Series comparison

-[Qemu-devel] [PULL 0/4] target-arm queue
+[PULL 00/14] target-arm queue
-A surprisingly short target-arm queue, but no point in holding
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
 onto these waiting for more code to arrive :-)
-thanks
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 -- PMM
-The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-are available in the git repository at:
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
 for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:
   target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: ignore writes to CONTROL.SPSEL from Thread mode
+ * Implement FEAT_ECV
- * KVM: Enable in-kernel timers with user space gic
+ * STM32L4x5: Implement GPIO device
- * aspeed: Register all watchdogs
+ * Fix 32-bit SMOPA
- * hw/misc: Add Exynos4210 Pseudo Random Number Generator
+ * Refactor v7m related code from cpu32.c into its own file
  * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
 ----------------------------------------------------------------
-Alexander Graf (1):
+Inès Varhol (3):
-      ARM: KVM: Enable in-kernel timers with user space gic
+      hw/gpio: Implement STM32L4x5 GPIO
       hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
       tests/qtest: Add STM32L4x5 GPIO QTest testcase
-Joel Stanley (1):
+Peter Maydell (9):
-      aspeed: Register all watchdogs
+      target/arm: Move some register related defines to internals.h
       target/arm: Timer _EL02 registers UNDEF for E2H == 0
       target/arm: use FIELD macro for CNTHCTL bit definitions
       target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
       target/arm: Implement new FEAT_ECV trap bits
       target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
       target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
       target/arm: Enable FEAT_ECV for 'max' CPU
       hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-Krzysztof Kozlowski (1):
+Richard Henderson (1):
-      hw/misc: Add Exynos4210 Pseudo Random Number Generator
+      target/arm: Fix 32-bit SMOPA
-Peter Maydell (1):
+Thomas Huth (1):
-      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+      target/arm: Move v7m-related code from cpu32.c into a separate file
- hw/misc/Makefile.objs       |   2 +-
+ MAINTAINERS                        |   1 +
- include/hw/arm/aspeed_soc.h |   4 +-
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- include/sysemu/kvm.h        |  11 ++
+ docs/system/arm/emulation.rst      |   1 +
- target/arm/cpu.h            |   3 +
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
- accel/kvm/kvm-all.c         |   5 +
+ include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
- accel/stubs/kvm-stub.c      |   5 +
+ include/hw/misc/stm32l4x5_syscfg.h |   3 +-
- hw/arm/aspeed_soc.c         |  25 ++--
+ include/hw/rtc/sun4v-rtc.h         |   2 +-
- hw/arm/exynos4210.c         |   4 +
+ target/arm/cpu-features.h          |  10 +
- hw/intc/arm_gic.c           |   7 ++
+ target/arm/cpu.h                   | 129 +--------
- hw/misc/exynos4210_rng.c    | 277 ++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/internals.h             | 151 ++++++++++
- target/arm/helper.c         |  13 ++-
+ hw/arm/stm32l4x5_soc.c             |  71 ++++-
- target/arm/kvm.c            |  51 ++++++++
+ hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
-files changed, 394 insertions(+), 13 deletions(-)
+ hw/misc/stm32l4x5_syscfg.c         |   1 +
- create mode 100644 hw/misc/exynos4210_rng.c
+ hw/rtc/sun4v-rtc.c                 |   2 +-
  target/arm/helper.c                | 189 ++++++++++++-
  target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
  target/arm/tcg/cpu32.c             | 261 ------------------
  target/arm/tcg/cpu64.c             |   1 +
  target/arm/tcg/sme_helper.c        |  77 +++---
  tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
  tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
  hw/arm/Kconfig                     |   3 +-
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
  target/arm/meson.build             |   3 +
  target/arm/tcg/meson.build         |   3 +
  target/arm/trace-events            |   1 +
  tests/qtest/meson.build            |   3 +-
  tests/tcg/aarch64/Makefile.target  |   2 +-
 files changed, 1962 insertions(+), 456 deletions(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
  create mode 100644 target/arm/tcg/cpu-v7m.c
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

-New patch
+[PULL 01/14] target/arm: Move some register related defines to internals.h
+cpu.h has a lot of #defines relating to CPU register fields.
+Most of these aren't actually used outside target/arm code,
+so there's no point in cluttering up the cpu.h file with them.
+Move some easy ones to internals.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
+---
+ target/arm/cpu.h       | 128 -----------------------------------------
+ target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
+files changed, 128 insertions(+), 128 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
+     uint64_t ctl; /* Timer Control register */
+ } ARMGenericTimer;
+-#define VTCR_NSW (1u << 29)
+-#define VTCR_NSA (1u << 30)
+-#define VSTCR_SW VTCR_NSW
+-#define VSTCR_SA VTCR_NSA
+-
+ /* Define a maximum sized vector register.
+  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
+  * For 64-bit, this is a 2048-bit SVE register.
+@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
+ #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
+ #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
+-/* Bit definitions for CPACR (AArch32 only) */
+-FIELD(CPACR, CP10, 20, 2)
+-FIELD(CPACR, CP11, 22, 2)
+-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+-FIELD(CPACR, ASEDIS, 31, 1)
+-
+-/* Bit definitions for CPACR_EL1 (AArch64 only) */
+-FIELD(CPACR_EL1, ZEN, 16, 2)
+-FIELD(CPACR_EL1, FPEN, 20, 2)
+-FIELD(CPACR_EL1, SMEN, 24, 2)
+-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+-
+-/* Bit definitions for HCPTR (AArch32 only) */
+-FIELD(HCPTR, TCP10, 10, 1)
+-FIELD(HCPTR, TCP11, 11, 1)
+-FIELD(HCPTR, TASE, 15, 1)
+-FIELD(HCPTR, TTA, 20, 1)
+-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+-
+-/* Bit definitions for CPTR_EL2 (AArch64 only) */
+-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+-FIELD(CPTR_EL2, TTA, 28, 1)
+-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+-
+-/* Bit definitions for CPTR_EL3 (AArch64 only) */
+-FIELD(CPTR_EL3, EZ, 8, 1)
+-FIELD(CPTR_EL3, TFP, 10, 1)
+-FIELD(CPTR_EL3, ESM, 12, 1)
+-FIELD(CPTR_EL3, TTA, 20, 1)
+-FIELD(CPTR_EL3, TAM, 30, 1)
+-FIELD(CPTR_EL3, TCPAC, 31, 1)
+-
+-#define MDCR_MTPME    (1U << 28)
+-#define MDCR_TDCC     (1U << 27)
+-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+-#define MDCR_EPMAD    (1U << 21)
+-#define MDCR_EDAD     (1U << 20)
+-#define MDCR_TTRF     (1U << 19)
+-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+-#define MDCR_SDD      (1U << 16)
+-#define MDCR_SPD      (3U << 14)
+-#define MDCR_TDRA     (1U << 11)
+-#define MDCR_TDOSA    (1U << 10)
+-#define MDCR_TDA      (1U << 9)
+-#define MDCR_TDE      (1U << 8)
+-#define MDCR_HPME     (1U << 7)
+-#define MDCR_TPM      (1U << 6)
+-#define MDCR_TPMCR    (1U << 5)
+-#define MDCR_HPMN     (0x1fU)
+-
+-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+-
+ #define CPSR_M (0x1fU)
+ #define CPSR_T (1U << 5)
+ #define CPSR_F (1U << 6)
+@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
+ #define XPSR_NZCV CPSR_NZCV
+ #define XPSR_IT CPSR_IT
+-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+-#define TTBCR_PD0    (1U << 4)
+-#define TTBCR_PD1    (1U << 5)
+-#define TTBCR_EPD0   (1U << 7)
+-#define TTBCR_IRGN0  (3U << 8)
+-#define TTBCR_ORGN0  (3U << 10)
+-#define TTBCR_SH0    (3U << 12)
+-#define TTBCR_T1SZ   (3U << 16)
+-#define TTBCR_A1     (1U << 22)
+-#define TTBCR_EPD1   (1U << 23)
+-#define TTBCR_IRGN1  (3U << 24)
+-#define TTBCR_ORGN1  (3U << 26)
+-#define TTBCR_SH1    (1U << 28)
+-#define TTBCR_EAE    (1U << 31)
+-
+-FIELD(VTCR, T0SZ, 0, 6)
+-FIELD(VTCR, SL0, 6, 2)
+-FIELD(VTCR, IRGN0, 8, 2)
+-FIELD(VTCR, ORGN0, 10, 2)
+-FIELD(VTCR, SH0, 12, 2)
+-FIELD(VTCR, TG0, 14, 2)
+-FIELD(VTCR, PS, 16, 3)
+-FIELD(VTCR, VS, 19, 1)
+-FIELD(VTCR, HA, 21, 1)
+-FIELD(VTCR, HD, 22, 1)
+-FIELD(VTCR, HWU59, 25, 1)
+-FIELD(VTCR, HWU60, 26, 1)
+-FIELD(VTCR, HWU61, 27, 1)
+-FIELD(VTCR, HWU62, 28, 1)
+-FIELD(VTCR, NSW, 29, 1)
+-FIELD(VTCR, NSA, 30, 1)
+-FIELD(VTCR, DS, 32, 1)
+-FIELD(VTCR, SL2, 33, 1)
+-
+ /* Bit definitions for ARMv8 SPSR (PSTATE) format.
+  * Only these are valid when in AArch64 mode; in
+  * AArch32 mode SPSRs are basically CPSR-format.
+@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+ #define HCR_TWEDEN    (1ULL << 59)
+ #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
+-#define HCRX_ENAS0    (1ULL << 0)
+-#define HCRX_ENALS    (1ULL << 1)
+-#define HCRX_ENASR    (1ULL << 2)
+-#define HCRX_FNXS     (1ULL << 3)
+-#define HCRX_FGTNXS   (1ULL << 4)
+-#define HCRX_SMPME    (1ULL << 5)
+-#define HCRX_TALLINT  (1ULL << 6)
+-#define HCRX_VINMI    (1ULL << 7)
+-#define HCRX_VFNMI    (1ULL << 8)
+-#define HCRX_CMOW     (1ULL << 9)
+-#define HCRX_MCE2     (1ULL << 10)
+-#define HCRX_MSCEN    (1ULL << 11)
+-
+-#define HPFAR_NS      (1ULL << 63)
+-
+ #define SCR_NS                (1ULL << 0)
+ #define SCR_IRQ               (1ULL << 1)
+ #define SCR_FIQ               (1ULL << 2)
+@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+ #define SCR_GPF               (1ULL << 48)
+ #define SCR_NSE               (1ULL << 62)
+-#define HSTR_TTEE (1 << 16)
+-#define HSTR_TJDBX (1 << 17)
+-
+-#define CNTHCTL_CNTVMASK      (1 << 18)
+-#define CNTHCTL_CNTPMASK      (1 << 19)
+-
+ /* Return the current FPSCR value.  */
+ uint32_t vfp_get_fpscr(CPUARMState *env);
+ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
+ FIELD(DBGWCR, MASK, 24, 5)
+ FIELD(DBGWCR, SSCE, 29, 1)
++#define VTCR_NSW (1u << 29)
++#define VTCR_NSA (1u << 30)
++#define VSTCR_SW VTCR_NSW
++#define VSTCR_SA VTCR_NSA
++
++/* Bit definitions for CPACR (AArch32 only) */
++FIELD(CPACR, CP10, 20, 2)
++FIELD(CPACR, CP11, 22, 2)
++FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
++FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
++FIELD(CPACR, ASEDIS, 31, 1)
++
++/* Bit definitions for CPACR_EL1 (AArch64 only) */
++FIELD(CPACR_EL1, ZEN, 16, 2)
++FIELD(CPACR_EL1, FPEN, 20, 2)
++FIELD(CPACR_EL1, SMEN, 24, 2)
++FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
++
++/* Bit definitions for HCPTR (AArch32 only) */
++FIELD(HCPTR, TCP10, 10, 1)
++FIELD(HCPTR, TCP11, 11, 1)
++FIELD(HCPTR, TASE, 15, 1)
++FIELD(HCPTR, TTA, 20, 1)
++FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
++FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
++
++/* Bit definitions for CPTR_EL2 (AArch64 only) */
++FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
++FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
++FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
++FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
++FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
++FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
++FIELD(CPTR_EL2, TTA, 28, 1)
++FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
++FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
++
++/* Bit definitions for CPTR_EL3 (AArch64 only) */
++FIELD(CPTR_EL3, EZ, 8, 1)
++FIELD(CPTR_EL3, TFP, 10, 1)
++FIELD(CPTR_EL3, ESM, 12, 1)
++FIELD(CPTR_EL3, TTA, 20, 1)
++FIELD(CPTR_EL3, TAM, 30, 1)
++FIELD(CPTR_EL3, TCPAC, 31, 1)
++
++#define MDCR_MTPME    (1U << 28)
++#define MDCR_TDCC     (1U << 27)
++#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
++#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
++#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
++#define MDCR_EPMAD    (1U << 21)
++#define MDCR_EDAD     (1U << 20)
++#define MDCR_TTRF     (1U << 19)
++#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
++#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
++#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
++#define MDCR_SDD      (1U << 16)
++#define MDCR_SPD      (3U << 14)
++#define MDCR_TDRA     (1U << 11)
++#define MDCR_TDOSA    (1U << 10)
++#define MDCR_TDA      (1U << 9)
++#define MDCR_TDE      (1U << 8)
++#define MDCR_HPME     (1U << 7)
++#define MDCR_TPM      (1U << 6)
++#define MDCR_TPMCR    (1U << 5)
++#define MDCR_HPMN     (0x1fU)
++
++/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
++#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
++                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
++                         MDCR_STE | MDCR_SPME | MDCR_SPD)
++
++#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
++#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
++#define TTBCR_PD0    (1U << 4)
++#define TTBCR_PD1    (1U << 5)
++#define TTBCR_EPD0   (1U << 7)
++#define TTBCR_IRGN0  (3U << 8)
++#define TTBCR_ORGN0  (3U << 10)
++#define TTBCR_SH0    (3U << 12)
++#define TTBCR_T1SZ   (3U << 16)
++#define TTBCR_A1     (1U << 22)
++#define TTBCR_EPD1   (1U << 23)
++#define TTBCR_IRGN1  (3U << 24)
++#define TTBCR_ORGN1  (3U << 26)
++#define TTBCR_SH1    (1U << 28)
++#define TTBCR_EAE    (1U << 31)
++
++FIELD(VTCR, T0SZ, 0, 6)
++FIELD(VTCR, SL0, 6, 2)
++FIELD(VTCR, IRGN0, 8, 2)
++FIELD(VTCR, ORGN0, 10, 2)
++FIELD(VTCR, SH0, 12, 2)
++FIELD(VTCR, TG0, 14, 2)
++FIELD(VTCR, PS, 16, 3)
++FIELD(VTCR, VS, 19, 1)
++FIELD(VTCR, HA, 21, 1)
++FIELD(VTCR, HD, 22, 1)
++FIELD(VTCR, HWU59, 25, 1)
++FIELD(VTCR, HWU60, 26, 1)
++FIELD(VTCR, HWU61, 27, 1)
++FIELD(VTCR, HWU62, 28, 1)
++FIELD(VTCR, NSW, 29, 1)
++FIELD(VTCR, NSA, 30, 1)
++FIELD(VTCR, DS, 32, 1)
++FIELD(VTCR, SL2, 33, 1)
++
++#define HCRX_ENAS0    (1ULL << 0)
++#define HCRX_ENALS    (1ULL << 1)
++#define HCRX_ENASR    (1ULL << 2)
++#define HCRX_FNXS     (1ULL << 3)
++#define HCRX_FGTNXS   (1ULL << 4)
++#define HCRX_SMPME    (1ULL << 5)
++#define HCRX_TALLINT  (1ULL << 6)
++#define HCRX_VINMI    (1ULL << 7)
++#define HCRX_VFNMI    (1ULL << 8)
++#define HCRX_CMOW     (1ULL << 9)
++#define HCRX_MCE2     (1ULL << 10)
++#define HCRX_MSCEN    (1ULL << 11)
++
++#define HPFAR_NS      (1ULL << 63)
++
++#define HSTR_TTEE (1 << 16)
++#define HSTR_TJDBX (1 << 17)
++
++#define CNTHCTL_CNTVMASK      (1 << 18)
++#define CNTHCTL_CNTPMASK      (1 << 19)
++
+ /* We use a few fake FSR values for internal purposes in M profile.
+  * M profile cores don't have A/R format FSRs, but currently our
+  * get_phys_addr() code assumes A/R profile and reports failures via
+--
+.34.1

-New patch
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
+or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
+delivering the exception to EL2 with the wrong syndrome.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
+         return CP_ACCESS_OK;
+     }
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
+-        return CP_ACCESS_TRAP;
++        return CP_ACCESS_TRAP_UNCATEGORIZED;
+     }
+     return CP_ACCESS_OK;
+ }
+--
+.34.1

-[Qemu-devel] [PULL 4/4] target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-For v7M, writes to the CONTROL register are only permitted for
+We prefer the FIELD macro over ad-hoc #defines for register bits;
-privileged code. However even if the code is privileged, the
+switch CNTHCTL to that style before we add any more bits.
 write must not affect the SPSEL bit in the CONTROL register
 if the CPU is in Thread mode (as documented in the pseudocode
 for the MSR instruction). Implement this, instead of permitting
 SPSEL to be written in all cases.
 This was causing mbed applications not to run, because the
 RTX RTOS they use relies on this behaviour.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 13 ++++++++++---
+ target/arm/internals.h | 27 +++++++++++++++++++++++++--
-file changed, 10 insertions(+), 3 deletions(-)
+ target/arm/helper.c    |  9 ++++-----
 files changed, 29 insertions(+), 7 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
+ #define HSTR_TTEE (1 << 16)
+ #define HSTR_TJDBX (1 << 17)
+-#define CNTHCTL_CNTVMASK      (1 << 18)
+-#define CNTHCTL_CNTPMASK      (1 << 19)
++/*
++ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
++ * have different bit definitions, and EL1PCTEN might be
++ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
++ * disambiguate if necessary.
++ */
++FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
++FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
++FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
++FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
++FIELD(CNTHCTL, EVNTEN, 2, 1)
++FIELD(CNTHCTL, EVNTDIR, 3, 1)
++FIELD(CNTHCTL, EVNTI, 4, 4)
++FIELD(CNTHCTL, EL0VTEN, 8, 1)
++FIELD(CNTHCTL, EL0PTEN, 9, 1)
++FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
++FIELD(CNTHCTL, EL1PTEN, 11, 1)
++FIELD(CNTHCTL, ECV, 12, 1)
++FIELD(CNTHCTL, EL1TVT, 13, 1)
++FIELD(CNTHCTL, EL1TVCT, 14, 1)
++FIELD(CNTHCTL, EL1NVPCT, 15, 1)
++FIELD(CNTHCTL, EL1NVVCT, 16, 1)
++FIELD(CNTHCTL, EVNTIS, 17, 1)
++FIELD(CNTHCTL, CNTVMASK, 18, 1)
++FIELD(CNTHCTL, CNTPMASK, 19, 1)
+ /* We use a few fake FSR values for internal purposes in M profile.
+  * M profile cores don't have A/R format FSRs, but currently our
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
-         }
+      * It is RES0 in Secure and NonSecure state.
-         break;
+      */
-     case 20: /* CONTROL */
+     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
--        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
--        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
+-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
--                                  R_V7M_CONTROL_NPRIV_MASK);
++        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
-+        /* Writing to the SPSEL bit only has an effect if we are in
++         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
-+         * thread mode; other bits can be updated by any privileged code.
+         irqstate = 0;
-+         * switch_v7m_sp() deals with updating the SPSEL bit in
+     }
-+         * env->v7m.control, so we only need update the others.
-+         */
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+        if (env->v7m.exception == 0) {
+ {
-+            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+     ARMCPU *cpu = env_archcpu(env);
-+        }
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
+-
-+        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
+     raw_write(env, ri, value);
-         break;
-     default:
+-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
-         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
++    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
          gt_update_irq(cpu, GTIMER_VIRT);
 -    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
 +    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
          gt_update_irq(cpu, GTIMER_PHYS);
      }
  }
 --
-.7.4
+.34.1

-New patch
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
+This is not strictly architecturally required, but it is how we've
+tended to implement registers more recently.
+In particular, bits [19:18] are only present with FEAT_RME,
+and bits [17:12] will only be present with FEAT_ECV.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 18 ++++++++++++++++++
+file changed, 18 insertions(+)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ {
+     ARMCPU *cpu = env_archcpu(env);
+     uint32_t oldval = env->cp15.cnthctl_el2;
++    uint32_t valid_mask =
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
++        R_CNTHCTL_EVNTEN_MASK |
++        R_CNTHCTL_EVNTDIR_MASK |
++        R_CNTHCTL_EVNTI_MASK |
++        R_CNTHCTL_EL0VTEN_MASK |
++        R_CNTHCTL_EL0PTEN_MASK |
++        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
++        R_CNTHCTL_EL1PTEN_MASK;
++
++    if (cpu_isar_feature(aa64_rme, cpu)) {
++        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
++    }
++
++    /* Clear RES0 bits */
++    value &= valid_mask;
++
+     raw_write(env, ri, value);
+     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
+--
+.34.1

-New patch
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
+ * four new trap bits for various counter and timer registers
+ * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
+   scaling of the event stream. This is a no-op for us, because we don't
+   implement the event stream (our WFE is a NOP): all we need to do is
+   allow CNTHCTL_EL2.ENVTIS to be read and written.
+ * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
+   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
+   FEAT_SPE or FEAT_TRF.
+ * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
+   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
+   that no barriers are needed around their accesses. For us these
+   are just the same as the normal views, because all our sysregs are
+   inherently self-sychronizing.
+In this commit we implement the trap handling and permit the new
+CNTHCTL_EL2 bits to be written.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
+---
+ target/arm/cpu-features.h |  5 ++++
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
+files changed, 51 insertions(+), 5 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
+ }
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
++}
++
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
+              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
+             return CP_ACCESS_TRAP_EL2;
+         }
++        if (has_el2 && timeridx == GTIMER_VIRT) {
++            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
++                return CP_ACCESS_TRAP_EL2;
++            }
++        }
+         break;
+     }
+     return CP_ACCESS_OK;
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
+                 }
+             }
+         }
++        if (has_el2 && timeridx == GTIMER_VIRT) {
++            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
++                return CP_ACCESS_TRAP_EL2;
++            }
++        }
+         break;
+     }
+     return CP_ACCESS_OK;
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     if (cpu_isar_feature(aa64_rme, cpu)) {
+         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+     }
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
++        valid_mask |=
++            R_CNTHCTL_EL1TVT_MASK |
++            R_CNTHCTL_EL1TVCT_MASK |
++            R_CNTHCTL_EL1NVPCT_MASK |
++            R_CNTHCTL_EL1NVVCT_MASK |
++            R_CNTHCTL_EVNTIS_MASK;
++    }
+     /* Clear RES0 bits */
+     value &= valid_mask;
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
+ {
+     if (arm_current_el(env) == 1) {
+         /* This must be a FEAT_NV access */
+-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
+         return CP_ACCESS_OK;
+     }
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
+     return CP_ACCESS_OK;
+ }
++static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
++                                      bool isread)
++{
++    if (arm_current_el(env) == 1) {
++        /* This must be a FEAT_NV access with NVx == 101 */
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
++            return CP_ACCESS_TRAP_EL2;
++        }
++    }
++    return e2h_access(env, ri, isread);
++}
++
++static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
++                                      bool isread)
++{
++    if (arm_current_el(env) == 1) {
++        /* This must be a FEAT_NV access with NVx == 101 */
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
++            return CP_ACCESS_TRAP_EL2;
++        }
++    }
++    return e2h_access(env, ri, isread);
++}
++
+ /* Test if system register redirection is to occur in the current state.  */
+ static bool redirect_for_e2h(CPUARMState *env)
+ {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
+     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
+       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
+       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
+     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvvct,
+       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
+       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
+       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
+       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
+     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
+       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvvct,
+       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
+ #endif
+ };
+--
+.34.1

-New patch
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
+defined, which are "self-synchronized" views of the physical and
+virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
+(meaning that no barriers are needed around accesses to them to
+ensure that reads of them do not occur speculatively and out-of-order
+with other instructions).
+For QEMU, all our system registers are self-synchronized, so we can
+simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
+to the new register encodings.
+This means we now implement all the functionality required for
+ID_AA64MMFR0_EL1.ECV == 0b0001.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
+file changed, 43 insertions(+)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+     },
+ };
++/*
++ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
++ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
++ * so our implementations here are identical to the normal registers.
++ */
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
++    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
++      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
++      .accessfn = gt_vct_access,
++      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
++    },
++    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
++      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
++    },
++    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
++      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
++      .accessfn = gt_pct_access,
++      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
++    },
++    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
++      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
++    },
++};
++
+ #else
+ /*
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+     },
+ };
++/*
++ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
++ * is exposed to userspace by Linux.
++ */
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
++    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
++      .readfn = gt_virt_cnt_read,
++    },
++};
++
+ #endif
+ static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
+         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
+     }
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
++        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
++    }
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
+         ARMCPRegInfo vapa_cp_reginfo[] = {
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
+--
+.34.1

-New patch
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
+implemented.  This is similar to the existing CNTVOFF_EL2, except
+that it controls a hypervisor-adjustable offset made to the physical
+counter and timer.
+Implement the handling for this register, which includes control/trap
+bits in SCR_EL3 and CNTHCTL_EL2.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
+---
+ target/arm/cpu-features.h |  5 +++
+ target/arm/cpu.h          |  1 +
+ target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
+ target/arm/trace-events   |  1 +
+files changed, 73 insertions(+), 2 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+ }
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
++}
++
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         uint64_t c14_cntkctl; /* Timer Control register */
+         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
+         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
++        uint64_t cntpoff_el2; /* Counter Physical Offset register */
+         ARMGenericTimer c14_timer[NUM_GTIMERS];
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
+         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+         if (cpu_isar_feature(aa64_rme, cpu)) {
+             valid_mask |= SCR_NSE | SCR_GPF;
+         }
++        if (cpu_isar_feature(aa64_ecv, cpu)) {
++            valid_mask |= SCR_ECVEN;
++        }
+     } else {
+         valid_mask &= ~(SCR_RW | SCR_ST);
+         if (cpu_isar_feature(aa32_ras, cpu)) {
+@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
+     gt_update_irq(cpu, GTIMER_PHYS);
+ }
++static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
++{
++    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
++        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
++        arm_is_el2_enabled(env) &&
++        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
++        return env->cp15.cntpoff_el2;
++    }
++    return 0;
++}
++
++static uint64_t gt_phys_cnt_offset(CPUARMState *env)
++{
++    if (arm_current_el(env) >= 2) {
++        return 0;
++    }
++    return gt_phys_raw_cnt_offset(env);
++}
++
+ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
+ {
+     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
+@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
+          * reset timer to when ISTATUS next has to change
+          */
+         uint64_t offset = timeridx == GTIMER_VIRT ?
+-                                      cpu->env.cp15.cntvoff_el2 : 0;
++            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
+         uint64_t count = gt_get_countervalue(&cpu->env);
+         /* Note that this must be unsigned 64 bit arithmetic: */
+         int istatus = count - offset >= gt->cval;
+@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
+ static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
+ {
+-    return gt_get_countervalue(env);
++    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
+ }
+ static uint64_t gt_virt_cnt_offset(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
+     case GTIMER_HYPVIRT:
+         offset = gt_virt_cnt_offset(env);
+         break;
++    case GTIMER_PHYS:
++        offset = gt_phys_cnt_offset(env);
++        break;
+     }
+     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
+@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     case GTIMER_HYPVIRT:
+         offset = gt_virt_cnt_offset(env);
+         break;
++    case GTIMER_PHYS:
++        offset = gt_phys_cnt_offset(env);
++        break;
+     }
+     trace_arm_gt_tval_write(timeridx, value);
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
+             R_CNTHCTL_EL1NVVCT_MASK |
+             R_CNTHCTL_EVNTIS_MASK;
+     }
++    if (cpu_isar_feature(aa64_ecv, cpu)) {
++        valid_mask |= R_CNTHCTL_ECV_MASK;
++    }
+     /* Clear RES0 bits */
+     value &= valid_mask;
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+     },
+ };
++static CPAccessResult gt_cntpoff_access(CPUARMState *env,
++                                        const ARMCPRegInfo *ri,
++                                        bool isread)
++{
++    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
++        return CP_ACCESS_TRAP_EL3;
++    }
++    return CP_ACCESS_OK;
++}
++
++static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
++                              uint64_t value)
++{
++    ARMCPU *cpu = env_archcpu(env);
++
++    trace_arm_gt_cntpoff_write(value);
++    raw_write(env, ri, value);
++    gt_recalc_timer(cpu, GTIMER_PHYS);
++}
++
++static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
++    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
++    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
++    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
++    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
++    .nv2_redirect_offset = 0x1a8,
++    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
++};
+ #else
+ /*
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+     }
++#ifndef CONFIG_USER_ONLY
++    if (cpu_isar_feature(aa64_ecv, cpu)) {
++        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
++    }
++#endif
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
+         ARMCPRegInfo vapa_cp_reginfo[] = {
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
+diff --git a/target/arm/trace-events b/target/arm/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/trace-events
++++ b/target/arm/trace-events
+@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
+ arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
+ arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
+ arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
++arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
+ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
+ # kvm.c
+--
+.34.1

-New patch
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
+Enable all FEAT_ECV features on the 'max' CPU.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
+---
+ docs/system/arm/emulation.rst | 1 +
+ target/arm/tcg/cpu64.c        | 1 +
+files changed, 2 insertions(+)
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/emulation.rst
++++ b/docs/system/arm/emulation.rst
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
+ - FEAT_DoubleFault (Double Fault Extension)
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
++- FEAT_ECV (Enhanced Counter Virtualization)
+ - FEAT_EPAC (Enhanced pointer authentication)
+ - FEAT_ETS (Enhanced Translation Synchronization)
+ - FEAT_EVT (Enhanced Virtualization Traps)
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/cpu64.c
++++ b/target/arm/tcg/cpu64.c
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
+     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
++    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
+     cpu->isar.id_aa64mmfr0 = t;
+     t = cpu->isar.id_aa64mmfr1;
+--
+.34.1

-[Qemu-devel] [PULL 1/4] hw/misc: Add Exynos4210 Pseudo Random Number Generator
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Add emulation for Exynos4210 Pseudo Random Number Generator which could
+Features supported :
-work on fixed seeds or with seeds provided by True Random Number
+- the 8 STM32L4x5 GPIOs are initialized with their reset values
-Generator block inside the SoC.
+    (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
-Implement only the fixed seeds part of it in polling mode (no
+Difference with the real GPIOs :
-interrupts).
+- Alternate Function and Analog mode aren't implemented :
     pins in AF/Analog behave like pins in input mode
 - floating pins stay at their last value
 - register IDR reset values differ from the real one :
     values are coherent with the other registers reset values
     and the fact that AF/Analog modes aren't implemented
 - setting I/O output speed isn't supported
 - locking port bits isn't supported
 - ADC function isn't supported
 - GPIOH has 16 pins instead of 2 pins
 - writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
-Emulation tested with two independent Linux kernel exynos-rng drivers:
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-. New kcapi-rng interface (targeting Linux v4.12),
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-. Old hwrng inteface
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-   # echo "exynos" > /sys/class/misc/hw_random/rng_current
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-   # dd if=/dev/hwrng of=/dev/null bs=1 count=16
+Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Message-id: 20170425180609.11004-1-krzk@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: wrapped a few overlong lines; more efficient implementation
  of exynos4210_rng_seed_ready()]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs    |   2 +-
+ MAINTAINERS                        |   1 +
- hw/arm/exynos4210.c      |   4 +
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
+ include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
-files changed, 282 insertions(+), 1 deletion(-)
+ hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
- create mode 100644 hw/misc/exynos4210_rng.c
+ hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/MAINTAINERS
-+++ b/hw/misc/Makefile.objs
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
+@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
- obj-$(CONFIG_REALVIEW) += arm_sysctl.o
+ F: hw/misc/stm32l4x5_exti.c
- obj-$(CONFIG_NSERIES) += cbus.o
+ F: hw/misc/stm32l4x5_syscfg.c
- obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
+ F: hw/misc/stm32l4x5_rcc.c
--obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
++F: hw/gpio/stm32l4x5_gpio.c
-+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
+ F: include/hw/*/stm32l4x5_*.h
- obj-$(CONFIG_IMX) += imx_ccm.o
- obj-$(CONFIG_IMX) += imx31_ccm.o
+ B-L475E-IOT01A IoT Node
- obj-$(CONFIG_IMX) += imx25_ccm.o
+diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/docs/system/arm/b-l475e-iot01a.rst
-+++ b/hw/arm/exynos4210.c
++++ b/docs/system/arm/b-l475e-iot01a.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
- /* Clock controller SFR base address */
+ - STM32L4x5 EXTI (Extended interrupts and events controller)
- #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
+ - STM32L4x5 SYSCFG (System configuration controller)
+ - STM32L4x5 RCC (Reset and clock control)
-+/* PRNG/HASH SFR base address */
++- STM32L4x5 GPIOs (General-purpose I/Os)
-+#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
-+
+ Missing devices
- /* Display controllers (FIMD) */
+ """""""""""""""
- #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
+@@ -XXX,XX +XXX,XX @@ Missing devices
+ The B-L475E-IOT01A does *not* support the following devices:
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
-     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
+ - Serial ports (UART)
+-- General-purpose I/Os (GPIO)
-     sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
+ - Analog to Digital Converter (ADC)
-+    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
+ - SPI controller
+ - Timer controller (TIMER)
-     /* PWM */
+diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
      sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
 diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/exynos4210_rng.c
++++ b/include/hw/gpio/stm32l4x5_gpio.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ *  Exynos4210 Pseudo Random Nubmer Generator Emulation
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
-+ *  This program is free software; you can redistribute it and/or modify it
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + *  under the terms of the GNU General Public License as published by the
 + *  Free Software Foundation; either version 2 of the License, or
 + *  (at your option) any later version.
 + *
-+ *  This program is distributed in the hope that it will be useful, but WITHOUT
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * See the COPYING file in the top-level directory.
-+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ */
-+ *  for more details.
++
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#ifndef HW_STM32L4X5_GPIO_H
 +#define HW_STM32L4X5_GPIO_H
 +
 +#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 +OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +
 +#define GPIO_NUM_PINS 16
 +
 +struct Stm32l4x5GpioState {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion mmio;
 +
 +    /* GPIO registers */
 +    uint32_t moder;
 +    uint32_t otyper;
 +    uint32_t ospeedr;
 +    uint32_t pupdr;
 +    uint32_t idr;
 +    uint32_t odr;
 +    uint32_t lckr;
 +    uint32_t afrl;
 +    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
 +
 +#endif
 diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ *  You should have received a copy of the GNU General Public License along
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
-+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
++/*
++ * The reference used is the STMicroElectronics RM0351 Reference manual
++ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
++ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
++ */
++
 +#include "qemu/osdep.h"
-+#include "crypto/random.h"
-+#include "hw/sysbus.h"
 +#include "qemu/log.h"
-+
++#include "hw/gpio/stm32l4x5_gpio.h"
-+#define DEBUG_EXYNOS_RNG 0
++#include "hw/irq.h"
-+
++#include "hw/qdev-clock.h"
-+#define DPRINTF(fmt, ...) \
++#include "hw/qdev-properties.h"
-+    do { \
++#include "qapi/visitor.h"
-+        if (DEBUG_EXYNOS_RNG) { \
++#include "qapi/error.h"
-+            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
++#include "migration/vmstate.h"
-+        } \
++#include "trace.h"
-+    } while (0)
++
-+
++#define GPIO_MODER 0x00
-+#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
++#define GPIO_OTYPER 0x04
-+#define EXYNOS4210_RNG(obj) \
++#define GPIO_OSPEEDR 0x08
-+    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
++#define GPIO_PUPDR 0x0C
 +#define GPIO_IDR 0x10
 +#define GPIO_ODR 0x14
 +#define GPIO_BSRR 0x18
 +#define GPIO_LCKR 0x1C
 +#define GPIO_AFRL 0x20
 +#define GPIO_AFRH 0x24
 +#define GPIO_BRR 0x28
 +#define GPIO_ASCR 0x2C
 +
 +/* 0b11111111_11111111_00000000_00000000 */
 +#define RESERVED_BITS_MASK 0xFFFF0000
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s);
 +
 +static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 2;
 +}
 +
 +static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 1;
 +}
 +
 +static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
 +static void stm32l4x5_gpio_reset_hold(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    s->moder = s->moder_reset;
 +    s->otyper = 0x00000000;
 +    s->ospeedr = s->ospeedr_reset;
 +    s->pupdr = s->pupdr_reset;
 +    s->idr = 0x00000000;
 +    s->odr = 0x00000000;
 +    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
 +        s->pins_connected_high &= ~(1 << line);
 +    }
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s)
 +{
 +    uint32_t new_idr_mask = 0;
 +    uint32_t new_idr = s->odr;
 +    uint32_t old_idr = s->idr;
 +    int new_pin_state, old_pin_state;
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (is_output(s, i)) {
 +            if (is_push_pull(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (!(s->odr & (1 << i))) {
 +                /* open-drain ODR 0 */
 +                new_idr_mask |= (1 << i);
 +            /* open-drain ODR 1 */
 +            } else if (!(s->disconnected_pins & (1 << i)) &&
 +                       !(s->pins_connected_high & (1 << i))) {
 +                /* open-drain ODR 1 with pin connected low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            /* open-drain ODR 1 with unactive pin */
 +            } else if (is_pull_up(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for open-drain ODR 1
 +             * with unactive pin without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        /* input or analog mode with connected pin */
 +        } else if (!(s->disconnected_pins & (1 << i))) {
 +            if (s->pins_connected_high & (1 << i)) {
 +                /* pin high */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else {
 +                /* pin low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +        /* input or analog mode with disconnected pin */
 +        } else {
 +            if (is_pull_up(s, i)) {
 +                /* pull-up */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                /* pull-down */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for a disconnected pin
 +             * without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        }
 +    }
 +
 +    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
 +    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (new_idr_mask & (1 << i)) {
 +            new_pin_state = (new_idr & (1 << i)) > 0;
 +            old_pin_state = (old_idr & (1 << i)) > 0;
 +            if (new_pin_state > old_pin_state) {
 +                qemu_irq_raise(s->pin[i]);
 +            } else if (new_pin_state < old_pin_state) {
 +                qemu_irq_lower(s->pin[i]);
 +            }
 +        }
 +    }
 +}
 +
 +/*
-+ * Exynos4220, PRNG, only polling mode is supported.
++ * Return mask of pins that are both configured in output
 + * mode and externally driven (except pins in open-drain
 + * mode externally set to 0).
 + */
-+
++static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
-+/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
++{
-+#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
++    uint32_t pins_to_disconnect = 0;
-+#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
++    for (int i = 0; i < GPIO_NUM_PINS; i++) {
-+/* RNG_STATUS register bitfields, reset value: 0x1 */
++        /* for each connected pin in output mode */
-+#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
++        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
-+#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
++            /* if either push-pull or high level */
-+#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
++            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
-+#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
++                pins_to_disconnect |= (1 << i);
-+#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
++                qemu_log_mask(LOG_GUEST_ERROR,
-+#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
++                              "Line %d can't be driven externally\n",
-+#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
++                              i);
-+#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
++            }
-+                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
++        }
-+                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
++    }
-+
++    return pins_to_disconnect;
-+#define EXYNOS4210_RNG_CONTROL_1                  0x0
++}
-+#define EXYNOS4210_RNG_STATUS                    0x10
++
-+#define EXYNOS4210_RNG_SEED_IN                  0x140
++/*
-+#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
++ * Set field `disconnected_pins` and call `update_gpio_idr()`
-+#define EXYNOS4210_RNG_PRNG                     0x160
++ */
-+#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
++static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
-+
++{
-+#define EXYNOS4210_RNG_PRNG_NUM                 5
++    s->disconnected_pins |= lines;
-+
++    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
-+#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
++                              s->pins_connected_high);
-+
++    update_gpio_idr(s);
-+typedef struct Exynos4210RngState {
++}
-+    SysBusDevice parent_obj;
++
-+    MemoryRegion iomem;
++static void disconnected_pins_set(Object *obj, Visitor *v,
-+
++    const char *name, void *opaque, Error **errp)
-+    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
++{
-+    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+    uint32_t seed_set;
++    uint16_t value;
-+
++    if (!visit_type_uint16(v, name, &value, errp)) {
-+    /* Register values */
++        return;
-+    uint32_t reg_control;
++    }
-+    uint32_t reg_status;
++    disconnect_gpio_pins(s, value);
-+} Exynos4210RngState;
++}
 +
-+static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
++static void disconnected_pins_get(Object *obj, Visitor *v,
-+{
++    const char *name, void *opaque, Error **errp)
-+    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
++{
-+
++    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
-+    /* Return true if all the seed-set bits are set. */
++}
-+    return (s->seed_set & mask) == mask;
++
-+}
++static void clock_freq_get(Object *obj, Visitor *v,
-+
++    const char *name, void *opaque, Error **errp)
-+static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
++{
-+                                    uint64_t val)
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+{
++    uint32_t clock_freq_hz = clock_get_hz(s->clk);
-+    /*
++    visit_type_uint32(v, name, &clock_freq_hz, errp);
-+     * We actually ignore the seed and always generate true random numbers.
++}
-+     * Theoretically this should not match the device as Exynos has
++
-+     * a Pseudo Random Number Generator but testing shown that it always
++static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
-+     * generates random numbers regardless of the seed value.
++                                 uint64_t val64, unsigned int size)
-+     */
++{
-+    s->seed_set |= BIT(i);
++    Stm32l4x5GpioState *s = opaque;
 +
-+    /* If all seeds were written, update the status to reflect it */
++    uint32_t value = val64;
-+    if (exynos4210_rng_seed_ready(s)) {
++    trace_stm32l4x5_gpio_write(s->name, addr, val64);
-+        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
++
-+    } else {
++    switch (addr) {
-+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
++    case GPIO_MODER:
-+    }
++        s->moder = value;
-+}
++        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
-+
++        qemu_log_mask(LOG_UNIMP,
-+static void exynos4210_rng_run_engine(Exynos4210RngState *s)
++                      "%s: Analog and AF modes aren't supported\n\
-+{
++                       Analog and AF mode behave like input mode\n",
-+    Error *err = NULL;
++                      __func__);
-+    int ret;
++        return;
-+
++    case GPIO_OTYPER:
-+    /* Seed set? */
++        s->otyper = value & ~RESERVED_BITS_MASK;
-+    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
++        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
-+        goto out;
++        return;
-+    }
++    case GPIO_OSPEEDR:
-+
++        qemu_log_mask(LOG_UNIMP,
-+    /* PRNG engine chosen? */
++                      "%s: Changing I/O output speed isn't supported\n\
-+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
++                       I/O speed is already maximal\n",
-+        goto out;
++                      __func__);
-+    }
++        s->ospeedr = value;
-+
++        return;
-+    /* PRNG engine started? */
++    case GPIO_PUPDR:
-+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
++        s->pupdr = value;
-+        goto out;
++        update_gpio_idr(s);
-+    }
++        return;
-+
++    case GPIO_IDR:
-+    /* Get randoms */
++        qemu_log_mask(LOG_UNIMP,
-+    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
++                      "%s: GPIO->IDR is read-only\n",
-+                               sizeof(s->randr_value), &err);
++                      __func__);
-+    if (!ret) {
++        return;
-+        /* Notify that PRNG is ready */
++    case GPIO_ODR:
-+        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
++        s->odr = value & ~RESERVED_BITS_MASK;
-+    } else {
++        update_gpio_idr(s);
-+        error_report_err(err);
++        return;
-+    }
++    case GPIO_BSRR: {
-+
++        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
-+out:
++        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
-+    /* Always clear start engine bit */
++        /* If both BSx and BRx are set, BSx has priority.*/
-+    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
++        s->odr &= ~bits_to_reset;
-+}
++        s->odr |= bits_to_set;
-+
++        update_gpio_idr(s);
-+static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
++        return;
-+                                    unsigned size)
++    }
-+{
++    case GPIO_LCKR:
-+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
++        qemu_log_mask(LOG_UNIMP,
-+    uint32_t val = 0;
++                      "%s: Locking port bits configuration isn't supported\n",
-+
++                      __func__);
-+    assert(size == 4);
++        s->lckr = value & ~RESERVED_BITS_MASK;
-+
++        return;
-+    switch (offset) {
++    case GPIO_AFRL:
-+    case EXYNOS4210_RNG_CONTROL_1:
++        qemu_log_mask(LOG_UNIMP,
-+        val = s->reg_control;
++                      "%s: Alternate functions aren't supported\n",
-+        break;
++                      __func__);
-+
++        s->afrl = value;
-+    case EXYNOS4210_RNG_STATUS:
++        return;
-+        val = s->reg_status;
++    case GPIO_AFRH:
-+        break;
++        qemu_log_mask(LOG_UNIMP,
-+
++                      "%s: Alternate functions aren't supported\n",
-+    case EXYNOS4210_RNG_PRNG_OFFSET(0):
++                      __func__);
-+    case EXYNOS4210_RNG_PRNG_OFFSET(1):
++        s->afrh = value;
-+    case EXYNOS4210_RNG_PRNG_OFFSET(2):
++        return;
-+    case EXYNOS4210_RNG_PRNG_OFFSET(3):
++    case GPIO_BRR: {
-+    case EXYNOS4210_RNG_PRNG_OFFSET(4):
++        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
-+        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
++        s->odr &= ~bits_to_reset;
-+        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
++        update_gpio_idr(s);
-+                offset, val);
++        return;
-+        break;
++    }
-+
++    case GPIO_ASCR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: ADC function isn't supported\n",
 +                      __func__);
 +        s->ascr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
++                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
-+                      __func__, offset);
++    }
-+    }
++}
 +
-+    return val;
++static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
-+}
++                                    unsigned int size)
-+
++{
-+static void exynos4210_rng_write(void *opaque, hwaddr offset,
++    Stm32l4x5GpioState *s = opaque;
-+                                 uint64_t val, unsigned size)
++
-+{
++    trace_stm32l4x5_gpio_read(s->name, addr);
-+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
++
-+
++    switch (addr) {
-+    assert(size == 4);
++    case GPIO_MODER:
-+
++        return s->moder;
-+    switch (offset) {
++    case GPIO_OTYPER:
-+    case EXYNOS4210_RNG_CONTROL_1:
++        return s->otyper;
-+        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
++    case GPIO_OSPEEDR:
-+        s->reg_control = val;
++        return s->ospeedr;
-+        exynos4210_rng_run_engine(s);
++    case GPIO_PUPDR:
-+        break;
++        return s->pupdr;
-+
++    case GPIO_IDR:
-+    case EXYNOS4210_RNG_STATUS:
++        return s->idr;
-+        /* For clearing status fields */
++    case GPIO_ODR:
-+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
++        return s->odr;
-+        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
++    case GPIO_BSRR:
-+        break;
++        return 0;
-+
++    case GPIO_LCKR:
-+    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
++        return s->lckr;
-+    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
++    case GPIO_AFRL:
-+    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
++        return s->afrl;
-+    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
++    case GPIO_AFRH:
-+    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
++        return s->afrh;
-+        exynos4210_rng_set_seed(s,
++    case GPIO_BRR:
-+                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
++        return 0;
-+                                val);
++    case GPIO_ASCR:
-+        break;
++        return s->ascr;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
++                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
-+                      __func__, offset);
++        return 0;
 +    }
 +}
 +
-+static const MemoryRegionOps exynos4210_rng_ops = {
++static const MemoryRegionOps stm32l4x5_gpio_ops = {
-+    .read = exynos4210_rng_read,
++    .read = stm32l4x5_gpio_read,
-+    .write = exynos4210_rng_write,
++    .write = stm32l4x5_gpio_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
++    .impl = {
++        .min_access_size = 4,
++        .max_access_size = 4,
++        .unaligned = false,
++    },
++    .valid = {
++        .min_access_size = 4,
++        .max_access_size = 4,
++        .unaligned = false,
++    },
 +};
 +
-+static void exynos4210_rng_reset(DeviceState *dev)
++static void stm32l4x5_gpio_init(Object *obj)
 +{
-+    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
-+    s->reg_control = 0;
++    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
-+    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
++                          TYPE_STM32L4X5_GPIO, 0x400);
-+    memset(s->randr_value, 0, sizeof(s->randr_value));
++
-+    s->seed_set = 0;
++    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-+}
++
-+
++    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
-+static void exynos4210_rng_init(Object *obj)
++    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
-+{
++
-+    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
++    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
-+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
++
-+
++    object_property_add(obj, "disconnected-pins", "uint16",
-+    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
++                        disconnected_pins_get, disconnected_pins_set,
-+                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
++                        NULL, &s->disconnected_pins);
-+    sysbus_init_mmio(dev, &s->iomem);
++    object_property_add(obj, "clock-freq-hz", "uint32",
-+}
++                        clock_freq_get, NULL, NULL, NULL);
-+
++}
-+static const VMStateDescription exynos4210_rng_vmstate = {
++
-+    .name = TYPE_EXYNOS4210_RNG,
++static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
 +    if (!clock_has_source(s->clk)) {
 +        error_setg(errp, "GPIO: clk input must be connected");
 +        return;
 +    }
 +}
 +
 +static const VMStateDescription vmstate_stm32l4x5_gpio = {
 +    .name = TYPE_STM32L4X5_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
++    .fields = (VMStateField[]){
-+        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
++        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
-+                            EXYNOS4210_RNG_PRNG_NUM),
++        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
-+        VMSTATE_UINT32(seed_set, Exynos4210RngState),
++        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
-+        VMSTATE_UINT32(reg_status, Exynos4210RngState),
++        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
-+        VMSTATE_UINT32(reg_control, Exynos4210RngState),
++        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
++static Property stm32l4x5_gpio_properties[] = {
 +    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
 +    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
 +    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
 +    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
-+
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+    dc->reset = exynos4210_rng_reset;
++
-+    dc->vmsd = &exynos4210_rng_vmstate;
++    device_class_set_props(dc, stm32l4x5_gpio_properties);
-+}
++    dc->vmsd = &vmstate_stm32l4x5_gpio;
-+
++    dc->realize = stm32l4x5_gpio_realize;
-+static const TypeInfo exynos4210_rng_info = {
++    rc->phases.hold = stm32l4x5_gpio_reset_hold;
-+    .name          = TYPE_EXYNOS4210_RNG,
++}
-+    .parent        = TYPE_SYS_BUS_DEVICE,
++
-+    .instance_size = sizeof(Exynos4210RngState),
++static const TypeInfo stm32l4x5_gpio_types[] = {
-+    .instance_init = exynos4210_rng_init,
++    {
-+    .class_init    = exynos4210_rng_class_init,
++        .name = TYPE_STM32L4X5_GPIO,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(Stm32l4x5GpioState),
 +        .instance_init = stm32l4x5_gpio_init,
 +        .class_init = stm32l4x5_gpio_class_init,
 +    },
 +};
 +
-+static void exynos4210_rng_register(void)
++DEFINE_TYPES(stm32l4x5_gpio_types)
-+{
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
-+    type_register_static(&exynos4210_rng_info);
+index XXXXXXX..XXXXXXX 100644
-+}
+--- a/hw/gpio/Kconfig
-+
++++ b/hw/gpio/Kconfig
-+type_init(exynos4210_rng_register)
+@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
  config SIFIVE_GPIO
      bool
 +
 +config STM32L4X5_GPIO
 +    bool
 diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
      'bcm2835_gpio.c',
      'bcm2838_gpio.c'
  ))
 +system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
  system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
 diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/trace-events
 +++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
  # aspeed_gpio.c
  aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
  aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 +
 +# stm32l4x5_gpio.c
 +stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
 +stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
 +stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 3/4] ARM: KVM: Enable in-kernel timers with user space gic
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-From: Alexander Graf <agraf@suse.de>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-When running with KVM enabled, you can choose between emulating the
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-gic in kernel or user space. If the kernel supports in-kernel virtualization
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-of the interrupt controller, it will default to that. If not, if will
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-default to user space emulation.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Unfortunately when running in user mode gic emulation, we miss out on
 interrupt events which are only available from kernel space, such as the timer.
 This patch leverages the new kernel/user space pending line synchronization for
 timer events. It does not handle PMU events yet.
 Signed-off-by: Alexander Graf <agraf@suse.de>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/sysemu/kvm.h   | 11 +++++++++++
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
- target/arm/cpu.h       |  3 +++
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
- accel/kvm/kvm-all.c    |  5 +++++
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
- accel/stubs/kvm-stub.c |  5 +++++
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
- hw/intc/arm_gic.c      |  7 +++++++
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
- target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/arm/Kconfig                     |  3 +-
-files changed, 82 insertions(+)
+files changed, 63 insertions(+), 18 deletions(-)
-diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
+--- a/include/hw/arm/stm32l4x5_soc.h
-+++ b/include/sysemu/kvm.h
++++ b/include/hw/arm/stm32l4x5_soc.h
-@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
+@@ -XXX,XX +XXX,XX @@
- int kvm_cpu_exec(CPUState *cpu);
+ #include "hw/misc/stm32l4x5_syscfg.h"
- int kvm_destroy_vcpu(CPUState *cpu);
+ #include "hw/misc/stm32l4x5_exti.h"
+ #include "hw/misc/stm32l4x5_rcc.h"
-+/**
++#include "hw/gpio/stm32l4x5_gpio.h"
-+ * kvm_arm_supports_user_irq
+ #include "qom/object.h"
-+ *
-+ * Not all KVM implementations support notifications for kernel generated
+ #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
-+ * interrupt events to user space. This function indicates whether the current
+@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
-+ * KVM implementation does support them.
+     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
-+ *
+     Stm32l4x5SyscfgState syscfg;
-+ * Returns: true if KVM supports using kernel generated IRQs from user space
+     Stm32l4x5RccState rcc;
-+ */
++    Stm32l4x5GpioState gpio[NUM_GPIOS];
-+bool kvm_arm_supports_user_irq(void);
-+
+     MemoryRegion sram1;
- #ifdef NEED_CPU_H
+     MemoryRegion sram2;
- #include "cpu.h"
+diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
+index XXXXXXX..XXXXXXX 100644
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+--- a/include/hw/gpio/stm32l4x5_gpio.h
-index XXXXXXX..XXXXXXX 100644
++++ b/include/hw/gpio/stm32l4x5_gpio.h
---- a/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@
-+++ b/target/arm/cpu.h
+ #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+ OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
-     void *el_change_hook_opaque;
++#define NUM_GPIOS 8
-     int32_t node_id; /* NUMA node this CPU belongs to */
+ #define GPIO_NUM_PINS 16
-+
-+    /* Used to synchronize KVM and QEMU in-kernel device levels */
+ struct Stm32l4x5GpioState {
-+    uint8_t device_irq_level;
+diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
- static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
++static const struct {
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
++    uint32_t addr;
-index XXXXXXX..XXXXXXX 100644
++    uint32_t moder_reset;
---- a/accel/kvm/kvm-all.c
++    uint32_t ospeedr_reset;
-+++ b/accel/kvm/kvm-all.c
++    uint32_t pupdr_reset;
-@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
++} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
-     return kvm_state->intx_set_mask;
++    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
  static void stm32l4x5_soc_initfn(Object *obj)
  {
      Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
      }
      object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
      object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
 +        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
 +    }
  }
-+bool kvm_arm_supports_user_irq(void)
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+{
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
+     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
-+}
+     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
-+
+     MemoryRegion *system_memory = get_system_memory();
- #ifdef KVM_CAP_SET_GUEST_DEBUG
+-    DeviceState *armv7m;
- struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
++    DeviceState *armv7m, *dev;
-                                                  target_ulong pc)
+     SysBusDevice *busdev;
-diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
++    uint32_t pin_index;
-index XXXXXXX..XXXXXXX 100644
---- a/accel/stubs/kvm-stub.c
+     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
-+++ b/accel/stubs/kvm-stub.c
+                                 sc->flash_size, errp)) {
-@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
  {
      abort();
  }
 +
 +bool kvm_arm_supports_user_irq(void)
 +{
 +    return false;
 +}
  #endif
 diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic.c
 +++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@
  #include "qom/cpu.h"
  #include "qemu/log.h"
  #include "trace.h"
 +#include "sysemu/kvm.h"
  /* #define DEBUG_GIC */
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
          return;
      }
-+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
++    /* GPIOs */
-+        error_setg(errp, "KVM with user space irqchip only works when the "
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
-+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
++        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
-+        return;
++        dev = DEVICE(&s->gpio[i]);
 +        qdev_prop_set_string(dev, "name", name);
 +        qdev_prop_set_uint32(dev, "mode-reset",
 +                             stm32l4x5_gpio_cfg[i].moder_reset);
 +        qdev_prop_set_uint32(dev, "ospeed-reset",
 +                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
 +        qdev_prop_set_uint32(dev, "pupd-reset",
 +                            stm32l4x5_gpio_cfg[i].pupdr_reset);
 +        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
 +        g_free(name);
 +        name = g_strdup_printf("gpio%c-out", 'a' + i);
 +        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
 +            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
 +        if (!sysbus_realize(busdev, errp)) {
 +            return;
 +        }
 +        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
 +    }
 +
-     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
+     /* System configuration controller */
-     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
+     busdev = SYS_BUS_DEVICE(&s->syscfg);
+     if (!sysbus_realize(busdev, errp)) {
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
+         return;
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/target/arm/kvm.c
+     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-+++ b/target/arm/kvm.c
+-    /*
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
+-     * TODO: when the GPIO device is implemented, connect it
-      */
+-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     kvm_async_interrupts_allowed = true;
+-     * GPIO_NUM_PINS.
+-     */
-+    /*
++
-+     * PSCI wakes up secondary cores, so we always need to
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
-+     * have vCPUs waiting in kernel space
++        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
-+     */
++            pin_index = GPIO_NUM_PINS * i + j;
-+    kvm_halt_in_kernel_allowed = true;
++            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
-+
++                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
-     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
++                                  pin_index));
++        }
      type_register_static(&host_arm_cpu_type_info);
@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
  MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
  {
 +    ARMCPU *cpu;
 +    uint32_t switched_level;
 +
 +    if (kvm_irqchip_in_kernel()) {
 +        /*
 +         * We only need to sync timer states with user-space interrupt
 +         * controllers, so return early and save cycles if we don't.
 +         */
 +        return MEMTXATTRS_UNSPECIFIED;
 +    }
-+
-+    cpu = ARM_CPU(cs);
+     /* EXTI device */
-+
+     busdev = SYS_BUS_DEVICE(&s->exti);
-+    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
+         }
-+        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
+     }
-+
-+        qemu_mutex_lock_iothread();
+-    for (unsigned i = 0; i < 16; i++) {
-+
++    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
-+        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
+         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
-+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
+                               qdev_get_gpio_in(DEVICE(&s->exti), i));
-+                         !!(run->s.regs.device_irq_level &
+     }
-+                            KVM_ARM_DEV_EL1_VTIMER));
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
+     /* RESERVED:    0x40024400, 0x7FDBC00 */
-+        }
-+
+     /* AHB2 BUS */
-+        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
+-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
+-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-+                         !!(run->s.regs.device_irq_level &
+-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-+                            KVM_ARM_DEV_EL1_PTIMER));
+-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-+            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
+-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-+        }
+-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-+
+-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-+        /* XXX PMU IRQ is missing */
+-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
-+
+     /* RESERVED:    0x48002000, 0x7FDBC00 */
-+        if (switched_level) {
+     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
-+            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
+     create_unimplemented_device("ADC",       0x50040000, 0x400);
-+                          __func__, switched_level);
+diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
-+        }
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/hw/misc/stm32l4x5_syscfg.c
-+        /* We also mark unknown levels as processed to not waste cycles */
++++ b/hw/misc/stm32l4x5_syscfg.c
-+        cpu->device_irq_level = run->s.regs.device_irq_level;
+@@ -XXX,XX +XXX,XX @@
-+        qemu_mutex_unlock_iothread();
+ #include "hw/irq.h"
-+    }
+ #include "migration/vmstate.h"
-+
+ #include "hw/misc/stm32l4x5_syscfg.h"
-     return MEMTXATTRS_UNSPECIFIED;
++#include "hw/gpio/stm32l4x5_gpio.h"
- }
+ #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
-.7.4
+.34.1

-New patch
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
+The testcase contains :
+- `test_idr_reset_value()` :
+Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
+- `test_gpio_output_mode()` :
+Checks that writing a bit in register ODR results in the corresponding
+pin rising or lowering, if this pin is configured in output mode.
+- `test_gpio_input_mode()` :
+Checks that a input pin set high or low externally results
+in the pin rising and lowering.
+- `test_pull_up_pull_down()` :
+Checks that a floating pin in pull-up/down mode is actually high/down.
+- `test_push_pull()` :
+Checks that a pin set externally is disconnected when configured in
+push-pull output mode, and can't be set externally while in this mode.
+- `test_open_drain()` :
+Checks that a pin set externally high is disconnected when configured
+in open-drain output mode, and can't be set high while in this mode.
+- `test_bsrr_brr()` :
+Checks that writing to BSRR and BRR has the desired result in ODR.
+- `test_clock_enable()` :
+Checks that GPIO clock is at the right frequency after enabling it.
+Acked-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
+Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
+ tests/qtest/meson.build           |   3 +-
+files changed, 553 insertions(+), 1 deletion(-)
+ create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/stm32l4x5_gpio-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for STM32L4x5_GPIO
++ *
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ */
++
++#include "qemu/osdep.h"
++#include "libqtest-single.h"
++
++#define GPIO_BASE_ADDR 0x48000000
++#define GPIO_SIZE      0x400
++#define NUM_GPIOS      8
++#define NUM_GPIO_PINS  16
++
++#define GPIO_A 0x48000000
++#define GPIO_B 0x48000400
++#define GPIO_C 0x48000800
++#define GPIO_D 0x48000C00
++#define GPIO_E 0x48001000
++#define GPIO_F 0x48001400
++#define GPIO_G 0x48001800
++#define GPIO_H 0x48001C00
++
++#define MODER 0x00
++#define OTYPER 0x04
++#define PUPDR 0x0C
++#define IDR 0x10
++#define ODR 0x14
++#define BSRR 0x18
++#define BRR 0x28
++
++#define MODER_INPUT 0
++#define MODER_OUTPUT 1
++
++#define PUPDR_NONE 0
++#define PUPDR_PULLUP 1
++#define PUPDR_PULLDOWN 2
++
++#define OTYPER_PUSH_PULL 0
++#define OTYPER_OPEN_DRAIN 1
++
++const uint32_t moder_reset[NUM_GPIOS] = {
++    0xABFFFFFF,
++    0xFFFFFEBF,
++    0xFFFFFFFF,
++    0xFFFFFFFF,
++    0xFFFFFFFF,
++    0xFFFFFFFF,
++    0xFFFFFFFF,
++    0x0000000F
++};
++
++const uint32_t pupdr_reset[NUM_GPIOS] = {
++    0x64000000,
++    0x00000100,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000
++};
++
++const uint32_t idr_reset[NUM_GPIOS] = {
++    0x0000A000,
++    0x00000010,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000,
++    0x00000000
++};
++
++static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
++{
++    return readl(gpio + offset);
++}
++
++static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
++{
++    writel(gpio + offset, value);
++}
++
++static void gpio_set_bit(unsigned int gpio, unsigned int reg,
++                         unsigned int pin, uint32_t value)
++{
++    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
++    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
++}
++
++static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
++                           unsigned int pin, uint32_t value)
++{
++    uint32_t offset = 2 * pin;
++    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
++    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
++}
++
++static unsigned int get_gpio_id(uint32_t gpio_addr)
++{
++    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
++}
++
++static void gpio_set_irq(unsigned int gpio, int num, int level)
++{
++    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
++                                            get_gpio_id(gpio) + 'a');
++    qtest_set_irq_in(global_qtest, name, NULL, num, level);
++}
++
++static void disconnect_all_pins(unsigned int gpio)
++{
++    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
++                                            get_gpio_id(gpio) + 'a');
++    QDict *r;
++
++    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
++        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
++        path, 0xFFFF);
++    g_assert_false(qdict_haskey(r, "error"));
++    qobject_unref(r);
++}
++
++static uint32_t get_disconnected_pins(unsigned int gpio)
++{
++    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
++                                            get_gpio_id(gpio) + 'a');
++    uint32_t disconnected_pins = 0;
++    QDict *r;
++
++    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
++        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
++    g_assert_false(qdict_haskey(r, "error"));
++    disconnected_pins = qdict_get_int(r, "return");
++    qobject_unref(r);
++    return disconnected_pins;
++}
++
++static uint32_t reset(uint32_t gpio, unsigned int offset)
++{
++    switch (offset) {
++    case MODER:
++        return moder_reset[get_gpio_id(gpio)];
++    case PUPDR:
++        return pupdr_reset[get_gpio_id(gpio)];
++    case IDR:
++        return idr_reset[get_gpio_id(gpio)];
++    }
++    return 0x0;
++}
++
++static void system_reset(void)
++{
++    QDict *r;
++    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
++    g_assert_false(qdict_haskey(r, "error"));
++    qobject_unref(r);
++}
++
++static void test_idr_reset_value(void)
++{
++    /*
++     * Checks that the values in MODER, OTYPER, PUPDR and ODR
++     * after reset are correct, and that the value in IDR is
++     * coherent.
++     * Since AF and analog modes aren't implemented, IDR reset
++     * values aren't the same as with a real board.
++     *
++     * Register IDR contains the actual values of all GPIO pins.
++     * Its value depends on the pins' configuration
++     * (intput/output/analog : register MODER, push-pull/open-drain :
++     * register OTYPER, pull-up/pull-down/none : register PUPDR)
++     * and on the values stored in register ODR
++     * (in case the pin is in output mode).
++     */
++
++    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
++    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
++    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
++    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
++
++    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
++    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
++    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
++    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
++
++    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
++    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
++    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
++    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
++
++    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
++    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
++    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
++    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
++
++    system_reset();
++
++    uint32_t moder = gpio_readl(GPIO_A, MODER);
++    uint32_t odr = gpio_readl(GPIO_A, ODR);
++    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
++    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
++    uint32_t idr = gpio_readl(GPIO_A, IDR);
++    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
++    /* here AF is the same as Analog and Input mode */
++    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
++    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
++    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
++    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
++    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
++    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
++    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
++
++    moder = gpio_readl(GPIO_B, MODER);
++    odr = gpio_readl(GPIO_B, ODR);
++    otyper = gpio_readl(GPIO_B, OTYPER);
++    pupdr = gpio_readl(GPIO_B, PUPDR);
++    idr = gpio_readl(GPIO_B, IDR);
++    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
++    /* here AF is the same as Analog and Input mode */
++    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
++    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
++    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
++    /* ... 5: neither, 4: pull-up, 3: neither ... */
++    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
++    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
++    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
++
++    moder = gpio_readl(GPIO_C, MODER);
++    odr = gpio_readl(GPIO_C, ODR);
++    otyper = gpio_readl(GPIO_C, OTYPER);
++    pupdr = gpio_readl(GPIO_C, PUPDR);
++    idr = gpio_readl(GPIO_C, IDR);
++    /* Analog, same as Input mode*/
++    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
++    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
++    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
++    /* no pull-up or pull-down */
++    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
++    /* reset value */
++    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
++
++    moder = gpio_readl(GPIO_H, MODER);
++    odr = gpio_readl(GPIO_H, ODR);
++    otyper = gpio_readl(GPIO_H, OTYPER);
++    pupdr = gpio_readl(GPIO_H, PUPDR);
++    idr = gpio_readl(GPIO_H, IDR);
++    /* Analog, same as Input mode */
++    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
++    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
++    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
++    /* no pull-up or pull-down */
++    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
++    /* reset value */
++    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
++}
++
++static void test_gpio_output_mode(const void *data)
++{
++    /*
++     * Checks that setting a bit in ODR sets the corresponding
++     * GPIO line high : it should set the right bit in IDR
++     * and send an irq to syscfg.
++     * Additionally, it checks that values written to ODR
++     * when not in output mode are stored and not discarded.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++    unsigned int gpio_id = get_gpio_id(gpio);
++
++    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
++
++    /* Set a bit in ODR and check nothing happens */
++    gpio_set_bit(gpio, ODR, pin, 1);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
++    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Configure the relevant line as output and check the pin is high */
++    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
++    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Reset the bit in ODR and check the pin is low */
++    gpio_set_bit(gpio, ODR, pin, 0);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Clean the test */
++    gpio_writel(gpio, ODR, reset(gpio, ODR));
++    gpio_writel(gpio, MODER, reset(gpio, MODER));
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
++    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++}
++
++static void test_gpio_input_mode(const void *data)
++{
++    /*
++     * Test that setting a line high/low externally sets the
++     * corresponding GPIO line high/low : it should set the
++     * right bit in IDR and send an irq to syscfg.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++    unsigned int gpio_id = get_gpio_id(gpio);
++
++    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
++
++    /* Configure a line as input, raise it, and check that the pin is high */
++    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
++    gpio_set_irq(gpio, pin, 1);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
++    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Lower the line and check that the pin is low */
++    gpio_set_irq(gpio, pin, 0);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Clean the test */
++    gpio_writel(gpio, MODER, reset(gpio, MODER));
++    disconnect_all_pins(gpio);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
++}
++
++static void test_pull_up_pull_down(const void *data)
++{
++    /*
++     * Test that a floating pin with pull-up sets the pin
++     * high and vice-versa.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++    unsigned int gpio_id = get_gpio_id(gpio);
++
++    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
++
++    /* Configure a line as input with pull-up, check the line is set high */
++    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
++    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
++    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Configure the line with pull-down, check the line is low */
++    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
++
++    /* Clean the test */
++    gpio_writel(gpio, MODER, reset(gpio, MODER));
++    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
++}
++
++static void test_push_pull(const void *data)
++{
++    /*
++     * Test that configuring a line in push-pull output mode
++     * disconnects the pin, that the pin can't be set or reset
++     * externally afterwards.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
++
++    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
++
++    /* Setting a line high externally, configuring it in push-pull output */
++    /* And checking the pin was disconnected */
++    gpio_set_irq(gpio, pin, 1);
++    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
++    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++
++    /* Setting a line low externally, configuring it in push-pull output */
++    /* And checking the pin was disconnected */
++    gpio_set_irq(gpio2, pin, 0);
++    gpio_set_bit(gpio2, ODR, pin, 1);
++    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
++    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
++
++    /* Trying to set a push-pull output pin, checking it doesn't work */
++    gpio_set_irq(gpio, pin, 1);
++    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++
++    /* Trying to reset a push-pull output pin, checking it doesn't work */
++    gpio_set_irq(gpio2, pin, 0);
++    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
++
++    /* Clean the test */
++    gpio_writel(gpio, MODER, reset(gpio, MODER));
++    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
++    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
++}
++
++static void test_open_drain(const void *data)
++{
++    /*
++     * Test that configuring a line in open-drain output mode
++     * disconnects a pin set high externally and that the pin
++     * can't be set high externally while configured in open-drain.
++     *
++     * However a pin set low externally shouldn't be disconnected,
++     * and it can be set low externally when in open-drain mode.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
++
++    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
++
++    /* Setting a line high externally, configuring it in open-drain output */
++    /* And checking the pin was disconnected */
++    gpio_set_irq(gpio, pin, 1);
++    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
++    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
++    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++
++    /* Setting a line low externally, configuring it in open-drain output */
++    /* And checking the pin wasn't disconnected */
++    gpio_set_irq(gpio2, pin, 0);
++    gpio_set_bit(gpio2, ODR, pin, 1);
++    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
++    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
++    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
++    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
++                               reset(gpio2, IDR) & ~(1 << pin));
++
++    /* Trying to set a open-drain output pin, checking it doesn't work */
++    gpio_set_irq(gpio, pin, 1);
++    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
++
++    /* Trying to reset a open-drain output pin, checking it works */
++    gpio_set_bit(gpio, ODR, pin, 1);
++    gpio_set_irq(gpio, pin, 0);
++    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
++    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
++                               reset(gpio2, IDR) & ~(1 << pin));
++
++    /* Clean the test */
++    disconnect_all_pins(gpio2);
++    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
++    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
++    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
++    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
++    disconnect_all_pins(gpio);
++    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
++    gpio_writel(gpio, ODR, reset(gpio, ODR));
++    gpio_writel(gpio, MODER, reset(gpio, MODER));
++    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
++}
++
++static void test_bsrr_brr(const void *data)
++{
++    /*
++     * Test that writing a '1' in BSS and BSRR
++     * has the desired effect on ODR.
++     * In BSRR, BSx has priority over BRx.
++     */
++    unsigned int pin = ((uint64_t)data) & 0xF;
++    uint32_t gpio = ((uint64_t)data) >> 32;
++
++    gpio_writel(gpio, BSRR, (1 << pin));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
++
++    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
++
++    gpio_writel(gpio, BSRR, (1 << pin));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
++
++    gpio_writel(gpio, BRR, (1 << pin));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
++
++    /* BSx should have priority over BRx */
++    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
++
++    gpio_writel(gpio, BRR, (1 << pin));
++    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
++
++    gpio_writel(gpio, ODR, reset(gpio, ODR));
++}
++
++int main(int argc, char **argv)
++{
++    int ret;
++
++    g_test_init(&argc, &argv, NULL);
++    g_test_set_nonfatal_assertions();
++    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
++                   test_idr_reset_value);
++    /*
++     * The inputs for the tests (gpio and pin) can be changed,
++     * but the tests don't work for pins that are high at reset
++     * (GPIOA15, GPIO13 and GPIOB5).
++     * Specifically, rising the pin then checking `get_irq()`
++     * is problematic since the pin was already high.
++     */
++    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
++                        (void *)((uint64_t)GPIO_C << 32 | 5),
++                        test_gpio_output_mode);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
++                        (void *)((uint64_t)GPIO_H << 32 | 3),
++                        test_gpio_output_mode);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
++                        (void *)((uint64_t)GPIO_D << 32 | 6),
++                        test_gpio_input_mode);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
++                        (void *)((uint64_t)GPIO_C << 32 | 10),
++                        test_gpio_input_mode);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
++                        (void *)((uint64_t)GPIO_B << 32 | 5),
++                        test_pull_up_pull_down);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
++                        (void *)((uint64_t)GPIO_F << 32 | 1),
++                        test_pull_up_pull_down);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
++                        (void *)((uint64_t)GPIO_G << 32 | 6),
++                        test_push_pull);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
++                        (void *)((uint64_t)GPIO_H << 32 | 3),
++                        test_push_pull);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
++                        (void *)((uint64_t)GPIO_C << 32 | 4),
++                        test_open_drain);
++    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
++                        (void *)((uint64_t)GPIO_E << 32 | 11),
++                        test_open_drain);
++    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
++                        (void *)((uint64_t)GPIO_A << 32 | 12),
++                        test_bsrr_brr);
++    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
++                        (void *)((uint64_t)GPIO_D << 32 | 0),
++                        test_bsrr_brr);
++
++    qtest_start("-machine b-l475e-iot01a");
++    ret = g_test_run();
++    qtest_end();
++
++    return ret;
++}
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
+ qtests_stm32l4x5 = \
+   ['stm32l4x5_exti-test',
+    'stm32l4x5_syscfg-test',
+-   'stm32l4x5_rcc-test']
++   'stm32l4x5_rcc-test',
++   'stm32l4x5_gpio-test']
+ qtests_arm = \
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
+--
+.34.1

-New patch
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
+From: Richard Henderson <richard.henderson@linaro.org>
 While the 8-bit input elements are sequential in the input vector,
 the 32-bit output elements are not sequential in the output matrix.
 Do not attempt to compute 2 32-bit outputs at the same time.
 Cc: qemu-stable@nongnu.org
 Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
  tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
  tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
  tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 147 insertions(+), 33 deletions(-)
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sme_helper.c
 +++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
      }
  }
 -typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
 +static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn32 *fn)
 +{
 +    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
 +    bool neg = simd_data(desc);
 -static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 -                            uint8_t *pn, uint8_t *pm,
 -                            uint32_t desc, IMOPFn *fn)
 +    for (row = 0; row < oprsz; ++row) {
 +        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
 +        uint32_t *za_row = &za[tile_vslice_index(row)];
 +        uint32_t n = zn[H4(row)];
 +
 +        for (col = 0; col < oprsz; ++col) {
 +            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
 +            uint32_t *a = &za_row[H4(col)];
 +
 +            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
 +        }
 +    }
 +}
 +
 +typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn64 *fn)
  {
      intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
      bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
  }
  #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
 -static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
 +static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
  {                                                                           \
 -    uint32_t sum0 = 0, sum1 = 0;                                            \
 +    uint32_t sum = 0;                                                       \
      /* Apply P to N as a mask, making the inactive elements 0. */           \
      n &= expand_pred_b(p);                                                  \
 -    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
 -    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
 -    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
 -    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
 -    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
 -    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
 -    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
 -    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
 -    if (neg) {                                                              \
 -        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
 -    } else {                                                                \
 -        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
 -    }                                                                       \
 -    return ((uint64_t)sum1 << 32) | sum0;                                   \
 +    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
 +    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
 +    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
 +    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
 +    return neg ? a - sum : a + sum;                                         \
  }
  #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
  DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
  DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 -#define DEF_IMOPH(NAME) \
 -    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
 -                            void *vpm, uint32_t desc)                        \
 -    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
 +#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  # SME Tests
  ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
 -AARCH64_TESTS += sme-outprod1
 +AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
  endif
  # System Registers Tests
 --
 .34.1

-[Qemu-devel] [PULL 2/4] aspeed: Register all watchdogs
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-From: Joel Stanley <joel@jms.id.au>
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
 was unfortunately added with a license of GPL-v3-or-later, which is
 not compatible with other QEMU code which has a GPL-v2-only license.
-The ast2400 contains two and the ast2500 contains three watchdogs.
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-Add this information to the AspeedSoCInfo and realise the correct number
+to make it compatible with the rest of QEMU.
 of watchdogs for that each SoC type.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
 Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  4 +++-
+ include/hw/rtc/sun4v-rtc.h | 2 +-
- hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
+ hw/rtc/sun4v-rtc.c         | 2 +-
-files changed, 20 insertions(+), 9 deletions(-)
+files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/include/hw/rtc/sun4v-rtc.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/net/ftgmac100.h"
+  *
+  * Copyright (c) 2016 Artyom Tarasenko
- #define ASPEED_SPIS_NUM  2
+  *
-+#define ASPEED_WDTS_NUM  3
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
- typedef struct AspeedSoCState {
+  * version.
-     /*< private >*/
+  */
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
-     AspeedSMCState fmc;
+diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
      AspeedSMCState spi[ASPEED_SPIS_NUM];
      AspeedSDMCState sdmc;
 -    AspeedWDTState wdt;
 +    AspeedWDTState wdt[ASPEED_WDTS_NUM];
      FTGMAC100State ftgmac100;
  } AspeedSoCState;
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
      const hwaddr *spi_bases;
      const char *fmc_typename;
      const char **spi_typename;
 +    int wdts_num;
  } AspeedSoCInfo;
  typedef struct AspeedSoCClass {
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/hw/rtc/sun4v-rtc.c
-+++ b/hw/arm/aspeed_soc.c
++++ b/hw/rtc/sun4v-rtc.c
-@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
+@@ -XXX,XX +XXX,XX @@
-         .spi_bases    = aspeed_soc_ast2400_spi_bases,
+  *
-         .fmc_typename = "aspeed.smc.fmc",
+  * Copyright (c) 2016 Artyom Tarasenko
-         .spi_typename = aspeed_soc_ast2400_typenames,
+  *
-+        .wdts_num     = 2,
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-     }, {
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-         .name         = "ast2400-a1",
+  * version.
-         .cpu_model    = "arm926",
+  */
-@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2400",
          .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2500-a1",
          .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2500_spi_bases,
          .fmc_typename = "aspeed.smc.ast2500-fmc",
          .spi_typename = aspeed_soc_ast2500_typenames,
 +        .wdts_num     = 3,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                                "ram-size", &error_abort);
 -    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
 -    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
 -    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
 +    for (i = 0; i < sc->info->wdts_num; i++) {
 +        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
 +        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
 +        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
 +    }
      object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
      object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
      /* Watch dog */
 -    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
 -    if (err) {
 -        error_propagate(errp, err);
 -        return;
 +    for (i = 0; i < sc->info->wdts_num; i++) {
 +        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
 +        if (err) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
 +                        ASPEED_SOC_WDT_BASE + i * 0x20);
      }
 -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
      /* Net */
      qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
 --
-.7.4
+.34.1

-New patch
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
+From: Thomas Huth <thuth@redhat.com>
+Move the code to a separate file so that we do not have to compile
+it anymore if CONFIG_ARM_V7M is not set.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240308141051.536599-2-thuth@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
+ target/arm/meson.build     |   3 +
+ target/arm/tcg/meson.build |   3 +
+files changed, 296 insertions(+), 261 deletions(-)
+ create mode 100644 target/arm/tcg/cpu-v7m.c
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/arm/tcg/cpu-v7m.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QEMU ARMv7-M TCG-only CPUs.
++ *
++ * Copyright (c) 2012 SUSE LINUX Products GmbH
++ *
++ * This code is licensed under the GNU GPL v2 or later.
++ *
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ */
++
++#include "qemu/osdep.h"
++#include "cpu.h"
++#include "hw/core/tcg-cpu-ops.h"
++#include "internals.h"
++
++#if !defined(CONFIG_USER_ONLY)
++
++#include "hw/intc/armv7m_nvic.h"
++
++static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
++{
++    CPUClass *cc = CPU_GET_CLASS(cs);
++    ARMCPU *cpu = ARM_CPU(cs);
++    CPUARMState *env = &cpu->env;
++    bool ret = false;
++
++    /*
++     * ARMv7-M interrupt masking works differently than -A or -R.
++     * There is no FIQ/IRQ distinction. Instead of I and F bits
++     * masking FIQ and IRQ interrupts, an exception is taken only
++     * if it is higher priority than the current execution priority
++     * (which depends on state like BASEPRI, FAULTMASK and the
++     * currently active exception).
++     */
++    if (interrupt_request & CPU_INTERRUPT_HARD
++        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
++        cs->exception_index = EXCP_IRQ;
++        cc->tcg_ops->do_interrupt(cs);
++        ret = true;
++    }
++    return ret;
++}
++
++#endif /* !CONFIG_USER_ONLY */
++
++static void cortex_m0_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    set_feature(&cpu->env, ARM_FEATURE_V6);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++
++    cpu->midr = 0x410cc200;
++
++    /*
++     * These ID register values are not guest visible, because
++     * we do not implement the Main Extension. They must be set
++     * to values corresponding to the Cortex-M0's implemented
++     * features, because QEMU generally controls its emulation
++     * by looking at ID register fields. We use the same values as
++     * for the M3.
++     */
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00000030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x00000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01141110;
++    cpu->isar.id_isar1 = 0x02111000;
++    cpu->isar.id_isar2 = 0x21112231;
++    cpu->isar.id_isar3 = 0x01111110;
++    cpu->isar.id_isar4 = 0x01310102;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m3_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    cpu->midr = 0x410fc231;
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00000030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x00000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01141110;
++    cpu->isar.id_isar1 = 0x02111000;
++    cpu->isar.id_isar2 = 0x21112231;
++    cpu->isar.id_isar3 = 0x01111110;
++    cpu->isar.id_isar4 = 0x01310102;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m4_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fc240; /* r0p0 */
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.mvfr0 = 0x10110021;
++    cpu->isar.mvfr1 = 0x11000011;
++    cpu->isar.mvfr2 = 0x00000000;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00000030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x00000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01141110;
++    cpu->isar.id_isar1 = 0x02111000;
++    cpu->isar.id_isar2 = 0x21112231;
++    cpu->isar.id_isar3 = 0x01111110;
++    cpu->isar.id_isar4 = 0x01310102;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m7_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x411fc272; /* r1p2 */
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.mvfr0 = 0x10110221;
++    cpu->isar.mvfr1 = 0x12000011;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00100030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01101110;
++    cpu->isar.id_isar1 = 0x02112000;
++    cpu->isar.id_isar2 = 0x20232231;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m33_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V8);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fd213; /* r0p3 */
++    cpu->pmsav7_dregion = 16;
++    cpu->sau_sregion = 8;
++    cpu->isar.mvfr0 = 0x10110021;
++    cpu->isar.mvfr1 = 0x11000011;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000210;
++    cpu->isar.id_dfr0 = 0x00200000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00101F40;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01101110;
++    cpu->isar.id_isar1 = 0x02212000;
++    cpu->isar.id_isar2 = 0x20232232;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++    cpu->clidr = 0x00000000;
++    cpu->ctr = 0x8000c000;
++}
++
++static void cortex_m55_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V8);
++    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fd221; /* r0p1 */
++    cpu->revidr = 0;
++    cpu->pmsav7_dregion = 16;
++    cpu->sau_sregion = 8;
++    /* These are the MVFR* values for the FPU + full MVE configuration */
++    cpu->isar.mvfr0 = 0x10110221;
++    cpu->isar.mvfr1 = 0x12100211;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x20000030;
++    cpu->isar.id_pfr1 = 0x00000230;
++    cpu->isar.id_dfr0 = 0x10200000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00111040;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000011;
++    cpu->isar.id_isar0 = 0x01103110;
++    cpu->isar.id_isar1 = 0x02212000;
++    cpu->isar.id_isar2 = 0x20232232;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++    cpu->clidr = 0x00000000; /* caches not implemented */
++    cpu->ctr = 0x8303c003;
++}
++
++static const TCGCPUOps arm_v7m_tcg_ops = {
++    .initialize = arm_translate_init,
++    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
++    .debug_excp_handler = arm_debug_excp_handler,
++    .restore_state_to_opc = arm_restore_state_to_opc,
++
++#ifdef CONFIG_USER_ONLY
++    .record_sigsegv = arm_cpu_record_sigsegv,
++    .record_sigbus = arm_cpu_record_sigbus,
++#else
++    .tlb_fill = arm_cpu_tlb_fill,
++    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
++    .do_interrupt = arm_v7m_cpu_do_interrupt,
++    .do_transaction_failed = arm_cpu_do_transaction_failed,
++    .do_unaligned_access = arm_cpu_do_unaligned_access,
++    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
++    .debug_check_watchpoint = arm_debug_check_watchpoint,
++    .debug_check_breakpoint = arm_debug_check_breakpoint,
++#endif /* !CONFIG_USER_ONLY */
++};
++
++static void arm_v7m_class_init(ObjectClass *oc, void *data)
++{
++    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
++    CPUClass *cc = CPU_CLASS(oc);
++
++    acc->info = data;
++    cc->tcg_ops = &arm_v7m_tcg_ops;
++    cc->gdb_core_xml_file = "arm-m-profile.xml";
++}
++
++static const ARMCPUInfo arm_v7m_cpus[] = {
++    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
++                             .class_init = arm_v7m_class_init },
++};
++
++static void arm_v7m_cpu_register_types(void)
++{
++    size_t i;
++
++    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
++        arm_cpu_register(&arm_v7m_cpus[i]);
++    }
++}
++
++type_init(arm_v7m_cpu_register_types)
+diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/cpu32.c
++++ b/target/arm/tcg/cpu32.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #endif
+ #include "cpregs.h"
+-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+-#include "hw/intc/armv7m_nvic.h"
+-#endif
+ /* Share AArch32 -cpu max features with AArch64. */
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
+ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
+-#if !defined(CONFIG_USER_ONLY)
+-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+-{
+-    CPUClass *cc = CPU_GET_CLASS(cs);
+-    ARMCPU *cpu = ARM_CPU(cs);
+-    CPUARMState *env = &cpu->env;
+-    bool ret = false;
+-
+-    /*
+-     * ARMv7-M interrupt masking works differently than -A or -R.
+-     * There is no FIQ/IRQ distinction. Instead of I and F bits
+-     * masking FIQ and IRQ interrupts, an exception is taken only
+-     * if it is higher priority than the current execution priority
+-     * (which depends on state like BASEPRI, FAULTMASK and the
+-     * currently active exception).
+-     */
+-    if (interrupt_request & CPU_INTERRUPT_HARD
+-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+-        cs->exception_index = EXCP_IRQ;
+-        cc->tcg_ops->do_interrupt(cs);
+-        ret = true;
+-    }
+-    return ret;
+-}
+-#endif /* !CONFIG_USER_ONLY */
+-
+ static void arm926_initfn(Object *obj)
+ {
+     ARMCPU *cpu = ARM_CPU(obj);
+@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
+     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
+ }
+-static void cortex_m0_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-    set_feature(&cpu->env, ARM_FEATURE_V6);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-
+-    cpu->midr = 0x410cc200;
+-
+-    /*
+-     * These ID register values are not guest visible, because
+-     * we do not implement the Main Extension. They must be set
+-     * to values corresponding to the Cortex-M0's implemented
+-     * features, because QEMU generally controls its emulation
+-     * by looking at ID register fields. We use the same values as
+-     * for the M3.
+-     */
+-    cpu->isar.id_pfr0 = 0x00000030;
+-    cpu->isar.id_pfr1 = 0x00000200;
+-    cpu->isar.id_dfr0 = 0x00100000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00000030;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x00000000;
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01141110;
+-    cpu->isar.id_isar1 = 0x02111000;
+-    cpu->isar.id_isar2 = 0x21112231;
+-    cpu->isar.id_isar3 = 0x01111110;
+-    cpu->isar.id_isar4 = 0x01310102;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-}
+-
+-static void cortex_m3_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    cpu->midr = 0x410fc231;
+-    cpu->pmsav7_dregion = 8;
+-    cpu->isar.id_pfr0 = 0x00000030;
+-    cpu->isar.id_pfr1 = 0x00000200;
+-    cpu->isar.id_dfr0 = 0x00100000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00000030;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x00000000;
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01141110;
+-    cpu->isar.id_isar1 = 0x02111000;
+-    cpu->isar.id_isar2 = 0x21112231;
+-    cpu->isar.id_isar3 = 0x01111110;
+-    cpu->isar.id_isar4 = 0x01310102;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-}
+-
+-static void cortex_m4_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+-    cpu->midr = 0x410fc240; /* r0p0 */
+-    cpu->pmsav7_dregion = 8;
+-    cpu->isar.mvfr0 = 0x10110021;
+-    cpu->isar.mvfr1 = 0x11000011;
+-    cpu->isar.mvfr2 = 0x00000000;
+-    cpu->isar.id_pfr0 = 0x00000030;
+-    cpu->isar.id_pfr1 = 0x00000200;
+-    cpu->isar.id_dfr0 = 0x00100000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00000030;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x00000000;
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01141110;
+-    cpu->isar.id_isar1 = 0x02111000;
+-    cpu->isar.id_isar2 = 0x21112231;
+-    cpu->isar.id_isar3 = 0x01111110;
+-    cpu->isar.id_isar4 = 0x01310102;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-}
+-
+-static void cortex_m7_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+-    cpu->midr = 0x411fc272; /* r1p2 */
+-    cpu->pmsav7_dregion = 8;
+-    cpu->isar.mvfr0 = 0x10110221;
+-    cpu->isar.mvfr1 = 0x12000011;
+-    cpu->isar.mvfr2 = 0x00000040;
+-    cpu->isar.id_pfr0 = 0x00000030;
+-    cpu->isar.id_pfr1 = 0x00000200;
+-    cpu->isar.id_dfr0 = 0x00100000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00100030;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x01000000;
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01101110;
+-    cpu->isar.id_isar1 = 0x02112000;
+-    cpu->isar.id_isar2 = 0x20232231;
+-    cpu->isar.id_isar3 = 0x01111131;
+-    cpu->isar.id_isar4 = 0x01310132;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-}
+-
+-static void cortex_m33_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-
+-    set_feature(&cpu->env, ARM_FEATURE_V8);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+-    cpu->midr = 0x410fd213; /* r0p3 */
+-    cpu->pmsav7_dregion = 16;
+-    cpu->sau_sregion = 8;
+-    cpu->isar.mvfr0 = 0x10110021;
+-    cpu->isar.mvfr1 = 0x11000011;
+-    cpu->isar.mvfr2 = 0x00000040;
+-    cpu->isar.id_pfr0 = 0x00000030;
+-    cpu->isar.id_pfr1 = 0x00000210;
+-    cpu->isar.id_dfr0 = 0x00200000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00101F40;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x01000000;
+-    cpu->isar.id_mmfr3 = 0x00000000;
+-    cpu->isar.id_isar0 = 0x01101110;
+-    cpu->isar.id_isar1 = 0x02212000;
+-    cpu->isar.id_isar2 = 0x20232232;
+-    cpu->isar.id_isar3 = 0x01111131;
+-    cpu->isar.id_isar4 = 0x01310132;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-    cpu->clidr = 0x00000000;
+-    cpu->ctr = 0x8000c000;
+-}
+-
+-static void cortex_m55_initfn(Object *obj)
+-{
+-    ARMCPU *cpu = ARM_CPU(obj);
+-
+-    set_feature(&cpu->env, ARM_FEATURE_V8);
+-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+-    set_feature(&cpu->env, ARM_FEATURE_M);
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+-    cpu->midr = 0x410fd221; /* r0p1 */
+-    cpu->revidr = 0;
+-    cpu->pmsav7_dregion = 16;
+-    cpu->sau_sregion = 8;
+-    /* These are the MVFR* values for the FPU + full MVE configuration */
+-    cpu->isar.mvfr0 = 0x10110221;
+-    cpu->isar.mvfr1 = 0x12100211;
+-    cpu->isar.mvfr2 = 0x00000040;
+-    cpu->isar.id_pfr0 = 0x20000030;
+-    cpu->isar.id_pfr1 = 0x00000230;
+-    cpu->isar.id_dfr0 = 0x10200000;
+-    cpu->id_afr0 = 0x00000000;
+-    cpu->isar.id_mmfr0 = 0x00111040;
+-    cpu->isar.id_mmfr1 = 0x00000000;
+-    cpu->isar.id_mmfr2 = 0x01000000;
+-    cpu->isar.id_mmfr3 = 0x00000011;
+-    cpu->isar.id_isar0 = 0x01103110;
+-    cpu->isar.id_isar1 = 0x02212000;
+-    cpu->isar.id_isar2 = 0x20232232;
+-    cpu->isar.id_isar3 = 0x01111131;
+-    cpu->isar.id_isar4 = 0x01310132;
+-    cpu->isar.id_isar5 = 0x00000000;
+-    cpu->isar.id_isar6 = 0x00000000;
+-    cpu->clidr = 0x00000000; /* caches not implemented */
+-    cpu->ctr = 0x8303c003;
+-}
+-
+ static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
+     /* Dummy the TCM region regs for the moment */
+     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
+@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
+     cpu->reset_sctlr = 0x00000078;
+ }
+-static const TCGCPUOps arm_v7m_tcg_ops = {
+-    .initialize = arm_translate_init,
+-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+-    .debug_excp_handler = arm_debug_excp_handler,
+-    .restore_state_to_opc = arm_restore_state_to_opc,
+-
+-#ifdef CONFIG_USER_ONLY
+-    .record_sigsegv = arm_cpu_record_sigsegv,
+-    .record_sigbus = arm_cpu_record_sigbus,
+-#else
+-    .tlb_fill = arm_cpu_tlb_fill,
+-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+-    .do_interrupt = arm_v7m_cpu_do_interrupt,
+-    .do_transaction_failed = arm_cpu_do_transaction_failed,
+-    .do_unaligned_access = arm_cpu_do_unaligned_access,
+-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+-    .debug_check_watchpoint = arm_debug_check_watchpoint,
+-    .debug_check_breakpoint = arm_debug_check_breakpoint,
+-#endif /* !CONFIG_USER_ONLY */
+-};
+-
+-static void arm_v7m_class_init(ObjectClass *oc, void *data)
+-{
+-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+-
+-    acc->info = data;
+-    cc->tcg_ops = &arm_v7m_tcg_ops;
+-    cc->gdb_core_xml_file = "arm-m-profile.xml";
+-}
+-
+ #ifndef TARGET_AARCH64
+ /*
+  * -cpu max: a CPU with as many features enabled as our emulation supports.
+@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
+     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
+     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
+-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+-                             .class_init = arm_v7m_class_init },
+     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
+     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
+     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
+   'ptw.c',
+ ))
++arm_user_ss = ss.source_set()
++
+ subdir('hvf')
+ if 'CONFIG_TCG' in config_all_accel
+@@ -XXX,XX +XXX,XX @@ endif
+ target_arch += {'arm': arm_ss}
+ target_system_arch += {'arm': arm_system_ss}
++target_user_arch += {'arm': arm_user_ss}
+diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/meson.build
++++ b/target/arm/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+ arm_system_ss.add(files(
+   'psci.c',
+ ))
++
++arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
++arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
+--
+.34.1

A surprisingly short target-arm queue, but no point in holding
onto these waiting for more code to arrive :-)

thanks
-- PMM

The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711

for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:

target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: ignore writes to CONTROL.SPSEL from Thread mode
 * KVM: Enable in-kernel timers with user space gic
 * aspeed: Register all watchdogs
 * hw/misc: Add Exynos4210 Pseudo Random Number Generator

----------------------------------------------------------------
Alexander Graf (1):
      ARM: KVM: Enable in-kernel timers with user space gic

Joel Stanley (1):
      aspeed: Register all watchdogs

Krzysztof Kozlowski (1):
      hw/misc: Add Exynos4210 Pseudo Random Number Generator

Peter Maydell (1):
      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode

From: Krzysztof Kozlowski <krzk@kernel.org>

Add emulation for Exynos4210 Pseudo Random Number Generator which could
work on fixed seeds or with seeds provided by True Random Number
Generator block inside the SoC.

Implement only the fixed seeds part of it in polling mode (no
interrupts).

Emulation tested with two independent Linux kernel exynos-rng drivers:
1. New kcapi-rng interface (targeting Linux v4.12),
2. Old hwrng inteface
   # echo "exynos" > /sys/class/misc/hw_random/rng_current
   # dd if=/dev/hwrng of=/dev/null bs=1 count=16

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Message-id: 20170425180609.11004-1-krzk@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: wrapped a few overlong lines; more efficient implementation
 of exynos4210_rng_seed_ready()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs    |   2 +-
 hw/arm/exynos4210.c      |   4 +
 hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 282 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/exynos4210_rng.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
 obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 obj-$(CONFIG_NSERIES) += cbus.o
 obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
 obj-$(CONFIG_IMX) += imx_ccm.o
 obj-$(CONFIG_IMX) += imx31_ccm.o
 obj-$(CONFIG_IMX) += imx25_ccm.o
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* Clock controller SFR base address */
 #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
 
+/* PRNG/HASH SFR base address */
+#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
+
 /* Display controllers (FIMD) */
 #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
 
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
 
     sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
+    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
 
     /* PWM */
     sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/exynos4210_rng.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  Exynos4210 Pseudo Random Nubmer Generator Emulation
+ *
+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the
+ *  Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "crypto/random.h"
+#include "hw/sysbus.h"
+#include "qemu/log.h"
+
+#define DEBUG_EXYNOS_RNG 0
+
+#define DPRINTF(fmt, ...) \
+    do { \
+        if (DEBUG_EXYNOS_RNG) { \
+            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
+        } \
+    } while (0)
+
+#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
+#define EXYNOS4210_RNG(obj) \
+    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
+
+/*
+ * Exynos4220, PRNG, only polling mode is supported.
+ */
+
+/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
+#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
+#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
+/* RNG_STATUS register bitfields, reset value: 0x1 */
+#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
+#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
+#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
+#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
+#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
+#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
+#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
+#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
+
+#define EXYNOS4210_RNG_CONTROL_1                  0x0
+#define EXYNOS4210_RNG_STATUS                    0x10
+#define EXYNOS4210_RNG_SEED_IN                  0x140
+#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
+#define EXYNOS4210_RNG_PRNG                     0x160
+#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
+
+#define EXYNOS4210_RNG_PRNG_NUM                 5
+
+#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
+
+typedef struct Exynos4210RngState {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+
+    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
+    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
+    uint32_t seed_set;
+
+    /* Register values */
+    uint32_t reg_control;
+    uint32_t reg_status;
+} Exynos4210RngState;
+
+static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
+{
+    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
+
+    /* Return true if all the seed-set bits are set. */
+    return (s->seed_set & mask) == mask;
+}
+
+static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
+                                    uint64_t val)
+{
+    /*
+     * We actually ignore the seed and always generate true random numbers.
+     * Theoretically this should not match the device as Exynos has
+     * a Pseudo Random Number Generator but testing shown that it always
+     * generates random numbers regardless of the seed value.
+     */
+    s->seed_set |= BIT(i);
+
+    /* If all seeds were written, update the status to reflect it */
+    if (exynos4210_rng_seed_ready(s)) {
+        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    } else {
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    }
+}
+
+static void exynos4210_rng_run_engine(Exynos4210RngState *s)
+{
+    Error *err = NULL;
+    int ret;
+
+    /* Seed set? */
+    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine chosen? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine started? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
+        goto out;
+    }
+
+    /* Get randoms */
+    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
+                               sizeof(s->randr_value), &err);
+    if (!ret) {
+        /* Notify that PRNG is ready */
+        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
+    } else {
+        error_report_err(err);
+    }
+
+out:
+    /* Always clear start engine bit */
+    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
+}
+
+static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
+                                    unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+    uint32_t val = 0;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        val = s->reg_control;
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        val = s->reg_status;
+        break;
+
+    case EXYNOS4210_RNG_PRNG_OFFSET(0):
+    case EXYNOS4210_RNG_PRNG_OFFSET(1):
+    case EXYNOS4210_RNG_PRNG_OFFSET(2):
+    case EXYNOS4210_RNG_PRNG_OFFSET(3):
+    case EXYNOS4210_RNG_PRNG_OFFSET(4):
+        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
+        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
+                offset, val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+
+    return val;
+}
+
+static void exynos4210_rng_write(void *opaque, hwaddr offset,
+                                 uint64_t val, unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
+        s->reg_control = val;
+        exynos4210_rng_run_engine(s);
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        /* For clearing status fields */
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        break;
+
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
+        exynos4210_rng_set_seed(s,
+                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
+                                val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+}
+
+static const MemoryRegionOps exynos4210_rng_ops = {
+    .read = exynos4210_rng_read,
+    .write = exynos4210_rng_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void exynos4210_rng_reset(DeviceState *dev)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
+
+    s->reg_control = 0;
+    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
+    memset(s->randr_value, 0, sizeof(s->randr_value));
+    s->seed_set = 0;
+}
+
+static void exynos4210_rng_init(Object *obj)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
+                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
+    sysbus_init_mmio(dev, &s->iomem);
+}
+
+static const VMStateDescription exynos4210_rng_vmstate = {
+    .name = TYPE_EXYNOS4210_RNG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
+                            EXYNOS4210_RNG_PRNG_NUM),
+        VMSTATE_UINT32(seed_set, Exynos4210RngState),
+        VMSTATE_UINT32(reg_status, Exynos4210RngState),
+        VMSTATE_UINT32(reg_control, Exynos4210RngState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = exynos4210_rng_reset;
+    dc->vmsd = &exynos4210_rng_vmstate;
+}
+
+static const TypeInfo exynos4210_rng_info = {
+    .name          = TYPE_EXYNOS4210_RNG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210RngState),
+    .instance_init = exynos4210_rng_init,
+    .class_init    = exynos4210_rng_class_init,
+};
+
+static void exynos4210_rng_register(void)
+{
+    type_register_static(&exynos4210_rng_info);
+}
+
+type_init(exynos4210_rng_register)
-- 
2.7.4

From: Joel Stanley <joel@jms.id.au>

The ast2400 contains two and the ast2500 contains three watchdogs.
Add this information to the AspeedSoCInfo and realise the correct number
of watchdogs for that each SoC type.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  4 +++-
 hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/ftgmac100.h"
 
 #define ASPEED_SPIS_NUM  2
+#define ASPEED_WDTS_NUM  3
 
 typedef struct AspeedSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSMCState fmc;
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     AspeedSDMCState sdmc;
-    AspeedWDTState wdt;
+    AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100;
 } AspeedSoCState;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     const hwaddr *spi_bases;
     const char *fmc_typename;
     const char **spi_typename;
+    int wdts_num;
 } AspeedSoCInfo;
 
 typedef struct AspeedSoCClass {
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400-a1",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2500-a1",
         .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2500_spi_bases,
         .fmc_typename = "aspeed.smc.ast2500-fmc",
         .spi_typename = aspeed_soc_ast2500_typenames,
+        .wdts_num     = 3,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size", &error_abort);
 
-    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
-    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
-    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
+        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
+        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
+    }
 
     object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
     object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
 
     /* Watch dog */
-    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
-    if (err) {
-        error_propagate(errp, err);
-        return;
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+                        ASPEED_SOC_WDT_BASE + i * 0x20);
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
 
     /* Net */
     qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
-- 
2.7.4

From: Alexander Graf <agraf@suse.de>

When running with KVM enabled, you can choose between emulating the
gic in kernel or user space. If the kernel supports in-kernel virtualization
of the interrupt controller, it will default to that. If not, if will
default to user space emulation.

Unfortunately when running in user mode gic emulation, we miss out on
interrupt events which are only available from kernel space, such as the timer.
This patch leverages the new kernel/user space pending line synchronization for
timer events. It does not handle PMU events yet.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h   | 11 +++++++++++
 target/arm/cpu.h       |  3 +++
 accel/kvm/kvm-all.c    |  5 +++++
 accel/stubs/kvm-stub.c |  5 +++++
 hw/intc/arm_gic.c      |  7 +++++++
 target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 82 insertions(+)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
 int kvm_cpu_exec(CPUState *cpu);
 int kvm_destroy_vcpu(CPUState *cpu);
 
+/**
+ * kvm_arm_supports_user_irq
+ *
+ * Not all KVM implementations support notifications for kernel generated
+ * interrupt events to user space. This function indicates whether the current
+ * KVM implementation does support them.
+ *
+ * Returns: true if KVM supports using kernel generated IRQs from user space
+ */
+bool kvm_arm_supports_user_irq(void);
+
 #ifdef NEED_CPU_H
 #include "cpu.h"
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     void *el_change_hook_opaque;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
+
+    /* Used to synchronize KVM and QEMU in-kernel device levels */
+    uint8_t device_irq_level;
 };
 
 static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
     return kvm_state->intx_set_mask;
 }
 
+bool kvm_arm_supports_user_irq(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
+}
+
 #ifdef KVM_CAP_SET_GUEST_DEBUG
 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                  target_ulong pc)
diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
 {
     abort();
 }
+
+bool kvm_arm_supports_user_irq(void)
+{
+    return false;
+}
 #endif
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "qom/cpu.h"
 #include "qemu/log.h"
 #include "trace.h"
+#include "sysemu/kvm.h"
 
 /* #define DEBUG_GIC */
 
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
+        error_setg(errp, "KVM with user space irqchip only works when the "
+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
+        return;
+    }
+
     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
      */
     kvm_async_interrupts_allowed = true;
 
+    /*
+     * PSCI wakes up secondary cores, so we always need to
+     * have vCPUs waiting in kernel space
+     */
+    kvm_halt_in_kernel_allowed = true;
+
     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
 
     type_register_static(&host_arm_cpu_type_info);
@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
 
 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
 {
+    ARMCPU *cpu;
+    uint32_t switched_level;
+
+    if (kvm_irqchip_in_kernel()) {
+        /*
+         * We only need to sync timer states with user-space interrupt
+         * controllers, so return early and save cycles if we don't.
+         */
+        return MEMTXATTRS_UNSPECIFIED;
+    }
+
+    cpu = ARM_CPU(cs);
+
+    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
+    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
+        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
+
+        qemu_mutex_lock_iothread();
+
+        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_VTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
+        }
+
+        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_PTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
+        }
+
+        /* XXX PMU IRQ is missing */
+
+        if (switched_level) {
+            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
+                          __func__, switched_level);
+        }
+
+        /* We also mark unknown levels as processed to not waste cycles */
+        cpu->device_irq_level = run->s.regs.device_irq_level;
+        qemu_mutex_unlock_iothread();
+    }
+
     return MEMTXATTRS_UNSPECIFIED;
 }
 
-- 
2.7.4

For v7M, writes to the CONTROL register are only permitted for
privileged code. However even if the code is privileged, the
write must not affect the SPSEL bit in the CONTROL register
if the CPU is in Thread mode (as documented in the pseudocode
for the MSR instruction). Implement this, instead of permitting
SPSEL to be written in all cases.

This was causing mbed applications not to run, because the
RTX RTOS they use relies on this behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         }
         break;
     case 20: /* CONTROL */
-        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
-        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
-                                  R_V7M_CONTROL_NPRIV_MASK);
+        /* Writing to the SPSEL bit only has an effect if we are in
+         * thread mode; other bits can be updated by any privileged code.
+         * switch_v7m_sp() deals with updating the SPSEL bit in
+         * env->v7m.control, so we only need update the others.
+         */
+        if (env->v7m.exception == 0) {
+            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+        }
+        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
+        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
-- 
2.7.4

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1