Series comparison

-[Qemu-devel] [PULL 00/27] target-arm queue
+[PULL 00/14] target-arm queue
-ARM pullreq; contains some patches that arrived while I
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
 was on holiday, plus the series I sent off before going
 away, which got reviewed while I was away.
-thanks
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 -- PMM
+are available in the Git repository at:
-The following changes since commit c077a998eb3fcae2d048e3baeb5bc592d30fddde:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-  Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20170531' into staging (2017-06-01 15:50:40 +0100)
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-are available in the git repository at:
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
   git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170601
 for you to fetch changes up to cdc58be430b0bdeaef282e2e70f8135ae531616d:
   hw/arm/virt: fdt: generate distance-map when needed (2017-06-01 17:27:07 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * virt: numa: provide ACPI distance info when needed
+ * Implement FEAT_ECV
- * aspeed: fix i2c controller bugs
+ * STM32L4x5: Implement GPIO device
- * aspeed: add temperature sensor device
+ * Fix 32-bit SMOPA
- * M profile: support MPU
+ * Refactor v7m related code from cpu32.c into its own file
- * gicv3: fix mishandling of BPR1, VBPR1
+ * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
  * load_uboot_image: don't assume a full header read
  * libvixl: Correct build failures on NetBSD
 ----------------------------------------------------------------
-Andrew Jones (3):
+Inès Varhol (3):
-      load_uboot_image: don't assume a full header read
+      hw/gpio: Implement STM32L4x5 GPIO
-      hw/arm/virt-acpi-build: build SLIT when needed
+      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-      hw/arm/virt: fdt: generate distance-map when needed
+      tests/qtest: Add STM32L4x5 GPIO QTest testcase
-Cédric Le Goater (6):
+Peter Maydell (9):
-      aspeed/i2c: improve command handling
+      target/arm: Move some register related defines to internals.h
-      aspeed/i2c: handle LAST command under the RX command
+      target/arm: Timer _EL02 registers UNDEF for E2H == 0
-      aspeed/i2c: introduce a state machine
+      target/arm: use FIELD macro for CNTHCTL bit definitions
-      aspeed: add some I2C devices to the Aspeed machines
+      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-      hw/misc: add a TMP42{1,2,3} device model
+      target/arm: Implement new FEAT_ECV trap bits
-      aspeed: add a temp sensor device on I2C bus 3
+      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
       target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
       target/arm: Enable FEAT_ECV for 'max' CPU
       hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-Kamil Rytarowski (1):
+Richard Henderson (1):
-      libvixl: Correct build failures on NetBSD
+      target/arm: Fix 32-bit SMOPA
-Michael Davidsaver (4):
+Thomas Huth (1):
-      armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
+      target/arm: Move v7m-related code from cpu32.c into a separate file
       armv7m: Implement M profile default memory map
       armv7m: Classify faults as MemManage or BusFault
       arm: add MPU support to M profile CPUs
-Peter Maydell (12):
+ MAINTAINERS                        |   1 +
-      hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
-      hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
+ docs/system/arm/emulation.rst      |   1 +
-      hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
-      arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
+ include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
-      arm: Add support for M profile CPUs having different MMU index semantics
+ include/hw/misc/stm32l4x5_syscfg.h |   3 +-
-      arm: Use different ARMMMUIdx values for M profile
+ include/hw/rtc/sun4v-rtc.h         |   2 +-
-      arm: Clean up handling of no-MPU PMSA CPUs
+ target/arm/cpu-features.h          |  10 +
-      arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
+ target/arm/cpu.h                   | 129 +--------
-      arm: Don't let no-MPU PMSA cores write to SCTLR.M
+ target/arm/internals.h             | 151 ++++++++++
-      arm: Remove unnecessary check on cpu->pmsav7_dregion
+ hw/arm/stm32l4x5_soc.c             |  71 ++++-
-      arm: All M profile cores are PMSA
+ hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
-      arm: Implement HFNMIENA support for M profile MPU
+ hw/misc/stm32l4x5_syscfg.c         |   1 +
  hw/rtc/sun4v-rtc.c                 |   2 +-
  target/arm/helper.c                | 189 ++++++++++++-
  target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
  target/arm/tcg/cpu32.c             | 261 ------------------
  target/arm/tcg/cpu64.c             |   1 +
  target/arm/tcg/sme_helper.c        |  77 +++---
  tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
  tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
  hw/arm/Kconfig                     |   3 +-
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
  target/arm/meson.build             |   3 +
  target/arm/tcg/meson.build         |   3 +
  target/arm/trace-events            |   1 +
  tests/qtest/meson.build            |   3 +-
  tests/tcg/aarch64/Makefile.target  |   2 +-
 files changed, 1962 insertions(+), 456 deletions(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
  create mode 100644 target/arm/tcg/cpu-v7m.c
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
-Wei Huang (1):
-      target/arm: clear PMUVER field of AA64DFR0 when vPMU=off
- disas/libvixl/Makefile.objs     |   3 +
- hw/misc/Makefile.objs           |   1 +
- target/arm/cpu.h                | 118 ++++++++++--
- target/arm/translate.h          |   2 +-
- hw/arm/aspeed.c                 |  36 ++++
- hw/arm/virt-acpi-build.c        |   4 +
- hw/arm/virt.c                   |  21 +++
- hw/core/loader.c                |   3 +-
- hw/i2c/aspeed_i2c.c             |  65 ++++++-
- hw/intc/arm_gicv3_cpuif.c       |  50 ++++-
- hw/intc/armv7m_nvic.c           | 104 +++++++++++
- hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
- target/arm/cpu.c                |  28 ++-
- target/arm/helper.c             | 338 ++++++++++++++++++++++-----------
- target/arm/machine.c            |   7 +-
- target/arm/op_helper.c          |   3 +-
- target/arm/translate-a64.c      |  18 +-
- target/arm/translate.c          |  14 +-
- default-configs/arm-softmmu.mak |   1 +
-files changed, 1060 insertions(+), 157 deletions(-)
- create mode 100644 hw/misc/tmp421.c

-[Qemu-devel] [PULL 01/27] libvixl: Correct build failures on NetBSD
+Deleted patch
-From: Kamil Rytarowski <n54@gmx.com>
-Ensure that C99 macros are defined regardless of the inclusion order of
-headers in vixl. This is required at least on NetBSD.
-The vixl/globals.h headers defines __STDC_CONSTANT_MACROS and must be
-included before other system headers.
-This file defines unconditionally the following macros, without altering
-the original sources:
- - __STDC_CONSTANT_MACROS
- - __STDC_LIMIT_MACROS
- - __STDC_FORMAT_MACROS
-Signed-off-by: Kamil Rytarowski <n54@gmx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20170514051820.15985-1-n54@gmx.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- disas/libvixl/Makefile.objs | 3 +++
-file changed, 3 insertions(+)
-diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/disas/libvixl/Makefile.objs
-+++ b/disas/libvixl/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ libvixl_OBJS = vixl/utils.o \
- # The -Wno-sign-compare is needed only for gcc 4.6, which complains about
- # some signed-unsigned equality comparisons which later gcc versions do not.
- $(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS) -Wno-sign-compare
-+# Ensure that C99 macros are defined regardless of the inclusion order of
-+# headers in vixl. This is required at least on NetBSD.
-+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS
- common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)
---
-.7.4

-[Qemu-devel] [PULL 09/27] arm: Use different ARMMMUIdx values for M profile
+[PULL 01/14] target/arm: Move some register related defines to internals.h
-Make M profile use completely separate ARMMMUIdx values from
+cpu.h has a lot of #defines relating to CPU register fields.
-those that A profile CPUs use. This is a prelude to adding
+Most of these aren't actually used outside target/arm code,
-support for the MPU and for v8M, which together will require
+so there's no point in cluttering up the cpu.h file with them.
-MMU indexes which don't map cleanly onto the A profile
+Move some easy ones to internals.h.
 uses:
  non secure User
  non secure Privileged
  non secure Privileged, execution priority < 0
  secure User
  secure Privileged
  secure Privileged, execution priority < 0
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-4-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h       | 21 +++++++++++++++++++--
+ target/arm/cpu.h       | 128 -----------------------------------------
- target/arm/helper.c    |  5 +++++
+ target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
- target/arm/translate.c |  3 +++
+files changed, 128 insertions(+), 128 deletions(-)
 files changed, 27 insertions(+), 2 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
-  * of the AT/ATS operations.
+     uint64_t ctl; /* Timer Control register */
-  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
+ } ARMGenericTimer;
-  */
--#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
+-#define VTCR_NSW (1u << 29)
-+#define ARM_MMU_IDX_A 0x10 /* A profile */
+-#define VTCR_NSA (1u << 30)
- #define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
+-#define VSTCR_SW VTCR_NSW
-+#define ARM_MMU_IDX_M 0x40 /* M profile */
+-#define VSTCR_SA VTCR_NSA
+-
- #define ARM_MMU_IDX_TYPE_MASK (~0x7)
+ /* Define a maximum sized vector register.
- #define ARM_MMU_IDX_COREIDX_MASK 0x7
+  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
+  * For 64-bit, this is a 2048-bit SVE register.
-     ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
+@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
-     ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
+ #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
-     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
+ #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
-+    ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
-+    ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
+-/* Bit definitions for CPACR (AArch32 only) */
-     /* Indexes below here don't have TLBs and are used only for AT system
+-FIELD(CPACR, CP10, 20, 2)
-      * instructions or for the first stage of an S12 page table walk.
+-FIELD(CPACR, CP11, 22, 2)
-      */
+-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
+-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-     ARMMMUIdxBit_S1SE0 = 1 << 4,
+-FIELD(CPACR, ASEDIS, 31, 1)
-     ARMMMUIdxBit_S1SE1 = 1 << 5,
+-
-     ARMMMUIdxBit_S2NS = 1 << 6,
+-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-+    ARMMMUIdxBit_MUser = 1 << 0,
+-FIELD(CPACR_EL1, ZEN, 16, 2)
-+    ARMMMUIdxBit_MPriv = 1 << 1,
+-FIELD(CPACR_EL1, FPEN, 20, 2)
- } ARMMMUIdxBit;
+-FIELD(CPACR_EL1, SMEN, 24, 2)
+-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
- #define MMU_USER_IDX 0
+-
-@@ -XXX,XX +XXX,XX @@ static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
+-/* Bit definitions for HCPTR (AArch32 only) */
+-FIELD(HCPTR, TCP10, 10, 1)
- static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
+-FIELD(HCPTR, TCP11, 11, 1)
- {
+-FIELD(HCPTR, TASE, 15, 1)
--    return mmu_idx | ARM_MMU_IDX_A;
+-FIELD(HCPTR, TTA, 20, 1)
-+    if (arm_feature(env, ARM_FEATURE_M)) {
+-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-+        return mmu_idx | ARM_MMU_IDX_M;
+-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-+    } else {
+-
-+        return mmu_idx | ARM_MMU_IDX_A;
+-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-+    }
+-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
- }
+-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
- /* Return the exception level we're running at if this is our mmu_idx */
+-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
+-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-     switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
+-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-     case ARM_MMU_IDX_A:
+-FIELD(CPTR_EL2, TTA, 28, 1)
-         return mmu_idx & 3;
+-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-+    case ARM_MMU_IDX_M:
+-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-+        return mmu_idx & 1;
+-
-     default:
+-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-         g_assert_not_reached();
+-FIELD(CPTR_EL3, EZ, 8, 1)
-     }
+-FIELD(CPTR_EL3, TFP, 10, 1)
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
+-FIELD(CPTR_EL3, ESM, 12, 1)
- {
+-FIELD(CPTR_EL3, TTA, 20, 1)
-     int el = arm_current_el(env);
+-FIELD(CPTR_EL3, TAM, 30, 1)
+-FIELD(CPTR_EL3, TCPAC, 31, 1)
-+    if (arm_feature(env, ARM_FEATURE_M)) {
+-
-+        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
+-#define MDCR_MTPME    (1U << 28)
-+
+-#define MDCR_TDCC     (1U << 27)
-+        return arm_to_core_mmu_idx(mmu_idx);
+-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-+    }
+-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-+
+-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-     if (el < 2 && arm_is_secure_below_el3(env)) {
+-#define MDCR_EPMAD    (1U << 21)
-         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
+-#define MDCR_EDAD     (1U << 20)
-     }
+-#define MDCR_TTRF     (1U << 19)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 -#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 -#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 -#define MDCR_SDD      (1U << 16)
 -#define MDCR_SPD      (3U << 14)
 -#define MDCR_TDRA     (1U << 11)
 -#define MDCR_TDOSA    (1U << 10)
 -#define MDCR_TDA      (1U << 9)
 -#define MDCR_TDE      (1U << 8)
 -#define MDCR_HPME     (1U << 7)
 -#define MDCR_TPM      (1U << 6)
 -#define MDCR_TPMCR    (1U << 5)
 -#define MDCR_HPMN     (0x1fU)
 -
 -/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 -#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 -                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 -                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 -
  #define CPSR_M (0x1fU)
  #define CPSR_T (1U << 5)
  #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define XPSR_NZCV CPSR_NZCV
  #define XPSR_IT CPSR_IT
 -#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 -#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 -#define TTBCR_PD0    (1U << 4)
 -#define TTBCR_PD1    (1U << 5)
 -#define TTBCR_EPD0   (1U << 7)
 -#define TTBCR_IRGN0  (3U << 8)
 -#define TTBCR_ORGN0  (3U << 10)
 -#define TTBCR_SH0    (3U << 12)
 -#define TTBCR_T1SZ   (3U << 16)
 -#define TTBCR_A1     (1U << 22)
 -#define TTBCR_EPD1   (1U << 23)
 -#define TTBCR_IRGN1  (3U << 24)
 -#define TTBCR_ORGN1  (3U << 26)
 -#define TTBCR_SH1    (1U << 28)
 -#define TTBCR_EAE    (1U << 31)
 -
 -FIELD(VTCR, T0SZ, 0, 6)
 -FIELD(VTCR, SL0, 6, 2)
 -FIELD(VTCR, IRGN0, 8, 2)
 -FIELD(VTCR, ORGN0, 10, 2)
 -FIELD(VTCR, SH0, 12, 2)
 -FIELD(VTCR, TG0, 14, 2)
 -FIELD(VTCR, PS, 16, 3)
 -FIELD(VTCR, VS, 19, 1)
 -FIELD(VTCR, HA, 21, 1)
 -FIELD(VTCR, HD, 22, 1)
 -FIELD(VTCR, HWU59, 25, 1)
 -FIELD(VTCR, HWU60, 26, 1)
 -FIELD(VTCR, HWU61, 27, 1)
 -FIELD(VTCR, HWU62, 28, 1)
 -FIELD(VTCR, NSW, 29, 1)
 -FIELD(VTCR, NSA, 30, 1)
 -FIELD(VTCR, DS, 32, 1)
 -FIELD(VTCR, SL2, 33, 1)
 -
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_TWEDEN    (1ULL << 59)
  #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 -#define HCRX_ENAS0    (1ULL << 0)
 -#define HCRX_ENALS    (1ULL << 1)
 -#define HCRX_ENASR    (1ULL << 2)
 -#define HCRX_FNXS     (1ULL << 3)
 -#define HCRX_FGTNXS   (1ULL << 4)
 -#define HCRX_SMPME    (1ULL << 5)
 -#define HCRX_TALLINT  (1ULL << 6)
 -#define HCRX_VINMI    (1ULL << 7)
 -#define HCRX_VFNMI    (1ULL << 8)
 -#define HCRX_CMOW     (1ULL << 9)
 -#define HCRX_MCE2     (1ULL << 10)
 -#define HCRX_MSCEN    (1ULL << 11)
 -
 -#define HPFAR_NS      (1ULL << 63)
 -
  #define SCR_NS                (1ULL << 0)
  #define SCR_IRQ               (1ULL << 1)
  #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_GPF               (1ULL << 48)
  #define SCR_NSE               (1ULL << 62)
 -#define HSTR_TTEE (1 << 16)
 -#define HSTR_TJDBX (1 << 17)
 -
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 -
  /* Return the current FPSCR value.  */
  uint32_t vfp_get_fpscr(CPUARMState *env);
  void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/internals.h
-+++ b/target/arm/helper.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
-     case ARMMMUIdx_S1SE1:
+ FIELD(DBGWCR, MASK, 24, 5)
-     case ARMMMUIdx_S1NSE0:
+ FIELD(DBGWCR, SSCE, 29, 1)
-     case ARMMMUIdx_S1NSE1:
-+    case ARMMMUIdx_MPriv:
++#define VTCR_NSW (1u << 29)
-+    case ARMMMUIdx_MUser:
++#define VTCR_NSA (1u << 30)
-         return 1;
++#define VSTCR_SW VTCR_NSW
-     default:
++#define VSTCR_SA VTCR_NSA
-         g_assert_not_reached();
++
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
++/* Bit definitions for CPACR (AArch32 only) */
-     case ARMMMUIdx_S1NSE1:
++FIELD(CPACR, CP10, 20, 2)
-     case ARMMMUIdx_S1E2:
++FIELD(CPACR, CP11, 22, 2)
-     case ARMMMUIdx_S2NS:
++FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-+    case ARMMMUIdx_MPriv:
++FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-+    case ARMMMUIdx_MUser:
++FIELD(CPACR, ASEDIS, 31, 1)
-         return false;
++
-     case ARMMMUIdx_S1E3:
++/* Bit definitions for CPACR_EL1 (AArch64 only) */
-     case ARMMMUIdx_S1SE0:
++FIELD(CPACR_EL1, ZEN, 16, 2)
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
++FIELD(CPACR_EL1, FPEN, 20, 2)
-     switch (mmu_idx) {
++FIELD(CPACR_EL1, SMEN, 24, 2)
-     case ARMMMUIdx_S1SE0:
++FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-     case ARMMMUIdx_S1NSE0:
++
-+    case ARMMMUIdx_MUser:
++/* Bit definitions for HCPTR (AArch32 only) */
-         return true;
++FIELD(HCPTR, TCP10, 10, 1)
-     default:
++FIELD(HCPTR, TCP11, 11, 1)
-         return false;
++FIELD(HCPTR, TASE, 15, 1)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
++FIELD(HCPTR, TTA, 20, 1)
-index XXXXXXX..XXXXXXX 100644
++FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
---- a/target/arm/translate.c
++FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-+++ b/target/arm/translate.c
++
-@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
++/* Bit definitions for CPTR_EL2 (AArch64 only) */
-     case ARMMMUIdx_S1SE0:
++FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-     case ARMMMUIdx_S1SE1:
++FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
++FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-+    case ARMMMUIdx_MUser:
++FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-+    case ARMMMUIdx_MPriv:
++FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-+        return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
++FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-     case ARMMMUIdx_S2NS:
++FIELD(CPTR_EL2, TTA, 28, 1)
-     default:
++FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-         g_assert_not_reached();
++FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 +
 +/* Bit definitions for CPTR_EL3 (AArch64 only) */
 +FIELD(CPTR_EL3, EZ, 8, 1)
 +FIELD(CPTR_EL3, TFP, 10, 1)
 +FIELD(CPTR_EL3, ESM, 12, 1)
 +FIELD(CPTR_EL3, TTA, 20, 1)
 +FIELD(CPTR_EL3, TAM, 30, 1)
 +FIELD(CPTR_EL3, TCPAC, 31, 1)
 +
 +#define MDCR_MTPME    (1U << 28)
 +#define MDCR_TDCC     (1U << 27)
 +#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 +#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 +#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 +#define MDCR_EPMAD    (1U << 21)
 +#define MDCR_EDAD     (1U << 20)
 +#define MDCR_TTRF     (1U << 19)
 +#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 +#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 +#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 +#define MDCR_SDD      (1U << 16)
 +#define MDCR_SPD      (3U << 14)
 +#define MDCR_TDRA     (1U << 11)
 +#define MDCR_TDOSA    (1U << 10)
 +#define MDCR_TDA      (1U << 9)
 +#define MDCR_TDE      (1U << 8)
 +#define MDCR_HPME     (1U << 7)
 +#define MDCR_TPM      (1U << 6)
 +#define MDCR_TPMCR    (1U << 5)
 +#define MDCR_HPMN     (0x1fU)
 +
 +/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 +#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 +                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 +                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 +
 +#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 +#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 +#define TTBCR_PD0    (1U << 4)
 +#define TTBCR_PD1    (1U << 5)
 +#define TTBCR_EPD0   (1U << 7)
 +#define TTBCR_IRGN0  (3U << 8)
 +#define TTBCR_ORGN0  (3U << 10)
 +#define TTBCR_SH0    (3U << 12)
 +#define TTBCR_T1SZ   (3U << 16)
 +#define TTBCR_A1     (1U << 22)
 +#define TTBCR_EPD1   (1U << 23)
 +#define TTBCR_IRGN1  (3U << 24)
 +#define TTBCR_ORGN1  (3U << 26)
 +#define TTBCR_SH1    (1U << 28)
 +#define TTBCR_EAE    (1U << 31)
 +
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
 +#define HCRX_ENAS0    (1ULL << 0)
 +#define HCRX_ENALS    (1ULL << 1)
 +#define HCRX_ENASR    (1ULL << 2)
 +#define HCRX_FNXS     (1ULL << 3)
 +#define HCRX_FGTNXS   (1ULL << 4)
 +#define HCRX_SMPME    (1ULL << 5)
 +#define HCRX_TALLINT  (1ULL << 6)
 +#define HCRX_VINMI    (1ULL << 7)
 +#define HCRX_VFNMI    (1ULL << 8)
 +#define HCRX_CMOW     (1ULL << 9)
 +#define HCRX_MCE2     (1ULL << 10)
 +#define HCRX_MSCEN    (1ULL << 11)
 +
 +#define HPFAR_NS      (1ULL << 63)
 +
 +#define HSTR_TTEE (1 << 16)
 +#define HSTR_TJDBX (1 << 17)
 +
 +#define CNTHCTL_CNTVMASK      (1 << 18)
 +#define CNTHCTL_CNTPMASK      (1 << 19)
 +
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
   * get_phys_addr() code assumes A/R profile and reports failures via
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 19/27] arm: Implement HFNMIENA support for M profile MPU
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
-Implement HFNMIENA support for the M profile MPU. This bit controls
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
-whether the MPU is treated as enabled when executing at execution
+or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
-priorities of less than zero (in NMI, HardFault or with the FAULTMASK
+delivering the exception to EL2 with the wrong syndrome.
 bit set).
 Doing this requires us to use a different MMU index for "running
 at execution priority < 0", because we will have different
 access permissions for that case versus the normal case.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-14-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h       | 24 +++++++++++++++++++++++-
+ target/arm/helper.c | 2 +-
- target/arm/helper.c    | 18 +++++++++++++++++-
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/translate.c |  1 +
 files changed, 41 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-  * for the accesses done as part of a stage 1 page table walk, rather than
-  * having to walk the stage 2 page table over and over.)
-  *
-+ * R profile CPUs have an MPU, but can use the same set of MMU indexes
-+ * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
-+ * NS EL2 if we ever model a Cortex-R52).
-+ *
-+ * M profile CPUs are rather different as they do not have a true MMU.
-+ * They have the following different MMU indexes:
-+ *  User
-+ *  Privileged
-+ *  Execution priority negative (this is like privileged, but the
-+ *  MPU HFNMIENA bit means that it may have different access permission
-+ *  check results to normal privileged code, so can't share a TLB).
-+ *
-  * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
-  * are not quite the same -- different CPU types (most notably M profile
-  * vs A/R profile) would like to use MMU indexes with different semantics,
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
-     ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
-     ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
-+    ARMMMUIdx_MNegPri = 2 | ARM_MMU_IDX_M,
-     /* Indexes below here don't have TLBs and are used only for AT system
-      * instructions or for the first stage of an S12 page table walk.
-      */
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
-     ARMMMUIdxBit_S2NS = 1 << 6,
-     ARMMMUIdxBit_MUser = 1 << 0,
-     ARMMMUIdxBit_MPriv = 1 << 1,
-+    ARMMMUIdxBit_MNegPri = 1 << 2,
- } ARMMMUIdxBit;
- #define MMU_USER_IDX 0
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-     case ARM_MMU_IDX_A:
-         return mmu_idx & 3;
-     case ARM_MMU_IDX_M:
--        return mmu_idx & 1;
-+        return mmu_idx == ARMMMUIdx_MUser ? 0 : 1;
-     default:
-         g_assert_not_reached();
-     }
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
-     if (arm_feature(env, ARM_FEATURE_M)) {
-         ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
-+        /* Execution priority is negative if FAULTMASK is set or
-+         * we're in a HardFault or NMI handler.
-+         */
-+        if ((env->v7m.exception > 0 && env->v7m.exception <= 3)
-+            || env->daif & PSTATE_F) {
-+            return arm_to_core_mmu_idx(ARMMMUIdx_MNegPri);
-+        }
-+
-         return arm_to_core_mmu_idx(mmu_idx);
-     }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-     case ARMMMUIdx_S1NSE0:
+         return CP_ACCESS_OK;
      case ARMMMUIdx_S1NSE1:
      case ARMMMUIdx_MPriv:
 +    case ARMMMUIdx_MNegPri:
      case ARMMMUIdx_MUser:
          return 1;
      default:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
      case ARMMMUIdx_S1E2:
      case ARMMMUIdx_S2NS:
      case ARMMMUIdx_MPriv:
 +    case ARMMMUIdx_MNegPri:
      case ARMMMUIdx_MUser:
          return false;
      case ARMMMUIdx_S1E3:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx)
  {
      if (arm_feature(env, ARM_FEATURE_M)) {
 -        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
 +        switch (env->v7m.mpu_ctrl &
 +                (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
 +        case R_V7M_MPU_CTRL_ENABLE_MASK:
 +            /* Enabled, but not for HardFault and NMI */
 +            return mmu_idx == ARMMMUIdx_MNegPri;
 +        case R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK:
 +            /* Enabled for all cases */
 +            return false;
 +        case 0:
 +        default:
 +            /* HFNMIENA set and ENABLE clear is UNPREDICTABLE, but
 +             * we warned about that in armv7m_nvic.c when the guest set it.
 +             */
 +            return true;
 +        }
      }
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
-     if (mmu_idx == ARMMMUIdx_S2NS) {
+-        return CP_ACCESS_TRAP;
-diff --git a/target/arm/translate.c b/target/arm/translate.c
++        return CP_ACCESS_TRAP_UNCATEGORIZED;
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/target/arm/translate.c
+     return CP_ACCESS_OK;
-+++ b/target/arm/translate.c
+ }
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
          return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
      case ARMMMUIdx_MUser:
      case ARMMMUIdx_MPriv:
 +    case ARMMMUIdx_MNegPri:
          return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
      case ARMMMUIdx_S2NS:
      default:
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 14/27] armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-From: Michael Davidsaver <mdavidsaver@gmail.com>
+We prefer the FIELD macro over ad-hoc #defines for register bits;
 switch CNTHCTL to that style before we add any more bits.
-Improve the "-d mmu" tracing for the PMSAv7 MPU translation
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-process as an aid in debugging guest MPU configurations:
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
- * fix a missing newline for a guest-error log
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
- * report the region number with guest-error or unimp
+Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
-   logs of bad region register values
+---
- * add a log message for the overall result of the lookup
+ target/arm/internals.h | 27 +++++++++++++++++++++++++--
- * print "0x" prefix for hex values
+ target/arm/helper.c    |  9 ++++-----
 files changed, 29 insertions(+), 7 deletions(-)
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
+diff --git a/target/arm/internals.h b/target/arm/internals.h
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+index XXXXXXX..XXXXXXX 100644
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+--- a/target/arm/internals.h
-Message-id: 1493122030-32191-9-git-send-email-peter.maydell@linaro.org
++++ b/target/arm/internals.h
-[PMM: a little tidyup, report region number in all messages
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
- rather than just one]
+ #define HSTR_TTEE (1 << 16)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+ #define HSTR_TJDBX (1 << 17)
----
- target/arm/helper.c | 39 +++++++++++++++++++++++++++------------
+-#define CNTHCTL_CNTVMASK      (1 << 18)
-file changed, 27 insertions(+), 12 deletions(-)
+-#define CNTHCTL_CNTPMASK      (1 << 19)
++/*
 + * Depending on the value of HCR_EL2.E2H, bits 0 and 1
 + * have different bit definitions, and EL1PCTEN might be
 + * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
 + * disambiguate if necessary.
 + */
 +FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
 +FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
 +FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
 +FIELD(CNTHCTL, EVNTEN, 2, 1)
 +FIELD(CNTHCTL, EVNTDIR, 3, 1)
 +FIELD(CNTHCTL, EVNTI, 4, 4)
 +FIELD(CNTHCTL, EL0VTEN, 8, 1)
 +FIELD(CNTHCTL, EL0PTEN, 9, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
 +FIELD(CNTHCTL, EL1PTEN, 11, 1)
 +FIELD(CNTHCTL, ECV, 12, 1)
 +FIELD(CNTHCTL, EL1TVT, 13, 1)
 +FIELD(CNTHCTL, EL1TVCT, 14, 1)
 +FIELD(CNTHCTL, EL1NVPCT, 15, 1)
 +FIELD(CNTHCTL, EL1NVVCT, 16, 1)
 +FIELD(CNTHCTL, EVNTIS, 17, 1)
 +FIELD(CNTHCTL, CNTVMASK, 18, 1)
 +FIELD(CNTHCTL, CNTPMASK, 19, 1)
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
-             }
+      * It is RES0 in Secure and NonSecure state.
              if (!rsize) {
 -                qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "DRSR[%d]: Rsize field cannot be 0\n", n);
                  continue;
              }
              rsize++;
              rmask = (1ull << rsize) - 1;
              if (base & rmask) {
 -                qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
 -                              "to DRSR region size, mask = %" PRIx32,
 -                              base, rmask);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "DRBAR[%d]: 0x%" PRIx32 " misaligned "
 +                              "to DRSR region size, mask = 0x%" PRIx32 "\n",
 +                              n, base, rmask);
                  continue;
              }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                  }
              }
              if (rsize < TARGET_PAGE_BITS) {
 -                qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
 +                qemu_log_mask(LOG_UNIMP,
 +                              "DRSR[%d]: No support for MPU (sub)region "
                                "alignment of %" PRIu32 " bits. Minimum is %d\n",
 -                              rsize, TARGET_PAGE_BITS);
 +                              n, rsize, TARGET_PAGE_BITS);
                  continue;
              }
              if (srdis) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                      break;
                  default:
                      qemu_log_mask(LOG_GUEST_ERROR,
 -                                  "Bad value for AP bits in DRACR %"
 -                                  PRIx32 "\n", ap);
 +                                  "DRACR[%d]: Bad value for AP bits: 0x%"
 +                                  PRIx32 "\n", n, ap);
                  }
              } else { /* Priv. mode AP bits decoding */
                  switch (ap) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                      break;
                  default:
                      qemu_log_mask(LOG_GUEST_ERROR,
 -                                  "Bad value for AP bits in DRACR %"
 -                                  PRIx32 "\n", ap);
 +                                  "DRACR[%d]: Bad value for AP bits: 0x%"
 +                                  PRIx32 "\n", n, ap);
                  }
              }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
       */
-     if (arm_feature(env, ARM_FEATURE_PMSA) &&
+     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-         arm_feature(env, ARM_FEATURE_V7)) {
+-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-+        bool ret;
+-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
-         *page_size = TARGET_PAGE_SIZE;
++        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
--        return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
++         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
--                                    phys_ptr, prot, fsr);
+         irqstate = 0;
 +        ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
 +                                   phys_ptr, prot, fsr);
 +        qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
 +                      " mmu_idx %u -> %s (prot %c%c%c)\n",
 +                      access_type == 1 ? "reading" :
 +                      (access_type == 2 ? "writing" : "execute"),
 +                      (uint32_t)address, mmu_idx,
 +                      ret ? "Miss" : "Hit",
 +                      *prot & PAGE_READ ? 'r' : '-',
 +                      *prot & PAGE_WRITE ? 'w' : '-',
 +                      *prot & PAGE_EXEC ? 'x' : '-');
 +
 +        return ret;
      }
-     if (regime_translation_disabled(env, mmu_idx)) {
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      ARMCPU *cpu = env_archcpu(env);
      uint32_t oldval = env->cp15.cnthctl_el2;
 -
      raw_write(env, ri, value);
 -    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
 +    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
          gt_update_irq(cpu, GTIMER_VIRT);
 -    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
 +    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
          gt_update_irq(cpu, GTIMER_PHYS);
      }
  }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 12/27] arm: Don't let no-MPU PMSA cores write to SCTLR.M
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-If the CPU is a PMSA config with no MPU implemented, then the
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
-SCTLR.M bit should be RAZ/WI, so that the guest can never
+This is not strictly architecturally required, but it is how we've
-turn on the non-existent MPU.
+tended to implement registers more recently.
 In particular, bits [19:18] are only present with FEAT_RME,
 and bits [17:12] will only be present with FEAT_ECV.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
 Message-id: 1493122030-32191-7-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 5 +++++
+ target/arm/helper.c | 18 ++++++++++++++++++
-file changed, 5 insertions(+)
+file changed, 18 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         return;
+ {
-     }
+     ARMCPU *cpu = env_archcpu(env);
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+    if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
++    uint32_t valid_mask =
-+        /* M bit is RAZ/WI for PMSA with no MPU implemented */
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
-+        value &= ~SCTLR_M;
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
 +        R_CNTHCTL_EVNTEN_MASK |
 +        R_CNTHCTL_EVNTDIR_MASK |
 +        R_CNTHCTL_EVNTI_MASK |
 +        R_CNTHCTL_EL0VTEN_MASK |
 +        R_CNTHCTL_EL0PTEN_MASK |
 +        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
 +        R_CNTHCTL_EL1PTEN_MASK;
 +
 +    if (cpu_isar_feature(aa64_rme, cpu)) {
 +        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
 +    }
 +
++    /* Clear RES0 bits */
++    value &= valid_mask;
++
      raw_write(env, ri, value);
-     /* ??? Lots of these bits are not implemented.  */
-     /* This may enable/disable the MMU, so do a TLB flush.  */
+     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 10/27] arm: Clean up handling of no-MPU PMSA CPUs
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
-ARM CPUs come in two flavours:
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
- * proper MMU ("VMSA")
+ * four new trap bits for various counter and timer registers
- * only an MPU ("PMSA")
+ * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
-For PMSA, the MPU may be implemented, or not (in which case there
+   scaling of the event stream. This is a no-op for us, because we don't
-is default "always acts the same" behaviour, but it isn't guest
+   implement the event stream (our WFE is a NOP): all we need to do is
-programmable).
+   allow CNTHCTL_EL2.ENVTIS to be read and written.
  * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
    TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
    FEAT_SPE or FEAT_TRF.
  * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
    "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
    that no barriers are needed around their accesses. For us these
    are just the same as the normal views, because all our sysregs are
    inherently self-sychronizing.
-QEMU is a bit confused about how we indicate this: we have an
+In this commit we implement the trap handling and permit the new
-ARM_FEATURE_MPU, but it's not clear whether this indicates
+CNTHCTL_EL2 bits to be written.
 "PMSA, not VMSA" or "PMSA and MPU present" , and sometimes we
 use it for one purpose and sometimes the other.
 Currently trying to implement a PMSA-without-MPU core won't
 work correctly because we turn off the ARM_FEATURE_MPU bit
 and then a lot of things which should still exist get
 turned off too.
 As the first step in cleaning this up, rename the feature
 bit to ARM_FEATURE_PMSA, which indicates a PMSA CPU (with
 or without MPU).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
 Message-id: 1493122030-32191-5-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |  2 +-
+ target/arm/cpu-features.h |  5 ++++
- target/arm/cpu.c     | 12 ++++++------
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
- target/arm/helper.c  | 12 ++++++------
+files changed, 51 insertions(+), 5 deletions(-)
  target/arm/machine.c |  2 +-
 files changed, 14 insertions(+), 14 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/cpu-features.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
-     ARM_FEATURE_V6K,
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
-     ARM_FEATURE_V7,
+ }
-     ARM_FEATURE_THUMB2,
--    ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
-+    ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
++{
-     ARM_FEATURE_VFP3,
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
-     ARM_FEATURE_VFP_FP16,
++}
-     ARM_FEATURE_NEON,
++
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/target/arm/cpu.c
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
                                   &error_abort);
      }
 -    if (arm_feature(&cpu->env, ARM_FEATURE_MPU)) {
 +    if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
          if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V7) &&
          !arm_feature(env, ARM_FEATURE_M) &&
 -        !arm_feature(env, ARM_FEATURE_MPU)) {
 +        !arm_feature(env, ARM_FEATURE_PMSA)) {
          /* v7VMSA drops support for the old ARMv5 tiny pages, so we
           * can use 4K pages.
           */
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      }
      if (!cpu->has_mpu) {
 -        unset_feature(env, ARM_FEATURE_MPU);
 +        unset_feature(env, ARM_FEATURE_PMSA);
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU) &&
 +    if (arm_feature(env, ARM_FEATURE_PMSA) &&
          arm_feature(env, ARM_FEATURE_V7)) {
          uint32_t nr = cpu->pmsav7_dregion;
@@ -XXX,XX +XXX,XX @@ static void arm946_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm946";
      set_feature(&cpu->env, ARM_FEATURE_V5);
 -    set_feature(&cpu->env, ARM_FEATURE_MPU);
 +    set_feature(&cpu->env, ARM_FEATURE_PMSA);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      cpu->midr = 0x41059461;
      cpu->ctr = 0x0f004006;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DIV);
      set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
      set_feature(&cpu->env, ARM_FEATURE_V7MP);
 -    set_feature(&cpu->env, ARM_FEATURE_MPU);
 +    set_feature(&cpu->env, ARM_FEATURE_PMSA);
      cpu->midr = 0x411fc153; /* r1p3 */
      cpu->id_pfr0 = 0x0131;
      cpu->id_pfr1 = 0x001;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
               : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
              return CP_ACCESS_TRAP_EL2;
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                  }
              }
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (cpu_isar_feature(aa64_rme, cpu)) {
          valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        valid_mask |=
 +            R_CNTHCTL_EL1TVT_MASK |
 +            R_CNTHCTL_EL1TVCT_MASK |
 +            R_CNTHCTL_EL1NVPCT_MASK |
 +            R_CNTHCTL_EL1NVVCT_MASK |
 +            R_CNTHCTL_EVNTIS_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+     if (arm_current_el(env) == 1) {
+         /* This must be a FEAT_NV access */
--    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
+-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
-+    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
+         return CP_ACCESS_OK;
          && !extended_addresses_enabled(env)) {
          /* For VMSA (when not using the LPAE long descriptor page table
           * format) this register includes the ASID, so do a TLB flush.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
          define_arm_cp_regs(cpu, v6k_cp_reginfo);
      }
-     if (arm_feature(env, ARM_FEATURE_V7MP) &&
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
--        !arm_feature(env, ARM_FEATURE_MPU)) {
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-+        !arm_feature(env, ARM_FEATURE_PMSA)) {
+     return CP_ACCESS_OK;
          define_arm_cp_regs(cpu, v7mp_cp_reginfo);
      }
      if (arm_feature(env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
          }
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU)) {
 +    if (arm_feature(env, ARM_FEATURE_PMSA)) {
          if (arm_feature(env, ARM_FEATURE_V6)) {
              /* PMSAv6 not implemented */
              assert(arm_feature(env, ARM_FEATURE_V7));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
          }
          define_arm_cp_regs(cpu, id_cp_reginfo);
 -        if (!arm_feature(env, ARM_FEATURE_MPU)) {
 +        if (!arm_feature(env, ARM_FEATURE_PMSA)) {
              define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
          } else if (arm_feature(env, ARM_FEATURE_V7)) {
              define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
      /* pmsav7 has special handling for when MPU is disabled so call it before
       * the common MMU/MPU disabled check below.
       */
 -    if (arm_feature(env, ARM_FEATURE_MPU) &&
 +    if (arm_feature(env, ARM_FEATURE_PMSA) &&
          arm_feature(env, ARM_FEATURE_V7)) {
          *page_size = TARGET_PAGE_SIZE;
          return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
          return 0;
      }
 -    if (arm_feature(env, ARM_FEATURE_MPU)) {
 +    if (arm_feature(env, ARM_FEATURE_PMSA)) {
          /* Pre-v7 MPU */
          *page_size = TARGET_PAGE_SIZE;
          return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_needed(void *opaque)
      ARMCPU *cpu = opaque;
      CPUARMState *env = &cpu->env;
 -    return arm_feature(env, ARM_FEATURE_MPU) &&
 +    return arm_feature(env, ARM_FEATURE_PMSA) &&
             arm_feature(env, ARM_FEATURE_V7);
  }
++static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
++                                      bool isread)
++{
++    if (arm_current_el(env) == 1) {
++        /* This must be a FEAT_NV access with NVx == 101 */
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
++            return CP_ACCESS_TRAP_EL2;
++        }
++    }
++    return e2h_access(env, ri, isread);
++}
++
++static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
++                                      bool isread)
++{
++    if (arm_current_el(env) == 1) {
++        /* This must be a FEAT_NV access with NVx == 101 */
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
++            return CP_ACCESS_TRAP_EL2;
++        }
++    }
++    return e2h_access(env, ri, isread);
++}
++
+ /* Test if system register redirection is to occur in the current state.  */
+ static bool redirect_for_e2h(CPUARMState *env)
+ {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
+     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
+       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
+       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
+     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvvct,
+       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
+       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
+       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
+       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
+     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvvct,
+       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
+ #endif
+ };
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 13/27] arm: Remove unnecessary check on cpu->pmsav7_dregion
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-Now that we enforce both:
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
- * pmsav7_dregion == 0 implies has_mpu == false
+defined, which are "self-synchronized" views of the physical and
- * PMSA with has_mpu == false means SCTLR.M cannot be set
+virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
-we can remove a check on pmsav7_dregion from get_phys_addr_pmsav7(),
+(meaning that no barriers are needed around accesses to them to
-because we can only reach this code path if the MPU is enabled
+ensure that reads of them do not occur speculatively and out-of-order
-(and so region_translation_disabled() returned false).
+with other instructions).
 For QEMU, all our system registers are self-synchronized, so we can
 simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
 to the new register encodings.
 This means we now implement all the functionality required for
 ID_AA64MMFR0_EL1.ECV == 0b0001.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1493122030-32191-8-git-send-email-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 3 +--
+ target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 43 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-         }
+     },
+ };
-         if (n == -1) { /* no hits */
--            if (cpu->pmsav7_dregion &&
++/*
--                (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
++ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
-+            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
++ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
-                 /* background fault */
++ * so our implementations here are identical to the normal registers.
-                 *fsr = 0;
++ */
-                 return true;
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access,
 +      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
 +    },
 +    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access,
 +      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
 +    },
 +};
 +
  #else
  /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
  };
 +/*
 + * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
 + * is exposed to userspace by Linux.
 + */
 +static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .readfn = gt_virt_cnt_read,
 +    },
 +};
 +
  #endif
  static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
          define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
 +    }
      if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 08/27] arm: Add support for M profile CPUs having different MMU index semantics
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-The M profile CPU's MPU has an awkward corner case which we
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
-would like to implement with a different MMU index.
+implemented.  This is similar to the existing CNTVOFF_EL2, except
 that it controls a hypervisor-adjustable offset made to the physical
 counter and timer.
-We can avoid having to bump the number of MMU modes ARM
+Implement the handling for this register, which includes control/trap
-uses, because some of our existing MMU indexes are only
+bits in SCR_EL3 and CNTHCTL_EL2.
 used by non-M-profile CPUs, so we can borrow one.
 To avoid that getting too confusing, clean up the code
 to try to keep the two meanings of the index separate.
 Instead of ARMMMUIdx enum values being identical to core QEMU
 MMU index values, they are now the core index values with some
 high bits set. Any particular CPU always uses the same high
 bits (so eventually A profile cores and M profile cores will
 use different bits). New functions arm_to_core_mmu_idx()
 and core_to_arm_mmu_idx() convert between the two.
 In general core index values are stored in 'int' types, and
 ARM values are stored in ARMMMUIdx types.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1493122030-32191-3-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
 ---
- target/arm/cpu.h           |  71 ++++++++++++++++-----
+ target/arm/cpu-features.h |  5 +++
- target/arm/translate.h     |   2 +-
+ target/arm/cpu.h          |  1 +
- target/arm/helper.c        | 151 ++++++++++++++++++++++++---------------------
+ target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
- target/arm/op_helper.c     |   3 +-
+ target/arm/trace-events   |  1 +
- target/arm/translate-a64.c |  18 ++++--
+files changed, 73 insertions(+), 2 deletions(-)
  target/arm/translate.c     |  10 +--
 files changed, 156 insertions(+), 99 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+ }
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
++}
++
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-  * for the accesses done as part of a stage 1 page table walk, rather than
+         uint64_t c14_cntkctl; /* Timer Control register */
-  * having to walk the stage 2 page table over and over.)
+         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
-  *
+         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
-+ * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
++        uint64_t cntpoff_el2; /* Counter Physical Offset register */
-+ * are not quite the same -- different CPU types (most notably M profile
+         ARMGenericTimer c14_timer[NUM_GTIMERS];
-+ * vs A/R profile) would like to use MMU indexes with different semantics,
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
-+ * but since we don't ever need to use all of those in a single CPU we
+         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
 + * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
 + * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
 + * the same for any particular CPU.
 + * Variables of type ARMMUIdx are always full values, and the core
 + * index values are in variables of type 'int'.
 + *
   * Our enumeration includes at the end some entries which are not "true"
   * mmu_idx values in that they don't have corresponding TLBs and are only
   * valid for doing slow path page table walks.
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
   * of the AT/ATS operations.
   * The values used are carefully arranged to make mmu_idx => EL lookup easy.
   */
 +#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
 +#define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
 +
 +#define ARM_MMU_IDX_TYPE_MASK (~0x7)
 +#define ARM_MMU_IDX_COREIDX_MASK 0x7
 +
  typedef enum ARMMMUIdx {
 -    ARMMMUIdx_S12NSE0 = 0,
 -    ARMMMUIdx_S12NSE1 = 1,
 -    ARMMMUIdx_S1E2 = 2,
 -    ARMMMUIdx_S1E3 = 3,
 -    ARMMMUIdx_S1SE0 = 4,
 -    ARMMMUIdx_S1SE1 = 5,
 -    ARMMMUIdx_S2NS = 6,
 +    ARMMMUIdx_S12NSE0 = 0 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S12NSE1 = 1 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S1E2 = 2 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S1E3 = 3 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
 +    ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
      /* Indexes below here don't have TLBs and are used only for AT system
       * instructions or for the first stage of an S12 page table walk.
       */
 -    ARMMMUIdx_S1NSE0 = 7,
 -    ARMMMUIdx_S1NSE1 = 8,
 +    ARMMMUIdx_S1NSE0 = 0 | ARM_MMU_IDX_NOTLB,
 +    ARMMMUIdx_S1NSE1 = 1 | ARM_MMU_IDX_NOTLB,
  } ARMMMUIdx;
 +/* Bit macros for the core-mmu-index values for each index,
 + * for use when calling tlb_flush_by_mmuidx() and friends.
 + */
 +typedef enum ARMMMUIdxBit {
 +    ARMMMUIdxBit_S12NSE0 = 1 << 0,
 +    ARMMMUIdxBit_S12NSE1 = 1 << 1,
 +    ARMMMUIdxBit_S1E2 = 1 << 2,
 +    ARMMMUIdxBit_S1E3 = 1 << 3,
 +    ARMMMUIdxBit_S1SE0 = 1 << 4,
 +    ARMMMUIdxBit_S1SE1 = 1 << 5,
 +    ARMMMUIdxBit_S2NS = 1 << 6,
 +} ARMMMUIdxBit;
 +
  #define MMU_USER_IDX 0
 +static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
 +{
 +    return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
 +}
 +
 +static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
 +{
 +    return mmu_idx | ARM_MMU_IDX_A;
 +}
 +
  /* Return the exception level we're running at if this is our mmu_idx */
  static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
  {
 -    assert(mmu_idx < ARMMMUIdx_S2NS);
 -    return mmu_idx & 3;
 +    switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
 +    case ARM_MMU_IDX_A:
 +        return mmu_idx & 3;
 +    default:
 +        g_assert_not_reached();
 +    }
  }
  /* Determine the current mmu_idx to use for normal loads/stores */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
      int el = arm_current_el(env);
      if (el < 2 && arm_is_secure_below_el3(env)) {
 -        return ARMMMUIdx_S1SE0 + el;
 +        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
      }
      return el;
  }
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
  static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                                          target_ulong *cs_base, uint32_t *flags)
  {
 -    ARMMMUIdx mmu_idx = cpu_mmu_index(env, false);
 +    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
      if (is_a64(env)) {
          *pc = env->pc;
          *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                     << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
      }
 -    *flags |= (mmu_idx << ARM_TBFLAG_MMUIDX_SHIFT);
 +    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
      /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
       * states defined in the ARM ARM for software singlestep:
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_dc_feature(DisasContext *dc, int feature)
  static inline int get_mem_index(DisasContext *s)
  {
 -    return s->mmu_idx;
 +    return arm_to_core_mmu_idx(s->mmu_idx);
  }
  /* Function used to determine the target exception EL when otherwise not known
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-     CPUState *cs = ENV_GET_CPU(env);
+         if (cpu_isar_feature(aa64_rme, cpu)) {
+             valid_mask |= SCR_NSE | SCR_GPF;
-     tlb_flush_by_mmuidx(cs,
+         }
--                        (1 << ARMMMUIdx_S12NSE1) |
++        if (cpu_isar_feature(aa64_ecv, cpu)) {
--                        (1 << ARMMMUIdx_S12NSE0) |
++            valid_mask |= SCR_ECVEN;
--                        (1 << ARMMMUIdx_S2NS));
++        }
-+                        ARMMMUIdxBit_S12NSE1 |
+     } else {
-+                        ARMMMUIdxBit_S12NSE0 |
+         valid_mask &= ~(SCR_RW | SCR_ST);
-+                        ARMMMUIdxBit_S2NS);
+         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
      gt_update_irq(cpu, GTIMER_PHYS);
  }
- static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
++static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      CPUState *cs = ENV_GET_CPU(env);
      tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                        (1 << ARMMMUIdx_S12NSE1) |
 -                                        (1 << ARMMMUIdx_S12NSE0) |
 -                                        (1 << ARMMMUIdx_S2NS));
 +                                        ARMMMUIdxBit_S12NSE1 |
 +                                        ARMMMUIdxBit_S12NSE0 |
 +                                        ARMMMUIdxBit_S2NS);
  }
  static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      pageaddr = sextract64(value << 12, 0, 40);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
  }
  static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      pageaddr = sextract64(value << 12, 0, 40);
      tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             (1 << ARMMMUIdx_S2NS));
 +                                             ARMMMUIdxBit_S2NS);
  }
  static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = ENV_GET_CPU(env);
 -    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
  }
  static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = ENV_GET_CPU(env);
 -    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
  }
  static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
      CPUState *cs = ENV_GET_CPU(env);
      uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
  }
  static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
      tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             (1 << ARMMMUIdx_S1E2));
 +                                             ARMMMUIdxBit_S1E2);
  }
  static const ARMCPRegInfo cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
      if (raw_read(env, ri) != value) {
          tlb_flush_by_mmuidx(cs,
 -                            (1 << ARMMMUIdx_S12NSE1) |
 -                            (1 << ARMMMUIdx_S12NSE0) |
 -                            (1 << ARMMMUIdx_S2NS));
 +                            ARMMMUIdxBit_S12NSE1 |
 +                            ARMMMUIdxBit_S12NSE0 |
 +                            ARMMMUIdxBit_S2NS);
          raw_write(env, ri, value);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (arm_is_secure_below_el3(env)) {
          tlb_flush_by_mmuidx(cs,
 -                            (1 << ARMMMUIdx_S1SE1) |
 -                            (1 << ARMMMUIdx_S1SE0));
 +                            ARMMMUIdxBit_S1SE1 |
 +                            ARMMMUIdxBit_S1SE0);
      } else {
          tlb_flush_by_mmuidx(cs,
 -                            (1 << ARMMMUIdx_S12NSE1) |
 -                            (1 << ARMMMUIdx_S12NSE0));
 +                            ARMMMUIdxBit_S12NSE1 |
 +                            ARMMMUIdxBit_S12NSE0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (sec) {
          tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                            (1 << ARMMMUIdx_S1SE1) |
 -                                            (1 << ARMMMUIdx_S1SE0));
 +                                            ARMMMUIdxBit_S1SE1 |
 +                                            ARMMMUIdxBit_S1SE0);
      } else {
          tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                            (1 << ARMMMUIdx_S12NSE1) |
 -                                            (1 << ARMMMUIdx_S12NSE0));
 +                                            ARMMMUIdxBit_S12NSE1 |
 +                                            ARMMMUIdxBit_S12NSE0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (arm_is_secure_below_el3(env)) {
          tlb_flush_by_mmuidx(cs,
 -                            (1 << ARMMMUIdx_S1SE1) |
 -                            (1 << ARMMMUIdx_S1SE0));
 +                            ARMMMUIdxBit_S1SE1 |
 +                            ARMMMUIdxBit_S1SE0);
      } else {
          if (arm_feature(env, ARM_FEATURE_EL2)) {
              tlb_flush_by_mmuidx(cs,
 -                                (1 << ARMMMUIdx_S12NSE1) |
 -                                (1 << ARMMMUIdx_S12NSE0) |
 -                                (1 << ARMMMUIdx_S2NS));
 +                                ARMMMUIdxBit_S12NSE1 |
 +                                ARMMMUIdxBit_S12NSE0 |
 +                                ARMMMUIdxBit_S2NS);
          } else {
              tlb_flush_by_mmuidx(cs,
 -                                (1 << ARMMMUIdx_S12NSE1) |
 -                                (1 << ARMMMUIdx_S12NSE0));
 +                                ARMMMUIdxBit_S12NSE1 |
 +                                ARMMMUIdxBit_S12NSE0);
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      ARMCPU *cpu = arm_env_get_cpu(env);
      CPUState *cs = CPU(cpu);
 -    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
  }
  static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
      ARMCPU *cpu = arm_env_get_cpu(env);
      CPUState *cs = CPU(cpu);
 -    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E3));
 +    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
  }
  static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (sec) {
          tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                            (1 << ARMMMUIdx_S1SE1) |
 -                                            (1 << ARMMMUIdx_S1SE0));
 +                                            ARMMMUIdxBit_S1SE1 |
 +                                            ARMMMUIdxBit_S1SE0);
      } else if (has_el2) {
          tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                            (1 << ARMMMUIdx_S12NSE1) |
 -                                            (1 << ARMMMUIdx_S12NSE0) |
 -                                            (1 << ARMMMUIdx_S2NS));
 +                                            ARMMMUIdxBit_S12NSE1 |
 +                                            ARMMMUIdxBit_S12NSE0 |
 +                                            ARMMMUIdxBit_S2NS);
      } else {
            tlb_flush_by_mmuidx_all_cpus_synced(cs,
 -                                              (1 << ARMMMUIdx_S12NSE1) |
 -                                              (1 << ARMMMUIdx_S12NSE0));
 +                                              ARMMMUIdxBit_S12NSE1 |
 +                                              ARMMMUIdxBit_S12NSE0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = ENV_GET_CPU(env);
 -    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
  }
  static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      CPUState *cs = ENV_GET_CPU(env);
 -    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E3));
 +    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
  }
  static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (arm_is_secure_below_el3(env)) {
          tlb_flush_page_by_mmuidx(cs, pageaddr,
 -                                 (1 << ARMMMUIdx_S1SE1) |
 -                                 (1 << ARMMMUIdx_S1SE0));
 +                                 ARMMMUIdxBit_S1SE1 |
 +                                 ARMMMUIdxBit_S1SE0);
      } else {
          tlb_flush_page_by_mmuidx(cs, pageaddr,
 -                                 (1 << ARMMMUIdx_S12NSE1) |
 -                                 (1 << ARMMMUIdx_S12NSE0));
 +                                 ARMMMUIdxBit_S12NSE1 |
 +                                 ARMMMUIdxBit_S12NSE0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      CPUState *cs = CPU(cpu);
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
  }
  static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
      CPUState *cs = CPU(cpu);
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E3));
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
  }
  static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (sec) {
          tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                                 (1 << ARMMMUIdx_S1SE1) |
 -                                                 (1 << ARMMMUIdx_S1SE0));
 +                                                 ARMMMUIdxBit_S1SE1 |
 +                                                 ARMMMUIdxBit_S1SE0);
      } else {
          tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                                 (1 << ARMMMUIdx_S12NSE1) |
 -                                                 (1 << ARMMMUIdx_S12NSE0));
 +                                                 ARMMMUIdxBit_S12NSE1 |
 +                                                 ARMMMUIdxBit_S12NSE0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
      tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             (1 << ARMMMUIdx_S1E2));
 +                                             ARMMMUIdxBit_S1E2);
  }
  static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      uint64_t pageaddr = sextract64(value << 12, 0, 56);
      tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             (1 << ARMMMUIdx_S1E3));
 +                                             ARMMMUIdxBit_S1E3);
  }
  static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
      pageaddr = sextract64(value << 12, 0, 48);
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
 +    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
  }
  static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      pageaddr = sextract64(value << 12, 0, 48);
      tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             (1 << ARMMMUIdx_S2NS));
 +                                             ARMMMUIdxBit_S2NS);
  }
  static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
      return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
  }
 +/* Convert a possible stage1+2 MMU index into the appropriate
 + * stage 1 MMU index
 + */
 +static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
 +{
-+    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
++    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
-+        mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
++        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
 +        arm_is_el2_enabled(env) &&
 +        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 +        return env->cp15.cntpoff_el2;
 +    }
-+    return mmu_idx;
++    return 0;
 +}
 +
- /* Returns TBI0 value for current regime el */
++static uint64_t gt_phys_cnt_offset(CPUARMState *env)
- uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
++{
 +    if (arm_current_el(env) >= 2) {
 +        return 0;
 +    }
 +    return gt_phys_raw_cnt_offset(env);
 +}
 +
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
  {
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
+     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
-     uint32_t el;
+@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
+          * reset timer to when ISTATUS next has to change
-     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
+          */
--       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+         uint64_t offset = timeridx == GTIMER_VIRT ?
--       */
+-                                      cpu->env.cp15.cntvoff_el2 : 0;
--    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
++            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
--        mmu_idx += ARMMMUIdx_S1NSE0;
+         uint64_t count = gt_get_countervalue(&cpu->env);
--    }
+         /* Note that this must be unsigned 64 bit arithmetic: */
-+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+         int istatus = count - offset >= gt->cval;
-+     */
+@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
-+    mmu_idx = stage_1_mmu_idx(mmu_idx);
+ static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
      tcr = regime_tcr(env, mmu_idx);
      el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
      uint32_t el;
      /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
 -       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
 -       */
 -    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
 -        mmu_idx += ARMMMUIdx_S1NSE0;
 -    }
 +     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
 +     */
 +    mmu_idx = stage_1_mmu_idx(mmu_idx);
      tcr = regime_tcr(env, mmu_idx);
      el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static inline bool regime_using_lpae_format(CPUARMState *env,
   * on whether the long or short descriptor format is in use. */
  bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
--    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
+-    return gt_get_countervalue(env);
--        mmu_idx += ARMMMUIdx_S1NSE0;
++    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 -    }
 +    mmu_idx = stage_1_mmu_idx(mmu_idx);
      return regime_using_lpae_format(env, mmu_idx);
  }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
-             int ret;
+ static uint64_t gt_virt_cnt_offset(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
-             ret = get_phys_addr(env, address, access_type,
+     case GTIMER_HYPVIRT:
--                                mmu_idx + ARMMMUIdx_S1NSE0, &ipa, attrs,
+         offset = gt_virt_cnt_offset(env);
-+                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
+         break;
-                                 prot, page_size, fsr, fi);
++    case GTIMER_PHYS:
++        offset = gt_phys_cnt_offset(env);
              /* If S1 fails or S2 is disabled, return early.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
              /*
               * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
               */
 -            mmu_idx += ARMMMUIdx_S1NSE0;
 +            mmu_idx = stage_1_mmu_idx(mmu_idx);
          }
      }
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
      int ret;
      MemTxAttrs attrs = {};
 -    ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
 +    ret = get_phys_addr(env, address, access_type,
 +                        core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
                          &attrs, &prot, &page_size, fsr, fi);
      if (!ret) {
          /* Map a single [sub]page.  */
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
      bool ret;
      uint32_t fsr;
      ARMMMUFaultInfo fi = {};
 +    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
      *attrs = (MemTxAttrs) {};
 -    ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
 +    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
                          attrs, &prot, &page_size, &fsr, &fi);
      if (ret) {
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
      int target_el;
      bool same_el;
      uint32_t syn;
 +    ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
      if (retaddr) {
          /* now we have a real cpu fault */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
      /* the DFSR for an alignment fault depends on whether we're using
       * the LPAE long descriptor format, or the short descriptor format
       */
 -    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
 +    if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
          env->exception.fsr = (1 << 9) | 0x21;
      } else {
          env->exception.fsr = 0x1;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void a64_translate_init(void)
          offsetof(CPUARMState, exclusive_high), "exclusive_high");
  }
 -static inline ARMMMUIdx get_a64_user_mem_index(DisasContext *s)
 +static inline int get_a64_user_mem_index(DisasContext *s)
  {
 -    /* Return the mmu_idx to use for A64 "unprivileged load/store" insns:
 +    /* Return the core mmu_idx to use for A64 "unprivileged load/store" insns:
       *  if EL1, access as if EL0; otherwise access at current EL
       */
 +    ARMMMUIdx useridx;
 +
      switch (s->mmu_idx) {
      case ARMMMUIdx_S12NSE1:
 -        return ARMMMUIdx_S12NSE0;
 +        useridx = ARMMMUIdx_S12NSE0;
 +        break;
      case ARMMMUIdx_S1SE1:
 -        return ARMMMUIdx_S1SE0;
 +        useridx = ARMMMUIdx_S1SE0;
 +        break;
      case ARMMMUIdx_S2NS:
          g_assert_not_reached();
      default:
 -        return s->mmu_idx;
 +        useridx = s->mmu_idx;
 +        break;
      }
-+    return arm_to_core_mmu_idx(useridx);
- }
+     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
+@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
- void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
+     case GTIMER_HYPVIRT:
-@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
+         offset = gt_virt_cnt_offset(env);
-     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
+         break;
-     dc->condexec_mask = 0;
++    case GTIMER_PHYS:
-     dc->condexec_cond = 0;
++        offset = gt_phys_cnt_offset(env);
--    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
++        break;
-+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
+     }
-     dc->tbi0 = ARM_TBFLAG_TBI0(tb->flags);
-     dc->tbi1 = ARM_TBFLAG_TBI1(tb->flags);
+     trace_arm_gt_tval_write(timeridx, value);
-     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+             R_CNTHCTL_EL1NVVCT_MASK |
              R_CNTHCTL_EVNTIS_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        valid_mask |= R_CNTHCTL_ECV_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
      },
  };
 +static CPAccessResult gt_cntpoff_access(CPUARMState *env,
 +                                        const ARMCPRegInfo *ri,
 +                                        bool isread)
 +{
 +    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                              uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    trace_arm_gt_cntpoff_write(value);
 +    raw_write(env, ri, value);
 +    gt_recalc_timer(cpu, GTIMER_PHYS);
 +}
 +
 +static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
 +    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
 +    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
 +    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
 +    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
 +    .nv2_redirect_offset = 0x1a8,
 +    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
 +};
  #else
  /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
          define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
 +    }
 +#endif
      if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 diff --git a/target/arm/trace-events b/target/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/trace-events
-+++ b/target/arm/translate.c
++++ b/target/arm/trace-events
-@@ -XXX,XX +XXX,XX @@ static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
+@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
-     disas_set_insn_syndrome(s, syn);
+ arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
- }
+ arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
+ arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
--static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
++arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
-+static inline int get_a32_user_mem_index(DisasContext *s)
+ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
- {
--    /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
+ # kvm.c
 +    /* Return the core mmu_idx to use for A32/T32 "unprivileged load/store"
       * insns:
       *  if PL2, UNPREDICTABLE (we choose to implement as if PL0)
       *  otherwise, access as if at PL0.
@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
      case ARMMMUIdx_S1E2:        /* this one is UNPREDICTABLE */
      case ARMMMUIdx_S12NSE0:
      case ARMMMUIdx_S12NSE1:
 -        return ARMMMUIdx_S12NSE0;
 +        return arm_to_core_mmu_idx(ARMMMUIdx_S12NSE0);
      case ARMMMUIdx_S1E3:
      case ARMMMUIdx_S1SE0:
      case ARMMMUIdx_S1SE1:
 -        return ARMMMUIdx_S1SE0;
 +        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
      case ARMMMUIdx_S2NS:
      default:
          g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
      dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
      dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
      dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
 -    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
 +    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
      dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
  #if !defined(CONFIG_USER_ONLY)
      dc->user = (dc->current_el == 0);
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 16/27] arm: All M profile cores are PMSA
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
-All M profile CPUs are PMSA, so set the feature bit.
+Enable all FEAT_ECV features on the 'max' CPU.
 (We haven't actually implemented the M profile MPU register
 interface yet, but setting this feature bit gives us closer
 to correct behaviour for the MPU-disabled case.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 1493122030-32191-11-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 8 ++++++++
+ docs/system/arm/emulation.rst | 1 +
-file changed, 8 insertions(+)
+ target/arm/tcg/cpu64.c        | 1 +
 files changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/docs/system/arm/emulation.rst
-+++ b/target/arm/cpu.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- {
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
-     ARMCPU *cpu = ARM_CPU(obj);
+ - FEAT_DoubleFault (Double Fault Extension)
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
-+    /* M profile implies PMSA. We have to do this here rather than
++- FEAT_ECV (Enhanced Counter Virtualization)
-+     * in realize with the other feature-implication checks because
+ - FEAT_EPAC (Enhanced pointer authentication)
-+     * we look at the PMSA bit to see if we should add some properties.
+ - FEAT_ETS (Enhanced Translation Synchronization)
-+     */
+ - FEAT_EVT (Enhanced Virtualization Traps)
-+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-+        set_feature(&cpu->env, ARM_FEATURE_PMSA);
+index XXXXXXX..XXXXXXX 100644
-+    }
+--- a/target/arm/tcg/cpu64.c
-+
++++ b/target/arm/tcg/cpu64.c
-     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
-         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
-         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property,
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
      t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
 +    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
      cpu->isar.id_aa64mmfr0 = t;
      t = cpu->isar.id_aa64mmfr1;
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 24/27] hw/misc: add a TMP42{1, 2, 3} device model
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: Cédric Le Goater <clg@kaod.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Largely inspired by the TMP105 temperature sensor, here is a model for
+Features supported :
-the TMP42{1,2,3} temperature sensors.
+- the 8 STM32L4x5 GPIOs are initialized with their reset values
     (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
-Specs can be found here :
+Difference with the real GPIOs :
 - Alternate Function and Analog mode aren't implemented :
     pins in AF/Analog behave like pins in input mode
 - floating pins stay at their last value
 - register IDR reset values differ from the real one :
     values are coherent with the other registers reset values
     and the fact that AF/Analog modes aren't implemented
 - setting I/O output speed isn't supported
 - locking port bits isn't supported
 - ADC function isn't supported
 - GPIOH has 16 pins instead of 2 pins
 - writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
-    http://www.ti.com/lit/gpn/tmp421
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
 Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  MAINTAINERS                        |   1 +
  docs/system/arm/b-l475e-iot01a.rst |   2 +-
  include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
  hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+diff --git a/MAINTAINERS b/MAINTAINERS
 Message-id: 1494827476-1487-6-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/misc/Makefile.objs           |   1 +
  hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
  default-configs/arm-softmmu.mak |   1 +
 files changed, 403 insertions(+)
  create mode 100644 hw/misc/tmp421.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/MAINTAINERS
-+++ b/hw/misc/Makefile.objs
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
- common-obj-$(CONFIG_APPLESMC) += applesmc.o
+ F: hw/misc/stm32l4x5_exti.c
- common-obj-$(CONFIG_MAX111X) += max111x.o
+ F: hw/misc/stm32l4x5_syscfg.c
- common-obj-$(CONFIG_TMP105) += tmp105.o
+ F: hw/misc/stm32l4x5_rcc.c
-+common-obj-$(CONFIG_TMP421) += tmp421.o
++F: hw/gpio/stm32l4x5_gpio.c
- common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
+ F: include/hw/*/stm32l4x5_*.h
- common-obj-$(CONFIG_SGA) += sga.o
- common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
+ B-L475E-IOT01A IoT Node
-diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
+diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/b-l475e-iot01a.rst
 +++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
  - STM32L4x5 EXTI (Extended interrupts and events controller)
  - STM32L4x5 SYSCFG (System configuration controller)
  - STM32L4x5 RCC (Reset and clock control)
 +- STM32L4x5 GPIOs (General-purpose I/Os)
  Missing devices
  """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
  The B-L475E-IOT01A does *not* support the following devices:
  - Serial ports (UART)
 -- General-purpose I/Os (GPIO)
  - Analog to Digital Converter (ADC)
  - SPI controller
  - Timer controller (TIMER)
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/tmp421.c
++++ b/include/hw/gpio/stm32l4x5_gpio.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Texas Instruments TMP421 temperature sensor.
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ * Copyright (c) 2016 IBM Corporation.
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
-+ * Largely inspired by :
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * Texas Instruments TMP105 temperature sensor.
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#ifndef HW_STM32L4X5_GPIO_H
 +#define HW_STM32L4X5_GPIO_H
 +
 +#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 +OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +
 +#define GPIO_NUM_PINS 16
 +
 +struct Stm32l4x5GpioState {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion mmio;
 +
 +    /* GPIO registers */
 +    uint32_t moder;
 +    uint32_t otyper;
 +    uint32_t ospeedr;
 +    uint32_t pupdr;
 +    uint32_t idr;
 +    uint32_t odr;
 +    uint32_t lckr;
 +    uint32_t afrl;
 +    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
 +
 +#endif
 diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ * Copyright (C) 2008 Nokia Corporation
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
-+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
-+ * This program is free software; you can redistribute it and/or
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * modify it under the terms of the GNU General Public License as
 + * published by the Free Software Foundation; either version 2 or
 + * (at your option) version 3 of the License.
 + *
-+ * This program is distributed in the hope that it will be useful,
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * See the COPYING file in the top-level directory.
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
++/*
++ * The reference used is the STMicroElectronics RM0351 Reference manual
++ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
++ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
++ */
++
 +#include "qemu/osdep.h"
-+#include "hw/hw.h"
++#include "qemu/log.h"
-+#include "hw/i2c/i2c.h"
++#include "hw/gpio/stm32l4x5_gpio.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
-+#include "qapi/visitor.h"
++#include "migration/vmstate.h"
-+
++#include "trace.h"
-+/* Manufacturer / Device ID's */
++
-+#define TMP421_MANUFACTURER_ID          0x55
++#define GPIO_MODER 0x00
-+#define TMP421_DEVICE_ID                0x21
++#define GPIO_OTYPER 0x04
-+#define TMP422_DEVICE_ID                0x22
++#define GPIO_OSPEEDR 0x08
-+#define TMP423_DEVICE_ID                0x23
++#define GPIO_PUPDR 0x0C
-+
++#define GPIO_IDR 0x10
-+typedef struct DeviceInfo {
++#define GPIO_ODR 0x14
-+    int model;
++#define GPIO_BSRR 0x18
-+    const char *name;
++#define GPIO_LCKR 0x1C
-+} DeviceInfo;
++#define GPIO_AFRL 0x20
-+
++#define GPIO_AFRH 0x24
-+static const DeviceInfo devices[] = {
++#define GPIO_BRR 0x28
-+    { TMP421_DEVICE_ID, "tmp421" },
++#define GPIO_ASCR 0x2C
-+    { TMP422_DEVICE_ID, "tmp422" },
++
-+    { TMP423_DEVICE_ID, "tmp423" },
++/* 0b11111111_11111111_00000000_00000000 */
 +#define RESERVED_BITS_MASK 0xFFFF0000
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s);
 +
 +static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 2;
 +}
 +
 +static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 1;
 +}
 +
 +static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
 +static void stm32l4x5_gpio_reset_hold(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    s->moder = s->moder_reset;
 +    s->otyper = 0x00000000;
 +    s->ospeedr = s->ospeedr_reset;
 +    s->pupdr = s->pupdr_reset;
 +    s->idr = 0x00000000;
 +    s->odr = 0x00000000;
 +    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
 +        s->pins_connected_high &= ~(1 << line);
 +    }
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s)
 +{
 +    uint32_t new_idr_mask = 0;
 +    uint32_t new_idr = s->odr;
 +    uint32_t old_idr = s->idr;
 +    int new_pin_state, old_pin_state;
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (is_output(s, i)) {
 +            if (is_push_pull(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (!(s->odr & (1 << i))) {
 +                /* open-drain ODR 0 */
 +                new_idr_mask |= (1 << i);
 +            /* open-drain ODR 1 */
 +            } else if (!(s->disconnected_pins & (1 << i)) &&
 +                       !(s->pins_connected_high & (1 << i))) {
 +                /* open-drain ODR 1 with pin connected low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            /* open-drain ODR 1 with unactive pin */
 +            } else if (is_pull_up(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for open-drain ODR 1
 +             * with unactive pin without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        /* input or analog mode with connected pin */
 +        } else if (!(s->disconnected_pins & (1 << i))) {
 +            if (s->pins_connected_high & (1 << i)) {
 +                /* pin high */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else {
 +                /* pin low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +        /* input or analog mode with disconnected pin */
 +        } else {
 +            if (is_pull_up(s, i)) {
 +                /* pull-up */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                /* pull-down */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for a disconnected pin
 +             * without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        }
 +    }
 +
 +    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
 +    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (new_idr_mask & (1 << i)) {
 +            new_pin_state = (new_idr & (1 << i)) > 0;
 +            old_pin_state = (old_idr & (1 << i)) > 0;
 +            if (new_pin_state > old_pin_state) {
 +                qemu_irq_raise(s->pin[i]);
 +            } else if (new_pin_state < old_pin_state) {
 +                qemu_irq_lower(s->pin[i]);
 +            }
 +        }
 +    }
 +}
 +
 +/*
 + * Return mask of pins that are both configured in output
 + * mode and externally driven (except pins in open-drain
 + * mode externally set to 0).
 + */
 +static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
 +{
 +    uint32_t pins_to_disconnect = 0;
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        /* for each connected pin in output mode */
 +        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
 +            /* if either push-pull or high level */
 +            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
 +                pins_to_disconnect |= (1 << i);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Line %d can't be driven externally\n",
 +                              i);
 +            }
 +        }
 +    }
 +    return pins_to_disconnect;
 +}
 +
 +/*
 + * Set field `disconnected_pins` and call `update_gpio_idr()`
 + */
 +static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
 +{
 +    s->disconnected_pins |= lines;
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +static void disconnected_pins_set(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint16_t value;
 +    if (!visit_type_uint16(v, name, &value, errp)) {
 +        return;
 +    }
 +    disconnect_gpio_pins(s, value);
 +}
 +
 +static void disconnected_pins_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
 +}
 +
 +static void clock_freq_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint32_t clock_freq_hz = clock_get_hz(s->clk);
 +    visit_type_uint32(v, name, &clock_freq_hz, errp);
 +}
 +
 +static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
 +                                 uint64_t val64, unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    uint32_t value = val64;
 +    trace_stm32l4x5_gpio_write(s->name, addr, val64);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        s->moder = value;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Analog and AF modes aren't supported\n\
 +                       Analog and AF mode behave like input mode\n",
 +                      __func__);
 +        return;
 +    case GPIO_OTYPER:
 +        s->otyper = value & ~RESERVED_BITS_MASK;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        return;
 +    case GPIO_OSPEEDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing I/O output speed isn't supported\n\
 +                       I/O speed is already maximal\n",
 +                      __func__);
 +        s->ospeedr = value;
 +        return;
 +    case GPIO_PUPDR:
 +        s->pupdr = value;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_IDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: GPIO->IDR is read-only\n",
 +                      __func__);
 +        return;
 +    case GPIO_ODR:
 +        s->odr = value & ~RESERVED_BITS_MASK;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_BSRR: {
 +        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
 +        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
 +        /* If both BSx and BRx are set, BSx has priority.*/
 +        s->odr &= ~bits_to_reset;
 +        s->odr |= bits_to_set;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_LCKR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Locking port bits configuration isn't supported\n",
 +                      __func__);
 +        s->lckr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    case GPIO_AFRL:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrl = value;
 +        return;
 +    case GPIO_AFRH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrh = value;
 +        return;
 +    case GPIO_BRR: {
 +        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
 +        s->odr &= ~bits_to_reset;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_ASCR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: ADC function isn't supported\n",
 +                      __func__);
 +        s->ascr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +    }
 +}
 +
 +static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
 +                                    unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    trace_stm32l4x5_gpio_read(s->name, addr);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        return s->moder;
 +    case GPIO_OTYPER:
 +        return s->otyper;
 +    case GPIO_OSPEEDR:
 +        return s->ospeedr;
 +    case GPIO_PUPDR:
 +        return s->pupdr;
 +    case GPIO_IDR:
 +        return s->idr;
 +    case GPIO_ODR:
 +        return s->odr;
 +    case GPIO_BSRR:
 +        return 0;
 +    case GPIO_LCKR:
 +        return s->lckr;
 +    case GPIO_AFRL:
 +        return s->afrl;
 +    case GPIO_AFRH:
 +        return s->afrh;
 +    case GPIO_BRR:
 +        return 0;
 +    case GPIO_ASCR:
 +        return s->ascr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +        return 0;
 +    }
 +}
 +
 +static const MemoryRegionOps stm32l4x5_gpio_ops = {
 +    .read = stm32l4x5_gpio_read,
 +    .write = stm32l4x5_gpio_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +};
 +
-+typedef struct TMP421State {
++static void stm32l4x5_gpio_init(Object *obj)
-+    /*< private >*/
++{
-+    I2CSlave i2c;
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+    /*< public >*/
++
-+
++    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
-+    int16_t temperature[4];
++                          TYPE_STM32L4X5_GPIO, 0x400);
 +
-+    uint8_t status;
++    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-+    uint8_t config[2];
++
-+    uint8_t rate;
++    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
-+
++    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
-+    uint8_t len;
++
-+    uint8_t buf[2];
++    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
-+    uint8_t pointer;
++
-+
++    object_property_add(obj, "disconnected-pins", "uint16",
-+} TMP421State;
++                        disconnected_pins_get, disconnected_pins_set,
-+
++                        NULL, &s->disconnected_pins);
-+typedef struct TMP421Class {
++    object_property_add(obj, "clock-freq-hz", "uint32",
-+    I2CSlaveClass parent_class;
++                        clock_freq_get, NULL, NULL, NULL);
-+    DeviceInfo *dev;
++}
-+} TMP421Class;
++
-+
++static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
-+#define TYPE_TMP421 "tmp421-generic"
++{
-+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
-+
++    if (!clock_has_source(s->clk)) {
-+#define TMP421_CLASS(klass) \
++        error_setg(errp, "GPIO: clk input must be connected");
-+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
++        return;
-+#define TMP421_GET_CLASS(obj) \
++    }
-+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
++}
 +
-+/* the TMP421 registers */
++static const VMStateDescription vmstate_stm32l4x5_gpio = {
-+#define TMP421_STATUS_REG               0x08
++    .name = TYPE_STM32L4X5_GPIO,
-+#define    TMP421_STATUS_BUSY             (1 << 7)
++    .version_id = 1,
-+#define TMP421_CONFIG_REG_1             0x09
++    .minimum_version_id = 1,
-+#define    TMP421_CONFIG_RANGE            (1 << 2)
++    .fields = (VMStateField[]){
-+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
++        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
-+#define TMP421_CONFIG_REG_2             0x0A
++        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
-+#define    TMP421_CONFIG_RC               (1 << 2)
++        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
-+#define    TMP421_CONFIG_LEN              (1 << 3)
++        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
-+#define    TMP421_CONFIG_REN              (1 << 4)
++        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
-+#define    TMP421_CONFIG_REN2             (1 << 5)
++        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
-+#define    TMP421_CONFIG_REN3             (1 << 6)
++        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
-+
++        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
-+#define TMP421_CONVERSION_RATE_REG      0x0B
++        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
-+#define TMP421_ONE_SHOT                 0x0F
++        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
-+
++        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
-+#define TMP421_RESET                    0xFC
++        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +#define TMP421_MANUFACTURER_ID_REG      0xFE
 +#define TMP421_DEVICE_ID_REG            0xFF
 +
 +#define TMP421_TEMP_MSB0                0x00
 +#define TMP421_TEMP_MSB1                0x01
 +#define TMP421_TEMP_MSB2                0x02
 +#define TMP421_TEMP_MSB3                0x03
 +#define TMP421_TEMP_LSB0                0x10
 +#define TMP421_TEMP_LSB1                0x11
 +#define TMP421_TEMP_LSB2                0x12
 +#define TMP421_TEMP_LSB3                0x13
 +
 +static const int32_t mins[2] = { -40000, -55000 };
 +static const int32_t maxs[2] = { 127000, 150000 };
 +
 +static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
 +{
 +    TMP421State *s = TMP421(obj);
 +    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
 +    int offset = ext_range * 64 * 256;
 +    int64_t value;
 +    int tempid;
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
 +    if (tempid >= 4 || tempid < 0) {
 +        error_setg(errp, "error reading %s", name);
 +        return;
 +    }
 +
 +    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
 +
 +    visit_type_int(v, name, &value, errp);
 +}
 +
 +/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
 + * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
 + */
 +static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
 +{
 +    TMP421State *s = TMP421(obj);
 +    Error *local_err = NULL;
 +    int64_t temp;
 +    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
 +    int offset = ext_range * 64 * 256;
 +    int tempid;
 +
 +    visit_type_int(v, name, &temp, &local_err);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +
 +    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
 +        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
 +                   temp / 1000, temp % 1000);
 +        return;
 +    }
 +
 +    if (sscanf(name, "temperature%d", &tempid) != 1) {
 +        error_setg(errp, "error reading %s: %m", name);
 +        return;
 +    }
 +
 +    if (tempid >= 4 || tempid < 0) {
 +        error_setg(errp, "error reading %s", name);
 +        return;
 +    }
 +
 +    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
 +}
 +
 +static void tmp421_read(TMP421State *s)
 +{
 +    TMP421Class *sc = TMP421_GET_CLASS(s);
 +
 +    s->len = 0;
 +
 +    switch (s->pointer) {
 +    case TMP421_MANUFACTURER_ID_REG:
 +        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
 +        break;
 +    case TMP421_DEVICE_ID_REG:
 +        s->buf[s->len++] = sc->dev->model;
 +        break;
 +    case TMP421_CONFIG_REG_1:
 +        s->buf[s->len++] = s->config[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->buf[s->len++] = s->config[1];
 +        break;
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->buf[s->len++] = s->rate;
 +        break;
 +    case TMP421_STATUS_REG:
 +        s->buf[s->len++] = s->status;
 +        break;
 +
 +        /* FIXME: check for channel enablement in config registers */
 +    case TMP421_TEMP_MSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_MSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB0:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB1:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB2:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
 +        break;
 +    case TMP421_TEMP_LSB3:
 +        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
 +        break;
 +    }
 +}
 +
 +static void tmp421_reset(I2CSlave *i2c);
 +
 +static void tmp421_write(TMP421State *s)
 +{
 +    switch (s->pointer) {
 +    case TMP421_CONVERSION_RATE_REG:
 +        s->rate = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_1:
 +        s->config[0] = s->buf[0];
 +        break;
 +    case TMP421_CONFIG_REG_2:
 +        s->config[1] = s->buf[0];
 +        break;
 +    case TMP421_RESET:
 +        tmp421_reset(I2C_SLAVE(s));
 +        break;
 +    }
 +}
 +
 +static int tmp421_rx(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len < 2) {
 +        return s->buf[s->len++];
 +    } else {
 +        return 0xff;
 +    }
 +}
 +
 +static int tmp421_tx(I2CSlave *i2c, uint8_t data)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (s->len == 0) {
 +        /* first byte is the register pointer for a read or write
 +         * operation */
 +        s->pointer = data;
 +        s->len++;
 +    } else if (s->len == 1) {
 +        /* second byte is the data to write. The device only supports
 +         * one byte writes */
 +        s->buf[0] = data;
 +        tmp421_write(s);
 +    }
 +
 +    return 0;
 +}
 +
 +static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    if (event == I2C_START_RECV) {
 +        tmp421_read(s);
 +    }
 +
 +    s->len = 0;
 +    return 0;
 +}
 +
 +static const VMStateDescription vmstate_tmp421 = {
 +    .name = "TMP421",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT8(len, TMP421State),
 +        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
 +        VMSTATE_UINT8(pointer, TMP421State),
 +        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
 +        VMSTATE_UINT8(status, TMP421State),
 +        VMSTATE_UINT8(rate, TMP421State),
 +        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
 +        VMSTATE_I2C_SLAVE(i2c, TMP421State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static void tmp421_reset(I2CSlave *i2c)
++static Property stm32l4x5_gpio_properties[] = {
-+{
++    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
-+    TMP421State *s = TMP421(i2c);
++    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
-+    TMP421Class *sc = TMP421_GET_CLASS(s);
++    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
-+
++    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
-+    memset(s->temperature, 0, sizeof(s->temperature));
++    DEFINE_PROP_END_OF_LIST(),
-+    s->pointer = 0;
++};
 +
-+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
++static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +
 +     /* resistance correction and channel enablement */
 +    switch (sc->dev->model) {
 +    case TMP421_DEVICE_ID:
 +        s->config[1] = 0x1c;
 +        break;
 +    case TMP422_DEVICE_ID:
 +        s->config[1] = 0x3c;
 +        break;
 +    case TMP423_DEVICE_ID:
 +        s->config[1] = 0x7c;
 +        break;
 +    }
 +
 +    s->rate = 0x7;       /* 8Hz */
 +    s->status = 0;
 +}
 +
 +static int tmp421_init(I2CSlave *i2c)
 +{
 +    TMP421State *s = TMP421(i2c);
 +
 +    tmp421_reset(&s->i2c);
 +
 +    return 0;
 +}
 +
 +static void tmp421_initfn(Object *obj)
 +{
 +    object_property_add(obj, "temperature0", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature1", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature2", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +    object_property_add(obj, "temperature3", "int",
 +                        tmp421_get_temperature,
 +                        tmp421_set_temperature, NULL, NULL, NULL);
 +}
 +
 +static void tmp421_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+    TMP421Class *sc = TMP421_CLASS(klass);
++
-+
++    device_class_set_props(dc, stm32l4x5_gpio_properties);
-+    k->init = tmp421_init;
++    dc->vmsd = &vmstate_stm32l4x5_gpio;
-+    k->event = tmp421_event;
++    dc->realize = stm32l4x5_gpio_realize;
-+    k->recv = tmp421_rx;
++    rc->phases.hold = stm32l4x5_gpio_reset_hold;
-+    k->send = tmp421_tx;
++}
-+    dc->vmsd = &vmstate_tmp421;
++
-+    sc->dev = (DeviceInfo *) data;
++static const TypeInfo stm32l4x5_gpio_types[] = {
-+}
++    {
-+
++        .name = TYPE_STM32L4X5_GPIO,
-+static const TypeInfo tmp421_info = {
++        .parent = TYPE_SYS_BUS_DEVICE,
-+    .name          = TYPE_TMP421,
++        .instance_size = sizeof(Stm32l4x5GpioState),
-+    .parent        = TYPE_I2C_SLAVE,
++        .instance_init = stm32l4x5_gpio_init,
-+    .instance_size = sizeof(TMP421State),
++        .class_init = stm32l4x5_gpio_class_init,
-+    .instance_init = tmp421_initfn,
++    },
 +    .class_init    = tmp421_class_init,
 +};
 +
-+static void tmp421_register_types(void)
++DEFINE_TYPES(stm32l4x5_gpio_types)
-+{
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
 +    int i;
 +
 +    type_register_static(&tmp421_info);
 +    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
 +        TypeInfo ti = {
 +            .name       = devices[i].name,
 +            .parent     = TYPE_TMP421,
 +            .class_init = tmp421_class_init,
 +            .class_data = (void *) &devices[i],
 +        };
 +        type_register(&ti);
 +    }
 +}
 +
 +type_init(tmp421_register_types)
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
---- a/default-configs/arm-softmmu.mak
+--- a/hw/gpio/Kconfig
-+++ b/default-configs/arm-softmmu.mak
++++ b/hw/gpio/Kconfig
-@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
+@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
- CONFIG_TSC2005=y
- CONFIG_LM832X=y
+ config SIFIVE_GPIO
- CONFIG_TMP105=y
+     bool
-+CONFIG_TMP421=y
++
- CONFIG_STELLARIS=y
++config STM32L4X5_GPIO
- CONFIG_STELLARIS_INPUT=y
++    bool
- CONFIG_STELLARIS_ENET=y
+diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
      'bcm2835_gpio.c',
      'bcm2838_gpio.c'
  ))
 +system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
  system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
 diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/trace-events
 +++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
  # aspeed_gpio.c
  aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
  aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 +
 +# stm32l4x5_gpio.c
 +stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
 +stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
 +stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 27/27] hw/arm/virt: fdt: generate distance-map when needed
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-From: Andrew Jones <drjones@redhat.com>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-This is based on patch Shannon Zhao originally posted.
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-Cc: Shannon Zhao <zhaoshenglong@huawei.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Message-id: 20170529173751.3443-3-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 21 +++++++++++++++++++++
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
-file changed, 21 insertions(+)
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
-index XXXXXXX..XXXXXXX 100644
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
---- a/hw/arm/virt.c
+ hw/arm/Kconfig                     |  3 +-
-+++ b/hw/arm/virt.c
+files changed, 63 insertions(+), 18 deletions(-)
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
-                                 "clk24mhz");
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
-     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/stm32l4x5_soc.h
-+    if (have_numa_distance) {
++++ b/include/hw/arm/stm32l4x5_soc.h
-+        int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
+@@ -XXX,XX +XXX,XX @@
-+        uint32_t *matrix = g_malloc0(size);
+ #include "hw/misc/stm32l4x5_syscfg.h"
-+        int idx, i, j;
+ #include "hw/misc/stm32l4x5_exti.h"
-+
+ #include "hw/misc/stm32l4x5_rcc.h"
-+        for (i = 0; i < nb_numa_nodes; i++) {
++#include "hw/gpio/stm32l4x5_gpio.h"
-+            for (j = 0; j < nb_numa_nodes; j++) {
+ #include "qom/object.h"
-+                idx = (i * nb_numa_nodes + j) * 3;
-+                matrix[idx + 0] = cpu_to_be32(i);
+ #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
-+                matrix[idx + 1] = cpu_to_be32(j);
+@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
-+                matrix[idx + 2] = cpu_to_be32(numa_info[i].distance[j]);
+     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
-+            }
+     Stm32l4x5SyscfgState syscfg;
-+        }
+     Stm32l4x5RccState rcc;
-+
++    Stm32l4x5GpioState gpio[NUM_GPIOS];
-+        qemu_fdt_add_subnode(fdt, "/distance-map");
-+        qemu_fdt_setprop_string(fdt, "/distance-map", "compatible",
+     MemoryRegion sram1;
-+                                "numa-distance-map-v1");
+     MemoryRegion sram2;
-+        qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",
+diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
-+                         matrix, size);
+index XXXXXXX..XXXXXXX 100644
-+        g_free(matrix);
+--- a/include/hw/gpio/stm32l4x5_gpio.h
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
  #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +#define NUM_GPIOS 8
  #define GPIO_NUM_PINS 16
  struct Stm32l4x5GpioState {
 diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
 +static const struct {
 +    uint32_t addr;
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
 +    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
  static void stm32l4x5_soc_initfn(Object *obj)
  {
      Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
      }
      object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
      object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
 +        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
 +    }
  }
- static void fdt_add_psci_node(const VirtMachineState *vms)
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
      const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
      MemoryRegion *system_memory = get_system_memory();
 -    DeviceState *armv7m;
 +    DeviceState *armv7m, *dev;
      SysBusDevice *busdev;
 +    uint32_t pin_index;
      if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                  sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          return;
      }
 +    /* GPIOs */
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
 +        dev = DEVICE(&s->gpio[i]);
 +        qdev_prop_set_string(dev, "name", name);
 +        qdev_prop_set_uint32(dev, "mode-reset",
 +                             stm32l4x5_gpio_cfg[i].moder_reset);
 +        qdev_prop_set_uint32(dev, "ospeed-reset",
 +                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
 +        qdev_prop_set_uint32(dev, "pupd-reset",
 +                            stm32l4x5_gpio_cfg[i].pupdr_reset);
 +        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
 +        g_free(name);
 +        name = g_strdup_printf("gpio%c-out", 'a' + i);
 +        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
 +            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
 +        if (!sysbus_realize(busdev, errp)) {
 +            return;
 +        }
 +        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
 +    }
 +
      /* System configuration controller */
      busdev = SYS_BUS_DEVICE(&s->syscfg);
      if (!sysbus_realize(busdev, errp)) {
          return;
      }
      sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
 -    /*
 -     * TODO: when the GPIO device is implemented, connect it
 -     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
 -     * GPIO_NUM_PINS.
 -     */
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
 +            pin_index = GPIO_NUM_PINS * i + j;
 +            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
 +                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
 +                                  pin_index));
 +        }
 +    }
      /* EXTI device */
      busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          }
      }
 -    for (unsigned i = 0; i < 16; i++) {
 +    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
          qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                                qdev_get_gpio_in(DEVICE(&s->exti), i));
      }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      /* RESERVED:    0x40024400, 0x7FDBC00 */
      /* AHB2 BUS */
 -    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
 -    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
 -    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
 -    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
 -    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
 -    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
 -    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
 -    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
      /* RESERVED:    0x48002000, 0x7FDBC00 */
      create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
      create_unimplemented_device("ADC",       0x50040000, 0x400);
 diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32l4x5_syscfg.c
 +++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "migration/vmstate.h"
  #include "hw/misc/stm32l4x5_syscfg.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 20/27] aspeed/i2c: improve command handling
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
-From: Cédric Le Goater <clg@kaod.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Multiple I2C commands can be fired simultaneously and the controller
+The testcase contains :
-execute the commands following these priorities:
+- `test_idr_reset_value()` :
 Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
 - `test_gpio_output_mode()` :
 Checks that writing a bit in register ODR results in the corresponding
 pin rising or lowering, if this pin is configured in output mode.
 - `test_gpio_input_mode()` :
 Checks that a input pin set high or low externally results
 in the pin rising and lowering.
 - `test_pull_up_pull_down()` :
 Checks that a floating pin in pull-up/down mode is actually high/down.
 - `test_push_pull()` :
 Checks that a pin set externally is disconnected when configured in
 push-pull output mode, and can't be set externally while in this mode.
 - `test_open_drain()` :
 Checks that a pin set externally high is disconnected when configured
 in open-drain output mode, and can't be set high while in this mode.
 - `test_bsrr_brr()` :
 Checks that writing to BSRR and BRR has the desired result in ODR.
 - `test_clock_enable()` :
 Checks that GPIO clock is at the right frequency after enabling it.
-  (1) Master Start Command
+Acked-by: Thomas Huth <thuth@redhat.com>
-  (2) Master Transmit Command
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-  (3) Slave Transmit Command or Master Receive Command
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-  (4) Master Stop Command
+Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
 The current code is incorrect with respect to the above sequence and
 needs to be reworked to handle each individual command.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 1494827476-1487-2-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i2c/aspeed_i2c.c | 24 ++++++++++++++++++------
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
-file changed, 18 insertions(+), 6 deletions(-)
+ tests/qtest/meson.build           |   3 +-
 files changed, 553 insertions(+), 1 deletion(-)
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for STM32L4x5_GPIO
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "libqtest-single.h"
 +
 +#define GPIO_BASE_ADDR 0x48000000
 +#define GPIO_SIZE      0x400
 +#define NUM_GPIOS      8
 +#define NUM_GPIO_PINS  16
 +
 +#define GPIO_A 0x48000000
 +#define GPIO_B 0x48000400
 +#define GPIO_C 0x48000800
 +#define GPIO_D 0x48000C00
 +#define GPIO_E 0x48001000
 +#define GPIO_F 0x48001400
 +#define GPIO_G 0x48001800
 +#define GPIO_H 0x48001C00
 +
 +#define MODER 0x00
 +#define OTYPER 0x04
 +#define PUPDR 0x0C
 +#define IDR 0x10
 +#define ODR 0x14
 +#define BSRR 0x18
 +#define BRR 0x28
 +
 +#define MODER_INPUT 0
 +#define MODER_OUTPUT 1
 +
 +#define PUPDR_NONE 0
 +#define PUPDR_PULLUP 1
 +#define PUPDR_PULLDOWN 2
 +
 +#define OTYPER_PUSH_PULL 0
 +#define OTYPER_OPEN_DRAIN 1
 +
 +const uint32_t moder_reset[NUM_GPIOS] = {
 +    0xABFFFFFF,
 +    0xFFFFFEBF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0x0000000F
 +};
 +
 +const uint32_t pupdr_reset[NUM_GPIOS] = {
 +    0x64000000,
 +    0x00000100,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +const uint32_t idr_reset[NUM_GPIOS] = {
 +    0x0000A000,
 +    0x00000010,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
 +{
 +    return readl(gpio + offset);
 +}
 +
 +static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
 +{
 +    writel(gpio + offset, value);
 +}
 +
 +static void gpio_set_bit(unsigned int gpio, unsigned int reg,
 +                         unsigned int pin, uint32_t value)
 +{
 +    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
 +}
 +
 +static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
 +                           unsigned int pin, uint32_t value)
 +{
 +    uint32_t offset = 2 * pin;
 +    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
 +}
 +
 +static unsigned int get_gpio_id(uint32_t gpio_addr)
 +{
 +    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
 +}
 +
 +static void gpio_set_irq(unsigned int gpio, int num, int level)
 +{
 +    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    qtest_set_irq_in(global_qtest, name, NULL, num, level);
 +}
 +
 +static void disconnect_all_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
 +        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
 +        path, 0xFFFF);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static uint32_t get_disconnected_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    uint32_t disconnected_pins = 0;
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
 +        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    disconnected_pins = qdict_get_int(r, "return");
 +    qobject_unref(r);
 +    return disconnected_pins;
 +}
 +
 +static uint32_t reset(uint32_t gpio, unsigned int offset)
 +{
 +    switch (offset) {
 +    case MODER:
 +        return moder_reset[get_gpio_id(gpio)];
 +    case PUPDR:
 +        return pupdr_reset[get_gpio_id(gpio)];
 +    case IDR:
 +        return idr_reset[get_gpio_id(gpio)];
 +    }
 +    return 0x0;
 +}
 +
 +static void system_reset(void)
 +{
 +    QDict *r;
 +    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static void test_idr_reset_value(void)
 +{
 +    /*
 +     * Checks that the values in MODER, OTYPER, PUPDR and ODR
 +     * after reset are correct, and that the value in IDR is
 +     * coherent.
 +     * Since AF and analog modes aren't implemented, IDR reset
 +     * values aren't the same as with a real board.
 +     *
 +     * Register IDR contains the actual values of all GPIO pins.
 +     * Its value depends on the pins' configuration
 +     * (intput/output/analog : register MODER, push-pull/open-drain :
 +     * register OTYPER, pull-up/pull-down/none : register PUPDR)
 +     * and on the values stored in register ODR
 +     * (in case the pin is in output mode).
 +     */
 +
 +    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
 +
 +    system_reset();
 +
 +    uint32_t moder = gpio_readl(GPIO_A, MODER);
 +    uint32_t odr = gpio_readl(GPIO_A, ODR);
 +    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
 +    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
 +    uint32_t idr = gpio_readl(GPIO_A, IDR);
 +    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
 +    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
 +    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
 +
 +    moder = gpio_readl(GPIO_B, MODER);
 +    odr = gpio_readl(GPIO_B, ODR);
 +    otyper = gpio_readl(GPIO_B, OTYPER);
 +    pupdr = gpio_readl(GPIO_B, PUPDR);
 +    idr = gpio_readl(GPIO_B, IDR);
 +    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
 +    /* ... 5: neither, 4: pull-up, 3: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
 +    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
 +
 +    moder = gpio_readl(GPIO_C, MODER);
 +    odr = gpio_readl(GPIO_C, ODR);
 +    otyper = gpio_readl(GPIO_C, OTYPER);
 +    pupdr = gpio_readl(GPIO_C, PUPDR);
 +    idr = gpio_readl(GPIO_C, IDR);
 +    /* Analog, same as Input mode*/
 +    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
 +
 +    moder = gpio_readl(GPIO_H, MODER);
 +    odr = gpio_readl(GPIO_H, ODR);
 +    otyper = gpio_readl(GPIO_H, OTYPER);
 +    pupdr = gpio_readl(GPIO_H, PUPDR);
 +    idr = gpio_readl(GPIO_H, IDR);
 +    /* Analog, same as Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
 +}
 +
 +static void test_gpio_output_mode(const void *data)
 +{
 +    /*
 +     * Checks that setting a bit in ODR sets the corresponding
 +     * GPIO line high : it should set the right bit in IDR
 +     * and send an irq to syscfg.
 +     * Additionally, it checks that values written to ODR
 +     * when not in output mode are stored and not discarded.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Set a bit in ODR and check nothing happens */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the relevant line as output and check the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Reset the bit in ODR and check the pin is low */
 +    gpio_set_bit(gpio, ODR, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +}
 +
 +static void test_gpio_input_mode(const void *data)
 +{
 +    /*
 +     * Test that setting a line high/low externally sets the
 +     * corresponding GPIO line high/low : it should set the
 +     * right bit in IDR and send an irq to syscfg.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input, raise it, and check that the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Lower the line and check that the pin is low */
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    disconnect_all_pins(gpio);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_pull_up_pull_down(const void *data)
 +{
 +    /*
 +     * Test that a floating pin with pull-up sets the pin
 +     * high and vice-versa.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input with pull-up, check the line is set high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the line with pull-down, check the line is low */
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_push_pull(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in push-pull output mode
 +     * disconnects the pin, that the pin can't be set or reset
 +     * externally afterwards.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Trying to set a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio2, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +}
 +
 +static void test_open_drain(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in open-drain output mode
 +     * disconnects a pin set high externally and that the pin
 +     * can't be set high externally while configured in open-drain.
 +     *
 +     * However a pin set low externally shouldn't be disconnected,
 +     * and it can be set low externally when in open-drain mode.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in open-drain output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in open-drain output */
 +    /* And checking the pin wasn't disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Trying to set a open-drain output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a open-drain output pin, checking it works */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Clean the test */
 +    disconnect_all_pins(gpio2);
 +    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
 +    disconnect_all_pins(gpio);
 +    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_bsrr_brr(const void *data)
 +{
 +    /*
 +     * Test that writing a '1' in BSS and BSRR
 +     * has the desired effect on ODR.
 +     * In BSRR, BSx has priority over BRx.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    /* BSx should have priority over BRx */
 +    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int ret;
 +
 +    g_test_init(&argc, &argv, NULL);
 +    g_test_set_nonfatal_assertions();
 +    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
 +                   test_idr_reset_value);
 +    /*
 +     * The inputs for the tests (gpio and pin) can be changed,
 +     * but the tests don't work for pins that are high at reset
 +     * (GPIOA15, GPIO13 and GPIOB5).
 +     * Specifically, rising the pin then checking `get_irq()`
 +     * is problematic since the pin was already high.
 +     */
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
 +                        (void *)((uint64_t)GPIO_C << 32 | 5),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
 +                        (void *)((uint64_t)GPIO_D << 32 | 6),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
 +                        (void *)((uint64_t)GPIO_C << 32 | 10),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
 +                        (void *)((uint64_t)GPIO_B << 32 | 5),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
 +                        (void *)((uint64_t)GPIO_F << 32 | 1),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
 +                        (void *)((uint64_t)GPIO_G << 32 | 6),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
 +                        (void *)((uint64_t)GPIO_C << 32 | 4),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
 +                        (void *)((uint64_t)GPIO_E << 32 | 11),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
 +                        (void *)((uint64_t)GPIO_A << 32 | 12),
 +                        test_bsrr_brr);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
 +                        (void *)((uint64_t)GPIO_D << 32 | 0),
 +                        test_bsrr_brr);
 +
 +    qtest_start("-machine b-l475e-iot01a");
 +    ret = g_test_run();
 +    qtest_end();
 +
 +    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/tests/qtest/meson.build
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
+ qtests_stm32l4x5 = \
- static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+   ['stm32l4x5_exti-test',
- {
+    'stm32l4x5_syscfg-test',
-+    bus->cmd &= ~0xFFFF;
+-   'stm32l4x5_rcc-test']
-     bus->cmd |= value & 0xFFFF;
++   'stm32l4x5_rcc-test',
-     bus->intr_status = 0;
++   'stm32l4x5_gpio-test']
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+ qtests_arm = \
-             bus->intr_status |= I2CD_INTR_TX_ACK;
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
          }
 -    } else if (bus->cmd & I2CD_M_TX_CMD) {
 +        /* START command is also a TX command, as the slave address is
 +         * sent on the bus */
 +        bus->cmd &= ~(I2CD_M_START_CMD | I2CD_M_TX_CMD);
 +
 +        /* No slave found */
 +        if (!i2c_bus_busy(bus->bus)) {
 +            return;
 +        }
 +    }
 +
 +    if (bus->cmd & I2CD_M_TX_CMD) {
          if (i2c_send(bus->bus, bus->buf)) {
              bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
              i2c_end_transfer(bus->bus);
          } else {
              bus->intr_status |= I2CD_INTR_TX_ACK;
          }
 +        bus->cmd &= ~I2CD_M_TX_CMD;
 +    }
 -    } else if (bus->cmd & I2CD_M_RX_CMD) {
 +    if (bus->cmd & I2CD_M_RX_CMD) {
          int ret = i2c_recv(bus->bus);
          if (ret < 0) {
              qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
              bus->intr_status |= I2CD_INTR_RX_DONE;
          }
          bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
 +        bus->cmd &= ~I2CD_M_RX_CMD;
      }
      if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
              i2c_end_transfer(bus->bus);
              bus->intr_status |= I2CD_INTR_NORMAL_STOP;
          }
 +        bus->cmd &= ~I2CD_M_STOP_CMD;
      }
 -
 -    /* command is handled, reset it and check for interrupts  */
 -    bus->cmd &= ~0xFFFF;
 -    aspeed_i2c_bus_raise_interrupt(bus);
  }
  static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
          }
          aspeed_i2c_bus_handle_cmd(bus, value);
 +        aspeed_i2c_bus_raise_interrupt(bus);
          break;
      default:
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 18/27] arm: add MPU support to M profile CPUs
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
-From: Michael Davidsaver <mdavidsaver@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The M series MPU is almost the same as the already implemented R
+While the 8-bit input elements are sequential in the input vector,
-profile MPU (v7 PMSA).  So all we need to implement here is the MPU
+the 32-bit output elements are not sequential in the output matrix.
-register interface in the system register space.
+Do not attempt to compute 2 32-bit outputs at the same time.
-This implementation has the same restriction as the R profile MPU
+Cc: qemu-stable@nongnu.org
-that it doesn't permit regions to be sized down smaller than 1K.
+Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
-We also do not yet implement support for MPU_CTRL.HFNMIENA; this
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-bit should if zero disable use of the MPU when running HardFault,
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-NMI or with FAULTMASK set to 1 (ie at an execution priority of
+Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 less than zero) -- if the MPU is enabled we don't treat these
 cases any differently.
 Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
 Message-id: 1493122030-32191-13-git-send-email-peter.maydell@linaro.org
 [PMM: Keep all the bits in mpu_ctrl field, rather than
  using SCTLR bits for them; drop broken HFNMIENA support;
  various cleanup]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h      |   6 +++
+ target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
- hw/intc/armv7m_nvic.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
- target/arm/helper.c   |  25 +++++++++++-
+ tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
- target/arm/machine.c  |   5 ++-
+ tests/tcg/aarch64/Makefile.target |  2 +-
-files changed, 137 insertions(+), 3 deletions(-)
+files changed, 147 insertions(+), 33 deletions(-)
+ create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+ create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/tcg/sme_helper.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/tcg/sme_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
          uint32_t dfsr; /* Debug Fault Status Register */
          uint32_t mmfar; /* MemManage Fault Address */
          uint32_t bfar; /* BusFault Address */
 +        unsigned mpu_ctrl; /* MPU_CTRL (some bits kept in sctlr_el[1]) */
          int exception;
      } v7m;
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
  FIELD(V7M_DFSR, VCATCH, 3, 1)
  FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 +/* v7M MPU_CTRL bits */
 +FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
 +FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
 +FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
 +
  /* If adding a feature bit which corresponds to a Linux ELF
   * HWCAP bit, remember to update the feature-bit-to-hwcap
   * mapping in linux-user/elfload.c:get_elf_hwcap().
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/arm.h"
  #include "hw/arm/armv7m_nvic.h"
  #include "target/arm/cpu.h"
 +#include "exec/exec-all.h"
  #include "qemu/log.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
      case 0xd70: /* ISAR4.  */
          return 0x01310102;
      /* TODO: Implement debug registers.  */
 +    case 0xd90: /* MPU_TYPE */
 +        /* Unified MPU; if the MPU is not present this value is zero */
 +        return cpu->pmsav7_dregion << 8;
 +        break;
 +    case 0xd94: /* MPU_CTRL */
 +        return cpu->env.v7m.mpu_ctrl;
 +    case 0xd98: /* MPU_RNR */
 +        return cpu->env.cp15.c6_rgnr;
 +    case 0xd9c: /* MPU_RBAR */
 +    case 0xda4: /* MPU_RBAR_A1 */
 +    case 0xdac: /* MPU_RBAR_A2 */
 +    case 0xdb4: /* MPU_RBAR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return 0;
 +        }
 +        return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
 +    }
 +    case 0xda0: /* MPU_RASR */
 +    case 0xda8: /* MPU_RASR_A1 */
 +    case 0xdb0: /* MPU_RASR_A2 */
 +    case 0xdb8: /* MPU_RASR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return 0;
 +        }
 +        return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
 +            (cpu->env.pmsav7.drsr[region] & 0xffff);
 +    }
      default:
          qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
          return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
          qemu_log_mask(LOG_UNIMP,
                        "NVIC: Aux fault status registers unimplemented\n");
          break;
 +    case 0xd90: /* MPU_TYPE */
 +        return; /* RO */
 +    case 0xd94: /* MPU_CTRL */
 +        if ((value &
 +             (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
 +            == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
 +                          "UNPREDICTABLE\n");
 +        }
 +        cpu->env.v7m.mpu_ctrl = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
 +                                         R_V7M_MPU_CTRL_HFNMIENA_MASK |
 +                                         R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
 +        tlb_flush(CPU(cpu));
 +        break;
 +    case 0xd98: /* MPU_RNR */
 +        if (value >= cpu->pmsav7_dregion) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
 +                          PRIu32 "/%" PRIu32 "\n",
 +                          value, cpu->pmsav7_dregion);
 +        } else {
 +            cpu->env.cp15.c6_rgnr = value;
 +        }
 +        break;
 +    case 0xd9c: /* MPU_RBAR */
 +    case 0xda4: /* MPU_RBAR_A1 */
 +    case 0xdac: /* MPU_RBAR_A2 */
 +    case 0xdb4: /* MPU_RBAR_A3 */
 +    {
 +        int region;
 +
 +        if (value & (1 << 4)) {
 +            /* VALID bit means use the region number specified in this
 +             * value and also update MPU_RNR.REGION with that value.
 +             */
 +            region = extract32(value, 0, 4);
 +            if (region >= cpu->pmsav7_dregion) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "MPU region out of range %u/%" PRIu32 "\n",
 +                              region, cpu->pmsav7_dregion);
 +                return;
 +            }
 +            cpu->env.cp15.c6_rgnr = region;
 +        } else {
 +            region = cpu->env.cp15.c6_rgnr;
 +        }
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return;
 +        }
 +
 +        cpu->env.pmsav7.drbar[region] = value & ~0x1f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
 +    case 0xda0: /* MPU_RASR */
 +    case 0xda8: /* MPU_RASR_A1 */
 +    case 0xdb0: /* MPU_RASR_A2 */
 +    case 0xdb8: /* MPU_RASR_A3 */
 +    {
 +        int region = cpu->env.cp15.c6_rgnr;
 +
 +        if (region >= cpu->pmsav7_dregion) {
 +            return;
 +        }
 +
 +        cpu->env.pmsav7.drsr[region] = value & 0xff3f;
 +        cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
      case 0xf00: /* Software Triggered Interrupt Register */
      {
          /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
  static inline bool regime_translation_disabled(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx)
  {
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
 +    }
 +
      if (mmu_idx == ARMMMUIdx_S2NS) {
          return (env->cp15.hcr_el2 & HCR_VM) == 0;
      }
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
      }
  }
-+static bool pmsav7_use_background_region(ARMCPU *cpu,
+-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
-+                                         ARMMMUIdx mmu_idx, bool is_user)
++typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
 +static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn32 *fn)
 +{
-+    /* Return true if we should use the default memory map as a
++    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
-+     * "background" region if there are no hits against any MPU regions.
++    bool neg = simd_data(desc);
-+     */
-+    CPUARMState *env = &cpu->env;
+-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-+
+-                            uint8_t *pn, uint8_t *pm,
-+    if (is_user) {
+-                            uint32_t desc, IMOPFn *fn)
-+        return false;
++    for (row = 0; row < oprsz; ++row) {
-+    }
++        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
-+
++        uint32_t *za_row = &za[tile_vslice_index(row)];
-+    if (arm_feature(env, ARM_FEATURE_M)) {
++        uint32_t n = zn[H4(row)];
-+        return env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
++
-+    } else {
++        for (col = 0; col < oprsz; ++col) {
-+        return regime_sctlr(env, mmu_idx) & SCTLR_BR;
++            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
 +            uint32_t *a = &za_row[H4(col)];
 +
 +            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
 +        }
 +    }
 +}
 +
- static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
++typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
-                                  int access_type, ARMMMUIdx mmu_idx,
++static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
++                              uint8_t *pn, uint8_t *pm,
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
++                              uint32_t desc, IMOPFn64 *fn)
-         }
+ {
+     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
-         if (n == -1) { /* no hits */
+     bool neg = simd_data(desc);
--            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
+@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-+            if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
+ }
-                 /* background fault */
-                 *fsr = 0;
+ #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-                 return true;
+-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
-diff --git a/target/arm/machine.c b/target/arm/machine.c
++static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
  {                                                                           \
 -    uint32_t sum0 = 0, sum1 = 0;                                            \
 +    uint32_t sum = 0;                                                       \
      /* Apply P to N as a mask, making the inactive elements 0. */           \
      n &= expand_pred_b(p);                                                  \
 -    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
 -    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
 -    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
 -    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
 -    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
 -    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
 -    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
 -    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
 -    if (neg) {                                                              \
 -        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
 -    } else {                                                                \
 -        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
 -    }                                                                       \
 -    return ((uint64_t)sum1 << 32) | sum0;                                   \
 +    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
 +    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
 +    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
 +    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
 +    return neg ? a - sum : a + sum;                                         \
  }
  #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
  DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
  DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 -#define DEF_IMOPH(NAME) \
 -    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
 -                            void *vpm, uint32_t desc)                        \
 -    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
 +#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/tests/tcg/aarch64/Makefile.target
-+++ b/target/arm/machine.c
++++ b/tests/tcg/aarch64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ static bool m_needed(void *opaque)
+@@ -XXX,XX +XXX,XX @@ endif
- static const VMStateDescription vmstate_m = {
+ # SME Tests
-     .name = "cpu/m",
+ ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
--    .version_id = 3,
+-AARCH64_TESTS += sme-outprod1
--    .minimum_version_id = 3,
++AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
-+    .version_id = 4,
+ endif
-+    .minimum_version_id = 4,
-     .needed = m_needed,
+ # System Registers Tests
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(env.v7m.vecbase, ARMCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
          VMSTATE_UINT32(env.v7m.dfsr, ARMCPU),
          VMSTATE_UINT32(env.v7m.mmfar, ARMCPU),
          VMSTATE_UINT32(env.v7m.bfar, ARMCPU),
 +        VMSTATE_UINT32(env.v7m.mpu_ctrl, ARMCPU),
          VMSTATE_INT32(env.v7m.exception, ARMCPU),
          VMSTATE_END_OF_LIST()
      }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 02/27] load_uboot_image: don't assume a full header read
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-From: Andrew Jones <drjones@redhat.com>
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
 was unfortunately added with a license of GPL-v3-or-later, which is
 not compatible with other QEMU code which has a GPL-v2-only license.
-Don't allow load_uboot_image() to proceed when less bytes than
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-header-size was read.
+to make it compatible with the rest of QEMU.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Cc: qemu-stable@nongnu.org
-Message-id: 20170524091315.20284-1-drjones@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
 Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/loader.c | 3 ++-
+ include/hw/rtc/sun4v-rtc.h | 2 +-
-file changed, 2 insertions(+), 1 deletion(-)
+ hw/rtc/sun4v-rtc.c         | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/core/loader.c b/hw/core/loader.c
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/loader.c
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/hw/core/loader.c
++++ b/include/hw/rtc/sun4v-rtc.h
-@@ -XXX,XX +XXX,XX @@ static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
+@@ -XXX,XX +XXX,XX @@
-         return -1;
+  *
+  * Copyright (c) 2016 Artyom Tarasenko
-     size = read(fd, hdr, sizeof(uboot_image_header_t));
+  *
--    if (size < 0)
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-+    if (size < sizeof(uboot_image_header_t)) {
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-         goto out;
+  * version.
-+    }
+  */
-     bswap_uboot_header(hdr);
+diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/sun4v-rtc.c
 +++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
   *
   * Copyright (c) 2016 Artyom Tarasenko
   *
 - * This code is licensed under the GNU GPL v3 or (at your option) any later
 + * This code is licensed under the GNU GPL v2 or (at your option) any later
   * version.
   */
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 03/27] hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
+Deleted patch
-We were setting the VBPR1 field of VMCR_EL2 to icv_min_vbpr()
-on reset, but this is not correct. The field should reset to
-the minimum value of ICV_BPR0_EL1 plus one.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493226792-3237-2-git-send-email-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_cpuif.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-     cs->ich_hcr_el2 = 0;
-     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
-     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
--        (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR1_SHIFT) |
-+        ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
-         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
- }
---
-.7.4

-[Qemu-devel] [PULL 04/27] hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
+Deleted patch
-icc_bpr_write() was not enforcing that writing a value below the
-minimum for the BPR should behave as if the BPR was set to the
-minimum value. This doesn't make a difference for the secure
-BPRs (since we define the minimum for the QEMU implementation
-as zero) but did mean we were allowing the NS BPR1 to be set to
-when 1 should be the lowest value.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493226792-3237-3-git-send-email-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_cpuif.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     GICv3CPUState *cs = icc_cs_from_env(env);
-     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
-+    uint64_t minval;
-     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
-         icv_bpr_write(env, ri, value);
-@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         return;
-     }
-+    minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
-+    if (value < minval) {
-+        value = minval;
-+    }
-+
-     cs->icc_bpr[grp] = value & 7;
-     gicv3_cpuif_update(cs);
- }
---
-.7.4

-[Qemu-devel] [PULL 05/27] hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
+Deleted patch
-When we calculate the mask to use to get the group priority from
-an interrupt priority, the way that NS BPR1 is handled differs
-from how BPR0 and S BPR1 work -- a BPR1 value of 1 means
-the group priority is in bits [7:1], whereas for BPR0 and S BPR1
-this is indicated by a 0 BPR value.
-Subtract 1 from the BPR value before creating the mask if
-we're using the NS BPR value, for both hardware and virtual
-interrupts, as the GICv3 pseudocode does, and fix the comments
-accordingly.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_cpuif.c | 42 ++++++++++++++++++++++++++++++++++++++----
-file changed, 38 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
- {
-     /* Return a mask word which clears the subpriority bits from
-      * a priority value for a virtual interrupt in the specified group.
--     * This depends on the VBPR value:
-+     * This depends on the VBPR value.
-+     * If using VBPR0 then:
-      *  a BPR of 0 means the group priority bits are [7:1];
-      *  a BPR of 1 means they are [7:2], and so on down to
-      *  a BPR of 7 meaning no group priority bits at all.
-+     * If using VBPR1 then:
-+     *  a BPR of 0 is impossible (the minimum value is 1)
-+     *  a BPR of 1 means the group priority bits are [7:1];
-+     *  a BPR of 2 means they are [7:2], and so on down to
-+     *  a BPR of 7 meaning the group priority is [7].
-+     *
-      * Which BPR to use depends on the group of the interrupt and
-      * the current ICH_VMCR_EL2.VCBPR settings.
-+     *
-+     * This corresponds to the VGroupBits() pseudocode.
-      */
-+    int bpr;
-+
-     if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
-         group = GICV3_G0;
-     }
--    return ~0U << (read_vbpr(cs, group) + 1);
-+    bpr = read_vbpr(cs, group);
-+    if (group == GICV3_G1NS) {
-+        assert(bpr > 0);
-+        bpr--;
-+    }
-+
-+    return ~0U << (bpr + 1);
- }
- static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
-@@ -XXX,XX +XXX,XX @@ static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
- {
-     /* Return a mask word which clears the subpriority bits from
-      * a priority value for an interrupt in the specified group.
--     * This depends on the BPR value:
-+     * This depends on the BPR value. For CBPR0 (S or NS):
-      *  a BPR of 0 means the group priority bits are [7:1];
-      *  a BPR of 1 means they are [7:2], and so on down to
-      *  a BPR of 7 meaning no group priority bits at all.
-+     * For CBPR1 NS:
-+     *  a BPR of 0 is impossible (the minimum value is 1)
-+     *  a BPR of 1 means the group priority bits are [7:1];
-+     *  a BPR of 2 means they are [7:2], and so on down to
-+     *  a BPR of 7 meaning the group priority is [7].
-+     *
-      * Which BPR to use depends on the group of the interrupt and
-      * the current ICC_CTLR.CBPR settings.
-+     *
-+     * This corresponds to the GroupBits() pseudocode.
-      */
-+    int bpr;
-+
-     if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
-         (group == GICV3_G1NS &&
-          cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
-         group = GICV3_G0;
-     }
--    return ~0U << ((cs->icc_bpr[group] & 7) + 1);
-+    bpr = cs->icc_bpr[group] & 7;
-+
-+    if (group == GICV3_G1NS) {
-+        assert(bpr > 0);
-+        bpr--;
-+    }
-+
-+    return ~0U << (bpr + 1);
- }
- static bool icc_no_enabled_hppi(GICv3CPUState *cs)
---
-.7.4

-[Qemu-devel] [PULL 06/27] target/arm: clear PMUVER field of AA64DFR0 when vPMU=off
+Deleted patch
-From: Wei Huang <wei@redhat.com>
-The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)
-relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support
-is present or not. This patch clears the PMUVER field under TCG mode
-when vPMU=off. Without it, PMUv3 will init insider guest VMs even
-with vPMU=off. This patch also removes a redundant line inside the
-if-statement.
-Signed-off-by: Wei Huang <wei@redhat.com>
-Message-id: 1495123889-32301-1-git-send-email-wei@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-     }
-     if (!cpu->has_pmu) {
--        cpu->has_pmu = false;
-         unset_feature(env, ARM_FEATURE_PMU);
-+        cpu->id_aa64dfr0 &= ~0xf00;
-     }
-     if (!arm_feature(env, ARM_FEATURE_EL2)) {
---
-.7.4

-[Qemu-devel] [PULL 07/27] arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
+Deleted patch
-When identifying the DFSR format for an alignment fault, use
-the mmu index that we are passed, rather than calling cpu_mmu_index()
-to get the mmu index for the current CPU state. This doesn't actually
-make any difference since the only cases where the current MMU index
-differs from the index used for the load are the "unprivileged
-load/store" instructions, and in that case the mmu index may
-differ but the translation regime is the same (apart from the
-"use from Hyp mode" case which is UNPREDICTABLE).
-However it's the more logical thing to do.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-2-git-send-email-peter.maydell@linaro.org
----
- target/arm/op_helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
-+++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
-     /* the DFSR for an alignment fault depends on whether we're using
-      * the LPAE long descriptor format, or the short descriptor format
-      */
--    if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
-+    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
-         env->exception.fsr = (1 << 9) | 0x21;
-     } else {
-         env->exception.fsr = 0x1;
---
-.7.4

-[Qemu-devel] [PULL 11/27] arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
+Deleted patch
-Fix the handling of QOM properties for PMSA CPUs with no MPU:
-Allow no-MPU to be specified by either:
- * has-mpu = false
- * pmsav7_dregion = 0
-and make setting one imply the other. Don't clear the PMSA
-feature bit in this situation.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1493122030-32191-6-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.c | 8 +++++++-
-file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-         cpu->id_pfr1 &= ~0xf000;
-     }
-+    /* MPU can be configured out of a PMSA CPU either by setting has-mpu
-+     * to false or by setting pmsav7-dregion to 0.
-+     */
-     if (!cpu->has_mpu) {
--        unset_feature(env, ARM_FEATURE_PMSA);
-+        cpu->pmsav7_dregion = 0;
-+    }
-+    if (cpu->pmsav7_dregion == 0) {
-+        cpu->has_mpu = false;
-     }
-     if (arm_feature(env, ARM_FEATURE_PMSA) &&
---
-.7.4

-[Qemu-devel] [PULL 15/27] armv7m: Implement M profile default memory map
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-Add support for the M profile default memory map which is used
-if the MPU is not present or disabled.
-The main differences in behaviour from implementing this
-correctly are that we set the PAGE_EXEC attribute on
-the right regions of memory, such that device regions
-are not executable.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Message-id: 1493122030-32191-10-git-send-email-peter.maydell@linaro.org
-[PMM: rephrased comment and commit message; don't mark
- the flash memory region as not-writable; list all
- the cases in the default map explicitly rather than
- using a 'default' case for the non-executable regions]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 41 ++++++++++++++++++++++++++++++++---------
-file changed, 32 insertions(+), 9 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
-                                                 ARMMMUIdx mmu_idx,
-                                                 int32_t address, int *prot)
- {
--    *prot = PAGE_READ | PAGE_WRITE;
--    switch (address) {
--    case 0xF0000000 ... 0xFFFFFFFF:
--        if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
-+    if (!arm_feature(env, ARM_FEATURE_M)) {
-+        *prot = PAGE_READ | PAGE_WRITE;
-+        switch (address) {
-+        case 0xF0000000 ... 0xFFFFFFFF:
-+            if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
-+                /* hivecs execing is ok */
-+                *prot |= PAGE_EXEC;
-+            }
-+            break;
-+        case 0x00000000 ... 0x7FFFFFFF:
-             *prot |= PAGE_EXEC;
-+            break;
-+        }
-+    } else {
-+        /* Default system address map for M profile cores.
-+         * The architecture specifies which regions are execute-never;
-+         * at the MPU level no other checks are defined.
-+         */
-+        switch (address) {
-+        case 0x00000000 ... 0x1fffffff: /* ROM */
-+        case 0x20000000 ... 0x3fffffff: /* SRAM */
-+        case 0x60000000 ... 0x7fffffff: /* RAM */
-+        case 0x80000000 ... 0x9fffffff: /* RAM */
-+            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
-+            break;
-+        case 0x40000000 ... 0x5fffffff: /* Peripheral */
-+        case 0xa0000000 ... 0xbfffffff: /* Device */
-+        case 0xc0000000 ... 0xdfffffff: /* Device */
-+        case 0xe0000000 ... 0xffffffff: /* System */
-+            *prot = PAGE_READ | PAGE_WRITE;
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
--        break;
--    case 0x00000000 ... 0x7FFFFFFF:
--        *prot |= PAGE_EXEC;
--        break;
-     }
--
- }
- static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
---
-.7.4

-[Qemu-devel] [PULL 17/27] armv7m: Classify faults as MemManage or BusFault
+Deleted patch
-From: Michael Davidsaver <mdavidsaver@gmail.com>
-General logic is that operations stopped by the MPU are MemManage,
-and those which go through the MPU and are caught by the unassigned
-handle are BusFault. Distinguish these by looking at the
-exception.fsr values, and set the CFSR bits and (if appropriate)
-fill in the BFAR or MMFAR with the exception address.
-Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
-Message-id: 1493122030-32191-12-git-send-email-peter.maydell@linaro.org
-[PMM: i-side faults do not set BFAR/MMFAR, only d-side;
- added some CPU_LOG_INT logging]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
----
- target/arm/helper.c | 45 ++++++++++++++++++++++++++++++++++++++++++---
-file changed, 42 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         break;
-     case EXCP_PREFETCH_ABORT:
-     case EXCP_DATA_ABORT:
--        /* TODO: if we implemented the MPU registers, this is where we
--         * should set the MMFAR, etc from exception.fsr and exception.vaddress.
-+        /* Note that for M profile we don't have a guest facing FSR, but
-+         * the env->exception.fsr will be populated by the code that
-+         * raises the fault, in the A profile short-descriptor format.
-          */
--        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
-+        switch (env->exception.fsr & 0xf) {
-+        case 0x8: /* External Abort */
-+            switch (cs->exception_index) {
-+            case EXCP_PREFETCH_ABORT:
-+                env->v7m.cfsr |= R_V7M_CFSR_PRECISERR_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
-+                break;
-+            case EXCP_DATA_ABORT:
-+                env->v7m.cfsr |=
-+                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-+                env->v7m.bfar = env->exception.vaddress;
-+                qemu_log_mask(CPU_LOG_INT,
-+                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
-+                              env->v7m.bfar);
-+                break;
-+            }
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS);
-+            break;
-+        default:
-+            /* All other FSR values are either MPU faults or "can't happen
-+             * for M profile" cases.
-+             */
-+            switch (cs->exception_index) {
-+            case EXCP_PREFETCH_ABORT:
-+                env->v7m.cfsr |= R_V7M_CFSR_IACCVIOL_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
-+                break;
-+            case EXCP_DATA_ABORT:
-+                env->v7m.cfsr |=
-+                    (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
-+                env->v7m.mmfar = env->exception.vaddress;
-+                qemu_log_mask(CPU_LOG_INT,
-+                              "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
-+                              env->v7m.mmfar);
-+                break;
-+            }
-+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
-+            break;
-+        }
-         break;
-     case EXCP_BKPT:
-         if (semihosting_enabled()) {
---
-.7.4

-[Qemu-devel] [PULL 21/27] aspeed/i2c: handle LAST command under the RX command
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Today, the LAST command is handled with the STOP command but this is
-incorrect. Also nack the I2C bus when a LAST is issued.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-3-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/i2c/aspeed_i2c.c | 9 ++++++---
-file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
-+++ b/hw/i2c/aspeed_i2c.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-         bus->cmd &= ~I2CD_M_TX_CMD;
-     }
--    if (bus->cmd & I2CD_M_RX_CMD) {
-+    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
-         int ret = i2c_recv(bus->bus);
-         if (ret < 0) {
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
-             bus->intr_status |= I2CD_INTR_RX_DONE;
-         }
-         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
--        bus->cmd &= ~I2CD_M_RX_CMD;
-+        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
-+            i2c_nack(bus->bus);
-+        }
-+        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
-     }
--    if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
-+    if (bus->cmd & I2CD_M_STOP_CMD) {
-         if (!i2c_bus_busy(bus->bus)) {
-             bus->intr_status |= I2CD_INTR_ABNORMAL;
-         } else {
---
-.7.4

-[Qemu-devel] [PULL 22/27] aspeed/i2c: introduce a state machine
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
-From: Cédric Le Goater <clg@kaod.org>
+From: Thomas Huth <thuth@redhat.com>
-The Aspeed I2C controller maintains a state machine in the command
+Move the code to a separate file so that we do not have to compile
-register, which is mostly used for debug.
+it anymore if CONFIG_ARM_V7M is not set.
-Let's start adding a few states to handle abnormal STOP
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-commands. Today, the model uses the busy status of the bus as a
+Message-id: 20240308141051.536599-2-thuth@redhat.com
-condition to do so but it is not precise enough.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Also remove the ABNORMAL bit for failing TX commands. This is
 incorrect with respect to the specs.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 1494827476-1487-4-git-send-email-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i2c/aspeed_i2c.c | 36 +++++++++++++++++++++++++++++++++---
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
-file changed, 33 insertions(+), 3 deletions(-)
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
  target/arm/meson.build     |   3 +
  target/arm/tcg/meson.build |   3 +
 files changed, 296 insertions(+), 261 deletions(-)
  create mode 100644 target/arm/tcg/cpu-v7m.c
-diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU ARMv7-M TCG-only CPUs.
 + *
 + * Copyright (c) 2012 SUSE LINUX Products GmbH
 + *
 + * This code is licensed under the GNU GPL v2 or later.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
 +#include "internals.h"
 +
 +#if !defined(CONFIG_USER_ONLY)
 +
 +#include "hw/intc/armv7m_nvic.h"
 +
 +static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cs);
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    bool ret = false;
 +
 +    /*
 +     * ARMv7-M interrupt masking works differently than -A or -R.
 +     * There is no FIQ/IRQ distinction. Instead of I and F bits
 +     * masking FIQ and IRQ interrupts, an exception is taken only
 +     * if it is higher priority than the current execution priority
 +     * (which depends on state like BASEPRI, FAULTMASK and the
 +     * currently active exception).
 +     */
 +    if (interrupt_request & CPU_INTERRUPT_HARD
 +        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 +        cs->exception_index = EXCP_IRQ;
 +        cc->tcg_ops->do_interrupt(cs);
 +        ret = true;
 +    }
 +    return ret;
 +}
 +
 +#endif /* !CONFIG_USER_ONLY */
 +
 +static void cortex_m0_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V6);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +
 +    cpu->midr = 0x410cc200;
 +
 +    /*
 +     * These ID register values are not guest visible, because
 +     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 +     * features, because QEMU generally controls its emulation
 +     * by looking at ID register fields. We use the same values as
 +     * for the M3.
 +     */
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m3_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    cpu->midr = 0x410fc231;
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m4_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fc240; /* r0p0 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000000;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m7_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x411fc272; /* r1p2 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00100030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02112000;
 +    cpu->isar.id_isar2 = 0x20232231;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m33_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd213; /* r0p3 */
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
 +    cpu->isar.id_dfr0 = 0x00200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00101F40;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000;
 +    cpu->ctr = 0x8000c000;
 +}
 +
 +static void cortex_m55_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd221; /* r0p1 */
 +    cpu->revidr = 0;
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    /* These are the MVFR* values for the FPU + full MVE configuration */
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12100211;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x20000030;
 +    cpu->isar.id_pfr1 = 0x00000230;
 +    cpu->isar.id_dfr0 = 0x10200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00111040;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000011;
 +    cpu->isar.id_isar0 = 0x01103110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000; /* caches not implemented */
 +    cpu->ctr = 0x8303c003;
 +}
 +
 +static const TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +    .restore_state_to_opc = arm_restore_state_to_opc,
 +
 +#ifdef CONFIG_USER_ONLY
 +    .record_sigsegv = arm_cpu_record_sigsegv,
 +    .record_sigbus = arm_cpu_record_sigbus,
 +#else
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +    .debug_check_breakpoint = arm_debug_check_breakpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
 +static void arm_v7m_class_init(ObjectClass *oc, void *data)
 +{
 +    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
 +
 +    acc->info = data;
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
 +    cc->gdb_core_xml_file = "arm-m-profile.xml";
 +}
 +
 +static const ARMCPUInfo arm_v7m_cpus[] = {
 +    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 +                             .class_init = arm_v7m_class_init },
 +};
 +
 +static void arm_v7m_cpu_register_types(void)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
 +        arm_cpu_register(&arm_v7m_cpus[i]);
 +    }
 +}
 +
 +type_init(arm_v7m_cpu_register_types)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/aspeed_i2c.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/hw/i2c/aspeed_i2c.c
++++ b/target/arm/tcg/cpu32.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@
-     }
+ #include "hw/boards.h"
  #endif
  #include "cpregs.h"
 -#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 -#include "hw/intc/armv7m_nvic.h"
 -#endif
  /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 -#if !defined(CONFIG_USER_ONLY)
 -static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cs);
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    CPUARMState *env = &cpu->env;
 -    bool ret = false;
 -
 -    /*
 -     * ARMv7-M interrupt masking works differently than -A or -R.
 -     * There is no FIQ/IRQ distinction. Instead of I and F bits
 -     * masking FIQ and IRQ interrupts, an exception is taken only
 -     * if it is higher priority than the current execution priority
 -     * (which depends on state like BASEPRI, FAULTMASK and the
 -     * currently active exception).
 -     */
 -    if (interrupt_request & CPU_INTERRUPT_HARD
 -        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 -        cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops->do_interrupt(cs);
 -        ret = true;
 -    }
 -    return ret;
 -}
 -#endif /* !CONFIG_USER_ONLY */
 -
  static void arm926_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
-+static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
+-static void cortex_m0_initfn(Object *obj)
-+{
+-{
-+    bus->cmd &= ~(I2CD_TX_STATE_MASK << I2CD_TX_STATE_SHIFT);
+-    ARMCPU *cpu = ARM_CPU(obj);
-+    bus->cmd |= (state & I2CD_TX_STATE_MASK) << I2CD_TX_STATE_SHIFT;
+-    set_feature(&cpu->env, ARM_FEATURE_V6);
-+}
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-+
+-
-+static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
+-    cpu->midr = 0x410cc200;
-+{
+-
-+    return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
+-    /*
-+}
+-     * These ID register values are not guest visible, because
-+
+-     * we do not implement the Main Extension. They must be set
-+/*
+-     * to values corresponding to the Cortex-M0's implemented
-+ * The state machine needs some refinement. It is only used to track
+-     * features, because QEMU generally controls its emulation
-+ * invalid STOP commands for the moment.
+-     * by looking at ID register fields. We use the same values as
-+ */
+-     * for the M3.
- static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+-     */
- {
+-    cpu->isar.id_pfr0 = 0x00000030;
-     bus->cmd &= ~0xFFFF;
+-    cpu->isar.id_pfr1 = 0x00000200;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+-    cpu->isar.id_dfr0 = 0x00100000;
-     bus->intr_status = 0;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00000030;
-     if (bus->cmd & I2CD_M_START_CMD) {
+-    cpu->isar.id_mmfr1 = 0x00000000;
-+        uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
+-    cpu->isar.id_mmfr2 = 0x00000000;
-+            I2CD_MSTARTR : I2CD_MSTART;
+-    cpu->isar.id_mmfr3 = 0x00000000;
-+
+-    cpu->isar.id_isar0 = 0x01141110;
-+        aspeed_i2c_set_state(bus, state);
+-    cpu->isar.id_isar1 = 0x02111000;
-+
+-    cpu->isar.id_isar2 = 0x21112231;
-         if (i2c_start_transfer(bus->bus, extract32(bus->buf, 1, 7),
+-    cpu->isar.id_isar3 = 0x01111110;
-                                extract32(bus->buf, 0, 1))) {
+-    cpu->isar.id_isar4 = 0x01310102;
-             bus->intr_status |= I2CD_INTR_TX_NAK;
+-    cpu->isar.id_isar5 = 0x00000000;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+-    cpu->isar.id_isar6 = 0x00000000;
-         if (!i2c_bus_busy(bus->bus)) {
+-}
-             return;
+-
-         }
+-static void cortex_m3_initfn(Object *obj)
-+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+-{
-     }
+-    ARMCPU *cpu = ARM_CPU(obj);
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
-     if (bus->cmd & I2CD_M_TX_CMD) {
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-+        aspeed_i2c_set_state(bus, I2CD_MTXD);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-         if (i2c_send(bus->bus, bus->buf)) {
+-    cpu->midr = 0x410fc231;
--            bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
+-    cpu->pmsav7_dregion = 8;
-+            bus->intr_status |= (I2CD_INTR_TX_NAK);
+-    cpu->isar.id_pfr0 = 0x00000030;
-             i2c_end_transfer(bus->bus);
+-    cpu->isar.id_pfr1 = 0x00000200;
-         } else {
+-    cpu->isar.id_dfr0 = 0x00100000;
-             bus->intr_status |= I2CD_INTR_TX_ACK;
+-    cpu->id_afr0 = 0x00000000;
-         }
+-    cpu->isar.id_mmfr0 = 0x00000030;
-         bus->cmd &= ~I2CD_M_TX_CMD;
+-    cpu->isar.id_mmfr1 = 0x00000000;
-+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+-    cpu->isar.id_mmfr2 = 0x00000000;
-     }
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01141110;
-     if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
+-    cpu->isar.id_isar1 = 0x02111000;
--        int ret = i2c_recv(bus->bus);
+-    cpu->isar.id_isar2 = 0x21112231;
-+        int ret;
+-    cpu->isar.id_isar3 = 0x01111110;
-+
+-    cpu->isar.id_isar4 = 0x01310102;
-+        aspeed_i2c_set_state(bus, I2CD_MRXD);
+-    cpu->isar.id_isar5 = 0x00000000;
-+        ret = i2c_recv(bus->bus);
+-    cpu->isar.id_isar6 = 0x00000000;
-         if (ret < 0) {
+-}
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
+-
-             ret = 0xff;
+-static void cortex_m4_initfn(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
+-{
-             i2c_nack(bus->bus);
+-    ARMCPU *cpu = ARM_CPU(obj);
-         }
+-
-         bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
-+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-     }
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-     if (bus->cmd & I2CD_M_STOP_CMD) {
+-    cpu->midr = 0x410fc240; /* r0p0 */
--        if (!i2c_bus_busy(bus->bus)) {
+-    cpu->pmsav7_dregion = 8;
-+        if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
+-    cpu->isar.mvfr0 = 0x10110021;
-+            qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
+-    cpu->isar.mvfr1 = 0x11000011;
-             bus->intr_status |= I2CD_INTR_ABNORMAL;
+-    cpu->isar.mvfr2 = 0x00000000;
-         } else {
+-    cpu->isar.id_pfr0 = 0x00000030;
-+            aspeed_i2c_set_state(bus, I2CD_MSTOP);
+-    cpu->isar.id_pfr1 = 0x00000200;
-             i2c_end_transfer(bus->bus);
+-    cpu->isar.id_dfr0 = 0x00100000;
-             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
+-    cpu->id_afr0 = 0x00000000;
-         }
+-    cpu->isar.id_mmfr0 = 0x00000030;
-         bus->cmd &= ~I2CD_M_STOP_CMD;
+-    cpu->isar.id_mmfr1 = 0x00000000;
-+        aspeed_i2c_set_state(bus, I2CD_IDLE);
+-    cpu->isar.id_mmfr2 = 0x00000000;
-     }
+-    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m7_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x411fc272; /* r1p2 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00100030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02112000;
 -    cpu->isar.id_isar2 = 0x20232231;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m33_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd213; /* r0p3 */
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000210;
 -    cpu->isar.id_dfr0 = 0x00200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00101F40;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000;
 -    cpu->ctr = 0x8000c000;
 -}
 -
 -static void cortex_m55_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd221; /* r0p1 */
 -    cpu->revidr = 0;
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    /* These are the MVFR* values for the FPU + full MVE configuration */
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12100211;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x20000030;
 -    cpu->isar.id_pfr1 = 0x00000230;
 -    cpu->isar.id_dfr0 = 0x10200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00111040;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000011;
 -    cpu->isar.id_isar0 = 0x01103110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000; /* caches not implemented */
 -    cpu->ctr = 0x8303c003;
 -}
 -
  static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
      /* Dummy the TCM region regs for the moment */
      { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
+-static const TCGCPUOps arm_v7m_tcg_ops = {
+-    .initialize = arm_translate_init,
+-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+-    .debug_excp_handler = arm_debug_excp_handler,
+-    .restore_state_to_opc = arm_restore_state_to_opc,
+-
+-#ifdef CONFIG_USER_ONLY
+-    .record_sigsegv = arm_cpu_record_sigsegv,
+-    .record_sigbus = arm_cpu_record_sigbus,
+-#else
+-    .tlb_fill = arm_cpu_tlb_fill,
+-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+-    .do_interrupt = arm_v7m_cpu_do_interrupt,
+-    .do_transaction_failed = arm_cpu_do_transaction_failed,
+-    .do_unaligned_access = arm_cpu_do_unaligned_access,
+-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+-    .debug_check_watchpoint = arm_debug_check_watchpoint,
+-    .debug_check_breakpoint = arm_debug_check_breakpoint,
+-#endif /* !CONFIG_USER_ONLY */
+-};
+-
+-static void arm_v7m_class_init(ObjectClass *oc, void *data)
+-{
+-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+-
+-    acc->info = data;
+-    cc->tcg_ops = &arm_v7m_tcg_ops;
+-    cc->gdb_core_xml_file = "arm-m-profile.xml";
+-}
+-
+ #ifndef TARGET_AARCH64
+ /*
+  * -cpu max: a CPU with as many features enabled as our emulation supports.
+@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
+     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
+     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
+-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+-                             .class_init = arm_v7m_class_init },
+     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
+     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
+     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
+   'ptw.c',
+ ))
++arm_user_ss = ss.source_set()
++
+ subdir('hvf')
+ if 'CONFIG_TCG' in config_all_accel
+@@ -XXX,XX +XXX,XX @@ endif
+ target_arch += {'arm': arm_ss}
+ target_system_arch += {'arm': arm_system_ss}
++target_user_arch += {'arm': arm_user_ss}
+diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/meson.build
++++ b/target/arm/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+ arm_system_ss.add(files(
+   'psci.c',
+ ))
++
++arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
++arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 23/27] aspeed: add some I2C devices to the Aspeed machines
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Let's add an RTC to the palmetto BMC and a LM75 temperature sensor to
-the AST2500 EVB to start with.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-5-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 27 +++++++++++++++++++++++++++
-file changed, 27 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
-     const char *fmc_model;
-     const char *spi_model;
-     uint32_t num_cs;
-+    void (*i2c_init)(AspeedBoardState *bmc);
- } AspeedBoardConfig;
- enum {
-@@ -XXX,XX +XXX,XX @@ enum {
-         SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
-         SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
-+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
-+static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
-+
- static const AspeedBoardConfig aspeed_boards[] = {
-     [PALMETTO_BMC] = {
-         .soc_name  = "ast2400-a1",
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
-         .fmc_model = "n25q256a",
-         .spi_model = "mx25l25635e",
-         .num_cs    = 1,
-+        .i2c_init  = palmetto_bmc_i2c_init,
-     },
-     [AST2500_EVB]  = {
-         .soc_name  = "ast2500-a1",
-@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
-         .fmc_model = "n25q256a",
-         .spi_model = "mx25l25635e",
-         .num_cs    = 1,
-+        .i2c_init  = ast2500_evb_i2c_init,
-     },
-     [ROMULUS_BMC]  = {
-         .soc_name  = "ast2500-a1",
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
-     aspeed_board_binfo.ram_size = ram_size;
-     aspeed_board_binfo.loader_start = sc->info->sdram_base;
-+    if (cfg->i2c_init) {
-+        cfg->i2c_init(bmc);
-+    }
-+
-     arm_load_kernel(ARM_CPU(first_cpu), &aspeed_board_binfo);
- }
-+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-+     * enough to provide basic RTC features. Alarms will be missing */
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+}
-+
- static void palmetto_bmc_init(MachineState *machine)
- {
-     aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
-     .class_init = palmetto_bmc_class_init,
- };
-+static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
-+{
-+    AspeedSoCState *soc = &bmc->soc;
-+
-+    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
-+}
-+
- static void ast2500_evb_init(MachineState *machine)
- {
-     aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
---
-.7.4

-[Qemu-devel] [PULL 25/27] aspeed: add a temp sensor device on I2C bus 3
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Temperatures can be changed from the monitor with :
-    (qemu) qom-set /machine/unattached/device[2] temperature0 12000
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 1494827476-1487-7-git-send-email-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
- static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    DeviceState *dev;
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-      * enough to provide basic RTC features. Alarms will be missing */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+
-+    /* add a TMP423 temperature sensor */
-+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
-+                           "tmp423", 0x4c);
-+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
-+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
-+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
-+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
- }
- static void palmetto_bmc_init(MachineState *machine)
---
-.7.4

-[Qemu-devel] [PULL 26/27] hw/arm/virt-acpi-build: build SLIT when needed
+Deleted patch
-From: Andrew Jones <drjones@redhat.com>
-Cc: Shannon Zhao <zhaoshenglong@huawei.com>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
-Message-id: 20170529173751.3443-2-drjones@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt-acpi-build.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
-+++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
-     if (nb_numa_nodes > 0) {
-         acpi_add_table(table_offsets, tables_blob);
-         build_srat(tables_blob, tables->linker, vms);
-+        if (have_numa_distance) {
-+            acpi_add_table(table_offsets, tables_blob);
-+            build_slit(tables_blob, tables->linker);
-+        }
-     }
-     if (its_class_name() && !vmc->no_its) {
---
-.7.4

ARM pullreq; contains some patches that arrived while I
was on holiday, plus the series I sent off before going
away, which got reviewed while I was away.

thanks
-- PMM

The following changes since commit c077a998eb3fcae2d048e3baeb5bc592d30fddde:

Merge remote-tracking branch 'remotes/riku/tags/pull-linux-user-20170531' into staging (2017-06-01 15:50:40 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170601

for you to fetch changes up to cdc58be430b0bdeaef282e2e70f8135ae531616d:

hw/arm/virt: fdt: generate distance-map when needed (2017-06-01 17:27:07 +0100)

----------------------------------------------------------------
target-arm queue:
 * virt: numa: provide ACPI distance info when needed
 * aspeed: fix i2c controller bugs
 * aspeed: add temperature sensor device
 * M profile: support MPU
 * gicv3: fix mishandling of BPR1, VBPR1
 * load_uboot_image: don't assume a full header read
 * libvixl: Correct build failures on NetBSD

----------------------------------------------------------------
Andrew Jones (3):
      load_uboot_image: don't assume a full header read
      hw/arm/virt-acpi-build: build SLIT when needed
      hw/arm/virt: fdt: generate distance-map when needed

Cédric Le Goater (6):
      aspeed/i2c: improve command handling
      aspeed/i2c: handle LAST command under the RX command
      aspeed/i2c: introduce a state machine
      aspeed: add some I2C devices to the Aspeed machines
      hw/misc: add a TMP42{1,2,3} device model
      aspeed: add a temp sensor device on I2C bus 3

Kamil Rytarowski (1):
      libvixl: Correct build failures on NetBSD

Michael Davidsaver (4):
      armv7m: Improve "-d mmu" tracing for PMSAv7 MPU
      armv7m: Implement M profile default memory map
      armv7m: Classify faults as MemManage or BusFault
      arm: add MPU support to M profile CPUs

Peter Maydell (12):
      hw/intc/arm_gicv3_cpuif: Fix reset value for VMCR_EL2.VBPR1
      hw/intc/arm_gicv3_cpuif: Don't let BPR be set below its minimum
      hw/intc/arm_gicv3_cpuif: Fix priority masking for NS BPR1
      arm: Use the mmu_idx we're passed in arm_cpu_do_unaligned_access()
      arm: Add support for M profile CPUs having different MMU index semantics
      arm: Use different ARMMMUIdx values for M profile
      arm: Clean up handling of no-MPU PMSA CPUs
      arm: Don't clear ARM_FEATURE_PMSA for no-mpu configs
      arm: Don't let no-MPU PMSA cores write to SCTLR.M
      arm: Remove unnecessary check on cpu->pmsav7_dregion
      arm: All M profile cores are PMSA
      arm: Implement HFNMIENA support for M profile MPU

Wei Huang (1):
      target/arm: clear PMUVER field of AA64DFR0 when vPMU=off

From: Kamil Rytarowski <n54@gmx.com>

Ensure that C99 macros are defined regardless of the inclusion order of
headers in vixl. This is required at least on NetBSD.

The vixl/globals.h headers defines __STDC_CONSTANT_MACROS and must be
included before other system headers.

This file defines unconditionally the following macros, without altering
the original sources:
 - __STDC_CONSTANT_MACROS
 - __STDC_LIMIT_MACROS
 - __STDC_FORMAT_MACROS

Signed-off-by: Kamil Rytarowski <n54@gmx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20170514051820.15985-1-n54@gmx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 disas/libvixl/Makefile.objs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/disas/libvixl/Makefile.objs b/disas/libvixl/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/disas/libvixl/Makefile.objs
+++ b/disas/libvixl/Makefile.objs
@@ -XXX,XX +XXX,XX @@ libvixl_OBJS = vixl/utils.o \
 # The -Wno-sign-compare is needed only for gcc 4.6, which complains about
 # some signed-unsigned equality comparisons which later gcc versions do not.
 $(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS := -I$(SRC_PATH)/disas/libvixl $(QEMU_CFLAGS) -Wno-sign-compare
+# Ensure that C99 macros are defined regardless of the inclusion order of
+# headers in vixl. This is required at least on NetBSD.
+$(addprefix $(obj)/,$(libvixl_OBJS)): QEMU_CFLAGS += -D__STDC_CONSTANT_MACROS -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS
 
 common-obj-$(CONFIG_ARM_A64_DIS) += $(libvixl_OBJS)
-- 
2.7.4

We were setting the VBPR1 field of VMCR_EL2 to icv_min_vbpr()
on reset, but this is not correct. The field should reset to
the minimum value of ICV_BPR0_EL1 plus one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-2-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     cs->ich_hcr_el2 = 0;
     memset(cs->ich_lr_el2, 0, sizeof(cs->ich_lr_el2));
     cs->ich_vmcr_el2 = ICH_VMCR_EL2_VFIQEN |
-        (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR1_SHIFT) |
+        ((icv_min_vbpr(cs) + 1) << ICH_VMCR_EL2_VBPR1_SHIFT) |
         (icv_min_vbpr(cs) << ICH_VMCR_EL2_VBPR0_SHIFT);
 }
 
-- 
2.7.4

icc_bpr_write() was not enforcing that writing a value below the
minimum for the BPR should behave as if the BPR was set to the
minimum value. This doesn't make a difference for the secure
BPRs (since we define the minimum for the QEMU implementation
as zero) but did mean we were allowing the NS BPR1 to be set to
0 when 1 should be the lowest value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-3-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     GICv3CPUState *cs = icc_cs_from_env(env);
     int grp = (ri->crm == 8) ? GICV3_G0 : GICV3_G1;
+    uint64_t minval;
 
     if (icv_access(env, grp == GICV3_G0 ? HCR_FMO : HCR_IMO)) {
         icv_bpr_write(env, ri, value);
@@ -XXX,XX +XXX,XX @@ static void icc_bpr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         return;
     }
 
+    minval = (grp == GICV3_G1NS) ? GIC_MIN_BPR_NS : GIC_MIN_BPR;
+    if (value < minval) {
+        value = minval;
+    }
+
     cs->icc_bpr[grp] = value & 7;
     gicv3_cpuif_update(cs);
 }
-- 
2.7.4

When we calculate the mask to use to get the group priority from
an interrupt priority, the way that NS BPR1 is handled differs
from how BPR0 and S BPR1 work -- a BPR1 value of 1 means
the group priority is in bits [7:1], whereas for BPR0 and S BPR1
this is indicated by a 0 BPR value.

Subtract 1 from the BPR value before creating the mask if
we're using the NS BPR value, for both hardware and virtual
interrupts, as the GICv3 pseudocode does, and fix the comments
accordingly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493226792-3237-4-git-send-email-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 42 ++++++++++++++++++++++++++++++++++++++----
 1 file changed, 38 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static uint32_t icv_gprio_mask(GICv3CPUState *cs, int group)
 {
     /* Return a mask word which clears the subpriority bits from
      * a priority value for a virtual interrupt in the specified group.
-     * This depends on the VBPR value:
+     * This depends on the VBPR value.
+     * If using VBPR0 then:
      *  a BPR of 0 means the group priority bits are [7:1];
      *  a BPR of 1 means they are [7:2], and so on down to
      *  a BPR of 7 meaning no group priority bits at all.
+     * If using VBPR1 then:
+     *  a BPR of 0 is impossible (the minimum value is 1)
+     *  a BPR of 1 means the group priority bits are [7:1];
+     *  a BPR of 2 means they are [7:2], and so on down to
+     *  a BPR of 7 meaning the group priority is [7].
+     *
      * Which BPR to use depends on the group of the interrupt and
      * the current ICH_VMCR_EL2.VCBPR settings.
+     *
+     * This corresponds to the VGroupBits() pseudocode.
      */
+    int bpr;
+
     if (group == GICV3_G1NS && cs->ich_vmcr_el2 & ICH_VMCR_EL2_VCBPR) {
         group = GICV3_G0;
     }
 
-    return ~0U << (read_vbpr(cs, group) + 1);
+    bpr = read_vbpr(cs, group);
+    if (group == GICV3_G1NS) {
+        assert(bpr > 0);
+        bpr--;
+    }
+
+    return ~0U << (bpr + 1);
 }
 
 static bool icv_hppi_can_preempt(GICv3CPUState *cs, uint64_t lr)
@@ -XXX,XX +XXX,XX @@ static uint32_t icc_gprio_mask(GICv3CPUState *cs, int group)
 {
     /* Return a mask word which clears the subpriority bits from
      * a priority value for an interrupt in the specified group.
-     * This depends on the BPR value:
+     * This depends on the BPR value. For CBPR0 (S or NS):
      *  a BPR of 0 means the group priority bits are [7:1];
      *  a BPR of 1 means they are [7:2], and so on down to
      *  a BPR of 7 meaning no group priority bits at all.
+     * For CBPR1 NS:
+     *  a BPR of 0 is impossible (the minimum value is 1)
+     *  a BPR of 1 means the group priority bits are [7:1];
+     *  a BPR of 2 means they are [7:2], and so on down to
+     *  a BPR of 7 meaning the group priority is [7].
+     *
      * Which BPR to use depends on the group of the interrupt and
      * the current ICC_CTLR.CBPR settings.
+     *
+     * This corresponds to the GroupBits() pseudocode.
      */
+    int bpr;
+
     if ((group == GICV3_G1 && cs->icc_ctlr_el1[GICV3_S] & ICC_CTLR_EL1_CBPR) ||
         (group == GICV3_G1NS &&
          cs->icc_ctlr_el1[GICV3_NS] & ICC_CTLR_EL1_CBPR)) {
         group = GICV3_G0;
     }
 
-    return ~0U << ((cs->icc_bpr[group] & 7) + 1);
+    bpr = cs->icc_bpr[group] & 7;
+
+    if (group == GICV3_G1NS) {
+        assert(bpr > 0);
+        bpr--;
+    }
+
+    return ~0U << (bpr + 1);
 }
 
 static bool icc_no_enabled_hppi(GICv3CPUState *cs)
-- 
2.7.4

From: Wei Huang <wei@redhat.com>

The PMUv3 driver of linux kernel (in arch/arm64/kernel/perf_event.c)
relies on the PMUVER field of id_aa64dfr0_el1 to decide if PMU support
is present or not. This patch clears the PMUVER field under TCG mode
when vPMU=off. Without it, PMUv3 will init insider guest VMs even
with vPMU=off. This patch also removes a redundant line inside the
if-statement.

Signed-off-by: Wei Huang <wei@redhat.com>
Message-id: 1495123889-32301-1-git-send-email-wei@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_pmu) {
-        cpu->has_pmu = false;
         unset_feature(env, ARM_FEATURE_PMU);
+        cpu->id_aa64dfr0 &= ~0xf00;
     }
 
     if (!arm_feature(env, ARM_FEATURE_EL2)) {
-- 
2.7.4

When identifying the DFSR format for an alignment fault, use
the mmu index that we are passed, rather than calling cpu_mmu_index()
to get the mmu index for the current CPU state. This doesn't actually
make any difference since the only cases where the current MMU index
differs from the index used for the load are the "unprivileged
load/store" instructions, and in that case the mmu index may
differ but the translation regime is the same (apart from the
"use from Hyp mode" case which is UNPREDICTABLE).
However it's the more logical thing to do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/op_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     /* the DFSR for an alignment fault depends on whether we're using
      * the LPAE long descriptor format, or the short descriptor format
      */
-    if (arm_s1_regime_using_lpae_format(env, cpu_mmu_index(env, false))) {
+    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
         env->exception.fsr = (1 << 9) | 0x21;
     } else {
         env->exception.fsr = 0x1;
-- 
2.7.4

The M profile CPU's MPU has an awkward corner case which we
would like to implement with a different MMU index.

We can avoid having to bump the number of MMU modes ARM
uses, because some of our existing MMU indexes are only
used by non-M-profile CPUs, so we can borrow one.
To avoid that getting too confusing, clean up the code
to try to keep the two meanings of the index separate.

Instead of ARMMMUIdx enum values being identical to core QEMU
MMU index values, they are now the core index values with some
high bits set. Any particular CPU always uses the same high
bits (so eventually A profile cores and M profile cores will
use different bits). New functions arm_to_core_mmu_idx()
and core_to_arm_mmu_idx() convert between the two.

In general core index values are stored in 'int' types, and
ARM values are stored in ARMMMUIdx types.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  71 ++++++++++++++++-----
 target/arm/translate.h     |   2 +-
 target/arm/helper.c        | 151 ++++++++++++++++++++++++---------------------
 target/arm/op_helper.c     |   3 +-
 target/arm/translate-a64.c |  18 ++++--
 target/arm/translate.c     |  10 +--
 6 files changed, 156 insertions(+), 99 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * for the accesses done as part of a stage 1 page table walk, rather than
  * having to walk the stage 2 page table over and over.)
  *
+ * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
+ * are not quite the same -- different CPU types (most notably M profile
+ * vs A/R profile) would like to use MMU indexes with different semantics,
+ * but since we don't ever need to use all of those in a single CPU we
+ * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
+ * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
+ * the same for any particular CPU.
+ * Variables of type ARMMUIdx are always full values, and the core
+ * index values are in variables of type 'int'.
+ *
  * Our enumeration includes at the end some entries which are not "true"
  * mmu_idx values in that they don't have corresponding TLBs and are only
  * valid for doing slow path page table walks.
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * of the AT/ATS operations.
  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
  */
+#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
+#define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
+
+#define ARM_MMU_IDX_TYPE_MASK (~0x7)
+#define ARM_MMU_IDX_COREIDX_MASK 0x7
+
 typedef enum ARMMMUIdx {
-    ARMMMUIdx_S12NSE0 = 0,
-    ARMMMUIdx_S12NSE1 = 1,
-    ARMMMUIdx_S1E2 = 2,
-    ARMMMUIdx_S1E3 = 3,
-    ARMMMUIdx_S1SE0 = 4,
-    ARMMMUIdx_S1SE1 = 5,
-    ARMMMUIdx_S2NS = 6,
+    ARMMMUIdx_S12NSE0 = 0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S12NSE1 = 1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1E2 = 2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1E3 = 3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
     /* Indexes below here don't have TLBs and are used only for AT system
      * instructions or for the first stage of an S12 page table walk.
      */
-    ARMMMUIdx_S1NSE0 = 7,
-    ARMMMUIdx_S1NSE1 = 8,
+    ARMMMUIdx_S1NSE0 = 0 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_S1NSE1 = 1 | ARM_MMU_IDX_NOTLB,
 } ARMMMUIdx;
 
+/* Bit macros for the core-mmu-index values for each index,
+ * for use when calling tlb_flush_by_mmuidx() and friends.
+ */
+typedef enum ARMMMUIdxBit {
+    ARMMMUIdxBit_S12NSE0 = 1 << 0,
+    ARMMMUIdxBit_S12NSE1 = 1 << 1,
+    ARMMMUIdxBit_S1E2 = 1 << 2,
+    ARMMMUIdxBit_S1E3 = 1 << 3,
+    ARMMMUIdxBit_S1SE0 = 1 << 4,
+    ARMMMUIdxBit_S1SE1 = 1 << 5,
+    ARMMMUIdxBit_S2NS = 1 << 6,
+} ARMMMUIdxBit;
+
 #define MMU_USER_IDX 0
 
+static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
+{
+    return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
+}
+
+static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
+{
+    return mmu_idx | ARM_MMU_IDX_A;
+}
+
 /* Return the exception level we're running at if this is our mmu_idx */
 static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
 {
-    assert(mmu_idx < ARMMMUIdx_S2NS);
-    return mmu_idx & 3;
+    switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
+    case ARM_MMU_IDX_A:
+        return mmu_idx & 3;
+    default:
+        g_assert_not_reached();
+    }
 }
 
 /* Determine the current mmu_idx to use for normal loads/stores */
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
     int el = arm_current_el(env);
 
     if (el < 2 && arm_is_secure_below_el3(env)) {
-        return ARMMMUIdx_S1SE0 + el;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
     }
     return el;
 }
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                                         target_ulong *cs_base, uint32_t *flags)
 {
-    ARMMMUIdx mmu_idx = cpu_mmu_index(env, false);
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
     if (is_a64(env)) {
         *pc = env->pc;
         *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
@@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                    << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
     }
 
-    *flags |= (mmu_idx << ARM_TBFLAG_MMUIDX_SHIFT);
+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 
     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
      * states defined in the ARM ARM for software singlestep:
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_dc_feature(DisasContext *dc, int feature)
 
 static inline int get_mem_index(DisasContext *s)
 {
-    return s->mmu_idx;
+    return arm_to_core_mmu_idx(s->mmu_idx);
 }
 
 /* Function used to determine the target exception EL when otherwise not known
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
 
     tlb_flush_by_mmuidx(cs,
-                        (1 << ARMMMUIdx_S12NSE1) |
-                        (1 << ARMMMUIdx_S12NSE0) |
-                        (1 << ARMMMUIdx_S2NS));
+                        ARMMMUIdxBit_S12NSE1 |
+                        ARMMMUIdxBit_S12NSE0 |
+                        ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
 
     tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                        (1 << ARMMMUIdx_S12NSE1) |
-                                        (1 << ARMMMUIdx_S12NSE0) |
-                                        (1 << ARMMMUIdx_S2NS));
+                                        ARMMMUIdxBit_S12NSE1 |
+                                        ARMMMUIdxBit_S12NSE0 |
+                                        ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     pageaddr = sextract64(value << 12, 0, 40);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     pageaddr = sextract64(value << 12, 0, 40);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S2NS));
+                                             ARMMMUIdxBit_S2NS);
 }
 
 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = ENV_GET_CPU(env);
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E2));
+                                             ARMMMUIdxBit_S1E2);
 }
 
 static const ARMCPRegInfo cp_reginfo[] = {
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     /* Accesses to VTTBR may change the VMID so we must flush the TLB.  */
     if (raw_read(env, ri) != value) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S12NSE1) |
-                            (1 << ARMMMUIdx_S12NSE0) |
-                            (1 << ARMMMUIdx_S2NS));
+                            ARMMMUIdxBit_S12NSE1 |
+                            ARMMMUIdxBit_S12NSE0 |
+                            ARMMMUIdxBit_S2NS);
         raw_write(env, ri, value);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S1SE1) |
-                            (1 << ARMMMUIdx_S1SE0));
+                            ARMMMUIdxBit_S1SE1 |
+                            ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S12NSE1) |
-                            (1 << ARMMMUIdx_S12NSE0));
+                            ARMMMUIdxBit_S12NSE1 |
+                            ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S1SE1) |
-                                            (1 << ARMMMUIdx_S1SE0));
+                                            ARMMMUIdxBit_S1SE1 |
+                                            ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S12NSE1) |
-                                            (1 << ARMMMUIdx_S12NSE0));
+                                            ARMMMUIdxBit_S12NSE1 |
+                                            ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_by_mmuidx(cs,
-                            (1 << ARMMMUIdx_S1SE1) |
-                            (1 << ARMMMUIdx_S1SE0));
+                            ARMMMUIdxBit_S1SE1 |
+                            ARMMMUIdxBit_S1SE0);
     } else {
         if (arm_feature(env, ARM_FEATURE_EL2)) {
             tlb_flush_by_mmuidx(cs,
-                                (1 << ARMMMUIdx_S12NSE1) |
-                                (1 << ARMMMUIdx_S12NSE0) |
-                                (1 << ARMMMUIdx_S2NS));
+                                ARMMMUIdxBit_S12NSE1 |
+                                ARMMMUIdxBit_S12NSE0 |
+                                ARMMMUIdxBit_S2NS);
         } else {
             tlb_flush_by_mmuidx(cs,
-                                (1 << ARMMMUIdx_S12NSE1) |
-                                (1 << ARMMMUIdx_S12NSE0));
+                                ARMMMUIdxBit_S12NSE1 |
+                                ARMMMUIdxBit_S12NSE0);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S1SE1) |
-                                            (1 << ARMMMUIdx_S1SE0));
+                                            ARMMMUIdxBit_S1SE1 |
+                                            ARMMMUIdxBit_S1SE0);
     } else if (has_el2) {
         tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                            (1 << ARMMMUIdx_S12NSE1) |
-                                            (1 << ARMMMUIdx_S12NSE0) |
-                                            (1 << ARMMMUIdx_S2NS));
+                                            ARMMMUIdxBit_S12NSE1 |
+                                            ARMMMUIdxBit_S12NSE0 |
+                                            ARMMMUIdxBit_S2NS);
     } else {
           tlb_flush_by_mmuidx_all_cpus_synced(cs,
-                                              (1 << ARMMMUIdx_S12NSE1) |
-                                              (1 << ARMMMUIdx_S12NSE0));
+                                              ARMMMUIdxBit_S12NSE1 |
+                                              ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = ENV_GET_CPU(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (arm_is_secure_below_el3(env)) {
         tlb_flush_page_by_mmuidx(cs, pageaddr,
-                                 (1 << ARMMMUIdx_S1SE1) |
-                                 (1 << ARMMMUIdx_S1SE0));
+                                 ARMMMUIdxBit_S1SE1 |
+                                 ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_page_by_mmuidx(cs, pageaddr,
-                                 (1 << ARMMMUIdx_S12NSE1) |
-                                 (1 << ARMMMUIdx_S12NSE0));
+                                 ARMMMUIdxBit_S12NSE1 |
+                                 ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E2));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S1E3));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     if (sec) {
         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                 (1 << ARMMMUIdx_S1SE1) |
-                                                 (1 << ARMMMUIdx_S1SE0));
+                                                 ARMMMUIdxBit_S1SE1 |
+                                                 ARMMMUIdxBit_S1SE0);
     } else {
         tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                 (1 << ARMMMUIdx_S12NSE1) |
-                                                 (1 << ARMMMUIdx_S12NSE0));
+                                                 ARMMMUIdxBit_S12NSE1 |
+                                                 ARMMMUIdxBit_S12NSE0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E2));
+                                             ARMMMUIdxBit_S1E2);
 }
 
 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S1E3));
+                                             ARMMMUIdxBit_S1E3);
 }
 
 static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     pageaddr = sextract64(value << 12, 0, 48);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, (1 << ARMMMUIdx_S2NS));
+    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_S2NS);
 }
 
 static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     pageaddr = sextract64(value << 12, 0, 48);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             (1 << ARMMMUIdx_S2NS));
+                                             ARMMMUIdxBit_S2NS);
 }
 
 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
+/* Convert a possible stage1+2 MMU index into the appropriate
+ * stage 1 MMU index
+ */
+static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
+{
+    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
+        mmu_idx += (ARMMMUIdx_S1NSE0 - ARMMMUIdx_S12NSE0);
+    }
+    return mmu_idx;
+}
+
 /* Returns TBI0 value for current regime el */
 uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
     uint32_t el;
 
     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
-       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-       */
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+     */
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     tcr = regime_tcr(env, mmu_idx);
     el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
     uint32_t el;
 
     /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
-       * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
-       */
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+     * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
+     */
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     tcr = regime_tcr(env, mmu_idx);
     el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static inline bool regime_using_lpae_format(CPUARMState *env,
  * on whether the long or short descriptor format is in use. */
 bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
-    if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
-        mmu_idx += ARMMMUIdx_S1NSE0;
-    }
+    mmu_idx = stage_1_mmu_idx(mmu_idx);
 
     return regime_using_lpae_format(env, mmu_idx);
 }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             int ret;
 
             ret = get_phys_addr(env, address, access_type,
-                                mmu_idx + ARMMMUIdx_S1NSE0, &ipa, attrs,
+                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
                                 prot, page_size, fsr, fi);
 
             /* If S1 fails or S2 is disabled, return early.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             /*
              * For non-EL2 CPUs a stage1+stage2 translation is just stage 1.
              */
-            mmu_idx += ARMMMUIdx_S1NSE0;
+            mmu_idx = stage_1_mmu_idx(mmu_idx);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
     int ret;
     MemTxAttrs attrs = {};
 
-    ret = get_phys_addr(env, address, access_type, mmu_idx, &phys_addr,
+    ret = get_phys_addr(env, address, access_type,
+                        core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
                         &attrs, &prot, &page_size, fsr, fi);
     if (!ret) {
         /* Map a single [sub]page.  */
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     bool ret;
     uint32_t fsr;
     ARMMMUFaultInfo fi = {};
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
 
     *attrs = (MemTxAttrs) {};
 
-    ret = get_phys_addr(env, addr, 0, cpu_mmu_index(env, false), &phys_addr,
+    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
                         attrs, &prot, &page_size, &fsr, &fi);
 
     if (ret) {
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     int target_el;
     bool same_el;
     uint32_t syn;
+    ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
 
     if (retaddr) {
         /* now we have a real cpu fault */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     /* the DFSR for an alignment fault depends on whether we're using
      * the LPAE long descriptor format, or the short descriptor format
      */
-    if (arm_s1_regime_using_lpae_format(env, mmu_idx)) {
+    if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
         env->exception.fsr = (1 << 9) | 0x21;
     } else {
         env->exception.fsr = 0x1;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void a64_translate_init(void)
         offsetof(CPUARMState, exclusive_high), "exclusive_high");
 }
 
-static inline ARMMMUIdx get_a64_user_mem_index(DisasContext *s)
+static inline int get_a64_user_mem_index(DisasContext *s)
 {
-    /* Return the mmu_idx to use for A64 "unprivileged load/store" insns:
+    /* Return the core mmu_idx to use for A64 "unprivileged load/store" insns:
      *  if EL1, access as if EL0; otherwise access at current EL
      */
+    ARMMMUIdx useridx;
+
     switch (s->mmu_idx) {
     case ARMMMUIdx_S12NSE1:
-        return ARMMMUIdx_S12NSE0;
+        useridx = ARMMMUIdx_S12NSE0;
+        break;
     case ARMMMUIdx_S1SE1:
-        return ARMMMUIdx_S1SE0;
+        useridx = ARMMMUIdx_S1SE0;
+        break;
     case ARMMMUIdx_S2NS:
         g_assert_not_reached();
     default:
-        return s->mmu_idx;
+        useridx = s->mmu_idx;
+        break;
     }
+    return arm_to_core_mmu_idx(useridx);
 }
 
 void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code_a64(ARMCPU *cpu, TranslationBlock *tb)
     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
     dc->condexec_mask = 0;
     dc->condexec_cond = 0;
-    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
     dc->tbi0 = ARM_TBFLAG_TBI0(tb->flags);
     dc->tbi1 = ARM_TBFLAG_TBI1(tb->flags);
     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_set_da_iss(DisasContext *s, TCGMemOp memop, ISSInfo issinfo)
     disas_set_insn_syndrome(s, syn);
 }
 
-static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
+static inline int get_a32_user_mem_index(DisasContext *s)
 {
-    /* Return the mmu_idx to use for A32/T32 "unprivileged load/store"
+    /* Return the core mmu_idx to use for A32/T32 "unprivileged load/store"
      * insns:
      *  if PL2, UNPREDICTABLE (we choose to implement as if PL0)
      *  otherwise, access as if at PL0.
@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx get_a32_user_mem_index(DisasContext *s)
     case ARMMMUIdx_S1E2:        /* this one is UNPREDICTABLE */
     case ARMMMUIdx_S12NSE0:
     case ARMMMUIdx_S12NSE1:
-        return ARMMMUIdx_S12NSE0;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S12NSE0);
     case ARMMMUIdx_S1E3:
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1SE1:
-        return ARMMMUIdx_S1SE0;
+        return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
     case ARMMMUIdx_S2NS:
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ void gen_intermediate_code(CPUARMState *env, TranslationBlock *tb)
     dc->be_data = ARM_TBFLAG_BE_DATA(tb->flags) ? MO_BE : MO_LE;
     dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;
     dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;
-    dc->mmu_idx = ARM_TBFLAG_MMUIDX(tb->flags);
+    dc->mmu_idx = core_to_arm_mmu_idx(env, ARM_TBFLAG_MMUIDX(tb->flags));
     dc->current_el = arm_mmu_idx_to_el(dc->mmu_idx);
 #if !defined(CONFIG_USER_ONLY)
     dc->user = (dc->current_el == 0);
-- 
2.7.4

Make M profile use completely separate ARMMMUIdx values from
those that A profile CPUs use. This is a prelude to adding
support for the MPU and for v8M, which together will require
6 MMU indexes which don't map cleanly onto the A profile
uses:
 non secure User
 non secure Privileged
 non secure Privileged, execution priority < 0
 secure User
 secure Privileged
 secure Privileged, execution priority < 0

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 21 +++++++++++++++++++--
 target/arm/helper.c    |  5 +++++
 target/arm/translate.c |  3 +++
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
  * of the AT/ATS operations.
  * The values used are carefully arranged to make mmu_idx => EL lookup easy.
  */
-#define ARM_MMU_IDX_A 0x10 /* A profile (and M profile, for the moment) */
+#define ARM_MMU_IDX_A 0x10 /* A profile */
 #define ARM_MMU_IDX_NOTLB 0x20 /* does not have a TLB */
+#define ARM_MMU_IDX_M 0x40 /* M profile */
 
 #define ARM_MMU_IDX_TYPE_MASK (~0x7)
 #define ARM_MMU_IDX_COREIDX_MASK 0x7
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_S1SE0 = 4 | ARM_MMU_IDX_A,
     ARMMMUIdx_S1SE1 = 5 | ARM_MMU_IDX_A,
     ARMMMUIdx_S2NS = 6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_MUser = 0 | ARM_MMU_IDX_M,
+    ARMMMUIdx_MPriv = 1 | ARM_MMU_IDX_M,
     /* Indexes below here don't have TLBs and are used only for AT system
      * instructions or for the first stage of an S12 page table walk.
      */
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
     ARMMMUIdxBit_S1SE0 = 1 << 4,
     ARMMMUIdxBit_S1SE1 = 1 << 5,
     ARMMMUIdxBit_S2NS = 1 << 6,
+    ARMMMUIdxBit_MUser = 1 << 0,
+    ARMMMUIdxBit_MPriv = 1 << 1,
 } ARMMMUIdxBit;
 
 #define MMU_USER_IDX 0
@@ -XXX,XX +XXX,XX @@ static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
 
 static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)
 {
-    return mmu_idx | ARM_MMU_IDX_A;
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return mmu_idx | ARM_MMU_IDX_M;
+    } else {
+        return mmu_idx | ARM_MMU_IDX_A;
+    }
 }
 
 /* Return the exception level we're running at if this is our mmu_idx */
@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     switch (mmu_idx & ARM_MMU_IDX_TYPE_MASK) {
     case ARM_MMU_IDX_A:
         return mmu_idx & 3;
+    case ARM_MMU_IDX_M:
+        return mmu_idx & 1;
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
     int el = arm_current_el(env);
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
+
+        return arm_to_core_mmu_idx(mmu_idx);
+    }
+
     if (el < 2 && arm_is_secure_below_el3(env)) {
         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_S1SE1:
     case ARMMMUIdx_S1NSE0:
     case ARMMMUIdx_S1NSE1:
+    case ARMMMUIdx_MPriv:
+    case ARMMMUIdx_MUser:
         return 1;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_S1NSE1:
     case ARMMMUIdx_S1E2:
     case ARMMMUIdx_S2NS:
+    case ARMMMUIdx_MPriv:
+    case ARMMMUIdx_MUser:
         return false;
     case ARMMMUIdx_S1E3:
     case ARMMMUIdx_S1SE0:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
     switch (mmu_idx) {
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1NSE0:
+    case ARMMMUIdx_MUser:
         return true;
     default:
         return false;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
     case ARMMMUIdx_S1SE0:
     case ARMMMUIdx_S1SE1:
         return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0);
+    case ARMMMUIdx_MUser:
+    case ARMMMUIdx_MPriv:
+        return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
     case ARMMMUIdx_S2NS:
     default:
         g_assert_not_reached();
-- 
2.7.4

ARM CPUs come in two flavours:
 * proper MMU ("VMSA")
 * only an MPU ("PMSA")
For PMSA, the MPU may be implemented, or not (in which case there
is default "always acts the same" behaviour, but it isn't guest
programmable).

QEMU is a bit confused about how we indicate this: we have an
ARM_FEATURE_MPU, but it's not clear whether this indicates
"PMSA, not VMSA" or "PMSA and MPU present" , and sometimes we
use it for one purpose and sometimes the other.

Currently trying to implement a PMSA-without-MPU core won't
work correctly because we turn off the ARM_FEATURE_MPU bit
and then a lot of things which should still exist get
turned off too.

As the first step in cleaning this up, rename the feature
bit to ARM_FEATURE_PMSA, which indicates a PMSA CPU (with
or without MPU).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  2 +-
 target/arm/cpu.c     | 12 ++++++------
 target/arm/helper.c  | 12 ++++++------
 target/arm/machine.c |  2 +-
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V6K,
     ARM_FEATURE_V7,
     ARM_FEATURE_THUMB2,
-    ARM_FEATURE_MPU,    /* Only has Memory Protection Unit, not full MMU.  */
+    ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
     ARM_FEATURE_VFP3,
     ARM_FEATURE_VFP_FP16,
     ARM_FEATURE_NEON,
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
-    if (arm_feature(&cpu->env, ARM_FEATURE_MPU)) {
+    if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
         if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 
     if (arm_feature(env, ARM_FEATURE_V7) &&
         !arm_feature(env, ARM_FEATURE_M) &&
-        !arm_feature(env, ARM_FEATURE_MPU)) {
+        !arm_feature(env, ARM_FEATURE_PMSA)) {
         /* v7VMSA drops support for the old ARMv5 tiny pages, so we
          * can use 4K pages.
          */
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!cpu->has_mpu) {
-        unset_feature(env, ARM_FEATURE_MPU);
+        unset_feature(env, ARM_FEATURE_PMSA);
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU) &&
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
         uint32_t nr = cpu->pmsav7_dregion;
 
@@ -XXX,XX +XXX,XX @@ static void arm946_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm946";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_MPU);
+    set_feature(&cpu->env, ARM_FEATURE_PMSA);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     cpu->midr = 0x41059461;
     cpu->ctr = 0x0f004006;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DIV);
     set_feature(&cpu->env, ARM_FEATURE_ARM_DIV);
     set_feature(&cpu->env, ARM_FEATURE_V7MP);
-    set_feature(&cpu->env, ARM_FEATURE_MPU);
+    set_feature(&cpu->env, ARM_FEATURE_PMSA);
     cpu->midr = 0x411fc153; /* r1p3 */
     cpu->id_pfr0 = 0x0131;
     cpu->id_pfr1 = 0x001;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void contextidr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
 
-    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_MPU)
+    if (raw_read(env, ri) != value && !arm_feature(env, ARM_FEATURE_PMSA)
         && !extended_addresses_enabled(env)) {
         /* For VMSA (when not using the LPAE long descriptor page table
          * format) this register includes the ASID, so do a TLB flush.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, v6k_cp_reginfo);
     }
     if (arm_feature(env, ARM_FEATURE_V7MP) &&
-        !arm_feature(env, ARM_FEATURE_MPU)) {
+        !arm_feature(env, ARM_FEATURE_PMSA)) {
         define_arm_cp_regs(cpu, v7mp_cp_reginfo);
     }
     if (arm_feature(env, ARM_FEATURE_V7)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         }
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU)) {
+    if (arm_feature(env, ARM_FEATURE_PMSA)) {
         if (arm_feature(env, ARM_FEATURE_V6)) {
             /* PMSAv6 not implemented */
             assert(arm_feature(env, ARM_FEATURE_V7));
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
         }
         define_arm_cp_regs(cpu, id_cp_reginfo);
-        if (!arm_feature(env, ARM_FEATURE_MPU)) {
+        if (!arm_feature(env, ARM_FEATURE_PMSA)) {
             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
         } else if (arm_feature(env, ARM_FEATURE_V7)) {
             define_one_arm_cp_reg(cpu, &id_mpuir_reginfo);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
     /* pmsav7 has special handling for when MPU is disabled so call it before
      * the common MMU/MPU disabled check below.
      */
-    if (arm_feature(env, ARM_FEATURE_MPU) &&
+    if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
         *page_size = TARGET_PAGE_SIZE;
         return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
         return 0;
     }
 
-    if (arm_feature(env, ARM_FEATURE_MPU)) {
+    if (arm_feature(env, ARM_FEATURE_PMSA)) {
         /* Pre-v7 MPU */
         *page_size = TARGET_PAGE_SIZE;
         return get_phys_addr_pmsav5(env, address, access_type, mmu_idx,
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool pmsav7_needed(void *opaque)
     ARMCPU *cpu = opaque;
     CPUARMState *env = &cpu->env;
 
-    return arm_feature(env, ARM_FEATURE_MPU) &&
+    return arm_feature(env, ARM_FEATURE_PMSA) &&
            arm_feature(env, ARM_FEATURE_V7);
 }
 
-- 
2.7.4

Fix the handling of QOM properties for PMSA CPUs with no MPU:

Allow no-MPU to be specified by either:
 * has-mpu = false
 * pmsav7_dregion = 0
and make setting one imply the other. Don't clear the PMSA
feature bit in this situation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->id_pfr1 &= ~0xf000;
     }
 
+    /* MPU can be configured out of a PMSA CPU either by setting has-mpu
+     * to false or by setting pmsav7-dregion to 0.
+     */
     if (!cpu->has_mpu) {
-        unset_feature(env, ARM_FEATURE_PMSA);
+        cpu->pmsav7_dregion = 0;
+    }
+    if (cpu->pmsav7_dregion == 0) {
+        cpu->has_mpu = false;
     }
 
     if (arm_feature(env, ARM_FEATURE_PMSA) &&
-- 
2.7.4

If the CPU is a PMSA config with no MPU implemented, then the
SCTLR.M bit should be RAZ/WI, so that the guest can never
turn on the non-existent MPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_PMSA) && !cpu->has_mpu) {
+        /* M bit is RAZ/WI for PMSA with no MPU implemented */
+        value &= ~SCTLR_M;
+    }
+
     raw_write(env, ri, value);
     /* ??? Lots of these bits are not implemented.  */
     /* This may enable/disable the MMU, so do a TLB flush.  */
-- 
2.7.4

Now that we enforce both:
 * pmsav7_dregion == 0 implies has_mpu == false
 * PMSA with has_mpu == false means SCTLR.M cannot be set
we can remove a check on pmsav7_dregion from get_phys_addr_pmsav7(),
because we can only reach this code path if the MPU is enabled
(and so region_translation_disabled() returned false).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
         }
 
         if (n == -1) { /* no hits */
-            if (cpu->pmsav7_dregion &&
-                (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR))) {
+            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
                 /* background fault */
                 *fsr = 0;
                 return true;
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Improve the "-d mmu" tracing for the PMSAv7 MPU translation
process as an aid in debugging guest MPU configurations:
 * fix a missing newline for a guest-error log
 * report the region number with guest-error or unimp
   logs of bad region register values
 * add a log message for the overall result of the lookup
 * print "0x" prefix for hex values

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-9-git-send-email-peter.maydell@linaro.org
[PMM: a little tidyup, report region number in all messages
 rather than just one]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 39 +++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
             }
 
             if (!rsize) {
-                qemu_log_mask(LOG_GUEST_ERROR, "DRSR.Rsize field can not be 0");
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "DRSR[%d]: Rsize field cannot be 0\n", n);
                 continue;
             }
             rsize++;
             rmask = (1ull << rsize) - 1;
 
             if (base & rmask) {
-                qemu_log_mask(LOG_GUEST_ERROR, "DRBAR %" PRIx32 " misaligned "
-                              "to DRSR region size, mask = %" PRIx32,
-                              base, rmask);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "DRBAR[%d]: 0x%" PRIx32 " misaligned "
+                              "to DRSR region size, mask = 0x%" PRIx32 "\n",
+                              n, base, rmask);
                 continue;
             }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                 }
             }
             if (rsize < TARGET_PAGE_BITS) {
-                qemu_log_mask(LOG_UNIMP, "No support for MPU (sub)region"
+                qemu_log_mask(LOG_UNIMP,
+                              "DRSR[%d]: No support for MPU (sub)region "
                               "alignment of %" PRIu32 " bits. Minimum is %d\n",
-                              rsize, TARGET_PAGE_BITS);
+                              n, rsize, TARGET_PAGE_BITS);
                 continue;
             }
             if (srdis) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                     break;
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
-                                  "Bad value for AP bits in DRACR %"
-                                  PRIx32 "\n", ap);
+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
+                                  PRIx32 "\n", n, ap);
                 }
             } else { /* Priv. mode AP bits decoding */
                 switch (ap) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                     break;
                 default:
                     qemu_log_mask(LOG_GUEST_ERROR,
-                                  "Bad value for AP bits in DRACR %"
-                                  PRIx32 "\n", ap);
+                                  "DRACR[%d]: Bad value for AP bits: 0x%"
+                                  PRIx32 "\n", n, ap);
                 }
             }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
      */
     if (arm_feature(env, ARM_FEATURE_PMSA) &&
         arm_feature(env, ARM_FEATURE_V7)) {
+        bool ret;
         *page_size = TARGET_PAGE_SIZE;
-        return get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-                                    phys_ptr, prot, fsr);
+        ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
+                                   phys_ptr, prot, fsr);
+        qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32
+                      " mmu_idx %u -> %s (prot %c%c%c)\n",
+                      access_type == 1 ? "reading" :
+                      (access_type == 2 ? "writing" : "execute"),
+                      (uint32_t)address, mmu_idx,
+                      ret ? "Miss" : "Hit",
+                      *prot & PAGE_READ ? 'r' : '-',
+                      *prot & PAGE_WRITE ? 'w' : '-',
+                      *prot & PAGE_EXEC ? 'x' : '-');
+
+        return ret;
     }
 
     if (regime_translation_disabled(env, mmu_idx)) {
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

Add support for the M profile default memory map which is used
if the MPU is not present or disabled.

The main differences in behaviour from implementing this
correctly are that we set the PAGE_EXEC attribute on
the right regions of memory, such that device regions
are not executable.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-10-git-send-email-peter.maydell@linaro.org
[PMM: rephrased comment and commit message; don't mark
 the flash memory region as not-writable; list all
 the cases in the default map explicitly rather than
 using a 'default' case for the non-executable regions]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 41 ++++++++++++++++++++++++++++++++---------
 1 file changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx,
                                                 int32_t address, int *prot)
 {
-    *prot = PAGE_READ | PAGE_WRITE;
-    switch (address) {
-    case 0xF0000000 ... 0xFFFFFFFF:
-        if (regime_sctlr(env, mmu_idx) & SCTLR_V) { /* hivecs execing is ok */
+    if (!arm_feature(env, ARM_FEATURE_M)) {
+        *prot = PAGE_READ | PAGE_WRITE;
+        switch (address) {
+        case 0xF0000000 ... 0xFFFFFFFF:
+            if (regime_sctlr(env, mmu_idx) & SCTLR_V) {
+                /* hivecs execing is ok */
+                *prot |= PAGE_EXEC;
+            }
+            break;
+        case 0x00000000 ... 0x7FFFFFFF:
             *prot |= PAGE_EXEC;
+            break;
+        }
+    } else {
+        /* Default system address map for M profile cores.
+         * The architecture specifies which regions are execute-never;
+         * at the MPU level no other checks are defined.
+         */
+        switch (address) {
+        case 0x00000000 ... 0x1fffffff: /* ROM */
+        case 0x20000000 ... 0x3fffffff: /* SRAM */
+        case 0x60000000 ... 0x7fffffff: /* RAM */
+        case 0x80000000 ... 0x9fffffff: /* RAM */
+            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            break;
+        case 0x40000000 ... 0x5fffffff: /* Peripheral */
+        case 0xa0000000 ... 0xbfffffff: /* Device */
+        case 0xc0000000 ... 0xdfffffff: /* Device */
+        case 0xe0000000 ... 0xffffffff: /* System */
+            *prot = PAGE_READ | PAGE_WRITE;
+            break;
+        default:
+            g_assert_not_reached();
         }
-        break;
-    case 0x00000000 ... 0x7FFFFFFF:
-        *prot |= PAGE_EXEC;
-        break;
     }
-
 }
 
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
-- 
2.7.4

All M profile CPUs are PMSA, so set the feature bit.
(We haven't actually implemented the M profile MPU register
interface yet, but setting this feature bit gives us closer
to correct behaviour for the MPU-disabled case.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1493122030-32191-11-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_post_init(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
+    /* M profile implies PMSA. We have to do this here rather than
+     * in realize with the other feature-implication checks because
+     * we look at the PMSA bit to see if we should add some properties.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+        set_feature(&cpu->env, ARM_FEATURE_PMSA);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_reset_cbar_property,
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

General logic is that operations stopped by the MPU are MemManage,
and those which go through the MPU and are caught by the unassigned
handle are BusFault. Distinguish these by looking at the
exception.fsr values, and set the CFSR bits and (if appropriate)
fill in the BFAR or MMFAR with the exception address.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-12-git-send-email-peter.maydell@linaro.org
[PMM: i-side faults do not set BFAR/MMFAR, only d-side;
 added some CPU_LOG_INT logging]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 target/arm/helper.c | 45 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 42 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         break;
     case EXCP_PREFETCH_ABORT:
     case EXCP_DATA_ABORT:
-        /* TODO: if we implemented the MPU registers, this is where we
-         * should set the MMFAR, etc from exception.fsr and exception.vaddress.
+        /* Note that for M profile we don't have a guest facing FSR, but
+         * the env->exception.fsr will be populated by the code that
+         * raises the fault, in the A profile short-descriptor format.
          */
-        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
+        switch (env->exception.fsr & 0xf) {
+        case 0x8: /* External Abort */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                env->v7m.cfsr |= R_V7M_CFSR_PRECISERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                break;
+            case EXCP_DATA_ABORT:
+                env->v7m.cfsr |=
+                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                env->v7m.bfar = env->exception.vaddress;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              env->v7m.bfar);
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS);
+            break;
+        default:
+            /* All other FSR values are either MPU faults or "can't happen
+             * for M profile" cases.
+             */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                env->v7m.cfsr |= R_V7M_CFSR_IACCVIOL_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IACCVIOL\n");
+                break;
+            case EXCP_DATA_ABORT:
+                env->v7m.cfsr |=
+                    (R_V7M_CFSR_DACCVIOL_MASK | R_V7M_CFSR_MMARVALID_MASK);
+                env->v7m.mmfar = env->exception.vaddress;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...with CFSR.DACCVIOL and MMFAR 0x%x\n",
+                              env->v7m.mmfar);
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM);
+            break;
+        }
         break;
     case EXCP_BKPT:
         if (semihosting_enabled()) {
-- 
2.7.4

From: Michael Davidsaver <mdavidsaver@gmail.com>

The M series MPU is almost the same as the already implemented R
profile MPU (v7 PMSA).  So all we need to implement here is the MPU
register interface in the system register space.

This implementation has the same restriction as the R profile MPU
that it doesn't permit regions to be sized down smaller than 1K.

We also do not yet implement support for MPU_CTRL.HFNMIENA; this
bit should if zero disable use of the MPU when running HardFault,
NMI or with FAULTMASK set to 1 (ie at an execution priority of
less than zero) -- if the MPU is enabled we don't treat these
cases any differently.

Signed-off-by: Michael Davidsaver <mdavidsaver@gmail.com>
Message-id: 1493122030-32191-13-git-send-email-peter.maydell@linaro.org
[PMM: Keep all the bits in mpu_ctrl field, rather than
 using SCTLR bits for them; drop broken HFNMIENA support;
 various cleanup]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h      |   6 +++
 hw/intc/armv7m_nvic.c | 104 ++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/helper.c   |  25 +++++++++++-
 target/arm/machine.c  |   5 ++-
 4 files changed, 137 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t dfsr; /* Debug Fault Status Register */
         uint32_t mmfar; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
+        unsigned mpu_ctrl; /* MPU_CTRL (some bits kept in sctlr_el[1]) */
         int exception;
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
 FIELD(V7M_DFSR, VCATCH, 3, 1)
 FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 
+/* v7M MPU_CTRL bits */
+FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
+FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
+FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
+
 /* If adding a feature bit which corresponds to a Linux ELF
  * HWCAP bit, remember to update the feature-bit-to-hwcap
  * mapping in linux-user/elfload.c:get_elf_hwcap().
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/arm.h"
 #include "hw/arm/armv7m_nvic.h"
 #include "target/arm/cpu.h"
+#include "exec/exec-all.h"
 #include "qemu/log.h"
 #include "trace.h"
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset)
     case 0xd70: /* ISAR4.  */
         return 0x01310102;
     /* TODO: Implement debug registers.  */
+    case 0xd90: /* MPU_TYPE */
+        /* Unified MPU; if the MPU is not present this value is zero */
+        return cpu->pmsav7_dregion << 8;
+        break;
+    case 0xd94: /* MPU_CTRL */
+        return cpu->env.v7m.mpu_ctrl;
+    case 0xd98: /* MPU_RNR */
+        return cpu->env.cp15.c6_rgnr;
+    case 0xd9c: /* MPU_RBAR */
+    case 0xda4: /* MPU_RBAR_A1 */
+    case 0xdac: /* MPU_RBAR_A2 */
+    case 0xdb4: /* MPU_RBAR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return 0;
+        }
+        return (cpu->env.pmsav7.drbar[region] & 0x1f) | (region & 0xf);
+    }
+    case 0xda0: /* MPU_RASR */
+    case 0xda8: /* MPU_RASR_A1 */
+    case 0xdb0: /* MPU_RASR_A2 */
+    case 0xdb8: /* MPU_RASR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return 0;
+        }
+        return ((cpu->env.pmsav7.dracr[region] & 0xffff) << 16) |
+            (cpu->env.pmsav7.drsr[region] & 0xffff);
+    }
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
         return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value)
         qemu_log_mask(LOG_UNIMP,
                       "NVIC: Aux fault status registers unimplemented\n");
         break;
+    case 0xd90: /* MPU_TYPE */
+        return; /* RO */
+    case 0xd94: /* MPU_CTRL */
+        if ((value &
+             (R_V7M_MPU_CTRL_HFNMIENA_MASK | R_V7M_MPU_CTRL_ENABLE_MASK))
+            == R_V7M_MPU_CTRL_HFNMIENA_MASK) {
+            qemu_log_mask(LOG_GUEST_ERROR, "MPU_CTRL: HFNMIENA and !ENABLE is "
+                          "UNPREDICTABLE\n");
+        }
+        cpu->env.v7m.mpu_ctrl = value & (R_V7M_MPU_CTRL_ENABLE_MASK |
+                                         R_V7M_MPU_CTRL_HFNMIENA_MASK |
+                                         R_V7M_MPU_CTRL_PRIVDEFENA_MASK);
+        tlb_flush(CPU(cpu));
+        break;
+    case 0xd98: /* MPU_RNR */
+        if (value >= cpu->pmsav7_dregion) {
+            qemu_log_mask(LOG_GUEST_ERROR, "MPU region out of range %"
+                          PRIu32 "/%" PRIu32 "\n",
+                          value, cpu->pmsav7_dregion);
+        } else {
+            cpu->env.cp15.c6_rgnr = value;
+        }
+        break;
+    case 0xd9c: /* MPU_RBAR */
+    case 0xda4: /* MPU_RBAR_A1 */
+    case 0xdac: /* MPU_RBAR_A2 */
+    case 0xdb4: /* MPU_RBAR_A3 */
+    {
+        int region;
+
+        if (value & (1 << 4)) {
+            /* VALID bit means use the region number specified in this
+             * value and also update MPU_RNR.REGION with that value.
+             */
+            region = extract32(value, 0, 4);
+            if (region >= cpu->pmsav7_dregion) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "MPU region out of range %u/%" PRIu32 "\n",
+                              region, cpu->pmsav7_dregion);
+                return;
+            }
+            cpu->env.cp15.c6_rgnr = region;
+        } else {
+            region = cpu->env.cp15.c6_rgnr;
+        }
+
+        if (region >= cpu->pmsav7_dregion) {
+            return;
+        }
+
+        cpu->env.pmsav7.drbar[region] = value & ~0x1f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
+    case 0xda0: /* MPU_RASR */
+    case 0xda8: /* MPU_RASR_A1 */
+    case 0xdb0: /* MPU_RASR_A2 */
+    case 0xdb8: /* MPU_RASR_A3 */
+    {
+        int region = cpu->env.cp15.c6_rgnr;
+
+        if (region >= cpu->pmsav7_dregion) {
+            return;
+        }
+
+        cpu->env.pmsav7.drsr[region] = value & 0xff3f;
+        cpu->env.pmsav7.dracr[region] = (value >> 16) & 0x173f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
     case 0xf00: /* Software Triggered Interrupt Register */
     {
         /* user mode can only write to STIR if CCR.USERSETMPEND permits it */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline bool regime_translation_disabled(CPUARMState *env,
                                                ARMMMUIdx mmu_idx)
 {
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return !(env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_ENABLE_MASK);
+    }
+
     if (mmu_idx == ARMMMUIdx_S2NS) {
         return (env->cp15.hcr_el2 & HCR_VM) == 0;
     }
@@ -XXX,XX +XXX,XX @@ static inline void get_phys_addr_pmsav7_default(CPUARMState *env,
     }
 }
 
+static bool pmsav7_use_background_region(ARMCPU *cpu,
+                                         ARMMMUIdx mmu_idx, bool is_user)
+{
+    /* Return true if we should use the default memory map as a
+     * "background" region if there are no hits against any MPU regions.
+     */
+    CPUARMState *env = &cpu->env;
+
+    if (is_user) {
+        return false;
+    }
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return env->v7m.mpu_ctrl & R_V7M_MPU_CTRL_PRIVDEFENA_MASK;
+    } else {
+        return regime_sctlr(env, mmu_idx) & SCTLR_BR;
+    }
+}
+
 static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
                                  int access_type, ARMMMUIdx mmu_idx,
                                  hwaddr *phys_ptr, int *prot, uint32_t *fsr)
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
         }
 
         if (n == -1) { /* no hits */
-            if (is_user || !(regime_sctlr(env, mmu_idx) & SCTLR_BR)) {
+            if (!pmsav7_use_background_region(cpu, mmu_idx, is_user)) {
                 /* background fault */
                 *fsr = 0;
                 return true;
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool m_needed(void *opaque)
 
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
-    .version_id = 3,
-    .minimum_version_id = 3,
+    .version_id = 4,
+    .minimum_version_id = 4,
     .needed = m_needed,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(env.v7m.vecbase, ARMCPU),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
         VMSTATE_UINT32(env.v7m.dfsr, ARMCPU),
         VMSTATE_UINT32(env.v7m.mmfar, ARMCPU),
         VMSTATE_UINT32(env.v7m.bfar, ARMCPU),
+        VMSTATE_UINT32(env.v7m.mpu_ctrl, ARMCPU),
         VMSTATE_INT32(env.v7m.exception, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
-- 
2.7.4

Implement HFNMIENA support for the M profile MPU. This bit controls
whether the MPU is treated as enabled when executing at execution
priorities of less than zero (in NMI, HardFault or with the FAULTMASK
bit set).

Doing this requires us to use a different MMU index for "running
at execution priority < 0", because we will have different
access permissions for that case versus the normal case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1493122030-32191-14-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 24 +++++++++++++++++++++++-
 target/arm/helper.c    | 18 +++++++++++++++++-
 target/arm/translate.c |  1 +
 3 files changed, 41 insertions(+), 2 deletions(-)

From: Cédric Le Goater <clg@kaod.org>

Multiple I2C commands can be fired simultaneously and the controller
execute the commands following these priorities:

(1) Master Start Command
  (2) Master Transmit Command
  (3) Slave Transmit Command or Master Receive Command
  (4) Master Stop Command

The current code is incorrect with respect to the above sequence and
needs to be reworked to handle each individual command.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-2-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
 
 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 {
+    bus->cmd &= ~0xFFFF;
     bus->cmd |= value & 0xFFFF;
     bus->intr_status = 0;
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
 
-    } else if (bus->cmd & I2CD_M_TX_CMD) {
+        /* START command is also a TX command, as the slave address is
+         * sent on the bus */
+        bus->cmd &= ~(I2CD_M_START_CMD | I2CD_M_TX_CMD);
+
+        /* No slave found */
+        if (!i2c_bus_busy(bus->bus)) {
+            return;
+        }
+    }
+
+    if (bus->cmd & I2CD_M_TX_CMD) {
         if (i2c_send(bus->bus, bus->buf)) {
             bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
             i2c_end_transfer(bus->bus);
         } else {
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
+        bus->cmd &= ~I2CD_M_TX_CMD;
+    }
 
-    } else if (bus->cmd & I2CD_M_RX_CMD) {
+    if (bus->cmd & I2CD_M_RX_CMD) {
         int ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_RX_DONE;
         }
         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
+        bus->cmd &= ~I2CD_M_RX_CMD;
     }
 
     if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             i2c_end_transfer(bus->bus);
             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
         }
+        bus->cmd &= ~I2CD_M_STOP_CMD;
     }
-
-    /* command is handled, reset it and check for interrupts  */
-    bus->cmd &= ~0xFFFF;
-    aspeed_i2c_bus_raise_interrupt(bus);
 }
 
 static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_write(void *opaque, hwaddr offset,
         }
 
         aspeed_i2c_bus_handle_cmd(bus, value);
+        aspeed_i2c_bus_raise_interrupt(bus);
         break;
 
     default:
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Today, the LAST command is handled with the STOP command but this is
incorrect. Also nack the I2C bus when a LAST is issued.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-3-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         bus->cmd &= ~I2CD_M_TX_CMD;
     }
 
-    if (bus->cmd & I2CD_M_RX_CMD) {
+    if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
         int ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             bus->intr_status |= I2CD_INTR_RX_DONE;
         }
         bus->buf = (ret & I2CD_BYTE_BUF_RX_MASK) << I2CD_BYTE_BUF_RX_SHIFT;
-        bus->cmd &= ~I2CD_M_RX_CMD;
+        if (bus->cmd & I2CD_M_S_RX_CMD_LAST) {
+            i2c_nack(bus->bus);
+        }
+        bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
     }
 
-    if (bus->cmd & (I2CD_M_STOP_CMD | I2CD_M_S_RX_CMD_LAST)) {
+    if (bus->cmd & I2CD_M_STOP_CMD) {
         if (!i2c_bus_busy(bus->bus)) {
             bus->intr_status |= I2CD_INTR_ABNORMAL;
         } else {
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

The Aspeed I2C controller maintains a state machine in the command
register, which is mostly used for debug.

Let's start adding a few states to handle abnormal STOP
commands. Today, the model uses the busy status of the bus as a
condition to do so but it is not precise enough.

Also remove the ABNORMAL bit for failing TX commands. This is
incorrect with respect to the specs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-4-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/aspeed_i2c.c | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_i2c_bus_read(void *opaque, hwaddr offset,
     }
 }
 
+static void aspeed_i2c_set_state(AspeedI2CBus *bus, uint8_t state)
+{
+    bus->cmd &= ~(I2CD_TX_STATE_MASK << I2CD_TX_STATE_SHIFT);
+    bus->cmd |= (state & I2CD_TX_STATE_MASK) << I2CD_TX_STATE_SHIFT;
+}
+
+static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
+{
+    return (bus->cmd >> I2CD_TX_STATE_SHIFT) & I2CD_TX_STATE_MASK;
+}
+
+/*
+ * The state machine needs some refinement. It is only used to track
+ * invalid STOP commands for the moment.
+ */
 static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
 {
     bus->cmd &= ~0xFFFF;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
     bus->intr_status = 0;
 
     if (bus->cmd & I2CD_M_START_CMD) {
+        uint8_t state = aspeed_i2c_get_state(bus) & I2CD_MACTIVE ?
+            I2CD_MSTARTR : I2CD_MSTART;
+
+        aspeed_i2c_set_state(bus, state);
+
         if (i2c_start_transfer(bus->bus, extract32(bus->buf, 1, 7),
                                extract32(bus->buf, 0, 1))) {
             bus->intr_status |= I2CD_INTR_TX_NAK;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
         if (!i2c_bus_busy(bus->bus)) {
             return;
         }
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & I2CD_M_TX_CMD) {
+        aspeed_i2c_set_state(bus, I2CD_MTXD);
         if (i2c_send(bus->bus, bus->buf)) {
-            bus->intr_status |= (I2CD_INTR_TX_NAK | I2CD_INTR_ABNORMAL);
+            bus->intr_status |= (I2CD_INTR_TX_NAK);
             i2c_end_transfer(bus->bus);
         } else {
             bus->intr_status |= I2CD_INTR_TX_ACK;
         }
         bus->cmd &= ~I2CD_M_TX_CMD;
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & (I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST)) {
-        int ret = i2c_recv(bus->bus);
+        int ret;
+
+        aspeed_i2c_set_state(bus, I2CD_MRXD);
+        ret = i2c_recv(bus->bus);
         if (ret < 0) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: read failed\n", __func__);
             ret = 0xff;
@@ -XXX,XX +XXX,XX @@ static void aspeed_i2c_bus_handle_cmd(AspeedI2CBus *bus, uint64_t value)
             i2c_nack(bus->bus);
         }
         bus->cmd &= ~(I2CD_M_RX_CMD | I2CD_M_S_RX_CMD_LAST);
+        aspeed_i2c_set_state(bus, I2CD_MACTIVE);
     }
 
     if (bus->cmd & I2CD_M_STOP_CMD) {
-        if (!i2c_bus_busy(bus->bus)) {
+        if (!(aspeed_i2c_get_state(bus) & I2CD_MACTIVE)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: abnormal stop\n", __func__);
             bus->intr_status |= I2CD_INTR_ABNORMAL;
         } else {
+            aspeed_i2c_set_state(bus, I2CD_MSTOP);
             i2c_end_transfer(bus->bus);
             bus->intr_status |= I2CD_INTR_NORMAL_STOP;
         }
         bus->cmd &= ~I2CD_M_STOP_CMD;
+        aspeed_i2c_set_state(bus, I2CD_IDLE);
     }
 }
 
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Let's add an RTC to the palmetto BMC and a LM75 temperature sensor to
the AST2500 EVB to start with.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-5-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
     const char *fmc_model;
     const char *spi_model;
     uint32_t num_cs;
+    void (*i2c_init)(AspeedBoardState *bmc);
 } AspeedBoardConfig;
 
 enum {
@@ -XXX,XX +XXX,XX @@ enum {
         SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
         SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 
+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
+static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
+
 static const AspeedBoardConfig aspeed_boards[] = {
     [PALMETTO_BMC] = {
         .soc_name  = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .fmc_model = "n25q256a",
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
+        .i2c_init  = palmetto_bmc_i2c_init,
     },
     [AST2500_EVB]  = {
         .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .fmc_model = "n25q256a",
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
+        .i2c_init  = ast2500_evb_i2c_init,
     },
     [ROMULUS_BMC]  = {
         .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
     aspeed_board_binfo.ram_size = ram_size;
     aspeed_board_binfo.loader_start = sc->info->sdram_base;
 
+    if (cfg->i2c_init) {
+        cfg->i2c_init(bmc);
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), &aspeed_board_binfo);
 }
 
+static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* The palmetto platform expects a ds3231 RTC but a ds1338 is
+     * enough to provide basic RTC features. Alarms will be missing */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+}
+
 static void palmetto_bmc_init(MachineState *machine)
 {
     aspeed_board_init(machine, &aspeed_boards[PALMETTO_BMC]);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
     .class_init = palmetto_bmc_class_init,
 };
 
+static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
+}
+
 static void ast2500_evb_init(MachineState *machine)
 {
     aspeed_board_init(machine, &aspeed_boards[AST2500_EVB]);
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Largely inspired by the TMP105 temperature sensor, here is a model for
the TMP42{1,2,3} temperature sensors.

Specs can be found here :

http://www.ti.com/lit/gpn/tmp421

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-6-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 hw/misc/tmp421.c                | 401 ++++++++++++++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak |   1 +
 3 files changed, 403 insertions(+)
 create mode 100644 hw/misc/tmp421.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@
 common-obj-$(CONFIG_APPLESMC) += applesmc.o
 common-obj-$(CONFIG_MAX111X) += max111x.o
 common-obj-$(CONFIG_TMP105) += tmp105.o
+common-obj-$(CONFIG_TMP421) += tmp421.o
 common-obj-$(CONFIG_ISA_DEBUG) += debugexit.o
 common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
diff --git a/hw/misc/tmp421.c b/hw/misc/tmp421.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/tmp421.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Texas Instruments TMP421 temperature sensor.
+ *
+ * Copyright (c) 2016 IBM Corporation.
+ *
+ * Largely inspired by :
+ *
+ * Texas Instruments TMP105 temperature sensor.
+ *
+ * Copyright (C) 2008 Nokia Corporation
+ * Written by Andrzej Zaborowski <andrew@openedhand.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/hw.h"
+#include "hw/i2c/i2c.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+
+/* Manufacturer / Device ID's */
+#define TMP421_MANUFACTURER_ID          0x55
+#define TMP421_DEVICE_ID                0x21
+#define TMP422_DEVICE_ID                0x22
+#define TMP423_DEVICE_ID                0x23
+
+typedef struct DeviceInfo {
+    int model;
+    const char *name;
+} DeviceInfo;
+
+static const DeviceInfo devices[] = {
+    { TMP421_DEVICE_ID, "tmp421" },
+    { TMP422_DEVICE_ID, "tmp422" },
+    { TMP423_DEVICE_ID, "tmp423" },
+};
+
+typedef struct TMP421State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    int16_t temperature[4];
+
+    uint8_t status;
+    uint8_t config[2];
+    uint8_t rate;
+
+    uint8_t len;
+    uint8_t buf[2];
+    uint8_t pointer;
+
+} TMP421State;
+
+typedef struct TMP421Class {
+    I2CSlaveClass parent_class;
+    DeviceInfo *dev;
+} TMP421Class;
+
+#define TYPE_TMP421 "tmp421-generic"
+#define TMP421(obj) OBJECT_CHECK(TMP421State, (obj), TYPE_TMP421)
+
+#define TMP421_CLASS(klass) \
+     OBJECT_CLASS_CHECK(TMP421Class, (klass), TYPE_TMP421)
+#define TMP421_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(TMP421Class, (obj), TYPE_TMP421)
+
+/* the TMP421 registers */
+#define TMP421_STATUS_REG               0x08
+#define    TMP421_STATUS_BUSY             (1 << 7)
+#define TMP421_CONFIG_REG_1             0x09
+#define    TMP421_CONFIG_RANGE            (1 << 2)
+#define    TMP421_CONFIG_SHUTDOWN         (1 << 6)
+#define TMP421_CONFIG_REG_2             0x0A
+#define    TMP421_CONFIG_RC               (1 << 2)
+#define    TMP421_CONFIG_LEN              (1 << 3)
+#define    TMP421_CONFIG_REN              (1 << 4)
+#define    TMP421_CONFIG_REN2             (1 << 5)
+#define    TMP421_CONFIG_REN3             (1 << 6)
+
+#define TMP421_CONVERSION_RATE_REG      0x0B
+#define TMP421_ONE_SHOT                 0x0F
+
+#define TMP421_RESET                    0xFC
+#define TMP421_MANUFACTURER_ID_REG      0xFE
+#define TMP421_DEVICE_ID_REG            0xFF
+
+#define TMP421_TEMP_MSB0                0x00
+#define TMP421_TEMP_MSB1                0x01
+#define TMP421_TEMP_MSB2                0x02
+#define TMP421_TEMP_MSB3                0x03
+#define TMP421_TEMP_LSB0                0x10
+#define TMP421_TEMP_LSB1                0x11
+#define TMP421_TEMP_LSB2                0x12
+#define TMP421_TEMP_LSB3                0x13
+
+static const int32_t mins[2] = { -40000, -55000 };
+static const int32_t maxs[2] = { 127000, 150000 };
+
+static void tmp421_get_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int64_t value;
+    int tempid;
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    value = ((s->temperature[tempid] - offset) * 1000 + 128) / 256;
+
+    visit_type_int(v, name, &value, errp);
+}
+
+/* Units are 0.001 centigrades relative to 0 C.  s->temperature is 8.8
+ * fixed point, so units are 1/256 centigrades.  A simple ratio will do.
+ */
+static void tmp421_set_temperature(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
+{
+    TMP421State *s = TMP421(obj);
+    Error *local_err = NULL;
+    int64_t temp;
+    bool ext_range = (s->config[0] & TMP421_CONFIG_RANGE);
+    int offset = ext_range * 64 * 256;
+    int tempid;
+
+    visit_type_int(v, name, &temp, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    if (temp >= maxs[ext_range] || temp < mins[ext_range]) {
+        error_setg(errp, "value %" PRId64 ".%03" PRIu64 " °C is out of range",
+                   temp / 1000, temp % 1000);
+        return;
+    }
+
+    if (sscanf(name, "temperature%d", &tempid) != 1) {
+        error_setg(errp, "error reading %s: %m", name);
+        return;
+    }
+
+    if (tempid >= 4 || tempid < 0) {
+        error_setg(errp, "error reading %s", name);
+        return;
+    }
+
+    s->temperature[tempid] = (int16_t) ((temp * 256 - 128) / 1000) + offset;
+}
+
+static void tmp421_read(TMP421State *s)
+{
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    s->len = 0;
+
+    switch (s->pointer) {
+    case TMP421_MANUFACTURER_ID_REG:
+        s->buf[s->len++] = TMP421_MANUFACTURER_ID;
+        break;
+    case TMP421_DEVICE_ID_REG:
+        s->buf[s->len++] = sc->dev->model;
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->buf[s->len++] = s->config[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->buf[s->len++] = s->config[1];
+        break;
+    case TMP421_CONVERSION_RATE_REG:
+        s->buf[s->len++] = s->rate;
+        break;
+    case TMP421_STATUS_REG:
+        s->buf[s->len++] = s->status;
+        break;
+
+        /* FIXME: check for channel enablement in config registers */
+    case TMP421_TEMP_MSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_MSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 8);
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB0:
+        s->buf[s->len++] = (((uint16_t) s->temperature[0]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB1:
+        s->buf[s->len++] = (((uint16_t) s->temperature[1]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB2:
+        s->buf[s->len++] = (((uint16_t) s->temperature[2]) >> 0) & 0xf0;
+        break;
+    case TMP421_TEMP_LSB3:
+        s->buf[s->len++] = (((uint16_t) s->temperature[3]) >> 0) & 0xf0;
+        break;
+    }
+}
+
+static void tmp421_reset(I2CSlave *i2c);
+
+static void tmp421_write(TMP421State *s)
+{
+    switch (s->pointer) {
+    case TMP421_CONVERSION_RATE_REG:
+        s->rate = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_1:
+        s->config[0] = s->buf[0];
+        break;
+    case TMP421_CONFIG_REG_2:
+        s->config[1] = s->buf[0];
+        break;
+    case TMP421_RESET:
+        tmp421_reset(I2C_SLAVE(s));
+        break;
+    }
+}
+
+static int tmp421_rx(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len < 2) {
+        return s->buf[s->len++];
+    } else {
+        return 0xff;
+    }
+}
+
+static int tmp421_tx(I2CSlave *i2c, uint8_t data)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (s->len == 0) {
+        /* first byte is the register pointer for a read or write
+         * operation */
+        s->pointer = data;
+        s->len++;
+    } else if (s->len == 1) {
+        /* second byte is the data to write. The device only supports
+         * one byte writes */
+        s->buf[0] = data;
+        tmp421_write(s);
+    }
+
+    return 0;
+}
+
+static int tmp421_event(I2CSlave *i2c, enum i2c_event event)
+{
+    TMP421State *s = TMP421(i2c);
+
+    if (event == I2C_START_RECV) {
+        tmp421_read(s);
+    }
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription vmstate_tmp421 = {
+    .name = "TMP421",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, TMP421State),
+        VMSTATE_UINT8_ARRAY(buf, TMP421State, 2),
+        VMSTATE_UINT8(pointer, TMP421State),
+        VMSTATE_UINT8_ARRAY(config, TMP421State, 2),
+        VMSTATE_UINT8(status, TMP421State),
+        VMSTATE_UINT8(rate, TMP421State),
+        VMSTATE_INT16_ARRAY(temperature, TMP421State, 4),
+        VMSTATE_I2C_SLAVE(i2c, TMP421State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tmp421_reset(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+    TMP421Class *sc = TMP421_GET_CLASS(s);
+
+    memset(s->temperature, 0, sizeof(s->temperature));
+    s->pointer = 0;
+
+    s->config[0] = 0; /* TMP421_CONFIG_RANGE */
+
+     /* resistance correction and channel enablement */
+    switch (sc->dev->model) {
+    case TMP421_DEVICE_ID:
+        s->config[1] = 0x1c;
+        break;
+    case TMP422_DEVICE_ID:
+        s->config[1] = 0x3c;
+        break;
+    case TMP423_DEVICE_ID:
+        s->config[1] = 0x7c;
+        break;
+    }
+
+    s->rate = 0x7;       /* 8Hz */
+    s->status = 0;
+}
+
+static int tmp421_init(I2CSlave *i2c)
+{
+    TMP421State *s = TMP421(i2c);
+
+    tmp421_reset(&s->i2c);
+
+    return 0;
+}
+
+static void tmp421_initfn(Object *obj)
+{
+    object_property_add(obj, "temperature0", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature1", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature2", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+    object_property_add(obj, "temperature3", "int",
+                        tmp421_get_temperature,
+                        tmp421_set_temperature, NULL, NULL, NULL);
+}
+
+static void tmp421_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    TMP421Class *sc = TMP421_CLASS(klass);
+
+    k->init = tmp421_init;
+    k->event = tmp421_event;
+    k->recv = tmp421_rx;
+    k->send = tmp421_tx;
+    dc->vmsd = &vmstate_tmp421;
+    sc->dev = (DeviceInfo *) data;
+}
+
+static const TypeInfo tmp421_info = {
+    .name          = TYPE_TMP421,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_size = sizeof(TMP421State),
+    .instance_init = tmp421_initfn,
+    .class_init    = tmp421_class_init,
+};
+
+static void tmp421_register_types(void)
+{
+    int i;
+
+    type_register_static(&tmp421_info);
+    for (i = 0; i < ARRAY_SIZE(devices); ++i) {
+        TypeInfo ti = {
+            .name       = devices[i].name,
+            .parent     = TYPE_TMP421,
+            .class_init = tmp421_class_init,
+            .class_data = (void *) &devices[i],
+        };
+        type_register(&ti);
+    }
+}
+
+type_init(tmp421_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TWL92230=y
 CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
+CONFIG_TMP421=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

Temperatures can be changed from the monitor with :

(qemu) qom-set /machine/unattached/device[2] temperature0 12000

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 1494827476-1487-7-git-send-email-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    DeviceState *dev;
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
+
+    /* add a TMP423 temperature sensor */
+    dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
+                           "tmp423", 0x4c);
+    object_property_set_int(OBJECT(dev), 31000, "temperature0", &error_abort);
+    object_property_set_int(OBJECT(dev), 28000, "temperature1", &error_abort);
+    object_property_set_int(OBJECT(dev), 20000, "temperature2", &error_abort);
+    object_property_set_int(OBJECT(dev), 110000, "temperature3", &error_abort);
 }
 
 static void palmetto_bmc_init(MachineState *machine)
-- 
2.7.4

From: Andrew Jones <drjones@redhat.com>

Cc: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 20170529173751.3443-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     if (nb_numa_nodes > 0) {
         acpi_add_table(table_offsets, tables_blob);
         build_srat(tables_blob, tables->linker, vms);
+        if (have_numa_distance) {
+            acpi_add_table(table_offsets, tables_blob);
+            build_slit(tables_blob, tables->linker);
+        }
     }
 
     if (its_class_name() && !vmc->no_its) {
-- 
2.7.4

From: Andrew Jones <drjones@redhat.com>

This is based on patch Shannon Zhao originally posted.

Cc: Shannon Zhao <zhaoshenglong@huawei.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Shannon Zhao <shannon.zhao@linaro.org>
Message-id: 20170529173751.3443-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
                                 "clk24mhz");
     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);
 
+    if (have_numa_distance) {
+        int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
+        uint32_t *matrix = g_malloc0(size);
+        int idx, i, j;
+
+        for (i = 0; i < nb_numa_nodes; i++) {
+            for (j = 0; j < nb_numa_nodes; j++) {
+                idx = (i * nb_numa_nodes + j) * 3;
+                matrix[idx + 0] = cpu_to_be32(i);
+                matrix[idx + 1] = cpu_to_be32(j);
+                matrix[idx + 2] = cpu_to_be32(numa_info[i].distance[j]);
+            }
+        }
+
+        qemu_fdt_add_subnode(fdt, "/distance-map");
+        qemu_fdt_setprop_string(fdt, "/distance-map", "compatible",
+                                "numa-distance-map-v1");
+        qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",
+                         matrix, size);
+        g_free(matrix);
+    }
 }
 
 static void fdt_add_psci_node(const VirtMachineState *vms)
-- 
2.7.4

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1