zynq MPSoC PMU (Power Management Unit) emulation
+ *
+ * Copyright (C) 2017 Xilinx Inc
+ * Written by Alistair Francis <alistair.francis@xilinx.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "exec/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "cpu.h"
+#include "boot.h"
+
+#include "hw/intc/xlnx-zynqmp-ipi.h"
+#include "hw/intc/xlnx-pmu-iomod-intc.h"
+
+/* Define the PMU device */
+
+#define TYPE_XLNX_ZYNQMP_PMU_SOC "xlnx,zynqmp-pmu-soc"
+#define XLNX_ZYNQMP_PMU_SOC(obj) OBJECT_CHECK(XlnxZynqMPPMUSoCState, (obj), \
+                                              TYPE_XLNX_ZYNQMP_PMU_SOC)
+
+#define XLNX_ZYNQMP_PMU_ROM_SIZE    0x8000
+#define XLNX_ZYNQMP_PMU_ROM_ADDR    0xFFD00000
+#define XLNX_ZYNQMP_PMU_RAM_ADDR    0xFFDC0000
+
+#define XLNX_ZYNQMP_PMU_INTC_ADDR   0xFFD40000
+
+#define XLNX_ZYNQMP_PMU_NUM_IPIS    4
+
+static const uint64_t ipi_addr[XLNX_ZYNQMP_PMU_NUM_IPIS] = {
+    0xFF340000, 0xFF350000, 0xFF360000, 0xFF370000,
+};
+static const uint64_t ipi_irq[XLNX_ZYNQMP_PMU_NUM_IPIS] = {
+    19, 20, 21, 22,
+};
+
+typedef struct XlnxZynqMPPMUSoCState {
+    /*< private >*/
+    DeviceState parent_obj;
+
+    /*< public >*/
+    MicroBlazeCPU cpu;
+    XlnxPMUIOIntc intc;
+}  XlnxZynqMPPMUSoCState;
+
+
+static void xlnx_zynqmp_pmu_soc_init(Object *obj)
+{
+    XlnxZynqMPPMUSoCState *s = XLNX_ZYNQMP_PMU_SOC(obj);
+
+    object_initialize(&s->cpu, sizeof(s->cpu),
+                      TYPE_MICROBLAZE_CPU);
+    object_property_add_child(obj, "pmu-cpu", OBJECT(&s->cpu),
+                              &error_abort);
+
+    object_initialize(&s->intc, sizeof(s->intc), TYPE_XLNX_PMU_IO_INTC);
+    qdev_set_parent_bus(DEVICE(&s->intc), sysbus_get_default());
+}
+
+static void xlnx_zynqmp_pmu_soc_realize(DeviceState *dev, Error **errp)
+{
+    XlnxZynqMPPMUSoCState *s = XLNX_ZYNQMP_PMU_SOC(dev);
+    Error *err = NULL;
+
+    object_property_set_uint(OBJECT(&s->cpu), XLNX_ZYNQMP_PMU_ROM_ADDR,
+                             "base-vectors", &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "use-stack-protection",
+                             &error_abort);
+    object_property_set_uint(OBJECT(&s->cpu), 0, "use-fpu", &error_abort);
+    object_property_set_uint(OBJECT(&s->cpu), 0, "use-hw-mul", &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "use-barrel",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "use-msr-instr",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "use-pcmp-instr",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), false, "use-mmu", &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "endianness",
+                             &error_abort);
+    object_property_set_str(OBJECT(&s->cpu), "8.40.b", "version",
+                            &error_abort);
+    object_property_set_uint(OBJECT(&s->cpu), 0, "pvr", &error_abort);
+    object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    object_property_set_uint(OBJECT(&s->intc), 0x10, "intc-intr-size",
+                             &error_abort);
+    object_property_set_uint(OBJECT(&s->intc), 0x0, "intc-level-edge",
+                             &error_abort);
+    object_property_set_uint(OBJECT(&s->intc), 0xffff, "intc-positive",
+                             &error_abort);
+    object_property_set_bool(OBJECT(&s->intc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->intc), 0, XLNX_ZYNQMP_PMU_INTC_ADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->intc), 0,
+                       qdev_get_gpio_in(DEVICE(&s->cpu), MB_CPU_IRQ));
+}
+
+static void xlnx_zynqmp_pmu_soc_class_init(ObjectClass *oc, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = xlnx_zynqmp_pmu_soc_realize;
+}
+
+static const TypeInfo xlnx_zynqmp_pmu_soc_type_info = {
+    .name = TYPE_XLNX_ZYNQMP_PMU_SOC,
+    .parent = TYPE_DEVICE,
+    .instance_size = sizeof(XlnxZynqMPPMUSoCState),
+    .instance_init = xlnx_zynqmp_pmu_soc_init,
+    .class_init = xlnx_zynqmp_pmu_soc_class_init,
+};
+
+static void xlnx_zynqmp_pmu_soc_register_types(void)
+{
+    type_register_static(&xlnx_zynqmp_pmu_soc_type_info);
+}
+
+type_init(xlnx_zynqmp_pmu_soc_register_types)
+
+/* Define the PMU Machine */
+
+static void xlnx_zynqmp_pmu_init(MachineState *machine)
+{
+    XlnxZynqMPPMUSoCState *pmu = g_new0(XlnxZynqMPPMUSoCState, 1);
+    MemoryRegion *address_space_mem = get_system_memory();
+    MemoryRegion *pmu_rom = g_new(MemoryRegion, 1);
+    MemoryRegion *pmu_ram = g_new(MemoryRegion, 1);
+    XlnxZynqMPIPI *ipi[XLNX_ZYNQMP_PMU_NUM_IPIS];
+    qemu_irq irq[32];
+    int i;
+
+    /* Create the ROM */
+    memory_region_init_rom(pmu_rom, NULL, "xlnx-zynqmp-pmu.rom",
+                           XLNX_ZYNQMP_PMU_ROM_SIZE, &error_fatal);
+    memory_region_add_subregion(address_space_mem, XLNX_ZYNQMP_PMU_ROM_ADDR,
+                                pmu_rom);
+
+    /* Create the RAM */
+    memory_region_init_ram(pmu_ram, NULL, "xlnx-zynqmp-pmu.ram",
+                           machine->ram_size, &error_fatal);
+    memory_region_add_subregion(address_space_mem, XLNX_ZYNQMP_PMU_RAM_ADDR,
+                                pmu_ram);
+
+    /* Create the PMU device */
+    object_initialize(pmu, sizeof(XlnxZynqMPPMUSoCState), TYPE_XLNX_ZYNQMP_PMU_SOC);
+    object_property_add_child(OBJECT(machine), "pmu", OBJECT(pmu),
+                              &error_abort);
+    object_property_set_bool(OBJECT(pmu), true, "realized", &error_fatal);
+
+    for (i = 0; i < 32; i++) {
+        irq[i] = qdev_get_gpio_in(DEVICE(&pmu->intc), i);
+    }
+
+    /* Create and connect the IPI device */
+    for (i = 0; i < XLNX_ZYNQMP_PMU_NUM_IPIS; i++) {
+        ipi[i] = g_new0(XlnxZynqMPIPI, 1);
+        object_initialize(ipi[i], sizeof(XlnxZynqMPIPI), TYPE_XLNX_ZYNQMP_IPI);
+        qdev_set_parent_bus(DEVICE(ipi[i]), sysbus_get_default());
+    }
+
+    for (i = 0; i < XLNX_ZYNQMP_PMU_NUM_IPIS; i++) {
+        object_property_set_bool(OBJECT(ipi[i]), true, "realized",
+                                 &error_abort);
+        sysbus_mmio_map(SYS_BUS_DEVICE(ipi[i]), 0, ipi_addr[i]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(ipi[i]), 0, irq[ipi_irq[i]]);
+    }
+
+    /* Load the kernel */
+    microblaze_load_kernel(&pmu->cpu, XLNX_ZYNQMP_PMU_RAM_ADDR,
+                           machine->ram_size,
+                           machine->initrd_filename,
+                           machine->dtb,
+                           NULL);
+}
+
+static void xlnx_zynqmp_pmu_machine_init(MachineClass *mc)
+{
+    mc->desc = "Xilinx ZynqMP PMU machine";
+    mc->init = xlnx_zynqmp_pmu_init;
+}
+
+DEFINE_MACHINE("xlnx-zynqmp-pmu", xlnx_zynqmp_pmu_machine_init)
+