Series comparison

-[Qemu-devel] [PULL 00/31] target-arm queue
+[PULL 00/14] target-arm queue
-target-arm queue: aspeed patches from Cédric, and
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
 cleanup and sd card patches from Philippe.
-thanks
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 -- PMM
 The following changes since commit bac5ba3dc5da706f52c149fa6c0bd1dc96899bec:
   Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2018-06-08 10:26:16 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180608
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-for you to fetch changes up to 113f31c06c6bf16451892b2459d83c9b9c5e9844:
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-  sdcard: Disable CMD19/CMD23 for Spec v2 (2018-06-08 13:15:34 +0100)
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * arm_gicv3_kvm: fix migration of registers corresponding to
+ * Implement FEAT_ECV
-   IRQs 992 to 1020 in the KVM GIC
+ * STM32L4x5: Implement GPIO device
- * aspeed: remove ignore_memory_transaction_failures on all boards
+ * Fix 32-bit SMOPA
- * aspeed: add support for the witherspoon-bmc board
+ * Refactor v7m related code from cpu32.c into its own file
- * aspeed: add an I2C RTC device and EEPROM I2C devices
+ * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
  * aspeed: add the pc9552 chips to the witherspoon machine
  * ftgmac100: fix various bugs
  * hw/arm: Remove the deprecated xlnx-ep108 machine
  * hw/i2c: Add trace events
  * add missing '\n' on various qemu_log() logging strings
  * sdcard: clean up spec version support so we report the
    right spec version to the guest and only implement the
    commands that are supposed to be present in that version
 ----------------------------------------------------------------
-Cédric Le Goater (11):
+Inès Varhol (3):
-      aspeed: remove ignore_memory_transaction_failures on all boards
+      hw/gpio: Implement STM32L4x5 GPIO
-      aspeed: add support for the witherspoon-bmc board
+      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-      aspeed: add an I2C RTC device to all machines
+      tests/qtest: Add STM32L4x5 GPIO QTest testcase
       smbus: add a smbus_eeprom_init_one() routine
       aspeed: Add EEPROM I2C devices
       misc: add pca9552 LED blinker model
       aspeed: add the pc9552 chips to the witherspoon machine
       ftgmac100: compute maximum frame size depending on the protocol
       ftgmac100: add IEEE 802.1Q VLAN support
       ftgmac100: fix multicast hash routine
       ftgmac100: remove check on runt messages
-Philippe Mathieu-Daudé (18):
+Peter Maydell (9):
-      hw/i2c: Add trace events
+      target/arm: Move some register related defines to internals.h
-      hw/sd/milkymist-memcard: Add trailing '\n' to qemu_log() call
+      target/arm: Timer _EL02 registers UNDEF for E2H == 0
-      hw/digic: Add trailing '\n' to qemu_log() calls
+      target/arm: use FIELD macro for CNTHCTL bit definitions
-      xilinx-dp: Add trailing '\n' to qemu_log() call
+      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-      ppc/pnv: Add trailing '\n' to qemu_log() calls
+      target/arm: Implement new FEAT_ECV trap bits
-      hw/core/register: Add trailing '\n' to qemu_log() call
+      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-      hw/mips/boston: Add trailing '\n' to qemu_log() calls
+      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-      stellaris: Add trailing '\n' to qemu_log() calls
+      target/arm: Enable FEAT_ECV for 'max' CPU
-      target/arm: Add trailing '\n' to qemu_log() calls
+      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
       target/m68k: Add trailing '\n' to qemu_log() call
       RISC-V: Add trailing '\n' to qemu_log() calls
       target/xtensa: Add trailing '\n' to qemu_log() calls
       sdcard: Update the Configuration Register (SCR) to Spec Version 1.10
       sdcard: Allow commands valid in SPI mode
       sdcard: Add a 'spec_version' property, default to Spec v2.00
       sdcard: Disable SEND_IF_COND (CMD8) for Spec v1
       sdcard: Reflect when the Spec v3 is supported in the Config Register (SCR)
       sdcard: Disable CMD19/CMD23 for Spec v2
-Shannon Zhao (1):
+Richard Henderson (1):
-      arm_gicv3_kvm: kvm_dist_get/put: skip the registers banked by GICR
+      target/arm: Fix 32-bit SMOPA
 Thomas Huth (1):
-      hw/arm: Remove the deprecated xlnx-ep108 machine
+      target/arm: Move v7m-related code from cpu32.c into a separate file
- Makefile.objs                      |   1 +
+ MAINTAINERS                        |   1 +
- hw/misc/Makefile.objs              |   1 +
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- tests/Makefile.include             |   2 +
+ docs/system/arm/emulation.rst      |   1 +
- include/hw/i2c/smbus.h             |   1 +
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
- include/hw/intc/arm_gicv3_common.h |   1 +
+ include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
- include/hw/misc/pca9552.h          |  32 +++++
+ include/hw/misc/stm32l4x5_syscfg.h |   3 +-
- include/hw/misc/pca9552_regs.h     |  32 +++++
+ include/hw/rtc/sun4v-rtc.h         |   2 +-
- include/hw/net/ftgmac100.h         |   7 +-
+ target/arm/cpu-features.h          |  10 +
- include/hw/sd/sd.h                 |   6 +
+ target/arm/cpu.h                   | 129 +--------
- tests/libqos/i2c.h                 |   2 +
+ target/arm/internals.h             | 151 ++++++++++
- hw/arm/aspeed.c                    |  88 +++++++++++++-
+ hw/arm/stm32l4x5_soc.c             |  71 ++++-
- hw/arm/stellaris.c                 |  11 +-
+ hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
- hw/arm/xlnx-zcu102.c               |  62 +---------
+ hw/misc/stm32l4x5_syscfg.c         |   1 +
- hw/char/digic-uart.c               |   4 +-
+ hw/rtc/sun4v-rtc.c                 |   2 +-
- hw/core/register.c                 |   2 +-
+ target/arm/helper.c                | 189 ++++++++++++-
- hw/display/xlnx_dp.c               |   4 +-
+ target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
- hw/i2c/core.c                      |  25 ++--
+ target/arm/tcg/cpu32.c             | 261 ------------------
- hw/i2c/smbus_eeprom.c              |  16 ++-
+ target/arm/tcg/cpu64.c             |   1 +
- hw/intc/arm_gicv3_common.c         |  79 ++++++++++++
+ target/arm/tcg/sme_helper.c        |  77 +++---
- hw/intc/arm_gicv3_kvm.c            |  38 ++++++
+ tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
- hw/mips/boston.c                   |   8 +-
+ tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
- hw/misc/pca9552.c                  | 240 +++++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
- hw/net/ftgmac100.c                 |  64 ++++++----
+ hw/arm/Kconfig                     |   3 +-
- hw/ppc/pnv_core.c                  |   4 +-
+ hw/gpio/Kconfig                    |   3 +
- hw/sd/milkymist-memcard.c          |   2 +-
+ hw/gpio/meson.build                |   1 +
- hw/sd/sd.c                         |  50 +++++---
+ hw/gpio/trace-events               |   6 +
- hw/timer/digic-timer.c             |   4 +-
+ target/arm/meson.build             |   3 +
- target/arm/helper.c                |   4 +-
+ target/arm/tcg/meson.build         |   3 +
- target/m68k/translate.c            |   2 +-
+ target/arm/trace-events            |   1 +
- target/riscv/op_helper.c           |   6 +-
+ tests/qtest/meson.build            |   3 +-
- target/xtensa/translate.c          |   6 +-
+ tests/tcg/aarch64/Makefile.target  |   2 +-
- tests/pca9552-test.c               | 116 ++++++++++++++++++
+files changed, 1962 insertions(+), 456 deletions(-)
- tests/tmp105-test.c                |   2 -
+ create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
- default-configs/arm-softmmu.mak    |   1 +
+ create mode 100644 hw/gpio/stm32l4x5_gpio.c
- hw/i2c/trace-events                |   7 ++
+ create mode 100644 target/arm/tcg/cpu-v7m.c
- qemu-doc.texi                      |   5 -
+ create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
-files changed, 788 insertions(+), 147 deletions(-)
+ create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
- create mode 100644 include/hw/misc/pca9552.h
+ create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
  create mode 100644 include/hw/misc/pca9552_regs.h
  create mode 100644 hw/misc/pca9552.c
  create mode 100644 tests/pca9552-test.c
  create mode 100644 hw/i2c/trace-events

-[Qemu-devel] [PULL 31/31] sdcard: Disable CMD19/CMD23 for Spec v2
+[PULL 01/14] target/arm: Move some register related defines to internals.h
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+cpu.h has a lot of #defines relating to CPU register fields.
 Most of these aren't actually used outside target/arm code,
 so there's no point in cluttering up the cpu.h file with them.
 Move some easy ones to internals.h.
-These commands got introduced by Spec v3
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-(see 0c3fb03f7ec and 4481bbc79d2).
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
 ---
  target/arm/cpu.h       | 128 -----------------------------------------
  target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 files changed, 128 insertions(+), 128 deletions(-)
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 Message-id: 20180607180641.874-7-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/sd/sd.c | 6 ++++++
 file changed, 6 insertions(+)
 diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/target/arm/cpu.h
-+++ b/hw/sd/sd.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
-         break;
+     uint64_t ctl; /* Timer Control register */
+ } ARMGenericTimer;
-     case 19:    /* CMD19: SEND_TUNING_BLOCK (SD) */
-+        if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
+-#define VTCR_NSW (1u << 29)
-+            break;
+-#define VTCR_NSA (1u << 30)
-+        }
+-#define VSTCR_SW VTCR_NSW
-         if (sd->state == sd_transfer_state) {
+-#define VSTCR_SA VTCR_NSA
-             sd->state = sd_sendingdata_state;
+-
-             sd->data_offset = 0;
+ /* Define a maximum sized vector register.
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
+  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
-         break;
+  * For 64-bit, this is a 2048-bit SVE register.
+@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
-     case 23:    /* CMD23: SET_BLOCK_COUNT */
+ #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
-+        if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
+ #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
-+            break;
-+        }
+-/* Bit definitions for CPACR (AArch32 only) */
-         switch (sd->state) {
+-FIELD(CPACR, CP10, 20, 2)
-         case sd_transfer_state:
+-FIELD(CPACR, CP11, 22, 2)
-             sd->multi_blk_cnt = req.arg;
+-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
 -FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
 -FIELD(CPACR, ASEDIS, 31, 1)
 -
 -/* Bit definitions for CPACR_EL1 (AArch64 only) */
 -FIELD(CPACR_EL1, ZEN, 16, 2)
 -FIELD(CPACR_EL1, FPEN, 20, 2)
 -FIELD(CPACR_EL1, SMEN, 24, 2)
 -FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
 -
 -/* Bit definitions for HCPTR (AArch32 only) */
 -FIELD(HCPTR, TCP10, 10, 1)
 -FIELD(HCPTR, TCP11, 11, 1)
 -FIELD(HCPTR, TASE, 15, 1)
 -FIELD(HCPTR, TTA, 20, 1)
 -FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
 -FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
 -
 -/* Bit definitions for CPTR_EL2 (AArch64 only) */
 -FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
 -FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 -FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 -FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 -FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 -FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 -FIELD(CPTR_EL2, TTA, 28, 1)
 -FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 -FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 -
 -/* Bit definitions for CPTR_EL3 (AArch64 only) */
 -FIELD(CPTR_EL3, EZ, 8, 1)
 -FIELD(CPTR_EL3, TFP, 10, 1)
 -FIELD(CPTR_EL3, ESM, 12, 1)
 -FIELD(CPTR_EL3, TTA, 20, 1)
 -FIELD(CPTR_EL3, TAM, 30, 1)
 -FIELD(CPTR_EL3, TCPAC, 31, 1)
 -
 -#define MDCR_MTPME    (1U << 28)
 -#define MDCR_TDCC     (1U << 27)
 -#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 -#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 -#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 -#define MDCR_EPMAD    (1U << 21)
 -#define MDCR_EDAD     (1U << 20)
 -#define MDCR_TTRF     (1U << 19)
 -#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 -#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 -#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 -#define MDCR_SDD      (1U << 16)
 -#define MDCR_SPD      (3U << 14)
 -#define MDCR_TDRA     (1U << 11)
 -#define MDCR_TDOSA    (1U << 10)
 -#define MDCR_TDA      (1U << 9)
 -#define MDCR_TDE      (1U << 8)
 -#define MDCR_HPME     (1U << 7)
 -#define MDCR_TPM      (1U << 6)
 -#define MDCR_TPMCR    (1U << 5)
 -#define MDCR_HPMN     (0x1fU)
 -
 -/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 -#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 -                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 -                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 -
  #define CPSR_M (0x1fU)
  #define CPSR_T (1U << 5)
  #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define XPSR_NZCV CPSR_NZCV
  #define XPSR_IT CPSR_IT
 -#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 -#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 -#define TTBCR_PD0    (1U << 4)
 -#define TTBCR_PD1    (1U << 5)
 -#define TTBCR_EPD0   (1U << 7)
 -#define TTBCR_IRGN0  (3U << 8)
 -#define TTBCR_ORGN0  (3U << 10)
 -#define TTBCR_SH0    (3U << 12)
 -#define TTBCR_T1SZ   (3U << 16)
 -#define TTBCR_A1     (1U << 22)
 -#define TTBCR_EPD1   (1U << 23)
 -#define TTBCR_IRGN1  (3U << 24)
 -#define TTBCR_ORGN1  (3U << 26)
 -#define TTBCR_SH1    (1U << 28)
 -#define TTBCR_EAE    (1U << 31)
 -
 -FIELD(VTCR, T0SZ, 0, 6)
 -FIELD(VTCR, SL0, 6, 2)
 -FIELD(VTCR, IRGN0, 8, 2)
 -FIELD(VTCR, ORGN0, 10, 2)
 -FIELD(VTCR, SH0, 12, 2)
 -FIELD(VTCR, TG0, 14, 2)
 -FIELD(VTCR, PS, 16, 3)
 -FIELD(VTCR, VS, 19, 1)
 -FIELD(VTCR, HA, 21, 1)
 -FIELD(VTCR, HD, 22, 1)
 -FIELD(VTCR, HWU59, 25, 1)
 -FIELD(VTCR, HWU60, 26, 1)
 -FIELD(VTCR, HWU61, 27, 1)
 -FIELD(VTCR, HWU62, 28, 1)
 -FIELD(VTCR, NSW, 29, 1)
 -FIELD(VTCR, NSA, 30, 1)
 -FIELD(VTCR, DS, 32, 1)
 -FIELD(VTCR, SL2, 33, 1)
 -
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_TWEDEN    (1ULL << 59)
  #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 -#define HCRX_ENAS0    (1ULL << 0)
 -#define HCRX_ENALS    (1ULL << 1)
 -#define HCRX_ENASR    (1ULL << 2)
 -#define HCRX_FNXS     (1ULL << 3)
 -#define HCRX_FGTNXS   (1ULL << 4)
 -#define HCRX_SMPME    (1ULL << 5)
 -#define HCRX_TALLINT  (1ULL << 6)
 -#define HCRX_VINMI    (1ULL << 7)
 -#define HCRX_VFNMI    (1ULL << 8)
 -#define HCRX_CMOW     (1ULL << 9)
 -#define HCRX_MCE2     (1ULL << 10)
 -#define HCRX_MSCEN    (1ULL << 11)
 -
 -#define HPFAR_NS      (1ULL << 63)
 -
  #define SCR_NS                (1ULL << 0)
  #define SCR_IRQ               (1ULL << 1)
  #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_GPF               (1ULL << 48)
  #define SCR_NSE               (1ULL << 62)
 -#define HSTR_TTEE (1 << 16)
 -#define HSTR_TJDBX (1 << 17)
 -
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 -
  /* Return the current FPSCR value.  */
  uint32_t vfp_get_fpscr(CPUARMState *env);
  void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
  FIELD(DBGWCR, MASK, 24, 5)
  FIELD(DBGWCR, SSCE, 29, 1)
 +#define VTCR_NSW (1u << 29)
 +#define VTCR_NSA (1u << 30)
 +#define VSTCR_SW VTCR_NSW
 +#define VSTCR_SA VTCR_NSA
 +
 +/* Bit definitions for CPACR (AArch32 only) */
 +FIELD(CPACR, CP10, 20, 2)
 +FIELD(CPACR, CP11, 22, 2)
 +FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
 +FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
 +FIELD(CPACR, ASEDIS, 31, 1)
 +
 +/* Bit definitions for CPACR_EL1 (AArch64 only) */
 +FIELD(CPACR_EL1, ZEN, 16, 2)
 +FIELD(CPACR_EL1, FPEN, 20, 2)
 +FIELD(CPACR_EL1, SMEN, 24, 2)
 +FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
 +
 +/* Bit definitions for HCPTR (AArch32 only) */
 +FIELD(HCPTR, TCP10, 10, 1)
 +FIELD(HCPTR, TCP11, 11, 1)
 +FIELD(HCPTR, TASE, 15, 1)
 +FIELD(HCPTR, TTA, 20, 1)
 +FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
 +FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
 +
 +/* Bit definitions for CPTR_EL2 (AArch64 only) */
 +FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
 +FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 +FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 +FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 +FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 +FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 +FIELD(CPTR_EL2, TTA, 28, 1)
 +FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 +FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 +
 +/* Bit definitions for CPTR_EL3 (AArch64 only) */
 +FIELD(CPTR_EL3, EZ, 8, 1)
 +FIELD(CPTR_EL3, TFP, 10, 1)
 +FIELD(CPTR_EL3, ESM, 12, 1)
 +FIELD(CPTR_EL3, TTA, 20, 1)
 +FIELD(CPTR_EL3, TAM, 30, 1)
 +FIELD(CPTR_EL3, TCPAC, 31, 1)
 +
 +#define MDCR_MTPME    (1U << 28)
 +#define MDCR_TDCC     (1U << 27)
 +#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 +#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 +#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 +#define MDCR_EPMAD    (1U << 21)
 +#define MDCR_EDAD     (1U << 20)
 +#define MDCR_TTRF     (1U << 19)
 +#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 +#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 +#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 +#define MDCR_SDD      (1U << 16)
 +#define MDCR_SPD      (3U << 14)
 +#define MDCR_TDRA     (1U << 11)
 +#define MDCR_TDOSA    (1U << 10)
 +#define MDCR_TDA      (1U << 9)
 +#define MDCR_TDE      (1U << 8)
 +#define MDCR_HPME     (1U << 7)
 +#define MDCR_TPM      (1U << 6)
 +#define MDCR_TPMCR    (1U << 5)
 +#define MDCR_HPMN     (0x1fU)
 +
 +/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 +#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 +                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 +                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 +
 +#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 +#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 +#define TTBCR_PD0    (1U << 4)
 +#define TTBCR_PD1    (1U << 5)
 +#define TTBCR_EPD0   (1U << 7)
 +#define TTBCR_IRGN0  (3U << 8)
 +#define TTBCR_ORGN0  (3U << 10)
 +#define TTBCR_SH0    (3U << 12)
 +#define TTBCR_T1SZ   (3U << 16)
 +#define TTBCR_A1     (1U << 22)
 +#define TTBCR_EPD1   (1U << 23)
 +#define TTBCR_IRGN1  (3U << 24)
 +#define TTBCR_ORGN1  (3U << 26)
 +#define TTBCR_SH1    (1U << 28)
 +#define TTBCR_EAE    (1U << 31)
 +
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
 +#define HCRX_ENAS0    (1ULL << 0)
 +#define HCRX_ENALS    (1ULL << 1)
 +#define HCRX_ENASR    (1ULL << 2)
 +#define HCRX_FNXS     (1ULL << 3)
 +#define HCRX_FGTNXS   (1ULL << 4)
 +#define HCRX_SMPME    (1ULL << 5)
 +#define HCRX_TALLINT  (1ULL << 6)
 +#define HCRX_VINMI    (1ULL << 7)
 +#define HCRX_VFNMI    (1ULL << 8)
 +#define HCRX_CMOW     (1ULL << 9)
 +#define HCRX_MCE2     (1ULL << 10)
 +#define HCRX_MSCEN    (1ULL << 11)
 +
 +#define HPFAR_NS      (1ULL << 63)
 +
 +#define HSTR_TTEE (1 << 16)
 +#define HSTR_TJDBX (1 << 17)
 +
 +#define CNTHCTL_CNTVMASK      (1 << 18)
 +#define CNTHCTL_CNTPMASK      (1 << 19)
 +
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
   * get_phys_addr() code assumes A/R profile and reports failures via
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 23/31] target/m68k: Add trailing '\n' to qemu_log() call
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
 or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
 delivering the exception to EL2 with the wrong syndrome.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
-Message-id: 20180606152128.449-10-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
 ---
- target/m68k/translate.c | 2 +-
+ target/arm/helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/m68k/translate.c b/target/m68k/translate.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/m68k/translate.c
+--- a/target/arm/helper.c
-+++ b/target/m68k/translate.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ DISAS_INSN(undef)
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-     /* ??? This is both instructions that are as yet unimplemented
+         return CP_ACCESS_OK;
-        for the 680x0 series, as well as those that are implemented
+     }
-        but actually illegal for CPU32 or pre-68020.  */
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
--    qemu_log_mask(LOG_UNIMP, "Illegal instruction: %04x @ %08x",
+-        return CP_ACCESS_TRAP;
-+    qemu_log_mask(LOG_UNIMP, "Illegal instruction: %04x @ %08x\n",
++        return CP_ACCESS_TRAP_UNCATEGORIZED;
-                   insn, s->insn_pc);
+     }
-     gen_exception(s, s->insn_pc, EXCP_UNSUPPORTED);
+     return CP_ACCESS_OK;
  }
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 20/31] hw/mips/boston: Add trailing '\n' to qemu_log() calls
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We prefer the FIELD macro over ad-hoc #defines for register bits;
 switch CNTHCTL to that style before we add any more bits.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606152128.449-7-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
 ---
- hw/mips/boston.c | 8 ++++----
+ target/arm/internals.h | 27 +++++++++++++++++++++++++--
-file changed, 4 insertions(+), 4 deletions(-)
+ target/arm/helper.c    |  9 ++++-----
 files changed, 29 insertions(+), 7 deletions(-)
-diff --git a/hw/mips/boston.c b/hw/mips/boston.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/boston.c
+--- a/target/arm/internals.h
-+++ b/hw/mips/boston.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t boston_platreg_read(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
-     uint32_t gic_freq, val;
+ #define HSTR_TTEE (1 << 16)
+ #define HSTR_TJDBX (1 << 17)
-     if (size != 4) {
--        qemu_log_mask(LOG_UNIMP, "%uB platform register read", size);
+-#define CNTHCTL_CNTVMASK      (1 << 18)
-+        qemu_log_mask(LOG_UNIMP, "%uB platform register read\n", size);
+-#define CNTHCTL_CNTPMASK      (1 << 19)
-         return 0;
++/*
 + * Depending on the value of HCR_EL2.E2H, bits 0 and 1
 + * have different bit definitions, and EL1PCTEN might be
 + * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
 + * disambiguate if necessary.
 + */
 +FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
 +FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
 +FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
 +FIELD(CNTHCTL, EVNTEN, 2, 1)
 +FIELD(CNTHCTL, EVNTDIR, 3, 1)
 +FIELD(CNTHCTL, EVNTI, 4, 4)
 +FIELD(CNTHCTL, EL0VTEN, 8, 1)
 +FIELD(CNTHCTL, EL0PTEN, 9, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
 +FIELD(CNTHCTL, EL1PTEN, 11, 1)
 +FIELD(CNTHCTL, ECV, 12, 1)
 +FIELD(CNTHCTL, EL1TVT, 13, 1)
 +FIELD(CNTHCTL, EL1TVCT, 14, 1)
 +FIELD(CNTHCTL, EL1NVPCT, 15, 1)
 +FIELD(CNTHCTL, EL1NVVCT, 16, 1)
 +FIELD(CNTHCTL, EVNTIS, 17, 1)
 +FIELD(CNTHCTL, CNTVMASK, 18, 1)
 +FIELD(CNTHCTL, CNTPMASK, 19, 1)
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
       * It is RES0 in Secure and NonSecure state.
       */
      if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
 -        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
 -         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
 +        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
 +         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
          irqstate = 0;
      }
-@@ -XXX,XX +XXX,XX @@ static uint64_t boston_platreg_read(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
          val |= PLAT_DDR_CFG_MHZ;
          return val;
      default:
 -        qemu_log_mask(LOG_UNIMP, "Read platform register 0x%" HWADDR_PRIx,
 +        qemu_log_mask(LOG_UNIMP, "Read platform register 0x%" HWADDR_PRIx "\n",
                        addr & 0xffff);
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static void boston_platreg_write(void *opaque, hwaddr addr,
                                   uint64_t val, unsigned size)
  {
-     if (size != 4) {
+     ARMCPU *cpu = env_archcpu(env);
--        qemu_log_mask(LOG_UNIMP, "%uB platform register write", size);
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+        qemu_log_mask(LOG_UNIMP, "%uB platform register write\n", size);
+-
-         return;
+     raw_write(env, ri, value);
-     }
+-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
-@@ -XXX,XX +XXX,XX @@ static void boston_platreg_write(void *opaque, hwaddr addr,
++    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-         break;
+         gt_update_irq(cpu, GTIMER_VIRT);
-     default:
+-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
-         qemu_log_mask(LOG_UNIMP, "Write platform register 0x%" HWADDR_PRIx
++    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
--                      " = 0x%" PRIx64, addr & 0xffff, val);
+         gt_update_irq(cpu, GTIMER_PHYS);
 +                      " = 0x%" PRIx64 "\n", addr & 0xffff, val);
          break;
      }
  }
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 22/31] target/arm: Add trailing '\n' to qemu_log() calls
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
 This is not strictly architecturally required, but it is how we've
 tended to implement registers more recently.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+In particular, bits [19:18] are only present with FEAT_RME,
-Message-id: 20180606152128.449-9-f4bug@amsat.org
+and bits [17:12] will only be present with FEAT_ECV.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 4 ++--
+ target/arm/helper.c | 18 ++++++++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 18 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     case 4: /* unlinked address mismatch (reserved if AArch64) */
+ {
-     case 5: /* linked address mismatch (reserved if AArch64) */
+     ARMCPU *cpu = env_archcpu(env);
-         qemu_log_mask(LOG_UNIMP,
+     uint32_t oldval = env->cp15.cnthctl_el2;
--                      "arm: address mismatch breakpoint types not implemented");
++    uint32_t valid_mask =
-+                      "arm: address mismatch breakpoint types not implemented\n");
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
-         return;
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
-     case 0: /* unlinked address match */
++        R_CNTHCTL_EVNTEN_MASK |
-     case 1: /* linked address match */
++        R_CNTHCTL_EVNTDIR_MASK |
-@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
++        R_CNTHCTL_EVNTI_MASK |
-     case 8: /* unlinked VMID match (reserved if no EL2) */
++        R_CNTHCTL_EL0VTEN_MASK |
-     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
++        R_CNTHCTL_EL0PTEN_MASK |
-         qemu_log_mask(LOG_UNIMP,
++        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
--                      "arm: unlinked context breakpoint types not implemented");
++        R_CNTHCTL_EL1PTEN_MASK;
-+                      "arm: unlinked context breakpoint types not implemented\n");
++
-         return;
++    if (cpu_isar_feature(aa64_rme, cpu)) {
-     case 9: /* linked VMID match (reserved if no EL2) */
++        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
-     case 11: /* linked context ID and VMID match (reserved if no EL2) */
++    }
 +
 +    /* Clear RES0 bits */
 +    value &= valid_mask;
 +
      raw_write(env, ri, value);
      if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 03/31] aspeed: add support for the witherspoon-bmc board
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
-From: Cédric Le Goater <clg@kaod.org>
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
  * four new trap bits for various counter and timer registers
  * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
    scaling of the event stream. This is a no-op for us, because we don't
    implement the event stream (our WFE is a NOP): all we need to do is
    allow CNTHCTL_EL2.ENVTIS to be read and written.
  * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
    TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
    FEAT_SPE or FEAT_TRF.
  * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
    "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
    that no barriers are needed around their accesses. For us these
    are just the same as the normal views, because all our sysregs are
    inherently self-sychronizing.
-The Witherspoon boards are OpenPOWER system hosting POWER9 Processors.
+In this commit we implement the trap handling and permit the new
-Add support for their BMC including a couple of I2C devices as found
+CNTHCTL_EL2 bits to be written.
 on real HW.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Message-id: 20180530064049.27976-3-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
 ---
- hw/arm/aspeed.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/cpu-features.h |  5 ++++
-file changed, 49 insertions(+)
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 files changed, 51 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/arm/cpu-features.h
-+++ b/hw/arm/aspeed.c
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
-     PALMETTO_BMC,
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
-     AST2500_EVB,
+ }
-     ROMULUS_BMC,
-+    WITHERSPOON_BMC,
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
  };
  /* Palmetto hardware value: 0x120CE416 */
@@ -XXX,XX +XXX,XX @@ enum {
          SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
          SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 +/* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 +#define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 +
  static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
  static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
 +static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
  static const AspeedBoardConfig aspeed_boards[] = {
      [PALMETTO_BMC] = {
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .spi_model = "mx66l1g45g",
          .num_cs    = 2,
      },
 +    [WITHERSPOON_BMC]  = {
 +        .soc_name  = "ast2500-a1",
 +        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
 +        .fmc_model = "mx25l25635e",
 +        .spi_model = "mx66l1g45g",
 +        .num_cs    = 2,
 +        .i2c_init  = witherspoon_bmc_i2c_init,
 +    },
  };
  #define FIRMWARE_ADDR 0x0
@@ -XXX,XX +XXX,XX @@ static const TypeInfo romulus_bmc_type = {
      .class_init = romulus_bmc_class_init,
  };
 +static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 +{
-+    AspeedSoCState *soc = &bmc->soc;
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 +
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
 +
 +    /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 9), "tmp105", 0x4a);
 +}
 +
-+static void witherspoon_bmc_init(MachineState *machine)
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
  {
      return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
               : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
              return CP_ACCESS_TRAP_EL2;
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                  }
              }
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (cpu_isar_feature(aa64_rme, cpu)) {
          valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        valid_mask |=
 +            R_CNTHCTL_EL1TVT_MASK |
 +            R_CNTHCTL_EL1TVCT_MASK |
 +            R_CNTHCTL_EL1NVPCT_MASK |
 +            R_CNTHCTL_EL1NVVCT_MASK |
 +            R_CNTHCTL_EVNTIS_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      if (arm_current_el(env) == 1) {
          /* This must be a FEAT_NV access */
 -        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
          return CP_ACCESS_OK;
      }
      if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
      return CP_ACCESS_OK;
  }
 +static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                      bool isread)
 +{
-+    aspeed_board_init(machine, &aspeed_boards[WITHERSPOON_BMC]);
++    if (arm_current_el(env) == 1) {
 +        /* This must be a FEAT_NV access with NVx == 101 */
 +        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
 +    }
 +    return e2h_access(env, ri, isread);
 +}
 +
-+static void witherspoon_bmc_class_init(ObjectClass *oc, void *data)
++static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                      bool isread)
 +{
-+    MachineClass *mc = MACHINE_CLASS(oc);
++    if (arm_current_el(env) == 1) {
-+
++        /* This must be a FEAT_NV access with NVx == 101 */
-+    mc->desc = "OpenPOWER Witherspoon BMC (ARM1176)";
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
-+    mc->init = witherspoon_bmc_init;
++            return CP_ACCESS_TRAP_EL2;
-+    mc->max_cpus = 1;
++        }
-+    mc->no_sdcard = 1;
++    }
-+    mc->no_floppy = 1;
++    return e2h_access(env, ri, isread);
 +    mc->no_cdrom = 1;
 +    mc->no_parallel = 1;
 +}
 +
-+static const TypeInfo witherspoon_bmc_type = {
+ /* Test if system register redirection is to occur in the current state.  */
-+    .name = MACHINE_TYPE_NAME("witherspoon-bmc"),
+ static bool redirect_for_e2h(CPUARMState *env)
 +    .parent = TYPE_MACHINE,
 +    .class_init = witherspoon_bmc_class_init,
 +};
 +
  static void aspeed_machine_init(void)
  {
-     type_register_static(&palmetto_bmc_type);
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
-     type_register_static(&ast2500_evb_type);
+     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
-     type_register_static(&romulus_bmc_type);
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
-+    type_register_static(&witherspoon_bmc_type);
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
- }
+-      .access = PL2_RW, .accessfn = e2h_access,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
- type_init(aspeed_machine_init)
+       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
        .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
      { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvvct,
        .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
        .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
        .type = ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvpct,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
      { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
        .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvvct,
        .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
  #endif
  };
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 30/31] sdcard: Reflect when the Spec v3 is supported in the Config Register (SCR)
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
 defined, which are "self-synchronized" views of the physical and
 virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
 (meaning that no barriers are needed around accesses to them to
 ensure that reads of them do not occur speculatively and out-of-order
 with other instructions).
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+For QEMU, all our system registers are self-synchronized, so we can
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
-Message-id: 20180607180641.874-6-f4bug@amsat.org
+to the new register encodings.
 This means we now implement all the functionality required for
 ID_AA64MMFR0_EL1.ECV == 0b0001.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
 ---
- include/hw/sd/sd.h | 1 +
+ target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- hw/sd/sd.c         | 7 +++++--
+file changed, 43 insertions(+)
 files changed, 6 insertions(+), 2 deletions(-)
-diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sd.h
+--- a/target/arm/helper.c
-+++ b/include/hw/sd/sd.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
- enum SDPhySpecificationVersion {
+     },
      SD_PHY_SPECv1_10_VERS     = 1,
      SD_PHY_SPECv2_00_VERS     = 2,
 +    SD_PHY_SPECv3_01_VERS     = 3,
  };
- typedef enum {
++/*
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
++ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
-index XXXXXXX..XXXXXXX 100644
++ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
---- a/hw/sd/sd.c
++ * so our implementations here are identical to the normal registers.
-+++ b/hw/sd/sd.c
++ */
-@@ -XXX,XX +XXX,XX @@ static void sd_set_scr(SDState *sd)
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
-     if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
++    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
-         sd->scr[0] |= 1;        /* Spec Version 1.10 */
++      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
-     } else {
++      .accessfn = gt_vct_access,
--        sd->scr[0] |= 2;        /* Spec Version 2.00 */
++      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
-+        sd->scr[0] |= 2;        /* Spec Version 2.00 or Version 3.0X */
++    },
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
 +    },
 +    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access,
 +      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
 +    },
 +};
 +
  #else
  /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
  };
 +/*
 + * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
 + * is exposed to userspace by Linux.
 + */
 +static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .readfn = gt_virt_cnt_read,
 +    },
 +};
 +
  #endif
  static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
          define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
      }
-     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
-                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
++        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
      sd->scr[2] = 0x00;          /* Extended Security is not supported. */
 +    if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
 +        sd->scr[2] |= 1 << 7;   /* Spec Version 3.0X */
 +    }
-     sd->scr[3] = 0x00;
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
-     /* reserved for manufacturer usage */
+         ARMCPRegInfo vapa_cp_reginfo[] = {
-     sd->scr[4] = 0x00;
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
      switch (sd->spec_version) {
      case SD_PHY_SPECv1_10_VERS
 -     ... SD_PHY_SPECv2_00_VERS:
 +     ... SD_PHY_SPECv3_01_VERS:
          break;
      default:
          error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 04/31] aspeed: add an I2C RTC device to all machines
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-From: Cédric Le Goater <clg@kaod.org>
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
 implemented.  This is similar to the existing CNTVOFF_EL2, except
 that it controls a hypervisor-adjustable offset made to the physical
 counter and timer.
-The AST2500 EVB does not have an RTC but we can pretend that one is
+Implement the handling for this register, which includes control/trap
-plugged on the I2C bus header.
+bits in SCR_EL3 and CNTHCTL_EL2.
-The romulus and witherspoon boards expects an Epson RX8900 I2C RTC but
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-a ds1338 is good enough for the basic features we need.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
 ---
  target/arm/cpu-features.h |  5 +++
  target/arm/cpu.h          |  1 +
  target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
  target/arm/trace-events   |  1 +
 files changed, 73 insertions(+), 2 deletions(-)
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
 Message-id: 20180530064049.27976-4-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/aspeed.c | 19 +++++++++++++++++++
 file changed, 19 insertions(+)
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/arm/cpu-features.h
-+++ b/hw/arm/aspeed.c
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
  static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
  static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
 +static void romulus_bmc_i2c_init(AspeedBoardState *bmc);
  static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
  static const AspeedBoardConfig aspeed_boards[] = {
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .fmc_model = "n25q256a",
          .spi_model = "mx66l1g45g",
          .num_cs    = 2,
 +        .i2c_init  = romulus_bmc_i2c_init,
      },
      [WITHERSPOON_BMC]  = {
          .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
      /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
      i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
 +
 +    /* The AST2500 EVB does not have an RTC. Let's pretend that one is
 +     * plugged on the I2C bus header */
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
  }
- static void ast2500_evb_init(MachineState *machine)
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ast2500_evb_type = {
      .class_init = ast2500_evb_class_init,
  };
 +static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
 +{
-+    AspeedSoCState *soc = &bmc->soc;
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
 +
 +    /* The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
 +     * good enough */
 +    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 +}
 +
- static void romulus_bmc_init(MachineState *machine)
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
  {
-     aspeed_board_init(machine, &aspeed_boards[ROMULUS_BMC]);
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
-     /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
+--- a/target/arm/cpu.h
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 9), "tmp105", 0x4a);
++++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          uint64_t c14_cntkctl; /* Timer Control register */
          uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
          uint64_t cntvoff_el2; /* Counter Virtual Offset register */
 +        uint64_t cntpoff_el2; /* Counter Physical Offset register */
          ARMGenericTimer c14_timer[NUM_GTIMERS];
          uint32_t c15_cpar; /* XScale Coprocessor Access Register */
          uint32_t c15_ticonfig; /* TI925T configuration byte.  */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          if (cpu_isar_feature(aa64_rme, cpu)) {
              valid_mask |= SCR_NSE | SCR_GPF;
          }
 +        if (cpu_isar_feature(aa64_ecv, cpu)) {
 +            valid_mask |= SCR_ECVEN;
 +        }
      } else {
          valid_mask &= ~(SCR_RW | SCR_ST);
          if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
      gt_update_irq(cpu, GTIMER_PHYS);
  }
 +static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
 +{
 +    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
 +        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
 +        arm_is_el2_enabled(env) &&
 +        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 +        return env->cp15.cntpoff_el2;
 +    }
 +    return 0;
 +}
 +
-+    /* The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
++static uint64_t gt_phys_cnt_offset(CPUARMState *env)
-+     * good enough */
++{
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
++    if (arm_current_el(env) >= 2) {
 +        return 0;
 +    }
 +    return gt_phys_raw_cnt_offset(env);
 +}
 +
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
  {
      ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
           * reset timer to when ISTATUS next has to change
           */
          uint64_t offset = timeridx == GTIMER_VIRT ?
 -                                      cpu->env.cp15.cntvoff_el2 : 0;
 +            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
          uint64_t count = gt_get_countervalue(&cpu->env);
          /* Note that this must be unsigned 64 bit arithmetic: */
          int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
  static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
 -    return gt_get_countervalue(env);
 +    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
  }
- static void witherspoon_bmc_init(MachineState *machine)
+ static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
      return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
      trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
              R_CNTHCTL_EL1NVVCT_MASK |
              R_CNTHCTL_EVNTIS_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        valid_mask |= R_CNTHCTL_ECV_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
      },
  };
 +static CPAccessResult gt_cntpoff_access(CPUARMState *env,
 +                                        const ARMCPRegInfo *ri,
 +                                        bool isread)
 +{
 +    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                              uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    trace_arm_gt_cntpoff_write(value);
 +    raw_write(env, ri, value);
 +    gt_recalc_timer(cpu, GTIMER_PHYS);
 +}
 +
 +static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
 +    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
 +    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
 +    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
 +    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
 +    .nv2_redirect_offset = 0x1a8,
 +    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
 +};
  #else
  /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
          define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
 +    }
 +#endif
      if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 diff --git a/target/arm/trace-events b/target/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/trace-events
 +++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
  arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
  arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
  arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
 +arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
  arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
  # kvm.c
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 29/31] sdcard: Disable SEND_IF_COND (CMD8) for Spec v1
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Enable all FEAT_ECV features on the 'max' CPU.
-CMD8 is "Reserved" in Spec v1.10.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
 ---
  docs/system/arm/emulation.rst | 1 +
  target/arm/tcg/cpu64.c        | 1 +
 files changed, 2 insertions(+)
-Spec v2.00 introduces the SEND_IF_COND command:
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 .4.1 Power Up
     CMD8 is newly added in the Physical Layer Specification Version
 .00 to support multiple voltage ranges and used to check whether
     the card supports supplied voltage. The version 2.00 or later host
     shall issue CMD8 and verify voltage before card initialization.
     The host that does not support CMD8 shall supply high voltage range.
 Message-Id: 201204252110.20873.paul@codesourcery.com
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180607180641.874-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/sd/sd.c | 4 +++-
 file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/sd/sd.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-         break;
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
+ - FEAT_DoubleFault (Double Fault Extension)
-     case 8:    /* CMD8:   SEND_IF_COND */
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
--        /* Physical Layer Specification Version 2.00 command */
++- FEAT_ECV (Enhanced Counter Virtualization)
-+        if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
+ - FEAT_EPAC (Enhanced pointer authentication)
-+            break;
+ - FEAT_ETS (Enhanced Translation Synchronization)
-+        }
+ - FEAT_EVT (Enhanced Virtualization Traps)
-         if (sd->state != sd_idle_state) {
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-             break;
+index XXXXXXX..XXXXXXX 100644
-         }
+--- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
      t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
      t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
      t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
 +    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
      cpu->isar.id_aa64mmfr0 = t;
      t = cpu->isar.id_aa64mmfr1;
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 01/31] arm_gicv3_kvm: kvm_dist_get/put: skip the registers banked by GICR
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: Shannon Zhao <zhaoshenglong@huawei.com>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-While we skip the GIC_INTERNAL irqs, we don't change the register offset
+Features supported :
-accordingly. This will overlap the GICR registers value and leave the
+- the 8 STM32L4x5 GPIOs are initialized with their reset values
-last GIC_INTERNAL irq's registers out of update.
+    (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
-Fix this by skipping the registers banked by GICR.
+Difference with the real GPIOs :
 - Alternate Function and Analog mode aren't implemented :
     pins in AF/Analog behave like pins in input mode
 - floating pins stay at their last value
 - register IDR reset values differ from the real one :
     values are coherent with the other registers reset values
     and the fact that AF/Analog modes aren't implemented
 - setting I/O output speed isn't supported
 - locking port bits isn't supported
 - ADC function isn't supported
 - GPIOH has 16 pins instead of 2 pins
 - writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
-Also for migration compatibility if the migration source (old version
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-qemu) doesn't send gicd_no_migration_shift_bug = 1 to destination, then
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-we shift the data of PPI to get the right data for SPI.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920
+Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
 Message-id: 1527816987-16108-1-git-send-email-zhaoshenglong@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/arm_gicv3_common.h |  1 +
+ MAINTAINERS                        |   1 +
- hw/intc/arm_gicv3_common.c         | 79 ++++++++++++++++++++++++++++++
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- hw/intc/arm_gicv3_kvm.c            | 38 ++++++++++++++
+ include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
-files changed, 118 insertions(+)
+ hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_common.h
+--- a/MAINTAINERS
-+++ b/include/hw/intc/arm_gicv3_common.h
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ struct GICv3State {
+@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
-     uint32_t revision;
+ F: hw/misc/stm32l4x5_exti.c
-     bool security_extn;
+ F: hw/misc/stm32l4x5_syscfg.c
-     bool irq_reset_nonsecure;
+ F: hw/misc/stm32l4x5_rcc.c
-+    bool gicd_no_migration_shift_bug;
++F: hw/gpio/stm32l4x5_gpio.c
+ F: include/hw/*/stm32l4x5_*.h
-     int dev_fd; /* kvm device fd if backed by kvm vgic support */
-     Error *migration_blocker;
+ B-L475E-IOT01A IoT Node
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
+diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_common.c
+--- a/docs/system/arm/b-l475e-iot01a.rst
-+++ b/hw/intc/arm_gicv3_common.c
++++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
  - STM32L4x5 EXTI (Extended interrupts and events controller)
  - STM32L4x5 SYSCFG (System configuration controller)
  - STM32L4x5 RCC (Reset and clock control)
 +- STM32L4x5 GPIOs (General-purpose I/Os)
  Missing devices
  """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
  The B-L475E-IOT01A does *not* support the following devices:
  - Serial ports (UART)
 -- General-purpose I/Os (GPIO)
  - Analog to Digital Converter (ADC)
  - SPI controller
  - Timer controller (TIMER)
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/intc/arm_gicv3_common.h"
++/*
- #include "gicv3_internal.h"
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
- #include "hw/arm/linux-boot-if.h"
++ *
-+#include "sysemu/kvm.h"
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
- static int gicv3_pre_save(void *opaque)
++ *
- {
++ * SPDX-License-Identifier: GPL-2.0-or-later
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3_cpu = {
++ *
-     }
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
- };
++ * See the COPYING file in the top-level directory.
++ */
-+static int gicv3_gicd_no_migration_shift_bug_pre_load(void *opaque)
++
-+{
++/*
-+    GICv3State *cs = opaque;
++ * The reference used is the STMicroElectronics RM0351 Reference manual
-+
++ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
-+   /*
++ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
-+    * The gicd_no_migration_shift_bug flag is used for migration compatibility
++ */
-+    * for old version QEMU which may have the GICD bmp shift bug under KVM mode.
++
-+    * Strictly, what we want to know is whether the migration source is using
++#ifndef HW_STM32L4X5_GPIO_H
-+    * KVM. Since we don't have any way to determine that, we look at whether the
++#define HW_STM32L4X5_GPIO_H
-+    * destination is using KVM; this is close enough because for the older QEMU
++
-+    * versions with this bug KVM -> TCG migration didn't work anyway. If the
++#include "hw/sysbus.h"
-+    * source is a newer QEMU without this bug it will transmit the migration
++#include "qom/object.h"
-+    * subsection which sets the flag to true; otherwise it will remain set to
++
-+    * the value we select here.
++#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
-+    */
++OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
-+    if (kvm_enabled()) {
++
-+        cs->gicd_no_migration_shift_bug = false;
++#define GPIO_NUM_PINS 16
-+    }
++
-+
++struct Stm32l4x5GpioState {
-+    return 0;
++    SysBusDevice parent_obj;
-+}
++
-+
++    MemoryRegion mmio;
-+static int gicv3_gicd_no_migration_shift_bug_post_load(void *opaque,
++
-+                                                       int version_id)
++    /* GPIO registers */
-+{
++    uint32_t moder;
-+    GICv3State *cs = opaque;
++    uint32_t otyper;
-+
++    uint32_t ospeedr;
-+    if (cs->gicd_no_migration_shift_bug) {
++    uint32_t pupdr;
 +    uint32_t idr;
 +    uint32_t odr;
 +    uint32_t lckr;
 +    uint32_t afrl;
 +    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
 +
 +#endif
 diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
 +#include "migration/vmstate.h"
 +#include "trace.h"
 +
 +#define GPIO_MODER 0x00
 +#define GPIO_OTYPER 0x04
 +#define GPIO_OSPEEDR 0x08
 +#define GPIO_PUPDR 0x0C
 +#define GPIO_IDR 0x10
 +#define GPIO_ODR 0x14
 +#define GPIO_BSRR 0x18
 +#define GPIO_LCKR 0x1C
 +#define GPIO_AFRL 0x20
 +#define GPIO_AFRH 0x24
 +#define GPIO_BRR 0x28
 +#define GPIO_ASCR 0x2C
 +
 +/* 0b11111111_11111111_00000000_00000000 */
 +#define RESERVED_BITS_MASK 0xFFFF0000
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s);
 +
 +static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 2;
 +}
 +
 +static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 1;
 +}
 +
 +static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
 +static void stm32l4x5_gpio_reset_hold(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    s->moder = s->moder_reset;
 +    s->otyper = 0x00000000;
 +    s->ospeedr = s->ospeedr_reset;
 +    s->pupdr = s->pupdr_reset;
 +    s->idr = 0x00000000;
 +    s->odr = 0x00000000;
 +    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
 +        s->pins_connected_high &= ~(1 << line);
 +    }
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s)
 +{
 +    uint32_t new_idr_mask = 0;
 +    uint32_t new_idr = s->odr;
 +    uint32_t old_idr = s->idr;
 +    int new_pin_state, old_pin_state;
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (is_output(s, i)) {
 +            if (is_push_pull(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (!(s->odr & (1 << i))) {
 +                /* open-drain ODR 0 */
 +                new_idr_mask |= (1 << i);
 +            /* open-drain ODR 1 */
 +            } else if (!(s->disconnected_pins & (1 << i)) &&
 +                       !(s->pins_connected_high & (1 << i))) {
 +                /* open-drain ODR 1 with pin connected low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            /* open-drain ODR 1 with unactive pin */
 +            } else if (is_pull_up(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for open-drain ODR 1
 +             * with unactive pin without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        /* input or analog mode with connected pin */
 +        } else if (!(s->disconnected_pins & (1 << i))) {
 +            if (s->pins_connected_high & (1 << i)) {
 +                /* pin high */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else {
 +                /* pin low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +        /* input or analog mode with disconnected pin */
 +        } else {
 +            if (is_pull_up(s, i)) {
 +                /* pull-up */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                /* pull-down */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for a disconnected pin
 +             * without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        }
 +    }
 +
 +    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
 +    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (new_idr_mask & (1 << i)) {
 +            new_pin_state = (new_idr & (1 << i)) > 0;
 +            old_pin_state = (old_idr & (1 << i)) > 0;
 +            if (new_pin_state > old_pin_state) {
 +                qemu_irq_raise(s->pin[i]);
 +            } else if (new_pin_state < old_pin_state) {
 +                qemu_irq_lower(s->pin[i]);
 +            }
 +        }
 +    }
 +}
 +
 +/*
 + * Return mask of pins that are both configured in output
 + * mode and externally driven (except pins in open-drain
 + * mode externally set to 0).
 + */
 +static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
 +{
 +    uint32_t pins_to_disconnect = 0;
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        /* for each connected pin in output mode */
 +        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
 +            /* if either push-pull or high level */
 +            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
 +                pins_to_disconnect |= (1 << i);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Line %d can't be driven externally\n",
 +                              i);
 +            }
 +        }
 +    }
 +    return pins_to_disconnect;
 +}
 +
 +/*
 + * Set field `disconnected_pins` and call `update_gpio_idr()`
 + */
 +static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
 +{
 +    s->disconnected_pins |= lines;
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +static void disconnected_pins_set(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint16_t value;
 +    if (!visit_type_uint16(v, name, &value, errp)) {
 +        return;
 +    }
 +    disconnect_gpio_pins(s, value);
 +}
 +
 +static void disconnected_pins_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
 +}
 +
 +static void clock_freq_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint32_t clock_freq_hz = clock_get_hz(s->clk);
 +    visit_type_uint32(v, name, &clock_freq_hz, errp);
 +}
 +
 +static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
 +                                 uint64_t val64, unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    uint32_t value = val64;
 +    trace_stm32l4x5_gpio_write(s->name, addr, val64);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        s->moder = value;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Analog and AF modes aren't supported\n\
 +                       Analog and AF mode behave like input mode\n",
 +                      __func__);
 +        return;
 +    case GPIO_OTYPER:
 +        s->otyper = value & ~RESERVED_BITS_MASK;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        return;
 +    case GPIO_OSPEEDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing I/O output speed isn't supported\n\
 +                       I/O speed is already maximal\n",
 +                      __func__);
 +        s->ospeedr = value;
 +        return;
 +    case GPIO_PUPDR:
 +        s->pupdr = value;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_IDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: GPIO->IDR is read-only\n",
 +                      __func__);
 +        return;
 +    case GPIO_ODR:
 +        s->odr = value & ~RESERVED_BITS_MASK;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_BSRR: {
 +        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
 +        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
 +        /* If both BSx and BRx are set, BSx has priority.*/
 +        s->odr &= ~bits_to_reset;
 +        s->odr |= bits_to_set;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_LCKR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Locking port bits configuration isn't supported\n",
 +                      __func__);
 +        s->lckr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    case GPIO_AFRL:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrl = value;
 +        return;
 +    case GPIO_AFRH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrh = value;
 +        return;
 +    case GPIO_BRR: {
 +        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
 +        s->odr &= ~bits_to_reset;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_ASCR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: ADC function isn't supported\n",
 +                      __func__);
 +        s->ascr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +    }
 +}
 +
 +static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
 +                                    unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    trace_stm32l4x5_gpio_read(s->name, addr);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        return s->moder;
 +    case GPIO_OTYPER:
 +        return s->otyper;
 +    case GPIO_OSPEEDR:
 +        return s->ospeedr;
 +    case GPIO_PUPDR:
 +        return s->pupdr;
 +    case GPIO_IDR:
 +        return s->idr;
 +    case GPIO_ODR:
 +        return s->odr;
 +    case GPIO_BSRR:
 +        return 0;
-+    }
++    case GPIO_LCKR:
-+
++        return s->lckr;
-+    /* Older versions of QEMU had a bug in the handling of state save/restore
++    case GPIO_AFRL:
-+     * to the KVM GICv3: they got the offset in the bitmap arrays wrong,
++        return s->afrl;
-+     * so that instead of the data for external interrupts 32 and up
++    case GPIO_AFRH:
-+     * starting at bit position 32 in the bitmap, it started at bit
++        return s->afrh;
-+     * position 64. If we're receiving data from a QEMU with that bug,
++    case GPIO_BRR:
-+     * we must move the data down into the right place.
++        return 0;
-+     */
++    case GPIO_ASCR:
-+    memmove(cs->group, (uint8_t *)cs->group + GIC_INTERNAL / 8,
++        return s->ascr;
-+            sizeof(cs->group) - GIC_INTERNAL / 8);
++    default:
-+    memmove(cs->grpmod, (uint8_t *)cs->grpmod + GIC_INTERNAL / 8,
++        qemu_log_mask(LOG_GUEST_ERROR,
-+            sizeof(cs->grpmod) - GIC_INTERNAL / 8);
++                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
-+    memmove(cs->enabled, (uint8_t *)cs->enabled + GIC_INTERNAL / 8,
++        return 0;
-+            sizeof(cs->enabled) - GIC_INTERNAL / 8);
++    }
-+    memmove(cs->pending, (uint8_t *)cs->pending + GIC_INTERNAL / 8,
++}
-+            sizeof(cs->pending) - GIC_INTERNAL / 8);
++
-+    memmove(cs->active, (uint8_t *)cs->active + GIC_INTERNAL / 8,
++static const MemoryRegionOps stm32l4x5_gpio_ops = {
-+            sizeof(cs->active) - GIC_INTERNAL / 8);
++    .read = stm32l4x5_gpio_read,
-+    memmove(cs->edge_trigger, (uint8_t *)cs->edge_trigger + GIC_INTERNAL / 8,
++    .write = stm32l4x5_gpio_write,
-+            sizeof(cs->edge_trigger) - GIC_INTERNAL / 8);
++    .endianness = DEVICE_NATIVE_ENDIAN,
-+
++    .impl = {
-+    /*
++        .min_access_size = 4,
-+     * While this new version QEMU doesn't have this kind of bug as we fix it,
++        .max_access_size = 4,
-+     * so it needs to set the flag to true to indicate that and it's necessary
++        .unaligned = false,
-+     * for next migration to work from this new version QEMU.
++    },
-+     */
++    .valid = {
-+    cs->gicd_no_migration_shift_bug = true;
++        .min_access_size = 4,
-+
++        .max_access_size = 4,
-+    return 0;
++        .unaligned = false,
-+}
++    },
-+
++};
-+const VMStateDescription vmstate_gicv3_gicd_no_migration_shift_bug = {
++
-+    .name = "arm_gicv3/gicd_no_migration_shift_bug",
++static void stm32l4x5_gpio_init(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
 +                          TYPE_STM32L4X5_GPIO, 0x400);
 +
 +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 +
 +    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
 +    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
 +
 +    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
 +
 +    object_property_add(obj, "disconnected-pins", "uint16",
 +                        disconnected_pins_get, disconnected_pins_set,
 +                        NULL, &s->disconnected_pins);
 +    object_property_add(obj, "clock-freq-hz", "uint32",
 +                        clock_freq_get, NULL, NULL, NULL);
 +}
 +
 +static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
 +    if (!clock_has_source(s->clk)) {
 +        error_setg(errp, "GPIO: clk input must be connected");
 +        return;
 +    }
 +}
 +
 +static const VMStateDescription vmstate_stm32l4x5_gpio = {
 +    .name = TYPE_STM32L4X5_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
-+    .pre_load = gicv3_gicd_no_migration_shift_bug_pre_load,
++    .fields = (VMStateField[]){
-+    .post_load = gicv3_gicd_no_migration_shift_bug_post_load,
++        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
-+    .fields = (VMStateField[]) {
++        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
-+        VMSTATE_BOOL(gicd_no_migration_shift_bug, GICv3State),
++        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
- static const VMStateDescription vmstate_gicv3 = {
++static Property stm32l4x5_gpio_properties[] = {
-     .name = "arm_gicv3",
++    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
-     .version_id = 1,
++    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
++    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
-         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(cpu, GICv3State, num_cpu,
++    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
-                                              vmstate_gicv3_cpu, GICv3CPUState),
++    DEFINE_PROP_END_OF_LIST(),
-         VMSTATE_END_OF_LIST()
++};
 +
 +static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    device_class_set_props(dc, stm32l4x5_gpio_properties);
 +    dc->vmsd = &vmstate_stm32l4x5_gpio;
 +    dc->realize = stm32l4x5_gpio_realize;
 +    rc->phases.hold = stm32l4x5_gpio_reset_hold;
 +}
 +
 +static const TypeInfo stm32l4x5_gpio_types[] = {
 +    {
 +        .name = TYPE_STM32L4X5_GPIO,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(Stm32l4x5GpioState),
 +        .instance_init = stm32l4x5_gpio_init,
 +        .class_init = stm32l4x5_gpio_class_init,
 +    },
-+    .subsections = (const VMStateDescription * []) {
++};
-+        &vmstate_gicv3_gicd_no_migration_shift_bug,
++
-+        NULL
++DEFINE_TYPES(stm32l4x5_gpio_types)
-     }
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
  };
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
              gicv3_gicd_group_set(s, i);
          }
      }
 +    s->gicd_no_migration_shift_bug = true;
  }
  static void arm_gic_common_linux_init(ARMLinuxBootIf *obj,
 diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_kvm.c
+--- a/hw/gpio/Kconfig
-+++ b/hw/intc/arm_gicv3_kvm.c
++++ b/hw/gpio/Kconfig
-@@ -XXX,XX +XXX,XX @@ static void kvm_dist_get_edge_trigger(GICv3State *s, uint32_t offset,
+@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
-     uint32_t reg;
-     int irq;
+ config SIFIVE_GPIO
+     bool
-+    /* For the KVM GICv3, affinity routing is always enabled, and the first 2
++
-+     * GICD_ICFGR<n> registers are always RAZ/WI. The corresponding
++config STM32L4X5_GPIO
-+     * functionality is replaced by GICR_ICFGR<n>. It doesn't need to sync
++    bool
-+     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
+diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
-+     * This matches the for_each_dist_irq_reg() macro which also skips the
+index XXXXXXX..XXXXXXX 100644
-+     * first GIC_INTERNAL irqs.
+--- a/hw/gpio/meson.build
-+     */
++++ b/hw/gpio/meson.build
-+    offset += (GIC_INTERNAL * 2) / 8;
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
-     for_each_dist_irq_reg(irq, s->num_irq, 2) {
+     'bcm2835_gpio.c',
-         kvm_gicd_access(s, offset, &reg, false);
+     'bcm2838_gpio.c'
-         reg = half_unshuffle32(reg >> 1);
+ ))
-@@ -XXX,XX +XXX,XX @@ static void kvm_dist_put_edge_trigger(GICv3State *s, uint32_t offset,
++system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
-     uint32_t reg;
+ system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
-     int irq;
+ system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
+diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
-+    /* For the KVM GICv3, affinity routing is always enabled, and the first 2
+index XXXXXXX..XXXXXXX 100644
-+     * GICD_ICFGR<n> registers are always RAZ/WI. The corresponding
+--- a/hw/gpio/trace-events
-+     * functionality is replaced by GICR_ICFGR<n>. It doesn't need to sync
++++ b/hw/gpio/trace-events
-+     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
+@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
-+     * This matches the for_each_dist_irq_reg() macro which also skips the
+ # aspeed_gpio.c
-+     * first GIC_INTERNAL irqs.
+ aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
-+     */
+ aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
-+    offset += (GIC_INTERNAL * 2) / 8;
++
-     for_each_dist_irq_reg(irq, s->num_irq, 2) {
++# stm32l4x5_gpio.c
-         reg = *gic_bmp_ptr32(bmp, irq);
++stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
-         if (irq % 32 != 0) {
++stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
-@@ -XXX,XX +XXX,XX @@ static void kvm_dist_getbmp(GICv3State *s, uint32_t offset, uint32_t *bmp)
++stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
-     uint32_t reg;
++stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
      int irq;
 +    /* For the KVM GICv3, affinity routing is always enabled, and the
 +     * GICD_IGROUPR0/GICD_IGRPMODR0/GICD_ISENABLER0/GICD_ISPENDR0/
 +     * GICD_ISACTIVER0 registers are always RAZ/WI. The corresponding
 +     * functionality is replaced by the GICR registers. It doesn't need to sync
 +     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
 +     * This matches the for_each_dist_irq_reg() macro which also skips the
 +     * first GIC_INTERNAL irqs.
 +     */
 +    offset += (GIC_INTERNAL * 1) / 8;
      for_each_dist_irq_reg(irq, s->num_irq, 1) {
          kvm_gicd_access(s, offset, &reg, false);
          *gic_bmp_ptr32(bmp, irq) = reg;
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,
      uint32_t reg;
      int irq;
 +    /* For the KVM GICv3, affinity routing is always enabled, and the
 +     * GICD_IGROUPR0/GICD_IGRPMODR0/GICD_ISENABLER0/GICD_ISPENDR0/
 +     * GICD_ISACTIVER0 registers are always RAZ/WI. The corresponding
 +     * functionality is replaced by the GICR registers. It doesn't need to sync
 +     * them. So it should increase the offset and clroffset to skip GIC_INTERNAL
 +     * irqs. This matches the for_each_dist_irq_reg() macro which also skips the
 +     * first GIC_INTERNAL irqs.
 +     */
 +    offset += (GIC_INTERNAL * 1) / 8;
 +    if (clroffset != 0) {
 +        clroffset += (GIC_INTERNAL * 1) / 8;
 +    }
 +
      for_each_dist_irq_reg(irq, s->num_irq, 1) {
          /* If this bitmap is a set/clear register pair, first write to the
           * clear-reg to clear all bits before using the set-reg to write
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 28/31] sdcard: Add a 'spec_version' property, default to Spec v2.00
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-As of this commit, the Spec v1 is not working, and all controllers
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-expect the cards to be conformant to Spec v2.
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Message-id: 20180607180641.874-4-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sd.h |  5 +++++
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
- hw/sd/sd.c         | 23 ++++++++++++++++++++---
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
-files changed, 25 insertions(+), 3 deletions(-)
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
-diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
-index XXXXXXX..XXXXXXX 100644
+ hw/arm/Kconfig                     |  3 +-
---- a/include/hw/sd/sd.h
+files changed, 63 insertions(+), 18 deletions(-)
-+++ b/include/hw/sd/sd.h
-@@ -XXX,XX +XXX,XX @@
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
- #define APP_CMD            (1 << 5)
+index XXXXXXX..XXXXXXX 100644
- #define AKE_SEQ_ERROR        (1 << 3)
+--- a/include/hw/arm/stm32l4x5_soc.h
++++ b/include/hw/arm/stm32l4x5_soc.h
-+enum SDPhySpecificationVersion {
+@@ -XXX,XX +XXX,XX @@
-+    SD_PHY_SPECv1_10_VERS     = 1,
+ #include "hw/misc/stm32l4x5_syscfg.h"
-+    SD_PHY_SPECv2_00_VERS     = 2,
+ #include "hw/misc/stm32l4x5_exti.h"
  #include "hw/misc/stm32l4x5_rcc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "qom/object.h"
  #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
      OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
      Stm32l4x5SyscfgState syscfg;
      Stm32l4x5RccState rcc;
 +    Stm32l4x5GpioState gpio[NUM_GPIOS];
      MemoryRegion sram1;
      MemoryRegion sram2;
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/gpio/stm32l4x5_gpio.h
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
  #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +#define NUM_GPIOS 8
  #define GPIO_NUM_PINS 16
  struct Stm32l4x5GpioState {
 diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
 +static const struct {
 +    uint32_t addr;
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
 +    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
- typedef enum {
+ static void stm32l4x5_soc_initfn(Object *obj)
      SD_VOLTAGE_0_4V     = 400,  /* currently not supported */
      SD_VOLTAGE_1_8V     = 1800,
 diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/sd/sd.c
 +++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
  /*
   * SD Memory Card emulation as defined in the "SD Memory Card Physical
 - * layer specification, Version 1.10."
 + * layer specification, Version 2.00."
   *
   * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
   * Copyright (c) 2007 CodeSourcery
 + * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions
@@ -XXX,XX +XXX,XX @@ struct SDState {
      uint8_t sd_status[64];
      /* Configurable properties */
 +    uint8_t spec_version;
      BlockBackend *blk;
      bool spi;
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
  static void sd_set_scr(SDState *sd)
  {
--    sd->scr[0] = (0 << 4)       /* SCR structure version 1.0 */
+     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
--                 | 1;           /* Spec Version 1.10 */
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
-+    sd->scr[0] = 0 << 4;        /* SCR structure version 1.0 */
+     }
-+    if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
+     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
-+        sd->scr[0] |= 1;        /* Spec Version 1.10 */
+     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
-+    } else {
++
-+        sd->scr[0] |= 2;        /* Spec Version 2.00 */
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
 +        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
 +    }
-     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
+ }
-                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
-     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
+     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
-     sd->proto_name = sd->spi ? "SPI" : "SD";
+     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
+     MemoryRegion *system_memory = get_system_memory();
-+    switch (sd->spec_version) {
+-    DeviceState *armv7m;
-+    case SD_PHY_SPECv1_10_VERS
++    DeviceState *armv7m, *dev;
-+     ... SD_PHY_SPECv2_00_VERS:
+     SysBusDevice *busdev;
-+        break;
++    uint32_t pin_index;
-+    default:
-+        error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
+     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
-+        return;
+                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          return;
      }
 +    /* GPIOs */
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
 +        dev = DEVICE(&s->gpio[i]);
 +        qdev_prop_set_string(dev, "name", name);
 +        qdev_prop_set_uint32(dev, "mode-reset",
 +                             stm32l4x5_gpio_cfg[i].moder_reset);
 +        qdev_prop_set_uint32(dev, "ospeed-reset",
 +                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
 +        qdev_prop_set_uint32(dev, "pupd-reset",
 +                            stm32l4x5_gpio_cfg[i].pupdr_reset);
 +        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
 +        g_free(name);
 +        name = g_strdup_printf("gpio%c-out", 'a' + i);
 +        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
 +            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
 +        if (!sysbus_realize(busdev, errp)) {
 +            return;
 +        }
 +        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
 +    }
 +
-     if (sd->blk && blk_is_read_only(sd->blk)) {
+     /* System configuration controller */
-         error_setg(errp, "Cannot use read-only drive as SD card");
+     busdev = SYS_BUS_DEVICE(&s->syscfg);
      if (!sysbus_realize(busdev, errp)) {
          return;
-@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
+     }
- }
+     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
+-    /*
- static Property sd_properties[] = {
+-     * TODO: when the GPIO device is implemented, connect it
-+    DEFINE_PROP_UINT8("spec_version", SDState,
+-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-+                      spec_version, SD_PHY_SPECv2_00_VERS),
+-     * GPIO_NUM_PINS.
-     DEFINE_PROP_DRIVE("drive", SDState, blk),
+-     */
-     /* We do not model the chip select pin, so allow the board to select
++
-      * whether card should be in SSI or MMC/SD mode.  It is also up to the
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
 +            pin_index = GPIO_NUM_PINS * i + j;
 +            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
 +                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
 +                                  pin_index));
 +        }
 +    }
      /* EXTI device */
      busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          }
      }
 -    for (unsigned i = 0; i < 16; i++) {
 +    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
          qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                                qdev_get_gpio_in(DEVICE(&s->exti), i));
      }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      /* RESERVED:    0x40024400, 0x7FDBC00 */
      /* AHB2 BUS */
 -    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
 -    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
 -    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
 -    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
 -    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
 -    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
 -    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
 -    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
      /* RESERVED:    0x48002000, 0x7FDBC00 */
      create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
      create_unimplemented_device("ADC",       0x50040000, 0x400);
 diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32l4x5_syscfg.c
 +++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "migration/vmstate.h"
  #include "hw/misc/stm32l4x5_syscfg.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 07/31] misc: add pca9552 LED blinker model
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
-From: Cédric Le Goater <clg@kaod.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Specs are available here :
+The testcase contains :
 - `test_idr_reset_value()` :
 Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
 - `test_gpio_output_mode()` :
 Checks that writing a bit in register ODR results in the corresponding
 pin rising or lowering, if this pin is configured in output mode.
 - `test_gpio_input_mode()` :
 Checks that a input pin set high or low externally results
 in the pin rising and lowering.
 - `test_pull_up_pull_down()` :
 Checks that a floating pin in pull-up/down mode is actually high/down.
 - `test_push_pull()` :
 Checks that a pin set externally is disconnected when configured in
 push-pull output mode, and can't be set externally while in this mode.
 - `test_open_drain()` :
 Checks that a pin set externally high is disconnected when configured
 in open-drain output mode, and can't be set high while in this mode.
 - `test_bsrr_brr()` :
 Checks that writing to BSRR and BRR has the desired result in ODR.
 - `test_clock_enable()` :
 Checks that GPIO clock is at the right frequency after enabling it.
-    https://www.nxp.com/docs/en/application-note/AN264.pdf
+Acked-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-This is a simple model supporting the basic registers for led and GPIO
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-mode. The device also supports two blinking rates but not the model
+Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
 yet.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180530064049.27976-7-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs           |   1 +
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
- tests/Makefile.include          |   2 +
+ tests/qtest/meson.build           |   3 +-
- include/hw/misc/pca9552.h       |  32 +++++
+files changed, 553 insertions(+), 1 deletion(-)
- include/hw/misc/pca9552_regs.h  |  32 +++++
+ create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
  tests/libqos/i2c.h              |   2 +
  hw/misc/pca9552.c               | 240 ++++++++++++++++++++++++++++++++
  tests/pca9552-test.c            | 116 +++++++++++++++
  tests/tmp105-test.c             |   2 -
  default-configs/arm-softmmu.mak |   1 +
 files changed, 426 insertions(+), 2 deletions(-)
  create mode 100644 include/hw/misc/pca9552.h
  create mode 100644 include/hw/misc/pca9552_regs.h
  create mode 100644 hw/misc/pca9552.c
  create mode 100644 tests/pca9552-test.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SGA) += sga.o
  common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
  common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
  common-obj-$(CONFIG_EDU) += edu.o
 +common-obj-$(CONFIG_PCA9552) += pca9552.o
  common-obj-y += unimp.o
  common-obj-$(CONFIG_FW_CFG_DMA) += vmcoreinfo.o
 diff --git a/tests/Makefile.include b/tests/Makefile.include
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/Makefile.include
 +++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
  check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
  check-qtest-arm-y = tests/tmp105-test$(EXESUF)
 +check-qtest-arm-y += tests/pca9552-test$(EXESUF)
  check-qtest-arm-y += tests/ds1338-test$(EXESUF)
  check-qtest-arm-y += tests/m25p80-test$(EXESUF)
  gcov-files-arm-y += hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ tests/bios-tables-test$(EXESUF): tests/bios-tables-test.o \
      tests/boot-sector.o tests/acpi-utils.o $(libqos-obj-y)
  tests/pxe-test$(EXESUF): tests/pxe-test.o tests/boot-sector.o $(libqos-obj-y)
  tests/tmp105-test$(EXESUF): tests/tmp105-test.o $(libqos-omap-obj-y)
 +tests/pca9552-test$(EXESUF): tests/pca9552-test.o $(libqos-omap-obj-y)
  tests/ds1338-test$(EXESUF): tests/ds1338-test.o $(libqos-imx-obj-y)
  tests/m25p80-test$(EXESUF): tests/m25p80-test.o
  tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
 diff --git a/include/hw/misc/pca9552.h b/include/hw/misc/pca9552.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/pca9552.h
++++ b/tests/qtest/stm32l4x5_gpio-test.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * PCA9552 I2C LED blinker
++ * QTest testcase for STM32L4x5_GPIO
 + *
-+ * Copyright (c) 2017-2018, IBM Corporation.
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
-+ *
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + * This work is licensed under the terms of the GNU GPL, version 2 or
 + * later. See the COPYING file in the top-level directory.
 + */
 +#ifndef PCA9552_H
 +#define PCA9552_H
 +
 +#include "hw/i2c/i2c.h"
 +
 +#define TYPE_PCA9552 "pca9552"
 +#define PCA9552(obj) OBJECT_CHECK(PCA9552State, (obj), TYPE_PCA9552)
 +
 +#define PCA9552_NR_REGS 10
 +
 +typedef struct PCA9552State {
 +    /*< private >*/
 +    I2CSlave i2c;
 +    /*< public >*/
 +
 +    uint8_t len;
 +    uint8_t pointer;
 +
 +    uint8_t regs[PCA9552_NR_REGS];
 +    uint8_t max_reg;
 +    uint8_t nr_leds;
 +} PCA9552State;
 +
 +#endif
 diff --git a/include/hw/misc/pca9552_regs.h b/include/hw/misc/pca9552_regs.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/pca9552_regs.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * PCA9552 I2C LED blinker registers
 + *
 + * Copyright (c) 2017-2018, IBM Corporation.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or
 + * later. See the COPYING file in the top-level directory.
 + */
 +#ifndef PCA9552_REGS_H
 +#define PCA9552_REGS_H
 +
 +/*
 + * Bits [0:3] are used to address a specific register.
 + */
 +#define PCA9552_INPUT0   0 /* read only input register 0 */
 +#define PCA9552_INPUT1   1 /* read only input register 1  */
 +#define PCA9552_PSC0     2 /* read/write frequency prescaler 0 */
 +#define PCA9552_PWM0     3 /* read/write PWM register 0 */
 +#define PCA9552_PSC1     4 /* read/write frequency prescaler 1 */
 +#define PCA9552_PWM1     5 /* read/write PWM register 1 */
 +#define PCA9552_LS0      6 /* read/write LED0 to LED3 selector */
 +#define PCA9552_LS1      7 /* read/write LED4 to LED7 selector */
 +#define PCA9552_LS2      8 /* read/write LED8 to LED11 selector */
 +#define PCA9552_LS3      9 /* read/write LED12 to LED15 selector */
 +
 +/*
 + * Bit [4] is used to activate the Auto-Increment option of the
 + * register address
 + */
 +#define PCA9552_AUTOINC  (1 << 4)
 +
 +#endif
 diff --git a/tests/libqos/i2c.h b/tests/libqos/i2c.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/libqos/i2c.h
 +++ b/tests/libqos/i2c.h
@@ -XXX,XX +XXX,XX @@ struct I2CAdapter {
      QTestState *qts;
  };
 +#define OMAP2_I2C_1_BASE 0x48070000
 +
  void i2c_send(I2CAdapter *i2c, uint8_t addr,
                const uint8_t *buf, uint16_t len);
  void i2c_recv(I2CAdapter *i2c, uint8_t addr,
 diff --git a/hw/misc/pca9552.c b/hw/misc/pca9552.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/pca9552.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * PCA9552 I2C LED blinker
 + *
 + *     https://www.nxp.com/docs/en/application-note/AN264.pdf
 + *
 + * Copyright (c) 2017-2018, IBM Corporation.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or
 + * later. See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/hw.h"
 +#include "hw/misc/pca9552.h"
 +#include "hw/misc/pca9552_regs.h"
 +
 +#define PCA9552_LED_ON   0x0
 +#define PCA9552_LED_OFF  0x1
 +#define PCA9552_LED_PWM0 0x2
 +#define PCA9552_LED_PWM1 0x3
 +
 +static uint8_t pca9552_pin_get_config(PCA9552State *s, int pin)
 +{
 +    uint8_t reg   = PCA9552_LS0 + (pin / 4);
 +    uint8_t shift = (pin % 4) << 1;
 +
 +    return extract32(s->regs[reg], shift, 2);
 +}
 +
 +static void pca9552_update_pin_input(PCA9552State *s)
 +{
 +    int i;
 +
 +    for (i = 0; i < s->nr_leds; i++) {
 +        uint8_t input_reg = PCA9552_INPUT0 + (i / 8);
 +        uint8_t input_shift = (i % 8);
 +        uint8_t config = pca9552_pin_get_config(s, i);
 +
 +        switch (config) {
 +        case PCA9552_LED_ON:
 +            s->regs[input_reg] |= 1 << input_shift;
 +            break;
 +        case PCA9552_LED_OFF:
 +            s->regs[input_reg] &= ~(1 << input_shift);
 +            break;
 +        case PCA9552_LED_PWM0:
 +        case PCA9552_LED_PWM1:
 +            /* TODO */
 +        default:
 +            break;
 +        }
 +    }
 +}
 +
 +static uint8_t pca9552_read(PCA9552State *s, uint8_t reg)
 +{
 +    switch (reg) {
 +    case PCA9552_INPUT0:
 +    case PCA9552_INPUT1:
 +    case PCA9552_PSC0:
 +    case PCA9552_PWM0:
 +    case PCA9552_PSC1:
 +    case PCA9552_PWM1:
 +    case PCA9552_LS0:
 +    case PCA9552_LS1:
 +    case PCA9552_LS2:
 +    case PCA9552_LS3:
 +        return s->regs[reg];
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: unexpected read to register %d\n",
 +                      __func__, reg);
 +        return 0xFF;
 +    }
 +}
 +
 +static void pca9552_write(PCA9552State *s, uint8_t reg, uint8_t data)
 +{
 +    switch (reg) {
 +    case PCA9552_PSC0:
 +    case PCA9552_PWM0:
 +    case PCA9552_PSC1:
 +    case PCA9552_PWM1:
 +        s->regs[reg] = data;
 +        break;
 +
 +    case PCA9552_LS0:
 +    case PCA9552_LS1:
 +    case PCA9552_LS2:
 +    case PCA9552_LS3:
 +        s->regs[reg] = data;
 +        pca9552_update_pin_input(s);
 +        break;
 +
 +    case PCA9552_INPUT0:
 +    case PCA9552_INPUT1:
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: unexpected write to register %d\n",
 +                      __func__, reg);
 +    }
 +}
 +
 +/*
 + * When Auto-Increment is on, the register address is incremented
 + * after each byte is sent to or received by the device. The index
 + * rollovers to 0 when the maximum register address is reached.
 + */
 +static void pca9552_autoinc(PCA9552State *s)
 +{
 +    if (s->pointer != 0xFF && s->pointer & PCA9552_AUTOINC) {
 +        uint8_t reg = s->pointer & 0xf;
 +
 +        reg = (reg + 1) % (s->max_reg + 1);
 +        s->pointer = reg | PCA9552_AUTOINC;
 +    }
 +}
 +
 +static int pca9552_recv(I2CSlave *i2c)
 +{
 +    PCA9552State *s = PCA9552(i2c);
 +    uint8_t ret;
 +
 +    ret = pca9552_read(s, s->pointer & 0xf);
 +
 +    /*
 +     * From the Specs:
 +     *
 +     *     Important Note: When a Read sequence is initiated and the
 +     *     AI bit is set to Logic Level 1, the Read Sequence MUST
 +     *     start by a register different from 0.
 +     *
 +     * I don't know what should be done in this case, so throw an
 +     * error.
 +     */
 +    if (s->pointer == PCA9552_AUTOINC) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Autoincrement read starting with register 0\n",
 +                      __func__);
 +    }
 +
 +    pca9552_autoinc(s);
 +
 +    return ret;
 +}
 +
 +static int pca9552_send(I2CSlave *i2c, uint8_t data)
 +{
 +    PCA9552State *s = PCA9552(i2c);
 +
 +    /* First byte sent by is the register address */
 +    if (s->len == 0) {
 +        s->pointer = data;
 +        s->len++;
 +    } else {
 +        pca9552_write(s, s->pointer & 0xf, data);
 +
 +        pca9552_autoinc(s);
 +    }
 +
 +    return 0;
 +}
 +
 +static int pca9552_event(I2CSlave *i2c, enum i2c_event event)
 +{
 +    PCA9552State *s = PCA9552(i2c);
 +
 +    s->len = 0;
 +    return 0;
 +}
 +
 +static const VMStateDescription pca9552_vmstate = {
 +    .name = "PCA9552",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT8(len, PCA9552State),
 +        VMSTATE_UINT8(pointer, PCA9552State),
 +        VMSTATE_UINT8_ARRAY(regs, PCA9552State, PCA9552_NR_REGS),
 +        VMSTATE_I2C_SLAVE(i2c, PCA9552State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void pca9552_reset(DeviceState *dev)
 +{
 +    PCA9552State *s = PCA9552(dev);
 +
 +    s->regs[PCA9552_PSC0] = 0xFF;
 +    s->regs[PCA9552_PWM0] = 0x80;
 +    s->regs[PCA9552_PSC1] = 0xFF;
 +    s->regs[PCA9552_PWM1] = 0x80;
 +    s->regs[PCA9552_LS0] = 0x55; /* all OFF */
 +    s->regs[PCA9552_LS1] = 0x55;
 +    s->regs[PCA9552_LS2] = 0x55;
 +    s->regs[PCA9552_LS3] = 0x55;
 +
 +    pca9552_update_pin_input(s);
 +
 +    s->pointer = 0xFF;
 +    s->len = 0;
 +}
 +
 +static void pca9552_initfn(Object *obj)
 +{
 +    PCA9552State *s = PCA9552(obj);
 +
 +    /* If support for the other PCA955X devices are implemented, these
 +     * constant values might be part of class structure describing the
 +     * PCA955X device
 +     */
 +    s->max_reg = PCA9552_LS3;
 +    s->nr_leds = 16;
 +}
 +
 +static void pca9552_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
 +
 +    k->event = pca9552_event;
 +    k->recv = pca9552_recv;
 +    k->send = pca9552_send;
 +    dc->reset = pca9552_reset;
 +    dc->vmsd = &pca9552_vmstate;
 +}
 +
 +static const TypeInfo pca9552_info = {
 +    .name          = TYPE_PCA9552,
 +    .parent        = TYPE_I2C_SLAVE,
 +    .instance_init = pca9552_initfn,
 +    .instance_size = sizeof(PCA9552State),
 +    .class_init    = pca9552_class_init,
 +};
 +
 +static void pca9552_register_types(void)
 +{
 +    type_register_static(&pca9552_info);
 +}
 +
 +type_init(pca9552_register_types)
 diff --git a/tests/pca9552-test.c b/tests/pca9552-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/pca9552-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for the PCA9552 LED blinker
 + *
 + * Copyright (c) 2017-2018, IBM Corporation.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
-+
++#include "libqtest-single.h"
-+#include "libqtest.h"
++
-+#include "libqos/i2c.h"
++#define GPIO_BASE_ADDR 0x48000000
-+#include "hw/misc/pca9552_regs.h"
++#define GPIO_SIZE      0x400
-+
++#define NUM_GPIOS      8
-+#define PCA9552_TEST_ID   "pca9552-test"
++#define NUM_GPIO_PINS  16
-+#define PCA9552_TEST_ADDR 0x60
++
-+
++#define GPIO_A 0x48000000
-+static I2CAdapter *i2c;
++#define GPIO_B 0x48000400
-+
++#define GPIO_C 0x48000800
-+static uint8_t pca9552_get8(I2CAdapter *i2c, uint8_t addr, uint8_t reg)
++#define GPIO_D 0x48000C00
-+{
++#define GPIO_E 0x48001000
-+    uint8_t resp[1];
++#define GPIO_F 0x48001400
-+    i2c_send(i2c, addr, &reg, 1);
++#define GPIO_G 0x48001800
-+    i2c_recv(i2c, addr, resp, 1);
++#define GPIO_H 0x48001C00
-+    return resp[0];
++
-+}
++#define MODER 0x00
-+
++#define OTYPER 0x04
-+static void pca9552_set8(I2CAdapter *i2c, uint8_t addr, uint8_t reg,
++#define PUPDR 0x0C
-+                         uint8_t value)
++#define IDR 0x10
-+{
++#define ODR 0x14
-+    uint8_t cmd[2];
++#define BSRR 0x18
-+    uint8_t resp[1];
++#define BRR 0x28
 +
-+    cmd[0] = reg;
++#define MODER_INPUT 0
-+    cmd[1] = value;
++#define MODER_OUTPUT 1
-+    i2c_send(i2c, addr, cmd, 2);
++
-+    i2c_recv(i2c, addr, resp, 1);
++#define PUPDR_NONE 0
-+    g_assert_cmphex(resp[0], ==, cmd[1]);
++#define PUPDR_PULLUP 1
-+}
++#define PUPDR_PULLDOWN 2
 +
-+static void receive_autoinc(void)
++#define OTYPER_PUSH_PULL 0
-+{
++#define OTYPER_OPEN_DRAIN 1
-+    uint8_t resp;
++
-+    uint8_t reg = PCA9552_LS0 | PCA9552_AUTOINC;
++const uint32_t moder_reset[NUM_GPIOS] = {
-+
++    0xABFFFFFF,
-+    i2c_send(i2c, PCA9552_TEST_ADDR, &reg, 1);
++    0xFFFFFEBF,
-+
++    0xFFFFFFFF,
-+    /* PCA9552_LS0 */
++    0xFFFFFFFF,
-+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
++    0xFFFFFFFF,
-+    g_assert_cmphex(resp, ==, 0x54);
++    0xFFFFFFFF,
-+
++    0xFFFFFFFF,
-+    /* PCA9552_LS1 */
++    0x0000000F
-+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
++};
-+    g_assert_cmphex(resp, ==, 0x55);
++
-+
++const uint32_t pupdr_reset[NUM_GPIOS] = {
-+    /* PCA9552_LS2 */
++    0x64000000,
-+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
++    0x00000100,
-+    g_assert_cmphex(resp, ==, 0x55);
++    0x00000000,
-+
++    0x00000000,
-+    /* PCA9552_LS3 */
++    0x00000000,
-+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
++    0x00000000,
-+    g_assert_cmphex(resp, ==, 0x54);
++    0x00000000,
-+}
++    0x00000000
-+
++};
-+static void send_and_receive(void)
++
-+{
++const uint32_t idr_reset[NUM_GPIOS] = {
-+    uint8_t value;
++    0x0000A000,
-+
++    0x00000010,
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0);
++    0x00000000,
-+    g_assert_cmphex(value, ==, 0x55);
++    0x00000000,
-+
++    0x00000000,
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT0);
++    0x00000000,
-+    g_assert_cmphex(value, ==, 0x0);
++    0x00000000,
-+
++    0x00000000
-+    /* Switch on LED 0 */
++};
-+    pca9552_set8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0, 0x54);
++
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0);
++static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
-+    g_assert_cmphex(value, ==, 0x54);
++{
-+
++    return readl(gpio + offset);
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT0);
++}
-+    g_assert_cmphex(value, ==, 0x01);
++
-+
++static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
-+    /* Switch on LED 12 */
++{
-+    pca9552_set8(i2c, PCA9552_TEST_ADDR, PCA9552_LS3, 0x54);
++    writel(gpio + offset, value);
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS3);
++}
-+    g_assert_cmphex(value, ==, 0x54);
++
-+
++static void gpio_set_bit(unsigned int gpio, unsigned int reg,
-+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT1);
++                         unsigned int pin, uint32_t value)
-+    g_assert_cmphex(value, ==, 0x10);
++{
 +    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
 +}
 +
 +static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
 +                           unsigned int pin, uint32_t value)
 +{
 +    uint32_t offset = 2 * pin;
 +    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
 +}
 +
 +static unsigned int get_gpio_id(uint32_t gpio_addr)
 +{
 +    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
 +}
 +
 +static void gpio_set_irq(unsigned int gpio, int num, int level)
 +{
 +    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    qtest_set_irq_in(global_qtest, name, NULL, num, level);
 +}
 +
 +static void disconnect_all_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
 +        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
 +        path, 0xFFFF);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static uint32_t get_disconnected_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    uint32_t disconnected_pins = 0;
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
 +        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    disconnected_pins = qdict_get_int(r, "return");
 +    qobject_unref(r);
 +    return disconnected_pins;
 +}
 +
 +static uint32_t reset(uint32_t gpio, unsigned int offset)
 +{
 +    switch (offset) {
 +    case MODER:
 +        return moder_reset[get_gpio_id(gpio)];
 +    case PUPDR:
 +        return pupdr_reset[get_gpio_id(gpio)];
 +    case IDR:
 +        return idr_reset[get_gpio_id(gpio)];
 +    }
 +    return 0x0;
 +}
 +
 +static void system_reset(void)
 +{
 +    QDict *r;
 +    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static void test_idr_reset_value(void)
 +{
 +    /*
 +     * Checks that the values in MODER, OTYPER, PUPDR and ODR
 +     * after reset are correct, and that the value in IDR is
 +     * coherent.
 +     * Since AF and analog modes aren't implemented, IDR reset
 +     * values aren't the same as with a real board.
 +     *
 +     * Register IDR contains the actual values of all GPIO pins.
 +     * Its value depends on the pins' configuration
 +     * (intput/output/analog : register MODER, push-pull/open-drain :
 +     * register OTYPER, pull-up/pull-down/none : register PUPDR)
 +     * and on the values stored in register ODR
 +     * (in case the pin is in output mode).
 +     */
 +
 +    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
 +
 +    system_reset();
 +
 +    uint32_t moder = gpio_readl(GPIO_A, MODER);
 +    uint32_t odr = gpio_readl(GPIO_A, ODR);
 +    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
 +    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
 +    uint32_t idr = gpio_readl(GPIO_A, IDR);
 +    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
 +    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
 +    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
 +
 +    moder = gpio_readl(GPIO_B, MODER);
 +    odr = gpio_readl(GPIO_B, ODR);
 +    otyper = gpio_readl(GPIO_B, OTYPER);
 +    pupdr = gpio_readl(GPIO_B, PUPDR);
 +    idr = gpio_readl(GPIO_B, IDR);
 +    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
 +    /* ... 5: neither, 4: pull-up, 3: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
 +    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
 +
 +    moder = gpio_readl(GPIO_C, MODER);
 +    odr = gpio_readl(GPIO_C, ODR);
 +    otyper = gpio_readl(GPIO_C, OTYPER);
 +    pupdr = gpio_readl(GPIO_C, PUPDR);
 +    idr = gpio_readl(GPIO_C, IDR);
 +    /* Analog, same as Input mode*/
 +    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
 +
 +    moder = gpio_readl(GPIO_H, MODER);
 +    odr = gpio_readl(GPIO_H, ODR);
 +    otyper = gpio_readl(GPIO_H, OTYPER);
 +    pupdr = gpio_readl(GPIO_H, PUPDR);
 +    idr = gpio_readl(GPIO_H, IDR);
 +    /* Analog, same as Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
 +}
 +
 +static void test_gpio_output_mode(const void *data)
 +{
 +    /*
 +     * Checks that setting a bit in ODR sets the corresponding
 +     * GPIO line high : it should set the right bit in IDR
 +     * and send an irq to syscfg.
 +     * Additionally, it checks that values written to ODR
 +     * when not in output mode are stored and not discarded.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Set a bit in ODR and check nothing happens */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the relevant line as output and check the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Reset the bit in ODR and check the pin is low */
 +    gpio_set_bit(gpio, ODR, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +}
 +
 +static void test_gpio_input_mode(const void *data)
 +{
 +    /*
 +     * Test that setting a line high/low externally sets the
 +     * corresponding GPIO line high/low : it should set the
 +     * right bit in IDR and send an irq to syscfg.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input, raise it, and check that the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Lower the line and check that the pin is low */
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    disconnect_all_pins(gpio);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_pull_up_pull_down(const void *data)
 +{
 +    /*
 +     * Test that a floating pin with pull-up sets the pin
 +     * high and vice-versa.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input with pull-up, check the line is set high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the line with pull-down, check the line is low */
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_push_pull(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in push-pull output mode
 +     * disconnects the pin, that the pin can't be set or reset
 +     * externally afterwards.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Trying to set a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio2, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +}
 +
 +static void test_open_drain(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in open-drain output mode
 +     * disconnects a pin set high externally and that the pin
 +     * can't be set high externally while configured in open-drain.
 +     *
 +     * However a pin set low externally shouldn't be disconnected,
 +     * and it can be set low externally when in open-drain mode.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in open-drain output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in open-drain output */
 +    /* And checking the pin wasn't disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Trying to set a open-drain output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a open-drain output pin, checking it works */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Clean the test */
 +    disconnect_all_pins(gpio2);
 +    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
 +    disconnect_all_pins(gpio);
 +    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_bsrr_brr(const void *data)
 +{
 +    /*
 +     * Test that writing a '1' in BSS and BSRR
 +     * has the desired effect on ODR.
 +     * In BSRR, BSx has priority over BRx.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    /* BSx should have priority over BRx */
 +    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +}
 +
 +int main(int argc, char **argv)
 +{
-+    QTestState *s = NULL;
 +    int ret;
 +
 +    g_test_init(&argc, &argv, NULL);
-+
++    g_test_set_nonfatal_assertions();
-+    s = qtest_start("-machine n800 "
++    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
-+                    "-device pca9552,bus=i2c-bus.0,id=" PCA9552_TEST_ID
++                   test_idr_reset_value);
-+                    ",address=0x60");
++    /*
-+    i2c = omap_i2c_create(s, OMAP2_I2C_1_BASE);
++     * The inputs for the tests (gpio and pin) can be changed,
-+
++     * but the tests don't work for pins that are high at reset
-+    qtest_add_func("/pca9552/tx-rx", send_and_receive);
++     * (GPIOA15, GPIO13 and GPIOB5).
-+    qtest_add_func("/pca9552/rx-autoinc", receive_autoinc);
++     * Specifically, rising the pin then checking `get_irq()`
-+
++     * is problematic since the pin was already high.
 +     */
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
 +                        (void *)((uint64_t)GPIO_C << 32 | 5),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
 +                        (void *)((uint64_t)GPIO_D << 32 | 6),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
 +                        (void *)((uint64_t)GPIO_C << 32 | 10),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
 +                        (void *)((uint64_t)GPIO_B << 32 | 5),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
 +                        (void *)((uint64_t)GPIO_F << 32 | 1),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
 +                        (void *)((uint64_t)GPIO_G << 32 | 6),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
 +                        (void *)((uint64_t)GPIO_C << 32 | 4),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
 +                        (void *)((uint64_t)GPIO_E << 32 | 11),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
 +                        (void *)((uint64_t)GPIO_A << 32 | 12),
 +                        test_bsrr_brr);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
 +                        (void *)((uint64_t)GPIO_D << 32 | 0),
 +                        test_bsrr_brr);
 +
 +    qtest_start("-machine b-l475e-iot01a");
 +    ret = g_test_run();
-+
++    qtest_end();
 +    if (s) {
 +        qtest_quit(s);
 +    }
 +    g_free(i2c);
 +
 +    return ret;
 +}
-diff --git a/tests/tmp105-test.c b/tests/tmp105-test.c
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/tests/tmp105-test.c
+--- a/tests/qtest/meson.build
-+++ b/tests/tmp105-test.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
- #include "qapi/qmp/qdict.h"
+ qtests_stm32l4x5 = \
- #include "hw/misc/tmp105_regs.h"
+   ['stm32l4x5_exti-test',
+    'stm32l4x5_syscfg-test',
--#define OMAP2_I2C_1_BASE 0x48070000
+-   'stm32l4x5_rcc-test']
--
++   'stm32l4x5_rcc-test',
- #define TMP105_TEST_ID   "tmp105-test"
++   'stm32l4x5_gpio-test']
- #define TMP105_TEST_ADDR 0x49
+ qtests_arm = \
-diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TSC2005=y
  CONFIG_LM832X=y
  CONFIG_TMP105=y
  CONFIG_TMP421=y
 +CONFIG_PCA9552=y
  CONFIG_STELLARIS=y
  CONFIG_STELLARIS_INPUT=y
  CONFIG_STELLARIS_ENET=y
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 02/31] aspeed: remove ignore_memory_transaction_failures on all boards
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+While the 8-bit input elements are sequential in the input vector,
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+the 32-bit output elements are not sequential in the output matrix.
-Message-id: 20180530064049.27976-2-clg@kaod.org
+Do not attempt to compute 2 32-bit outputs at the same time.
 Cc: qemu-stable@nongnu.org
 Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed.c | 3 ---
+ target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
-file changed, 3 deletions(-)
+ tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+ tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 147 insertions(+), 33 deletions(-)
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+--- a/target/arm/tcg/sme_helper.c
-+++ b/hw/arm/aspeed.c
++++ b/target/arm/tcg/sme_helper.c
-@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
-     mc->no_floppy = 1;
+     }
      mc->no_cdrom = 1;
      mc->no_parallel = 1;
 -    mc->ignore_memory_transaction_failures = true;
  }
- static const TypeInfo palmetto_bmc_type = {
+-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
-@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_class_init(ObjectClass *oc, void *data)
++typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
-     mc->no_floppy = 1;
++static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
-     mc->no_cdrom = 1;
++                              uint8_t *pn, uint8_t *pm,
-     mc->no_parallel = 1;
++                              uint32_t desc, IMOPFn32 *fn)
--    mc->ignore_memory_transaction_failures = true;
++{
 +    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
 +    bool neg = simd_data(desc);
 -static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 -                            uint8_t *pn, uint8_t *pm,
 -                            uint32_t desc, IMOPFn *fn)
 +    for (row = 0; row < oprsz; ++row) {
 +        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
 +        uint32_t *za_row = &za[tile_vslice_index(row)];
 +        uint32_t n = zn[H4(row)];
 +
 +        for (col = 0; col < oprsz; ++col) {
 +            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
 +            uint32_t *a = &za_row[H4(col)];
 +
 +            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
 +        }
 +    }
 +}
 +
 +typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn64 *fn)
  {
      intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
      bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
  }
- static const TypeInfo ast2500_evb_type = {
+ #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_class_init(ObjectClass *oc, void *data)
+-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
-     mc->no_floppy = 1;
++static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
-     mc->no_cdrom = 1;
+ {                                                                           \
-     mc->no_parallel = 1;
+-    uint32_t sum0 = 0, sum1 = 0;                                            \
--    mc->ignore_memory_transaction_failures = true;
++    uint32_t sum = 0;                                                       \
      /* Apply P to N as a mask, making the inactive elements 0. */           \
      n &= expand_pred_b(p);                                                  \
 -    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
 -    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
 -    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
 -    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
 -    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
 -    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
 -    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
 -    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
 -    if (neg) {                                                              \
 -        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
 -    } else {                                                                \
 -        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
 -    }                                                                       \
 -    return ((uint64_t)sum1 << 32) | sum0;                                   \
 +    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
 +    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
 +    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
 +    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
 +    return neg ? a - sum : a + sum;                                         \
  }
- static const TypeInfo romulus_bmc_type = {
+ #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
  DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
  DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 -#define DEF_IMOPH(NAME) \
 -    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
 -                            void *vpm, uint32_t desc)                        \
 -    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
 +#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  # SME Tests
  ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
 -AARCH64_TESTS += sme-outprod1
 +AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
  endif
  # System Registers Tests
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 05/31] smbus: add a smbus_eeprom_init_one() routine
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-This is an helper routine to add a single EEPROM on an I2C bus. It can
-be directly used by smbus_eeprom_init() which adds a certain number of
-EEPROMs on mips and x86 machines.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180530064049.27976-5-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/i2c/smbus.h |  1 +
- hw/i2c/smbus_eeprom.c  | 16 +++++++++++-----
-files changed, 12 insertions(+), 5 deletions(-)
-diff --git a/include/hw/i2c/smbus.h b/include/hw/i2c/smbus.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/smbus.h
-+++ b/include/hw/i2c/smbus.h
-@@ -XXX,XX +XXX,XX @@ int smbus_read_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data);
- int smbus_write_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data,
-                       int len);
-+void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf);
- void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
-                        const uint8_t *eeprom_spd, int size);
-diff --git a/hw/i2c/smbus_eeprom.c b/hw/i2c/smbus_eeprom.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/smbus_eeprom.c
-+++ b/hw/i2c/smbus_eeprom.c
-@@ -XXX,XX +XXX,XX @@ static void smbus_eeprom_register_types(void)
- type_init(smbus_eeprom_register_types)
-+void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf)
-+{
-+    DeviceState *dev;
-+
-+    dev = qdev_create((BusState *) smbus, "smbus-eeprom");
-+    qdev_prop_set_uint8(dev, "address", address);
-+    qdev_prop_set_ptr(dev, "data", eeprom_buf);
-+    qdev_init_nofail(dev);
-+}
-+
- void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
-                        const uint8_t *eeprom_spd, int eeprom_spd_size)
- {
-@@ -XXX,XX +XXX,XX @@ void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
-     }
-     for (i = 0; i < nb_eeprom; i++) {
--        DeviceState *eeprom;
--        eeprom = qdev_create((BusState *)smbus, "smbus-eeprom");
--        qdev_prop_set_uint8(eeprom, "address", 0x50 + i);
--        qdev_prop_set_ptr(eeprom, "data", eeprom_buf + (i * 256));
--        qdev_init_nofail(eeprom);
-+        smbus_eeprom_init_one(smbus, 0x50 + i, eeprom_buf + (i * 256));
-     }
- }
---
-.17.1

-[Qemu-devel] [PULL 06/31] aspeed: Add EEPROM I2C devices
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-The Aspeed boards have at least one EEPROM to hold the Vital Product
-Data (VPD).
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Message-id: 20180530064049.27976-6-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 13 +++++++++++++
-file changed, 13 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/arm/arm.h"
- #include "hw/arm/aspeed_soc.h"
- #include "hw/boards.h"
-+#include "hw/i2c/smbus.h"
- #include "qemu/log.h"
- #include "sysemu/block-backend.h"
- #include "hw/loader.h"
-@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-     DeviceState *dev;
-+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
-     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
-      * enough to provide basic RTC features. Alarms will be missing */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
-+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), 0x50,
-+                          eeprom_buf);
-+
-     /* add a TMP423 temperature sensor */
-     dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
-                            "tmp423", 0x4c);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
- static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-+
-+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 3), 0x50,
-+                          eeprom_buf);
-     /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo romulus_bmc_type = {
- static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
- {
-     AspeedSoCState *soc = &bmc->soc;
-+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
-     /* The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
-      * good enough */
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
-+
-+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), 0x51,
-+                          eeprom_buf);
- }
- static void witherspoon_bmc_init(MachineState *machine)
---
-.17.1

-[Qemu-devel] [PULL 08/31] aspeed: add the pc9552 chips to the witherspoon machine
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-The pca9552 LED blinkers on the Witherspoon machine are used for leds
-but also as GPIOs to control fans and GPUs.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180530064049.27976-8-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/aspeed.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
-+++ b/hw/arm/aspeed.c
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
-     AspeedSoCState *soc = &bmc->soc;
-     uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 3), "pca9552", 0x60);
-+
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
-     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
-@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
-     smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), 0x51,
-                           eeprom_buf);
-+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "pca9552",
-+                     0x60);
- }
- static void witherspoon_bmc_init(MachineState *machine)
---
-.17.1

-[Qemu-devel] [PULL 09/31] ftgmac100: compute maximum frame size depending on the protocol
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-The maximum frame size includes the CRC and depends if a VLAN tag is
-inserted or not. Adjust the frame size limit in the transmit handler
-using on the FTGMAC100State buffer size and in the receive handler use
-the packet protocol.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180530061711.23673-2-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/net/ftgmac100.h |  7 ++++++-
- hw/net/ftgmac100.c         | 23 ++++++++++++-----------
-files changed, 18 insertions(+), 12 deletions(-)
-diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/net/ftgmac100.h
-+++ b/include/hw/net/ftgmac100.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "net/net.h"
-+/*
-+ * Max frame size for the receiving buffer
-+ */
-+#define FTGMAC100_MAX_FRAME_SIZE    9220
-+
- typedef struct FTGMAC100State {
-     /*< private >*/
-     SysBusDevice parent_obj;
-@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
-     qemu_irq irq;
-     MemoryRegion iomem;
--    uint8_t *frame;
-+    uint8_t frame[FTGMAC100_MAX_FRAME_SIZE];
-     uint32_t irq_state;
-     uint32_t isr;
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
- /*
-  * Max frame size for the receiving buffer
-  */
--#define FTGMAC100_MAX_FRAME_SIZE    10240
-+#define FTGMAC100_MAX_FRAME_SIZE    9220
- /* Limits depending on the type of the frame
-  *
-  *   9216 for Jumbo frames (+ 4 for VLAN)
-  *   1518 for other frames (+ 4 for VLAN)
-  */
--static int ftgmac100_max_frame_size(FTGMAC100State *s)
-+static int ftgmac100_max_frame_size(FTGMAC100State *s, uint16_t proto)
- {
--    return (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518) + 4;
-+    int max = (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518);
-+
-+    return max + (proto == ETH_P_VLAN ? 4 : 0);
- }
- static void ftgmac100_update_irq(FTGMAC100State *s)
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-     uint8_t *ptr = s->frame;
-     uint32_t addr = tx_descriptor;
-     uint32_t flags = 0;
--    int max_frame_size = ftgmac100_max_frame_size(s);
-     while (1) {
-         FTGMAC100Desc bd;
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-             flags = bd.des1;
-         }
--        len = bd.des0 & 0x3FFF;
--        if (frame_size + len > max_frame_size) {
-+        len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
-+        if (frame_size + len > sizeof(s->frame)) {
-             qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
-                           __func__, len);
--            len = max_frame_size - frame_size;
-+            s->isr |= FTGMAC100_INT_XPKT_LOST;
-+            len =  sizeof(s->frame) - frame_size;
-         }
-         if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-     uint32_t buf_len;
-     size_t size = len;
-     uint32_t first = FTGMAC100_RXDES0_FRS;
--    int max_frame_size = ftgmac100_max_frame_size(s);
-+    uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(buf)->h_proto);
-+    int max_frame_size = ftgmac100_max_frame_size(s, proto);
-     if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
-          != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-     /* Huge frames are truncated.  */
-     if (size > max_frame_size) {
--        size = max_frame_size;
-         qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %zd bytes\n",
-                       __func__, size);
-+        size = max_frame_size;
-         flags |= FTGMAC100_RXDES0_FTL;
-     }
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_realize(DeviceState *dev, Error **errp)
-                           object_get_typename(OBJECT(dev)), DEVICE(dev)->id,
-                           s);
-     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
--
--    s->frame = g_malloc(FTGMAC100_MAX_FRAME_SIZE);
- }
- static const VMStateDescription vmstate_ftgmac100 = {
---
-.17.1

-[Qemu-devel] [PULL 10/31] ftgmac100: add IEEE 802.1Q VLAN support
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-The ftgmac100 NIC supports VLAN tag insertion and the MAC engine also
-has a control to remove VLAN tags from received packets.
-The VLAN control bits and VLAN tag information are contained in the
-second word of the transmit and receive descriptors. The Insert VLAN
-bit and the VLAN Tag available bit are only valid in the first segment
-of the packet.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180530061711.23673-3-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/ftgmac100.c | 31 ++++++++++++++++++++++++++++++-
-file changed, 30 insertions(+), 1 deletion(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-             break;
-         }
-+        /* Check for VLAN */
-+        if (bd.des0 & FTGMAC100_TXDES0_FTS &&
-+            bd.des1 & FTGMAC100_TXDES1_INS_VLANTAG &&
-+            be16_to_cpu(PKT_GET_ETH_HDR(ptr)->h_proto) != ETH_P_VLAN) {
-+            if (frame_size + len + 4 > sizeof(s->frame)) {
-+                qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
-+                              __func__, len);
-+                s->isr |= FTGMAC100_INT_XPKT_LOST;
-+                len =  sizeof(s->frame) - frame_size - 4;
-+            }
-+            memmove(ptr + 16, ptr + 12, len - 12);
-+            stw_be_p(ptr + 12, ETH_P_VLAN);
-+            stw_be_p(ptr + 14, bd.des1);
-+            len += 4;
-+        }
-+
-         ptr += len;
-         frame_size += len;
-         if (bd.des0 & FTGMAC100_TXDES0_LTS) {
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-             buf_len += size - 4;
-         }
-         buf_addr = bd.des3;
--        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
-+        if (first && proto == ETH_P_VLAN && buf_len >= 18) {
-+            bd.des1 = lduw_be_p(buf + 14) | FTGMAC100_RXDES1_VLANTAG_AVAIL;
-+
-+            if (s->maccr & FTGMAC100_MACCR_RM_VLAN) {
-+                dma_memory_write(&address_space_memory, buf_addr, buf, 12);
-+                dma_memory_write(&address_space_memory, buf_addr + 12, buf + 16,
-+                                 buf_len - 16);
-+            } else {
-+                dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
-+            }
-+        } else {
-+            bd.des1 = 0;
-+            dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
-+        }
-         buf += buf_len;
-         if (size < 4) {
-             dma_memory_write(&address_space_memory, buf_addr + buf_len,
---
-.17.1

-[Qemu-devel] [PULL 11/31] ftgmac100: fix multicast hash routine
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-Based on the multicast hash calculation of the FTGMAC100 Linux driver.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180530061711.23673-4-clg@kaod.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/ftgmac100.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static int ftgmac100_filter(FTGMAC100State *s, const uint8_t *buf, size_t len)
-                 return 0;
-             }
--            /* TODO: this does not seem to work for ftgmac100 */
--            mcast_idx = net_crc32(buf, ETH_ALEN) >> 26;
-+            mcast_idx = net_crc32_le(buf, ETH_ALEN);
-+            mcast_idx = (~(mcast_idx >> 2)) & 0x3f;
-             if (!(s->math[mcast_idx / 32] & (1 << (mcast_idx % 32)))) {
-                 return 0;
-             }
---
-.17.1

-[Qemu-devel] [PULL 12/31] ftgmac100: remove check on runt messages
+Deleted patch
-From: Cédric Le Goater <clg@kaod.org>
-This is a ethernet wire limitation not needed in emulation. It breaks
-U-Boot n/w stack also.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20180530061711.23673-5-clg@kaod.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/ftgmac100.c | 6 ------
-file changed, 6 deletions(-)
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
-         return size;
-     }
--    if (size < 64 && !(s->maccr & FTGMAC100_MACCR_RX_RUNT)) {
--        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped runt frame of %zd bytes\n",
--                      __func__, size);
--        return size;
--    }
--
-     if (!ftgmac100_filter(s, buf, size)) {
-         return size;
-     }
---
-.17.1

-[Qemu-devel] [PULL 19/31] hw/core/register: Add trailing '\n' to qemu_log() call
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
 was unfortunately added with a license of GPL-v3-or-later, which is
 not compatible with other QEMU code which has a GPL-v2-only license.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+to make it compatible with the rest of QEMU.
-Message-id: 20180606152128.449-6-f4bug@amsat.org
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
 Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/register.c | 2 +-
+ include/hw/rtc/sun4v-rtc.h | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/rtc/sun4v-rtc.c         | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/core/register.c b/hw/core/register.c
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/register.c
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/hw/core/register.c
++++ b/include/hw/rtc/sun4v-rtc.h
-@@ -XXX,XX +XXX,XX @@ void register_write(RegisterInfo *reg, uint64_t val, uint64_t we,
+@@ -XXX,XX +XXX,XX @@
-     if (test) {
+  *
-         qemu_log_mask(LOG_UNIMP,
+  * Copyright (c) 2016 Artyom Tarasenko
-                       "%s:%s writing %#" PRIx64 " to unimplemented bits:" \
+  *
--                      " %#" PRIx64 "",
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-+                      " %#" PRIx64 "\n",
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-                       prefix, reg->access->name, val, ac->unimp);
+  * version.
-     }
+  */
 diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/sun4v-rtc.c
 +++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
   *
   * Copyright (c) 2016 Artyom Tarasenko
   *
 - * This code is licensed under the GNU GPL v3 or (at your option) any later
 + * This code is licensed under the GNU GPL v2 or (at your option) any later
   * version.
   */
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 13/31] hw/arm: Remove the deprecated xlnx-ep108 machine
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
 From: Thomas Huth <thuth@redhat.com>
-It has been marked as deprecated since QEMU v2.11, so it is time to
+Move the code to a separate file so that we do not have to compile
-remove this now. The xlnx-zcu102 machine is very much the same and
+it anymore if CONFIG_ARM_V7M is not set.
 can be used as a replacement instead.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20240308141051.536599-2-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 62 ++------------------------------------------
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
- qemu-doc.texi        |  5 ----
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
-files changed, 2 insertions(+), 65 deletions(-)
+ target/arm/meson.build     |   3 +
  target/arm/tcg/meson.build |   3 +
 files changed, 296 insertions(+), 261 deletions(-)
  create mode 100644 target/arm/tcg/cpu-v7m.c
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU ARMv7-M TCG-only CPUs.
 + *
 + * Copyright (c) 2012 SUSE LINUX Products GmbH
 + *
 + * This code is licensed under the GNU GPL v2 or later.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
 +#include "internals.h"
 +
 +#if !defined(CONFIG_USER_ONLY)
 +
 +#include "hw/intc/armv7m_nvic.h"
 +
 +static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cs);
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    bool ret = false;
 +
 +    /*
 +     * ARMv7-M interrupt masking works differently than -A or -R.
 +     * There is no FIQ/IRQ distinction. Instead of I and F bits
 +     * masking FIQ and IRQ interrupts, an exception is taken only
 +     * if it is higher priority than the current execution priority
 +     * (which depends on state like BASEPRI, FAULTMASK and the
 +     * currently active exception).
 +     */
 +    if (interrupt_request & CPU_INTERRUPT_HARD
 +        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 +        cs->exception_index = EXCP_IRQ;
 +        cc->tcg_ops->do_interrupt(cs);
 +        ret = true;
 +    }
 +    return ret;
 +}
 +
 +#endif /* !CONFIG_USER_ONLY */
 +
 +static void cortex_m0_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V6);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +
 +    cpu->midr = 0x410cc200;
 +
 +    /*
 +     * These ID register values are not guest visible, because
 +     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 +     * features, because QEMU generally controls its emulation
 +     * by looking at ID register fields. We use the same values as
 +     * for the M3.
 +     */
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m3_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    cpu->midr = 0x410fc231;
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m4_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fc240; /* r0p0 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000000;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m7_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x411fc272; /* r1p2 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00100030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02112000;
 +    cpu->isar.id_isar2 = 0x20232231;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m33_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd213; /* r0p3 */
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
 +    cpu->isar.id_dfr0 = 0x00200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00101F40;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000;
 +    cpu->ctr = 0x8000c000;
 +}
 +
 +static void cortex_m55_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd221; /* r0p1 */
 +    cpu->revidr = 0;
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    /* These are the MVFR* values for the FPU + full MVE configuration */
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12100211;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x20000030;
 +    cpu->isar.id_pfr1 = 0x00000230;
 +    cpu->isar.id_dfr0 = 0x10200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00111040;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000011;
 +    cpu->isar.id_isar0 = 0x01103110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000; /* caches not implemented */
 +    cpu->ctr = 0x8303c003;
 +}
 +
 +static const TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +    .restore_state_to_opc = arm_restore_state_to_opc,
 +
 +#ifdef CONFIG_USER_ONLY
 +    .record_sigsegv = arm_cpu_record_sigsegv,
 +    .record_sigbus = arm_cpu_record_sigbus,
 +#else
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +    .debug_check_breakpoint = arm_debug_check_breakpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
 +static void arm_v7m_class_init(ObjectClass *oc, void *data)
 +{
 +    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
 +
 +    acc->info = data;
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
 +    cc->gdb_core_xml_file = "arm-m-profile.xml";
 +}
 +
 +static const ARMCPUInfo arm_v7m_cpus[] = {
 +    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 +                             .class_init = arm_v7m_class_init },
 +};
 +
 +static void arm_v7m_cpu_register_types(void)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
 +        arm_cpu_register(&arm_v7m_cpus[i]);
 +    }
 +}
 +
 +type_init(arm_v7m_cpu_register_types)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/tcg/cpu32.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+@@ -XXX,XX +XXX,XX @@
- #define ZCU102_MACHINE(obj) \
+ #include "hw/boards.h"
-     OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+ #endif
+ #include "cpregs.h"
--#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
--#define EP108_MACHINE(obj) \
+-#include "hw/intc/armv7m_nvic.h"
--    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+-#endif
--
- static struct arm_boot_info xlnx_zcu102_binfo;
+ /* Share AArch32 -cpu max features with AArch64. */
- static bool zcu102_get_secure(Object *obj, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-@@ -XXX,XX +XXX,XX @@ static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
-     s->virt = value;
+ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 -#if !defined(CONFIG_USER_ONLY)
 -static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cs);
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    CPUARMState *env = &cpu->env;
 -    bool ret = false;
 -
 -    /*
 -     * ARMv7-M interrupt masking works differently than -A or -R.
 -     * There is no FIQ/IRQ distinction. Instead of I and F bits
 -     * masking FIQ and IRQ interrupts, an exception is taken only
 -     * if it is higher priority than the current execution priority
 -     * (which depends on state like BASEPRI, FAULTMASK and the
 -     * currently active exception).
 -     */
 -    if (interrupt_request & CPU_INTERRUPT_HARD
 -        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 -        cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops->do_interrupt(cs);
 -        ret = true;
 -    }
 -    return ret;
 -}
 -#endif /* !CONFIG_USER_ONLY */
 -
  static void arm926_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
--static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-static void cortex_m0_initfn(Object *obj)
-+static void xlnx_zcu102_init(MachineState *machine)
+-{
- {
+-    ARMCPU *cpu = ARM_CPU(obj);
-+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+-    set_feature(&cpu->env, ARM_FEATURE_V6);
-     int i;
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-     uint64_t ram_size = machine->ram_size;
+-
+-    cpu->midr = 0x410cc200;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-
-     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
+-    /*
 -     * These ID register values are not guest visible, because
 -     * we do not implement the Main Extension. They must be set
 -     * to values corresponding to the Cortex-M0's implemented
 -     * features, because QEMU generally controls its emulation
 -     * by looking at ID register fields. We use the same values as
 -     * for the M3.
 -     */
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m3_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    cpu->midr = 0x410fc231;
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m4_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fc240; /* r0p0 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000000;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m7_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x411fc272; /* r1p2 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00100030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02112000;
 -    cpu->isar.id_isar2 = 0x20232231;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m33_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd213; /* r0p3 */
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000210;
 -    cpu->isar.id_dfr0 = 0x00200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00101F40;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000;
 -    cpu->ctr = 0x8000c000;
 -}
 -
 -static void cortex_m55_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd221; /* r0p1 */
 -    cpu->revidr = 0;
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    /* These are the MVFR* values for the FPU + full MVE configuration */
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12100211;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x20000030;
 -    cpu->isar.id_pfr1 = 0x00000230;
 -    cpu->isar.id_dfr0 = 0x10200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00111040;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000011;
 -    cpu->isar.id_isar0 = 0x01103110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000; /* caches not implemented */
 -    cpu->ctr = 0x8303c003;
 -}
 -
  static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
      /* Dummy the TCM region regs for the moment */
      { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
--static void xlnx_ep108_init(MachineState *machine)
+-static const TCGCPUOps arm_v7m_tcg_ops = {
--{
+-    .initialize = arm_translate_init,
--    XlnxZCU102 *s = EP108_MACHINE(machine);
+-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
--
+-    .debug_excp_handler = arm_debug_excp_handler,
--    if (!qtest_enabled()) {
+-    .restore_state_to_opc = arm_restore_state_to_opc,
--        info_report("The Xilinx EP108 machine is deprecated, please use the "
+-
--                    "ZCU102 machine (which has the same features) instead.");
+-#ifdef CONFIG_USER_ONLY
--    }
+-    .record_sigsegv = arm_cpu_record_sigsegv,
--
+-    .record_sigbus = arm_cpu_record_sigbus,
--    xlnx_zynqmp_init(s, machine);
+-#else
--}
+-    .tlb_fill = arm_cpu_tlb_fill,
--
+-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
--static void xlnx_ep108_machine_instance_init(Object *obj)
+-    .do_interrupt = arm_v7m_cpu_do_interrupt,
--{
+-    .do_transaction_failed = arm_cpu_do_transaction_failed,
--    XlnxZCU102 *s = EP108_MACHINE(obj);
+-    .do_unaligned_access = arm_cpu_do_unaligned_access,
--
+-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
--    /* EP108, we don't support setting secure or virt */
+-    .debug_check_watchpoint = arm_debug_check_watchpoint,
--    s->secure = false;
+-    .debug_check_breakpoint = arm_debug_check_breakpoint,
--    s->virt = false;
+-#endif /* !CONFIG_USER_ONLY */
 -}
 -
 -static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
 -{
 -    MachineClass *mc = MACHINE_CLASS(oc);
 -
 -    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
 -    mc->init = xlnx_ep108_init;
 -    mc->block_default_type = IF_IDE;
 -    mc->units_per_default_bus = 1;
 -    mc->ignore_memory_transaction_failures = true;
 -    mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 -    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 -}
 -
 -static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
 -    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
 -    .parent     = TYPE_MACHINE,
 -    .class_init = xlnx_ep108_machine_class_init,
 -    .instance_init = xlnx_ep108_machine_instance_init,
 -    .instance_size = sizeof(XlnxZCU102),
 -};
 -
--static void xlnx_ep108_machine_init_register_types(void)
+-static void arm_v7m_class_init(ObjectClass *oc, void *data)
 -{
--    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
--}
+-    CPUClass *cc = CPU_CLASS(oc);
 -
--static void xlnx_zcu102_init(MachineState *machine)
+-    acc->info = data;
--{
+-    cc->tcg_ops = &arm_v7m_tcg_ops;
--    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+-    cc->gdb_core_xml_file = "arm-m-profile.xml";
--
+-}
--    xlnx_zynqmp_init(s, machine);
+-
--}
+ #ifndef TARGET_AARCH64
--
+ /*
- static void xlnx_zcu102_machine_instance_init(Object *obj)
+  * -cpu max: a CPU with as many features enabled as our emulation supports.
- {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
-     XlnxZCU102 *s = ZCU102_MACHINE(obj);
+     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init_register_types(void)
+     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
- }
+     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
+-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
- type_init(xlnx_zcu102_machine_init_register_types)
+-                             .class_init = arm_v7m_class_init },
--type_init(xlnx_ep108_machine_init_register_types)
+-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-diff --git a/qemu-doc.texi b/qemu-doc.texi
+-                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 -                             .class_init = arm_v7m_class_init },
      { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
      { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
      { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-doc.texi
+--- a/target/arm/meson.build
-+++ b/qemu-doc.texi
++++ b/target/arm/meson.build
-@@ -XXX,XX +XXX,XX @@ support page sizes < 4096 any longer.
+@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
+   'ptw.c',
- @section System emulator machines
+ ))
--@subsection Xilinx EP108 (since 2.11.0)
++arm_user_ss = ss.source_set()
--
++
--The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
+ subdir('hvf')
--The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
--
+ if 'CONFIG_TCG' in config_all_accel
- @section Block device options
+@@ -XXX,XX +XXX,XX @@ endif
- @subsection "backing": "" (since 2.12.0)
+ target_arch += {'arm': arm_ss}
  target_system_arch += {'arm': arm_system_ss}
 +target_user_arch += {'arm': arm_user_ss}
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
  arm_system_ss.add(files(
    'psci.c',
  ))
 +
 +arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 --
-.17.1
+.34.1

-[Qemu-devel] [PULL 14/31] hw/i2c: Add trace events
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606191801.6331-1-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- Makefile.objs       |  1 +
- hw/i2c/core.c       | 25 ++++++++++++++++++-------
- hw/i2c/trace-events |  7 +++++++
-files changed, 26 insertions(+), 7 deletions(-)
- create mode 100644 hw/i2c/trace-events
-diff --git a/Makefile.objs b/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/Makefile.objs
-+++ b/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/char
- trace-events-subdirs += hw/display
- trace-events-subdirs += hw/dma
- trace-events-subdirs += hw/hppa
-+trace-events-subdirs += hw/i2c
- trace-events-subdirs += hw/i386
- trace-events-subdirs += hw/i386/xen
- trace-events-subdirs += hw/ide
-diff --git a/hw/i2c/core.c b/hw/i2c/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i2c/core.c
-+++ b/hw/i2c/core.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "hw/i2c/i2c.h"
-+#include "trace.h"
- #define I2C_BROADCAST 0x00
-@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, int recv)
-     }
-     QLIST_FOREACH(node, &bus->current_devs, next) {
-+        I2CSlave *s = node->elt;
-         int rv;
--        sc = I2C_SLAVE_GET_CLASS(node->elt);
-+        sc = I2C_SLAVE_GET_CLASS(s);
-         /* If the bus is already busy, assume this is a repeated
-            start condition.  */
-         if (sc->event) {
--            rv = sc->event(node->elt, recv ? I2C_START_RECV : I2C_START_SEND);
-+            trace_i2c_event("start", s->address);
-+            rv = sc->event(s, recv ? I2C_START_RECV : I2C_START_SEND);
-             if (rv && !bus->broadcast) {
-                 if (bus_scanned) {
-                     /* First call, terminate the transfer. */
-@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
-     I2CNode *node, *next;
-     QLIST_FOREACH_SAFE(node, &bus->current_devs, next, next) {
--        sc = I2C_SLAVE_GET_CLASS(node->elt);
-+        I2CSlave *s = node->elt;
-+        sc = I2C_SLAVE_GET_CLASS(s);
-         if (sc->event) {
--            sc->event(node->elt, I2C_FINISH);
-+            trace_i2c_event("finish", s->address);
-+            sc->event(s, I2C_FINISH);
-         }
-         QLIST_REMOVE(node, next);
-         g_free(node);
-@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
- int i2c_send_recv(I2CBus *bus, uint8_t *data, bool send)
- {
-     I2CSlaveClass *sc;
-+    I2CSlave *s;
-     I2CNode *node;
-     int ret = 0;
-     if (send) {
-         QLIST_FOREACH(node, &bus->current_devs, next) {
--            sc = I2C_SLAVE_GET_CLASS(node->elt);
-+            s = node->elt;
-+            sc = I2C_SLAVE_GET_CLASS(s);
-             if (sc->send) {
--                ret = ret || sc->send(node->elt, *data);
-+                trace_i2c_send(s->address, *data);
-+                ret = ret || sc->send(s, *data);
-             } else {
-                 ret = -1;
-             }
-@@ -XXX,XX +XXX,XX @@ int i2c_send_recv(I2CBus *bus, uint8_t *data, bool send)
-         sc = I2C_SLAVE_GET_CLASS(QLIST_FIRST(&bus->current_devs)->elt);
-         if (sc->recv) {
--            ret = sc->recv(QLIST_FIRST(&bus->current_devs)->elt);
-+            s = QLIST_FIRST(&bus->current_devs)->elt;
-+            ret = sc->recv(s);
-+            trace_i2c_recv(s->address, ret);
-             if (ret < 0) {
-                 return ret;
-             } else {
-@@ -XXX,XX +XXX,XX @@ void i2c_nack(I2CBus *bus)
-     QLIST_FOREACH(node, &bus->current_devs, next) {
-         sc = I2C_SLAVE_GET_CLASS(node->elt);
-         if (sc->event) {
-+            trace_i2c_event("nack", node->elt->address);
-             sc->event(node->elt, I2C_NACK);
-         }
-     }
-diff --git a/hw/i2c/trace-events b/hw/i2c/trace-events
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/i2c/trace-events
-@@ -XXX,XX +XXX,XX @@
-+# See docs/devel/tracing.txt for syntax documentation.
-+
-+# hw/i2c/core.c
-+
-+i2c_event(const char *event, uint8_t address) "%s(addr:0x%02x)"
-+i2c_send(uint8_t address, uint8_t data) "send(addr:0x%02x) data:0x%02x"
-+i2c_recv(uint8_t address, uint8_t data) "recv(addr:0x%02x) data:0x%02x"
---
-.17.1

-[Qemu-devel] [PULL 15/31] hw/sd/milkymist-memcard: Add trailing '\n' to qemu_log() call
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606152128.449-2-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/milkymist-memcard.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/milkymist-memcard.c
-+++ b/hw/sd/milkymist-memcard.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
-             r = s->response[s->response_read_ptr++];
-             if (s->response_read_ptr > s->response_len) {
-                 qemu_log_mask(LOG_GUEST_ERROR, "milkymist_memcard: "
--                              "read more cmd bytes than available. Clipping.");
-+                              "read more cmd bytes than available: clipping\n");
-                 s->response_read_ptr = 0;
-             }
-         }
---
-.17.1

-[Qemu-devel] [PULL 16/31] hw/digic: Add trailing '\n' to qemu_log() calls
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606152128.449-3-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/digic-uart.c   | 4 ++--
- hw/timer/digic-timer.c | 4 ++--
-files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/char/digic-uart.c b/hw/char/digic-uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/digic-uart.c
-+++ b/hw/char/digic-uart.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t digic_uart_read(void *opaque, hwaddr addr,
-     default:
-         qemu_log_mask(LOG_UNIMP,
-                       "digic-uart: read access to unknown register 0x"
--                      TARGET_FMT_plx, addr << 2);
-+                      TARGET_FMT_plx "\n", addr << 2);
-     }
-     return ret;
-@@ -XXX,XX +XXX,XX @@ static void digic_uart_write(void *opaque, hwaddr addr, uint64_t value,
-     default:
-         qemu_log_mask(LOG_UNIMP,
-                       "digic-uart: write access to unknown register 0x"
--                      TARGET_FMT_plx, addr << 2);
-+                      TARGET_FMT_plx "\n", addr << 2);
-     }
- }
-diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/digic-timer.c
-+++ b/hw/timer/digic-timer.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t digic_timer_read(void *opaque, hwaddr offset, unsigned size)
-     default:
-         qemu_log_mask(LOG_UNIMP,
-                       "digic-timer: read access to unknown register 0x"
--                      TARGET_FMT_plx, offset);
-+                      TARGET_FMT_plx "\n", offset);
-     }
-     return ret;
-@@ -XXX,XX +XXX,XX @@ static void digic_timer_write(void *opaque, hwaddr offset,
-     default:
-         qemu_log_mask(LOG_UNIMP,
-                       "digic-timer: read access to unknown register 0x"
--                      TARGET_FMT_plx, offset);
-+                      TARGET_FMT_plx "\n", offset);
-     }
- }
---
-.17.1

-[Qemu-devel] [PULL 17/31] xilinx-dp: Add trailing '\n' to qemu_log() call
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20180606152128.449-4-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/display/xlnx_dp.c | 4 +++-
-file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/display/xlnx_dp.c
-+++ b/hw/display/xlnx_dp.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_dp_avbufm_write(void *opaque, hwaddr offset, uint64_t value,
-     case AV_BUF_STC_SNAPSHOT1:
-     case AV_BUF_HCOUNT_VCOUNT_INT0:
-     case AV_BUF_HCOUNT_VCOUNT_INT1:
--        qemu_log_mask(LOG_UNIMP, "avbufm: unimplmented");
-+        qemu_log_mask(LOG_UNIMP, "avbufm: unimplemented register 0x%04"
-+                                 PRIx64 "\n",
-+                      offset << 2);
-         break;
-     default:
-         s->avbufm_registers[offset] = value;
---
-.17.1

-[Qemu-devel] [PULL 18/31] ppc/pnv: Add trailing '\n' to qemu_log() calls
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Acked-by: David Gibson <david@gibson.dropbear.id.au>
-Message-id: 20180606152128.449-5-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/ppc/pnv_core.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ppc/pnv_core.c
-+++ b/hw/ppc/pnv_core.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t pnv_core_xscom_read(void *opaque, hwaddr addr,
-         val = 0x24f000000000000ull;
-         break;
-     default:
--        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx,
-+        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
-                   addr);
-     }
-@@ -XXX,XX +XXX,XX @@ static uint64_t pnv_core_xscom_read(void *opaque, hwaddr addr,
- static void pnv_core_xscom_write(void *opaque, hwaddr addr, uint64_t val,
-                                  unsigned int width)
- {
--    qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx,
-+    qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
-                   addr);
- }
---
-.17.1

-[Qemu-devel] [PULL 21/31] stellaris: Add trailing '\n' to qemu_log() calls
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606152128.449-8-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/stellaris.c | 11 ++++++-----
-file changed, 6 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stellaris.c
-+++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t gptm_read(void *opaque, hwaddr offset,
-             return s->rtc;
-         }
-         qemu_log_mask(LOG_UNIMP,
--                      "GPTM: read of TAR but timer read not supported");
-+                      "GPTM: read of TAR but timer read not supported\n");
-         return 0;
-     case 0x4c: /* TBR */
-         qemu_log_mask(LOG_UNIMP,
--                      "GPTM: read of TBR but timer read not supported");
-+                      "GPTM: read of TBR but timer read not supported\n");
-         return 0;
-     default:
-         qemu_log_mask(LOG_GUEST_ERROR,
-@@ -XXX,XX +XXX,XX @@ static void stellaris_i2c_write(void *opaque, hwaddr offset,
-         break;
-     case 0x20: /* MCR */
-         if (value & 1) {
--            qemu_log_mask(LOG_UNIMP, "stellaris_i2c: Loopback not implemented");
-+            qemu_log_mask(LOG_UNIMP,
-+                          "stellaris_i2c: Loopback not implemented\n");
-         }
-         if (value & 0x20) {
-             qemu_log_mask(LOG_UNIMP,
--                          "stellaris_i2c: Slave mode not implemented");
-+                          "stellaris_i2c: Slave mode not implemented\n");
-         }
-         s->mcr = value & 0x31;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_write(void *opaque, hwaddr offset,
-         s->sspri = value;
-         break;
-     case 0x28: /* PSSI */
--        qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented");
-+        qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented\n");
-         break;
-     case 0x30: /* SAC */
-         s->sac = value;
---
-.17.1

-[Qemu-devel] [PULL 24/31] RISC-V: Add trailing '\n' to qemu_log() calls
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180606152128.449-11-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/riscv/op_helper.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/riscv/op_helper.c
-+++ b/target/riscv/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void csr_write_helper(CPURISCVState *env, target_ulong val_to_write,
-         if ((val_to_write & 3) == 0) {
-             env->stvec = val_to_write >> 2 << 2;
-         } else {
--            qemu_log_mask(LOG_UNIMP, "CSR_STVEC: vectored traps not supported");
-+            qemu_log_mask(LOG_UNIMP,
-+                          "CSR_STVEC: vectored traps not supported\n");
-         }
-         break;
-     case CSR_SCOUNTEREN:
-@@ -XXX,XX +XXX,XX @@ void csr_write_helper(CPURISCVState *env, target_ulong val_to_write,
-         if ((val_to_write & 3) == 0) {
-             env->mtvec = val_to_write >> 2 << 2;
-         } else {
--            qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: vectored traps not supported");
-+            qemu_log_mask(LOG_UNIMP,
-+                          "CSR_MTVEC: vectored traps not supported\n");
-         }
-         break;
-     case CSR_MCOUNTEREN:
---
-.17.1

-[Qemu-devel] [PULL 25/31] target/xtensa: Add trailing '\n' to qemu_log() calls
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Acked-by: Max Filippov <jcmvbkbc@gmail.com>
-Message-id: 20180606152128.449-12-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/xtensa/translate.c | 6 +++---
-file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/xtensa/translate.c
-+++ b/target/xtensa/translate.c
-@@ -XXX,XX +XXX,XX @@ static void translate_rur(DisasContext *dc, const uint32_t arg[],
-         if (uregnames[par[0]].name) {
-             tcg_gen_mov_i32(cpu_R[arg[0]], cpu_UR[par[0]]);
-         } else {
--            qemu_log_mask(LOG_UNIMP, "RUR %d not implemented, ", par[0]);
-+            qemu_log_mask(LOG_UNIMP, "RUR %d not implemented\n", par[0]);
-         }
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void translate_slli(DisasContext *dc, const uint32_t arg[],
- {
-     if (gen_window_check2(dc, arg[0], arg[1])) {
-         if (arg[2] == 32) {
--            qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined",
-+            qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined\n",
-                           arg[0], arg[1]);
-         }
-         tcg_gen_shli_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2] & 0x1f);
-@@ -XXX,XX +XXX,XX @@ static void translate_wur(DisasContext *dc, const uint32_t arg[],
-         if (uregnames[par[0]].name) {
-             gen_wur(par[0], cpu_R[arg[0]]);
-         } else {
--            qemu_log_mask(LOG_UNIMP, "WUR %d not implemented, ", par[0]);
-+            qemu_log_mask(LOG_UNIMP, "WUR %d not implemented\n", par[0]);
-         }
-     }
- }
---
-.17.1

-[Qemu-devel] [PULL 26/31] sdcard: Update the Configuration Register (SCR) to Spec Version 1.10
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The initial implementation is based on the Specs v1.10 (see a1bb27b1e98).
-However the SCR is anouncing the card being v1.01.
-The new chapters added in version 1.10 are:
-.3.10 Switch function command
-    Switch function command (CMD6) 1 is used to switch or expand
-    memory card functions. [...]
-    This is a new feature, introduced in SD physical Layer
-    Specification Version 1.10. Therefore, cards that are
-    compatible with earlier versions of the spec do not support
-    it. The host shall check the "SD_SPEC" field in the SCR
-    register to recognize what version of the spec the card
-    complies with before using CMD6. It is mandatory for SD
-    memory card of Ver1.10 to support CMD6.
-.3.11 High-Speed mode (25MB/sec interface speed)
-    Though the Rev 1.01 SD memory card supports up to 12.5MB/sec
-    interface speed, the speed of 25MB/sec is necessary to support
-    increasing performance needs of the host and because of memory
-    size which continues to grow.
-    To achieve 25MB/sec interface speed, clock rate is increased to
-MHz and CLK/CMD/DAT signal timing and circuit conditions are
-    reconsidered and changed from Physical Layer Specification
-    Version 1.01.
-.3.12 Command system (This chapter is newly added in version 1.10)
-    SD commands CMD34-37, CMD50, CMD57 are reserved for SD command
-    system expansion via the switch command.
-    [These commands] will be considered as illegal commands (as
-    defined in revision 1.01 of the SD physical layer specification).
-The SWITCH_FUNCTION is implemented since the first commit, a1bb27b1e98.
-The 25MB/sec High-Speed mode was already updated in d7ecb867529.
-The current implementation does not implements CMD34-37, CMD50 and
-CMD57, thus these commands already return ILLEGAL.
-With this patch, the SCR register now matches the description of the header:
- * SD Memory Card emulation as defined in the "SD Memory Card Physical
- * layer specification, Version 1.10."
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180607180641.874-2-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sd.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
-+++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
- static void sd_set_scr(SDState *sd)
- {
--    sd->scr[0] = (0 << 4)       /* SCR version 1.0 */
--                 | 0;           /* Spec Versions 1.0 and 1.01 */
-+    sd->scr[0] = (0 << 4)       /* SCR structure version 1.0 */
-+                 | 1;           /* Spec Version 1.10 */
-     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
-                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
-     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
---
-.17.1

-[Qemu-devel] [PULL 27/31] sdcard: Allow commands valid in SPI mode
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-From the "Physical Layer Simplified Specification Version 1.10"
-  Chapter 7.3 "SPI Mode Transaction Packets"
-    Table 57: "Commands and arguments"
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20180607180641.874-3-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/sd/sd.c | 14 --------------
-file changed, 14 deletions(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
-+++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
-         return sd_illegal;
-     case 6:    /* CMD6:   SWITCH_FUNCTION */
--        if (sd->spi)
--            goto bad_cmd;
-         switch (sd->mode) {
-         case sd_data_transfer_mode:
-             sd_function_switch(sd, req.arg);
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
-     /* Block write commands (Class 4) */
-     case 24:    /* CMD24:  WRITE_SINGLE_BLOCK */
--        if (sd->spi) {
--            goto unimplemented_spi_cmd;
--        }
-         switch (sd->state) {
-         case sd_transfer_state:
-             /* Writing in SPI mode not implemented.  */
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
-         break;
-     case 25:    /* CMD25:  WRITE_MULTIPLE_BLOCK */
--        if (sd->spi) {
--            goto unimplemented_spi_cmd;
--        }
-         switch (sd->state) {
-         case sd_transfer_state:
-             /* Writing in SPI mode not implemented.  */
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
-         break;
-     case 27:    /* CMD27:  PROGRAM_CSD */
--        if (sd->spi) {
--            goto unimplemented_spi_cmd;
--        }
-         switch (sd->state) {
-         case sd_transfer_state:
-             sd->state = sd_receivingdata_state;
-@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
-     /* Lock card commands (Class 7) */
-     case 42:    /* CMD42:  LOCK_UNLOCK */
--        if (sd->spi) {
--            goto unimplemented_spi_cmd;
--        }
-         switch (sd->state) {
-         case sd_transfer_state:
-             sd->state = sd_receivingdata_state;
---
-.17.1

target-arm queue: aspeed patches from Cédric, and
cleanup and sd card patches from Philippe.

thanks
-- PMM

The following changes since commit bac5ba3dc5da706f52c149fa6c0bd1dc96899bec:

Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2018-06-08 10:26:16 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180608

for you to fetch changes up to 113f31c06c6bf16451892b2459d83c9b9c5e9844:

sdcard: Disable CMD19/CMD23 for Spec v2 (2018-06-08 13:15:34 +0100)

----------------------------------------------------------------
target-arm queue:
 * arm_gicv3_kvm: fix migration of registers corresponding to
   IRQs 992 to 1020 in the KVM GIC
 * aspeed: remove ignore_memory_transaction_failures on all boards
 * aspeed: add support for the witherspoon-bmc board
 * aspeed: add an I2C RTC device and EEPROM I2C devices
 * aspeed: add the pc9552 chips to the witherspoon machine
 * ftgmac100: fix various bugs
 * hw/arm: Remove the deprecated xlnx-ep108 machine
 * hw/i2c: Add trace events
 * add missing '\n' on various qemu_log() logging strings
 * sdcard: clean up spec version support so we report the
   right spec version to the guest and only implement the
   commands that are supposed to be present in that version

----------------------------------------------------------------
Cédric Le Goater (11):
      aspeed: remove ignore_memory_transaction_failures on all boards
      aspeed: add support for the witherspoon-bmc board
      aspeed: add an I2C RTC device to all machines
      smbus: add a smbus_eeprom_init_one() routine
      aspeed: Add EEPROM I2C devices
      misc: add pca9552 LED blinker model
      aspeed: add the pc9552 chips to the witherspoon machine
      ftgmac100: compute maximum frame size depending on the protocol
      ftgmac100: add IEEE 802.1Q VLAN support
      ftgmac100: fix multicast hash routine
      ftgmac100: remove check on runt messages

Philippe Mathieu-Daudé (18):
      hw/i2c: Add trace events
      hw/sd/milkymist-memcard: Add trailing '\n' to qemu_log() call
      hw/digic: Add trailing '\n' to qemu_log() calls
      xilinx-dp: Add trailing '\n' to qemu_log() call
      ppc/pnv: Add trailing '\n' to qemu_log() calls
      hw/core/register: Add trailing '\n' to qemu_log() call
      hw/mips/boston: Add trailing '\n' to qemu_log() calls
      stellaris: Add trailing '\n' to qemu_log() calls
      target/arm: Add trailing '\n' to qemu_log() calls
      target/m68k: Add trailing '\n' to qemu_log() call
      RISC-V: Add trailing '\n' to qemu_log() calls
      target/xtensa: Add trailing '\n' to qemu_log() calls
      sdcard: Update the Configuration Register (SCR) to Spec Version 1.10
      sdcard: Allow commands valid in SPI mode
      sdcard: Add a 'spec_version' property, default to Spec v2.00
      sdcard: Disable SEND_IF_COND (CMD8) for Spec v1
      sdcard: Reflect when the Spec v3 is supported in the Config Register (SCR)
      sdcard: Disable CMD19/CMD23 for Spec v2

Shannon Zhao (1):
      arm_gicv3_kvm: kvm_dist_get/put: skip the registers banked by GICR

Thomas Huth (1):
      hw/arm: Remove the deprecated xlnx-ep108 machine

From: Shannon Zhao <zhaoshenglong@huawei.com>

While we skip the GIC_INTERNAL irqs, we don't change the register offset
accordingly. This will overlap the GICR registers value and leave the
last GIC_INTERNAL irq's registers out of update.

Fix this by skipping the registers banked by GICR.

Also for migration compatibility if the migration source (old version
qemu) doesn't send gicd_no_migration_shift_bug = 1 to destination, then
we shift the data of PPI to get the right data for SPI.

Fixes: 367b9f527becdd20ddf116e17a3c0c2bbc486920
Cc: qemu-stable@nongnu.org
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Shannon Zhao <zhaoshenglong@huawei.com>
Message-id: 1527816987-16108-1-git-send-email-zhaoshenglong@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gicv3_common.h |  1 +
 hw/intc/arm_gicv3_common.c         | 79 ++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_kvm.c            | 38 ++++++++++++++
 3 files changed, 118 insertions(+)

diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     uint32_t revision;
     bool security_extn;
     bool irq_reset_nonsecure;
+    bool gicd_no_migration_shift_bug;
 
     int dev_fd; /* kvm device fd if backed by kvm vgic support */
     Error *migration_blocker;
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gicv3_common.h"
 #include "gicv3_internal.h"
 #include "hw/arm/linux-boot-if.h"
+#include "sysemu/kvm.h"
 
 static int gicv3_pre_save(void *opaque)
 {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3_cpu = {
     }
 };
 
+static int gicv3_gicd_no_migration_shift_bug_pre_load(void *opaque)
+{
+    GICv3State *cs = opaque;
+
+   /*
+    * The gicd_no_migration_shift_bug flag is used for migration compatibility
+    * for old version QEMU which may have the GICD bmp shift bug under KVM mode.
+    * Strictly, what we want to know is whether the migration source is using
+    * KVM. Since we don't have any way to determine that, we look at whether the
+    * destination is using KVM; this is close enough because for the older QEMU
+    * versions with this bug KVM -> TCG migration didn't work anyway. If the
+    * source is a newer QEMU without this bug it will transmit the migration
+    * subsection which sets the flag to true; otherwise it will remain set to
+    * the value we select here.
+    */
+    if (kvm_enabled()) {
+        cs->gicd_no_migration_shift_bug = false;
+    }
+
+    return 0;
+}
+
+static int gicv3_gicd_no_migration_shift_bug_post_load(void *opaque,
+                                                       int version_id)
+{
+    GICv3State *cs = opaque;
+
+    if (cs->gicd_no_migration_shift_bug) {
+        return 0;
+    }
+
+    /* Older versions of QEMU had a bug in the handling of state save/restore
+     * to the KVM GICv3: they got the offset in the bitmap arrays wrong,
+     * so that instead of the data for external interrupts 32 and up
+     * starting at bit position 32 in the bitmap, it started at bit
+     * position 64. If we're receiving data from a QEMU with that bug,
+     * we must move the data down into the right place.
+     */
+    memmove(cs->group, (uint8_t *)cs->group + GIC_INTERNAL / 8,
+            sizeof(cs->group) - GIC_INTERNAL / 8);
+    memmove(cs->grpmod, (uint8_t *)cs->grpmod + GIC_INTERNAL / 8,
+            sizeof(cs->grpmod) - GIC_INTERNAL / 8);
+    memmove(cs->enabled, (uint8_t *)cs->enabled + GIC_INTERNAL / 8,
+            sizeof(cs->enabled) - GIC_INTERNAL / 8);
+    memmove(cs->pending, (uint8_t *)cs->pending + GIC_INTERNAL / 8,
+            sizeof(cs->pending) - GIC_INTERNAL / 8);
+    memmove(cs->active, (uint8_t *)cs->active + GIC_INTERNAL / 8,
+            sizeof(cs->active) - GIC_INTERNAL / 8);
+    memmove(cs->edge_trigger, (uint8_t *)cs->edge_trigger + GIC_INTERNAL / 8,
+            sizeof(cs->edge_trigger) - GIC_INTERNAL / 8);
+
+    /*
+     * While this new version QEMU doesn't have this kind of bug as we fix it,
+     * so it needs to set the flag to true to indicate that and it's necessary
+     * for next migration to work from this new version QEMU.
+     */
+    cs->gicd_no_migration_shift_bug = true;
+
+    return 0;
+}
+
+const VMStateDescription vmstate_gicv3_gicd_no_migration_shift_bug = {
+    .name = "arm_gicv3/gicd_no_migration_shift_bug",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .pre_load = gicv3_gicd_no_migration_shift_bug_pre_load,
+    .post_load = gicv3_gicd_no_migration_shift_bug_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(gicd_no_migration_shift_bug, GICv3State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_gicv3 = {
     .name = "arm_gicv3",
     .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_gicv3 = {
         VMSTATE_STRUCT_VARRAY_POINTER_UINT32(cpu, GICv3State, num_cpu,
                                              vmstate_gicv3_cpu, GICv3CPUState),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription * []) {
+        &vmstate_gicv3_gicd_no_migration_shift_bug,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
             gicv3_gicd_group_set(s, i);
         }
     }
+    s->gicd_no_migration_shift_bug = true;
 }
 
 static void arm_gic_common_linux_init(ARMLinuxBootIf *obj,
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_get_edge_trigger(GICv3State *s, uint32_t offset,
     uint32_t reg;
     int irq;
 
+    /* For the KVM GICv3, affinity routing is always enabled, and the first 2
+     * GICD_ICFGR<n> registers are always RAZ/WI. The corresponding
+     * functionality is replaced by GICR_ICFGR<n>. It doesn't need to sync
+     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
+     * This matches the for_each_dist_irq_reg() macro which also skips the
+     * first GIC_INTERNAL irqs.
+     */
+    offset += (GIC_INTERNAL * 2) / 8;
     for_each_dist_irq_reg(irq, s->num_irq, 2) {
         kvm_gicd_access(s, offset, &reg, false);
         reg = half_unshuffle32(reg >> 1);
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_put_edge_trigger(GICv3State *s, uint32_t offset,
     uint32_t reg;
     int irq;
 
+    /* For the KVM GICv3, affinity routing is always enabled, and the first 2
+     * GICD_ICFGR<n> registers are always RAZ/WI. The corresponding
+     * functionality is replaced by GICR_ICFGR<n>. It doesn't need to sync
+     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
+     * This matches the for_each_dist_irq_reg() macro which also skips the
+     * first GIC_INTERNAL irqs.
+     */
+    offset += (GIC_INTERNAL * 2) / 8;
     for_each_dist_irq_reg(irq, s->num_irq, 2) {
         reg = *gic_bmp_ptr32(bmp, irq);
         if (irq % 32 != 0) {
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_getbmp(GICv3State *s, uint32_t offset, uint32_t *bmp)
     uint32_t reg;
     int irq;
 
+    /* For the KVM GICv3, affinity routing is always enabled, and the
+     * GICD_IGROUPR0/GICD_IGRPMODR0/GICD_ISENABLER0/GICD_ISPENDR0/
+     * GICD_ISACTIVER0 registers are always RAZ/WI. The corresponding
+     * functionality is replaced by the GICR registers. It doesn't need to sync
+     * them. So it should increase the offset to skip GIC_INTERNAL irqs.
+     * This matches the for_each_dist_irq_reg() macro which also skips the
+     * first GIC_INTERNAL irqs.
+     */
+    offset += (GIC_INTERNAL * 1) / 8;
     for_each_dist_irq_reg(irq, s->num_irq, 1) {
         kvm_gicd_access(s, offset, &reg, false);
         *gic_bmp_ptr32(bmp, irq) = reg;
@@ -XXX,XX +XXX,XX @@ static void kvm_dist_putbmp(GICv3State *s, uint32_t offset,
     uint32_t reg;
     int irq;
 
+    /* For the KVM GICv3, affinity routing is always enabled, and the
+     * GICD_IGROUPR0/GICD_IGRPMODR0/GICD_ISENABLER0/GICD_ISPENDR0/
+     * GICD_ISACTIVER0 registers are always RAZ/WI. The corresponding
+     * functionality is replaced by the GICR registers. It doesn't need to sync
+     * them. So it should increase the offset and clroffset to skip GIC_INTERNAL
+     * irqs. This matches the for_each_dist_irq_reg() macro which also skips the
+     * first GIC_INTERNAL irqs.
+     */
+    offset += (GIC_INTERNAL * 1) / 8;
+    if (clroffset != 0) {
+        clroffset += (GIC_INTERNAL * 1) / 8;
+    }
+
     for_each_dist_irq_reg(irq, s->num_irq, 1) {
         /* If this bitmap is a set/clear register pair, first write to the
          * clear-reg to clear all bits before using the set-reg to write
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180530064049.27976-2-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
-    mc->ignore_memory_transaction_failures = true;
 }
 
 static const TypeInfo palmetto_bmc_type = {
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
-    mc->ignore_memory_transaction_failures = true;
 }
 
 static const TypeInfo ast2500_evb_type = {
@@ -XXX,XX +XXX,XX @@ static void romulus_bmc_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
-    mc->ignore_memory_transaction_failures = true;
 }
 
 static const TypeInfo romulus_bmc_type = {
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The Witherspoon boards are OpenPOWER system hosting POWER9 Processors.
Add support for their BMC including a couple of I2C devices as found
on real HW.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180530064049.27976-3-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ enum {
     PALMETTO_BMC,
     AST2500_EVB,
     ROMULUS_BMC,
+    WITHERSPOON_BMC,
 };
 
 /* Palmetto hardware value: 0x120CE416 */
@@ -XXX,XX +XXX,XX @@ enum {
         SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
         SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 
+/* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
+#define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
+
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
 static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
+static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
 
 static const AspeedBoardConfig aspeed_boards[] = {
     [PALMETTO_BMC] = {
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
     },
+    [WITHERSPOON_BMC]  = {
+        .soc_name  = "ast2500-a1",
+        .hw_strap1 = WITHERSPOON_BMC_HW_STRAP1,
+        .fmc_model = "mx25l25635e",
+        .spi_model = "mx66l1g45g",
+        .num_cs    = 2,
+        .i2c_init  = witherspoon_bmc_i2c_init,
+    },
 };
 
 #define FIRMWARE_ADDR 0x0
@@ -XXX,XX +XXX,XX @@ static const TypeInfo romulus_bmc_type = {
     .class_init = romulus_bmc_class_init,
 };
 
+static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
+
+    /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 9), "tmp105", 0x4a);
+}
+
+static void witherspoon_bmc_init(MachineState *machine)
+{
+    aspeed_board_init(machine, &aspeed_boards[WITHERSPOON_BMC]);
+}
+
+static void witherspoon_bmc_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "OpenPOWER Witherspoon BMC (ARM1176)";
+    mc->init = witherspoon_bmc_init;
+    mc->max_cpus = 1;
+    mc->no_sdcard = 1;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->no_parallel = 1;
+}
+
+static const TypeInfo witherspoon_bmc_type = {
+    .name = MACHINE_TYPE_NAME("witherspoon-bmc"),
+    .parent = TYPE_MACHINE,
+    .class_init = witherspoon_bmc_class_init,
+};
+
 static void aspeed_machine_init(void)
 {
     type_register_static(&palmetto_bmc_type);
     type_register_static(&ast2500_evb_type);
     type_register_static(&romulus_bmc_type);
+    type_register_static(&witherspoon_bmc_type);
 }
 
 type_init(aspeed_machine_init)
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The AST2500 EVB does not have an RTC but we can pretend that one is
plugged on the I2C bus header.

The romulus and witherspoon boards expects an Epson RX8900 I2C RTC but
a ds1338 is good enough for the basic features we need.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180530064049.27976-4-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ enum {
 
 static void palmetto_bmc_i2c_init(AspeedBoardState *bmc);
 static void ast2500_evb_i2c_init(AspeedBoardState *bmc);
+static void romulus_bmc_i2c_init(AspeedBoardState *bmc);
 static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc);
 
 static const AspeedBoardConfig aspeed_boards[] = {
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .fmc_model = "n25q256a",
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
+        .i2c_init  = romulus_bmc_i2c_init,
     },
     [WITHERSPOON_BMC]  = {
         .soc_name  = "ast2500-a1",
@@ -XXX,XX +XXX,XX @@ static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
 
     /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
+
+    /* The AST2500 EVB does not have an RTC. Let's pretend that one is
+     * plugged on the I2C bus header */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
 static void ast2500_evb_init(MachineState *machine)
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ast2500_evb_type = {
     .class_init = ast2500_evb_class_init,
 };
 
+static void romulus_bmc_i2c_init(AspeedBoardState *bmc)
+{
+    AspeedSoCState *soc = &bmc->soc;
+
+    /* The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
+     * good enough */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
+}
+
 static void romulus_bmc_init(MachineState *machine)
 {
     aspeed_board_init(machine, &aspeed_boards[ROMULUS_BMC]);
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 
     /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 9), "tmp105", 0x4a);
+
+    /* The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
+     * good enough */
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
 }
 
 static void witherspoon_bmc_init(MachineState *machine)
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

This is an helper routine to add a single EEPROM on an I2C bus. It can
be directly used by smbus_eeprom_init() which adds a certain number of
EEPROMs on mips and x86 machines.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530064049.27976-5-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i2c/smbus.h |  1 +
 hw/i2c/smbus_eeprom.c  | 16 +++++++++++-----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/include/hw/i2c/smbus.h b/include/hw/i2c/smbus.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/smbus.h
+++ b/include/hw/i2c/smbus.h
@@ -XXX,XX +XXX,XX @@ int smbus_read_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data);
 int smbus_write_block(I2CBus *bus, uint8_t addr, uint8_t command, uint8_t *data,
                       int len);
 
+void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf);
 void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
                        const uint8_t *eeprom_spd, int size);
 
diff --git a/hw/i2c/smbus_eeprom.c b/hw/i2c/smbus_eeprom.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/smbus_eeprom.c
+++ b/hw/i2c/smbus_eeprom.c
@@ -XXX,XX +XXX,XX @@ static void smbus_eeprom_register_types(void)
 
 type_init(smbus_eeprom_register_types)
 
+void smbus_eeprom_init_one(I2CBus *smbus, uint8_t address, uint8_t *eeprom_buf)
+{
+    DeviceState *dev;
+
+    dev = qdev_create((BusState *) smbus, "smbus-eeprom");
+    qdev_prop_set_uint8(dev, "address", address);
+    qdev_prop_set_ptr(dev, "data", eeprom_buf);
+    qdev_init_nofail(dev);
+}
+
 void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
                        const uint8_t *eeprom_spd, int eeprom_spd_size)
 {
@@ -XXX,XX +XXX,XX @@ void smbus_eeprom_init(I2CBus *smbus, int nb_eeprom,
     }
 
     for (i = 0; i < nb_eeprom; i++) {
-        DeviceState *eeprom;
-        eeprom = qdev_create((BusState *)smbus, "smbus-eeprom");
-        qdev_prop_set_uint8(eeprom, "address", 0x50 + i);
-        qdev_prop_set_ptr(eeprom, "data", eeprom_buf + (i * 256));
-        qdev_init_nofail(eeprom);
+        smbus_eeprom_init_one(smbus, 0x50 + i, eeprom_buf + (i * 256));
     }
 }
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The Aspeed boards have at least one EEPROM to hold the Vital Product
Data (VPD).

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180530064049.27976-6-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/arm.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
+#include "hw/i2c/smbus.h"
 #include "qemu/log.h"
 #include "sysemu/block-backend.h"
 #include "hw/loader.h"
@@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
     DeviceState *dev;
+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
 
     /* The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), "ds1338", 0x68);
 
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 0), 0x50,
+                          eeprom_buf);
+
     /* add a TMP423 temperature sensor */
     dev = i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 2),
                            "tmp423", 0x4c);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo palmetto_bmc_type = {
 static void ast2500_evb_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 3), 0x50,
+                          eeprom_buf);
 
     /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 7), "tmp105", 0x4d);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo romulus_bmc_type = {
 static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 {
     AspeedSoCState *soc = &bmc->soc;
+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
 
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
     /* The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
      * good enough */
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "ds1338", 0x32);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), 0x51,
+                          eeprom_buf);
 }
 
 static void witherspoon_bmc_init(MachineState *machine)
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

Specs are available here :

https://www.nxp.com/docs/en/application-note/AN264.pdf

This is a simple model supporting the basic registers for led and GPIO
mode. The device also supports two blinking rates but not the model
yet.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530064049.27976-7-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs           |   1 +
 tests/Makefile.include          |   2 +
 include/hw/misc/pca9552.h       |  32 +++++
 include/hw/misc/pca9552_regs.h  |  32 +++++
 tests/libqos/i2c.h              |   2 +
 hw/misc/pca9552.c               | 240 ++++++++++++++++++++++++++++++++
 tests/pca9552-test.c            | 116 +++++++++++++++
 tests/tmp105-test.c             |   2 -
 default-configs/arm-softmmu.mak |   1 +
 9 files changed, 426 insertions(+), 2 deletions(-)
 create mode 100644 include/hw/misc/pca9552.h
 create mode 100644 include/hw/misc/pca9552_regs.h
 create mode 100644 hw/misc/pca9552.c
 create mode 100644 tests/pca9552-test.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SGA) += sga.o
 common-obj-$(CONFIG_ISA_TESTDEV) += pc-testdev.o
 common-obj-$(CONFIG_PCI_TESTDEV) += pci-testdev.o
 common-obj-$(CONFIG_EDU) += edu.o
+common-obj-$(CONFIG_PCA9552) += pca9552.o
 
 common-obj-y += unimp.o
 common-obj-$(CONFIG_FW_CFG_DMA) += vmcoreinfo.o
diff --git a/tests/Makefile.include b/tests/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
 check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
 
 check-qtest-arm-y = tests/tmp105-test$(EXESUF)
+check-qtest-arm-y += tests/pca9552-test$(EXESUF)
 check-qtest-arm-y += tests/ds1338-test$(EXESUF)
 check-qtest-arm-y += tests/m25p80-test$(EXESUF)
 gcov-files-arm-y += hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ tests/bios-tables-test$(EXESUF): tests/bios-tables-test.o \
 	tests/boot-sector.o tests/acpi-utils.o $(libqos-obj-y)
 tests/pxe-test$(EXESUF): tests/pxe-test.o tests/boot-sector.o $(libqos-obj-y)
 tests/tmp105-test$(EXESUF): tests/tmp105-test.o $(libqos-omap-obj-y)
+tests/pca9552-test$(EXESUF): tests/pca9552-test.o $(libqos-omap-obj-y)
 tests/ds1338-test$(EXESUF): tests/ds1338-test.o $(libqos-imx-obj-y)
 tests/m25p80-test$(EXESUF): tests/m25p80-test.o
 tests/i440fx-test$(EXESUF): tests/i440fx-test.o $(libqos-pc-obj-y)
diff --git a/include/hw/misc/pca9552.h b/include/hw/misc/pca9552.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/pca9552.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * PCA9552 I2C LED blinker
+ *
+ * Copyright (c) 2017-2018, IBM Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later. See the COPYING file in the top-level directory.
+ */
+#ifndef PCA9552_H
+#define PCA9552_H
+
+#include "hw/i2c/i2c.h"
+
+#define TYPE_PCA9552 "pca9552"
+#define PCA9552(obj) OBJECT_CHECK(PCA9552State, (obj), TYPE_PCA9552)
+
+#define PCA9552_NR_REGS 10
+
+typedef struct PCA9552State {
+    /*< private >*/
+    I2CSlave i2c;
+    /*< public >*/
+
+    uint8_t len;
+    uint8_t pointer;
+
+    uint8_t regs[PCA9552_NR_REGS];
+    uint8_t max_reg;
+    uint8_t nr_leds;
+} PCA9552State;
+
+#endif
diff --git a/include/hw/misc/pca9552_regs.h b/include/hw/misc/pca9552_regs.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/pca9552_regs.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * PCA9552 I2C LED blinker registers
+ *
+ * Copyright (c) 2017-2018, IBM Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later. See the COPYING file in the top-level directory.
+ */
+#ifndef PCA9552_REGS_H
+#define PCA9552_REGS_H
+
+/*
+ * Bits [0:3] are used to address a specific register.
+ */
+#define PCA9552_INPUT0   0 /* read only input register 0 */
+#define PCA9552_INPUT1   1 /* read only input register 1  */
+#define PCA9552_PSC0     2 /* read/write frequency prescaler 0 */
+#define PCA9552_PWM0     3 /* read/write PWM register 0 */
+#define PCA9552_PSC1     4 /* read/write frequency prescaler 1 */
+#define PCA9552_PWM1     5 /* read/write PWM register 1 */
+#define PCA9552_LS0      6 /* read/write LED0 to LED3 selector */
+#define PCA9552_LS1      7 /* read/write LED4 to LED7 selector */
+#define PCA9552_LS2      8 /* read/write LED8 to LED11 selector */
+#define PCA9552_LS3      9 /* read/write LED12 to LED15 selector */
+
+/*
+ * Bit [4] is used to activate the Auto-Increment option of the
+ * register address
+ */
+#define PCA9552_AUTOINC  (1 << 4)
+
+#endif
diff --git a/tests/libqos/i2c.h b/tests/libqos/i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/libqos/i2c.h
+++ b/tests/libqos/i2c.h
@@ -XXX,XX +XXX,XX @@ struct I2CAdapter {
     QTestState *qts;
 };
 
+#define OMAP2_I2C_1_BASE 0x48070000
+
 void i2c_send(I2CAdapter *i2c, uint8_t addr,
               const uint8_t *buf, uint16_t len);
 void i2c_recv(I2CAdapter *i2c, uint8_t addr,
diff --git a/hw/misc/pca9552.c b/hw/misc/pca9552.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pca9552.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * PCA9552 I2C LED blinker
+ *
+ *     https://www.nxp.com/docs/en/application-note/AN264.pdf
+ *
+ * Copyright (c) 2017-2018, IBM Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later. See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/hw.h"
+#include "hw/misc/pca9552.h"
+#include "hw/misc/pca9552_regs.h"
+
+#define PCA9552_LED_ON   0x0
+#define PCA9552_LED_OFF  0x1
+#define PCA9552_LED_PWM0 0x2
+#define PCA9552_LED_PWM1 0x3
+
+static uint8_t pca9552_pin_get_config(PCA9552State *s, int pin)
+{
+    uint8_t reg   = PCA9552_LS0 + (pin / 4);
+    uint8_t shift = (pin % 4) << 1;
+
+    return extract32(s->regs[reg], shift, 2);
+}
+
+static void pca9552_update_pin_input(PCA9552State *s)
+{
+    int i;
+
+    for (i = 0; i < s->nr_leds; i++) {
+        uint8_t input_reg = PCA9552_INPUT0 + (i / 8);
+        uint8_t input_shift = (i % 8);
+        uint8_t config = pca9552_pin_get_config(s, i);
+
+        switch (config) {
+        case PCA9552_LED_ON:
+            s->regs[input_reg] |= 1 << input_shift;
+            break;
+        case PCA9552_LED_OFF:
+            s->regs[input_reg] &= ~(1 << input_shift);
+            break;
+        case PCA9552_LED_PWM0:
+        case PCA9552_LED_PWM1:
+            /* TODO */
+        default:
+            break;
+        }
+    }
+}
+
+static uint8_t pca9552_read(PCA9552State *s, uint8_t reg)
+{
+    switch (reg) {
+    case PCA9552_INPUT0:
+    case PCA9552_INPUT1:
+    case PCA9552_PSC0:
+    case PCA9552_PWM0:
+    case PCA9552_PSC1:
+    case PCA9552_PWM1:
+    case PCA9552_LS0:
+    case PCA9552_LS1:
+    case PCA9552_LS2:
+    case PCA9552_LS3:
+        return s->regs[reg];
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: unexpected read to register %d\n",
+                      __func__, reg);
+        return 0xFF;
+    }
+}
+
+static void pca9552_write(PCA9552State *s, uint8_t reg, uint8_t data)
+{
+    switch (reg) {
+    case PCA9552_PSC0:
+    case PCA9552_PWM0:
+    case PCA9552_PSC1:
+    case PCA9552_PWM1:
+        s->regs[reg] = data;
+        break;
+
+    case PCA9552_LS0:
+    case PCA9552_LS1:
+    case PCA9552_LS2:
+    case PCA9552_LS3:
+        s->regs[reg] = data;
+        pca9552_update_pin_input(s);
+        break;
+
+    case PCA9552_INPUT0:
+    case PCA9552_INPUT1:
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: unexpected write to register %d\n",
+                      __func__, reg);
+    }
+}
+
+/*
+ * When Auto-Increment is on, the register address is incremented
+ * after each byte is sent to or received by the device. The index
+ * rollovers to 0 when the maximum register address is reached.
+ */
+static void pca9552_autoinc(PCA9552State *s)
+{
+    if (s->pointer != 0xFF && s->pointer & PCA9552_AUTOINC) {
+        uint8_t reg = s->pointer & 0xf;
+
+        reg = (reg + 1) % (s->max_reg + 1);
+        s->pointer = reg | PCA9552_AUTOINC;
+    }
+}
+
+static int pca9552_recv(I2CSlave *i2c)
+{
+    PCA9552State *s = PCA9552(i2c);
+    uint8_t ret;
+
+    ret = pca9552_read(s, s->pointer & 0xf);
+
+    /*
+     * From the Specs:
+     *
+     *     Important Note: When a Read sequence is initiated and the
+     *     AI bit is set to Logic Level 1, the Read Sequence MUST
+     *     start by a register different from 0.
+     *
+     * I don't know what should be done in this case, so throw an
+     * error.
+     */
+    if (s->pointer == PCA9552_AUTOINC) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Autoincrement read starting with register 0\n",
+                      __func__);
+    }
+
+    pca9552_autoinc(s);
+
+    return ret;
+}
+
+static int pca9552_send(I2CSlave *i2c, uint8_t data)
+{
+    PCA9552State *s = PCA9552(i2c);
+
+    /* First byte sent by is the register address */
+    if (s->len == 0) {
+        s->pointer = data;
+        s->len++;
+    } else {
+        pca9552_write(s, s->pointer & 0xf, data);
+
+        pca9552_autoinc(s);
+    }
+
+    return 0;
+}
+
+static int pca9552_event(I2CSlave *i2c, enum i2c_event event)
+{
+    PCA9552State *s = PCA9552(i2c);
+
+    s->len = 0;
+    return 0;
+}
+
+static const VMStateDescription pca9552_vmstate = {
+    .name = "PCA9552",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(len, PCA9552State),
+        VMSTATE_UINT8(pointer, PCA9552State),
+        VMSTATE_UINT8_ARRAY(regs, PCA9552State, PCA9552_NR_REGS),
+        VMSTATE_I2C_SLAVE(i2c, PCA9552State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void pca9552_reset(DeviceState *dev)
+{
+    PCA9552State *s = PCA9552(dev);
+
+    s->regs[PCA9552_PSC0] = 0xFF;
+    s->regs[PCA9552_PWM0] = 0x80;
+    s->regs[PCA9552_PSC1] = 0xFF;
+    s->regs[PCA9552_PWM1] = 0x80;
+    s->regs[PCA9552_LS0] = 0x55; /* all OFF */
+    s->regs[PCA9552_LS1] = 0x55;
+    s->regs[PCA9552_LS2] = 0x55;
+    s->regs[PCA9552_LS3] = 0x55;
+
+    pca9552_update_pin_input(s);
+
+    s->pointer = 0xFF;
+    s->len = 0;
+}
+
+static void pca9552_initfn(Object *obj)
+{
+    PCA9552State *s = PCA9552(obj);
+
+    /* If support for the other PCA955X devices are implemented, these
+     * constant values might be part of class structure describing the
+     * PCA955X device
+     */
+    s->max_reg = PCA9552_LS3;
+    s->nr_leds = 16;
+}
+
+static void pca9552_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+
+    k->event = pca9552_event;
+    k->recv = pca9552_recv;
+    k->send = pca9552_send;
+    dc->reset = pca9552_reset;
+    dc->vmsd = &pca9552_vmstate;
+}
+
+static const TypeInfo pca9552_info = {
+    .name          = TYPE_PCA9552,
+    .parent        = TYPE_I2C_SLAVE,
+    .instance_init = pca9552_initfn,
+    .instance_size = sizeof(PCA9552State),
+    .class_init    = pca9552_class_init,
+};
+
+static void pca9552_register_types(void)
+{
+    type_register_static(&pca9552_info);
+}
+
+type_init(pca9552_register_types)
diff --git a/tests/pca9552-test.c b/tests/pca9552-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/pca9552-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the PCA9552 LED blinker
+ *
+ * Copyright (c) 2017-2018, IBM Corporation.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+
+#include "libqtest.h"
+#include "libqos/i2c.h"
+#include "hw/misc/pca9552_regs.h"
+
+#define PCA9552_TEST_ID   "pca9552-test"
+#define PCA9552_TEST_ADDR 0x60
+
+static I2CAdapter *i2c;
+
+static uint8_t pca9552_get8(I2CAdapter *i2c, uint8_t addr, uint8_t reg)
+{
+    uint8_t resp[1];
+    i2c_send(i2c, addr, &reg, 1);
+    i2c_recv(i2c, addr, resp, 1);
+    return resp[0];
+}
+
+static void pca9552_set8(I2CAdapter *i2c, uint8_t addr, uint8_t reg,
+                         uint8_t value)
+{
+    uint8_t cmd[2];
+    uint8_t resp[1];
+
+    cmd[0] = reg;
+    cmd[1] = value;
+    i2c_send(i2c, addr, cmd, 2);
+    i2c_recv(i2c, addr, resp, 1);
+    g_assert_cmphex(resp[0], ==, cmd[1]);
+}
+
+static void receive_autoinc(void)
+{
+    uint8_t resp;
+    uint8_t reg = PCA9552_LS0 | PCA9552_AUTOINC;
+
+    i2c_send(i2c, PCA9552_TEST_ADDR, &reg, 1);
+
+    /* PCA9552_LS0 */
+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
+    g_assert_cmphex(resp, ==, 0x54);
+
+    /* PCA9552_LS1 */
+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
+    g_assert_cmphex(resp, ==, 0x55);
+
+    /* PCA9552_LS2 */
+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
+    g_assert_cmphex(resp, ==, 0x55);
+
+    /* PCA9552_LS3 */
+    i2c_recv(i2c, PCA9552_TEST_ADDR, &resp, 1);
+    g_assert_cmphex(resp, ==, 0x54);
+}
+
+static void send_and_receive(void)
+{
+    uint8_t value;
+
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0);
+    g_assert_cmphex(value, ==, 0x55);
+
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT0);
+    g_assert_cmphex(value, ==, 0x0);
+
+    /* Switch on LED 0 */
+    pca9552_set8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0, 0x54);
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS0);
+    g_assert_cmphex(value, ==, 0x54);
+
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT0);
+    g_assert_cmphex(value, ==, 0x01);
+
+    /* Switch on LED 12 */
+    pca9552_set8(i2c, PCA9552_TEST_ADDR, PCA9552_LS3, 0x54);
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_LS3);
+    g_assert_cmphex(value, ==, 0x54);
+
+    value = pca9552_get8(i2c, PCA9552_TEST_ADDR, PCA9552_INPUT1);
+    g_assert_cmphex(value, ==, 0x10);
+}
+
+int main(int argc, char **argv)
+{
+    QTestState *s = NULL;
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+
+    s = qtest_start("-machine n800 "
+                    "-device pca9552,bus=i2c-bus.0,id=" PCA9552_TEST_ID
+                    ",address=0x60");
+    i2c = omap_i2c_create(s, OMAP2_I2C_1_BASE);
+
+    qtest_add_func("/pca9552/tx-rx", send_and_receive);
+    qtest_add_func("/pca9552/rx-autoinc", receive_autoinc);
+
+    ret = g_test_run();
+
+    if (s) {
+        qtest_quit(s);
+    }
+    g_free(i2c);
+
+    return ret;
+}
diff --git a/tests/tmp105-test.c b/tests/tmp105-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/tmp105-test.c
+++ b/tests/tmp105-test.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qmp/qdict.h"
 #include "hw/misc/tmp105_regs.h"
 
-#define OMAP2_I2C_1_BASE 0x48070000
-
 #define TMP105_TEST_ID   "tmp105-test"
 #define TMP105_TEST_ADDR 0x49
 
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_TSC2005=y
 CONFIG_LM832X=y
 CONFIG_TMP105=y
 CONFIG_TMP421=y
+CONFIG_PCA9552=y
 CONFIG_STELLARIS=y
 CONFIG_STELLARIS_INPUT=y
 CONFIG_STELLARIS_ENET=y
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The pca9552 LED blinkers on the Witherspoon machine are used for leds
but also as GPIOs to control fans and GPUs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530064049.27976-8-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
     AspeedSoCState *soc = &bmc->soc;
     uint8_t *eeprom_buf = g_malloc0(8 * 1024);
 
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 3), "pca9552", 0x60);
+
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 4), "tmp423", 0x4c);
     i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 5), "tmp423", 0x4c);
 
@@ -XXX,XX +XXX,XX @@ static void witherspoon_bmc_i2c_init(AspeedBoardState *bmc)
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), 0x51,
                           eeprom_buf);
+    i2c_create_slave(aspeed_i2c_get_bus(DEVICE(&soc->i2c), 11), "pca9552",
+                     0x60);
 }
 
 static void witherspoon_bmc_init(MachineState *machine)
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The maximum frame size includes the CRC and depends if a VLAN tag is
inserted or not. Adjust the frame size limit in the transmit handler
using on the FTGMAC100State buffer size and in the receive handler use
the packet protocol.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530061711.23673-2-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/ftgmac100.h |  7 ++++++-
 hw/net/ftgmac100.c         | 23 ++++++++++++-----------
 2 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/ftgmac100.h
+++ b/include/hw/net/ftgmac100.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "net/net.h"
 
+/*
+ * Max frame size for the receiving buffer
+ */
+#define FTGMAC100_MAX_FRAME_SIZE    9220
+
 typedef struct FTGMAC100State {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
     qemu_irq irq;
     MemoryRegion iomem;
 
-    uint8_t *frame;
+    uint8_t frame[FTGMAC100_MAX_FRAME_SIZE];
 
     uint32_t irq_state;
     uint32_t isr;
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
 /*
  * Max frame size for the receiving buffer
  */
-#define FTGMAC100_MAX_FRAME_SIZE    10240
+#define FTGMAC100_MAX_FRAME_SIZE    9220
 
 /* Limits depending on the type of the frame
  *
  *   9216 for Jumbo frames (+ 4 for VLAN)
  *   1518 for other frames (+ 4 for VLAN)
  */
-static int ftgmac100_max_frame_size(FTGMAC100State *s)
+static int ftgmac100_max_frame_size(FTGMAC100State *s, uint16_t proto)
 {
-    return (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518) + 4;
+    int max = (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518);
+
+    return max + (proto == ETH_P_VLAN ? 4 : 0);
 }
 
 static void ftgmac100_update_irq(FTGMAC100State *s)
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
     uint8_t *ptr = s->frame;
     uint32_t addr = tx_descriptor;
     uint32_t flags = 0;
-    int max_frame_size = ftgmac100_max_frame_size(s);
 
     while (1) {
         FTGMAC100Desc bd;
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
             flags = bd.des1;
         }
 
-        len = bd.des0 & 0x3FFF;
-        if (frame_size + len > max_frame_size) {
+        len = FTGMAC100_TXDES0_TXBUF_SIZE(bd.des0);
+        if (frame_size + len > sizeof(s->frame)) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
                           __func__, len);
-            len = max_frame_size - frame_size;
+            s->isr |= FTGMAC100_INT_XPKT_LOST;
+            len =  sizeof(s->frame) - frame_size;
         }
 
         if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
     uint32_t buf_len;
     size_t size = len;
     uint32_t first = FTGMAC100_RXDES0_FRS;
-    int max_frame_size = ftgmac100_max_frame_size(s);
+    uint16_t proto = be16_to_cpu(PKT_GET_ETH_HDR(buf)->h_proto);
+    int max_frame_size = ftgmac100_max_frame_size(s, proto);
 
     if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
          != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
 
     /* Huge frames are truncated.  */
     if (size > max_frame_size) {
-        size = max_frame_size;
         qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %zd bytes\n",
                       __func__, size);
+        size = max_frame_size;
         flags |= FTGMAC100_RXDES0_FTL;
     }
 
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_realize(DeviceState *dev, Error **errp)
                           object_get_typename(OBJECT(dev)), DEVICE(dev)->id,
                           s);
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
-
-    s->frame = g_malloc(FTGMAC100_MAX_FRAME_SIZE);
 }
 
 static const VMStateDescription vmstate_ftgmac100 = {
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

The ftgmac100 NIC supports VLAN tag insertion and the MAC engine also
has a control to remove VLAN tags from received packets.

The VLAN control bits and VLAN tag information are contained in the
second word of the transmit and receive descriptors. The Insert VLAN
bit and the VLAN Tag available bit are only valid in the first segment
of the packet.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530061711.23673-3-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/ftgmac100.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
             break;
         }
 
+        /* Check for VLAN */
+        if (bd.des0 & FTGMAC100_TXDES0_FTS &&
+            bd.des1 & FTGMAC100_TXDES1_INS_VLANTAG &&
+            be16_to_cpu(PKT_GET_ETH_HDR(ptr)->h_proto) != ETH_P_VLAN) {
+            if (frame_size + len + 4 > sizeof(s->frame)) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
+                              __func__, len);
+                s->isr |= FTGMAC100_INT_XPKT_LOST;
+                len =  sizeof(s->frame) - frame_size - 4;
+            }
+            memmove(ptr + 16, ptr + 12, len - 12);
+            stw_be_p(ptr + 12, ETH_P_VLAN);
+            stw_be_p(ptr + 14, bd.des1);
+            len += 4;
+        }
+
         ptr += len;
         frame_size += len;
         if (bd.des0 & FTGMAC100_TXDES0_LTS) {
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
             buf_len += size - 4;
         }
         buf_addr = bd.des3;
-        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
+        if (first && proto == ETH_P_VLAN && buf_len >= 18) {
+            bd.des1 = lduw_be_p(buf + 14) | FTGMAC100_RXDES1_VLANTAG_AVAIL;
+
+            if (s->maccr & FTGMAC100_MACCR_RM_VLAN) {
+                dma_memory_write(&address_space_memory, buf_addr, buf, 12);
+                dma_memory_write(&address_space_memory, buf_addr + 12, buf + 16,
+                                 buf_len - 16);
+            } else {
+                dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
+            }
+        } else {
+            bd.des1 = 0;
+            dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
+        }
         buf += buf_len;
         if (size < 4) {
             dma_memory_write(&address_space_memory, buf_addr + buf_len,
-- 
2.17.1

From: Cédric Le Goater <clg@kaod.org>

Based on the multicast hash calculation of the FTGMAC100 Linux driver.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180530061711.23673-4-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/ftgmac100.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static int ftgmac100_filter(FTGMAC100State *s, const uint8_t *buf, size_t len)
                 return 0;
             }
 
-            /* TODO: this does not seem to work for ftgmac100 */
-            mcast_idx = net_crc32(buf, ETH_ALEN) >> 26;
+            mcast_idx = net_crc32_le(buf, ETH_ALEN);
+            mcast_idx = (~(mcast_idx >> 2)) & 0x3f;
             if (!(s->math[mcast_idx / 32] & (1 << (mcast_idx % 32)))) {
                 return 0;
             }
-- 
2.17.1

From: Thomas Huth <thuth@redhat.com>

It has been marked as deprecated since QEMU v2.11, so it is time to
remove this now. The xlnx-zcu102 machine is very much the same and
can be used as a replacement instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 62 ++------------------------------------------
 qemu-doc.texi        |  5 ----
 2 files changed, 2 insertions(+), 65 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 #define ZCU102_MACHINE(obj) \
     OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
 
-#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
-#define EP108_MACHINE(obj) \
-    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
-
 static struct arm_boot_info xlnx_zcu102_binfo;
 
 static bool zcu102_get_secure(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_virt(Object *obj, bool value, Error **errp)
     s->virt = value;
 }
 
-static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_init(MachineState *machine)
-{
-    XlnxZCU102 *s = EP108_MACHINE(machine);
-
-    if (!qtest_enabled()) {
-        info_report("The Xilinx EP108 machine is deprecated, please use the "
-                    "ZCU102 machine (which has the same features) instead.");
-    }
-
-    xlnx_zynqmp_init(s, machine);
-}
-
-static void xlnx_ep108_machine_instance_init(Object *obj)
-{
-    XlnxZCU102 *s = EP108_MACHINE(obj);
-
-    /* EP108, we don't support setting secure or virt */
-    s->secure = false;
-    s->virt = false;
-}
-
-static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-
-    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
-    mc->init = xlnx_ep108_init;
-    mc->block_default_type = IF_IDE;
-    mc->units_per_default_bus = 1;
-    mc->ignore_memory_transaction_failures = true;
-    mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
-    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
-}
-
-static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
-    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
-    .parent     = TYPE_MACHINE,
-    .class_init = xlnx_ep108_machine_class_init,
-    .instance_init = xlnx_ep108_machine_instance_init,
-    .instance_size = sizeof(XlnxZCU102),
-};
-
-static void xlnx_ep108_machine_init_register_types(void)
-{
-    type_register_static(&xlnx_ep108_machine_init_typeinfo);
-}
-
-static void xlnx_zcu102_init(MachineState *machine)
-{
-    XlnxZCU102 *s = ZCU102_MACHINE(machine);
-
-    xlnx_zynqmp_init(s, machine);
-}
-
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = ZCU102_MACHINE(obj);
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init_register_types(void)
 }
 
 type_init(xlnx_zcu102_machine_init_register_types)
-type_init(xlnx_ep108_machine_init_register_types)
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ support page sizes < 4096 any longer.
 
 @section System emulator machines
 
-@subsection Xilinx EP108 (since 2.11.0)
-
-The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
-The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
-
 @section Block device options
 
 @subsection "backing": "" (since 2.12.0)
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606191801.6331-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 Makefile.objs       |  1 +
 hw/i2c/core.c       | 25 ++++++++++++++++++-------
 hw/i2c/trace-events |  7 +++++++
 3 files changed, 26 insertions(+), 7 deletions(-)
 create mode 100644 hw/i2c/trace-events

diff --git a/Makefile.objs b/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -XXX,XX +XXX,XX @@ trace-events-subdirs += hw/char
 trace-events-subdirs += hw/display
 trace-events-subdirs += hw/dma
 trace-events-subdirs += hw/hppa
+trace-events-subdirs += hw/i2c
 trace-events-subdirs += hw/i386
 trace-events-subdirs += hw/i386/xen
 trace-events-subdirs += hw/ide
diff --git a/hw/i2c/core.c b/hw/i2c/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/core.c
+++ b/hw/i2c/core.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/i2c/i2c.h"
+#include "trace.h"
 
 #define I2C_BROADCAST 0x00
 
@@ -XXX,XX +XXX,XX @@ int i2c_start_transfer(I2CBus *bus, uint8_t address, int recv)
     }
 
     QLIST_FOREACH(node, &bus->current_devs, next) {
+        I2CSlave *s = node->elt;
         int rv;
 
-        sc = I2C_SLAVE_GET_CLASS(node->elt);
+        sc = I2C_SLAVE_GET_CLASS(s);
         /* If the bus is already busy, assume this is a repeated
            start condition.  */
 
         if (sc->event) {
-            rv = sc->event(node->elt, recv ? I2C_START_RECV : I2C_START_SEND);
+            trace_i2c_event("start", s->address);
+            rv = sc->event(s, recv ? I2C_START_RECV : I2C_START_SEND);
             if (rv && !bus->broadcast) {
                 if (bus_scanned) {
                     /* First call, terminate the transfer. */
@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
     I2CNode *node, *next;
 
     QLIST_FOREACH_SAFE(node, &bus->current_devs, next, next) {
-        sc = I2C_SLAVE_GET_CLASS(node->elt);
+        I2CSlave *s = node->elt;
+        sc = I2C_SLAVE_GET_CLASS(s);
         if (sc->event) {
-            sc->event(node->elt, I2C_FINISH);
+            trace_i2c_event("finish", s->address);
+            sc->event(s, I2C_FINISH);
         }
         QLIST_REMOVE(node, next);
         g_free(node);
@@ -XXX,XX +XXX,XX @@ void i2c_end_transfer(I2CBus *bus)
 int i2c_send_recv(I2CBus *bus, uint8_t *data, bool send)
 {
     I2CSlaveClass *sc;
+    I2CSlave *s;
     I2CNode *node;
     int ret = 0;
 
     if (send) {
         QLIST_FOREACH(node, &bus->current_devs, next) {
-            sc = I2C_SLAVE_GET_CLASS(node->elt);
+            s = node->elt;
+            sc = I2C_SLAVE_GET_CLASS(s);
             if (sc->send) {
-                ret = ret || sc->send(node->elt, *data);
+                trace_i2c_send(s->address, *data);
+                ret = ret || sc->send(s, *data);
             } else {
                 ret = -1;
             }
@@ -XXX,XX +XXX,XX @@ int i2c_send_recv(I2CBus *bus, uint8_t *data, bool send)
 
         sc = I2C_SLAVE_GET_CLASS(QLIST_FIRST(&bus->current_devs)->elt);
         if (sc->recv) {
-            ret = sc->recv(QLIST_FIRST(&bus->current_devs)->elt);
+            s = QLIST_FIRST(&bus->current_devs)->elt;
+            ret = sc->recv(s);
+            trace_i2c_recv(s->address, ret);
             if (ret < 0) {
                 return ret;
             } else {
@@ -XXX,XX +XXX,XX @@ void i2c_nack(I2CBus *bus)
     QLIST_FOREACH(node, &bus->current_devs, next) {
         sc = I2C_SLAVE_GET_CLASS(node->elt);
         if (sc->event) {
+            trace_i2c_event("nack", node->elt->address);
             sc->event(node->elt, I2C_NACK);
         }
     }
diff --git a/hw/i2c/trace-events b/hw/i2c/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/i2c/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# hw/i2c/core.c
+
+i2c_event(const char *event, uint8_t address) "%s(addr:0x%02x)"
+i2c_send(uint8_t address, uint8_t data) "send(addr:0x%02x) data:0x%02x"
+i2c_recv(uint8_t address, uint8_t data) "recv(addr:0x%02x) data:0x%02x"
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/milkymist-memcard.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/milkymist-memcard.c b/hw/sd/milkymist-memcard.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/milkymist-memcard.c
+++ b/hw/sd/milkymist-memcard.c
@@ -XXX,XX +XXX,XX @@ static uint64_t memcard_read(void *opaque, hwaddr addr,
             r = s->response[s->response_read_ptr++];
             if (s->response_read_ptr > s->response_len) {
                 qemu_log_mask(LOG_GUEST_ERROR, "milkymist_memcard: "
-                              "read more cmd bytes than available. Clipping.");
+                              "read more cmd bytes than available: clipping\n");
                 s->response_read_ptr = 0;
             }
         }
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/digic-uart.c   | 4 ++--
 hw/timer/digic-timer.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/char/digic-uart.c b/hw/char/digic-uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/digic-uart.c
+++ b/hw/char/digic-uart.c
@@ -XXX,XX +XXX,XX @@ static uint64_t digic_uart_read(void *opaque, hwaddr addr,
     default:
         qemu_log_mask(LOG_UNIMP,
                       "digic-uart: read access to unknown register 0x"
-                      TARGET_FMT_plx, addr << 2);
+                      TARGET_FMT_plx "\n", addr << 2);
     }
 
     return ret;
@@ -XXX,XX +XXX,XX @@ static void digic_uart_write(void *opaque, hwaddr addr, uint64_t value,
     default:
         qemu_log_mask(LOG_UNIMP,
                       "digic-uart: write access to unknown register 0x"
-                      TARGET_FMT_plx, addr << 2);
+                      TARGET_FMT_plx "\n", addr << 2);
     }
 }
 
diff --git a/hw/timer/digic-timer.c b/hw/timer/digic-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/digic-timer.c
+++ b/hw/timer/digic-timer.c
@@ -XXX,XX +XXX,XX @@ static uint64_t digic_timer_read(void *opaque, hwaddr offset, unsigned size)
     default:
         qemu_log_mask(LOG_UNIMP,
                       "digic-timer: read access to unknown register 0x"
-                      TARGET_FMT_plx, offset);
+                      TARGET_FMT_plx "\n", offset);
     }
 
     return ret;
@@ -XXX,XX +XXX,XX @@ static void digic_timer_write(void *opaque, hwaddr offset,
     default:
         qemu_log_mask(LOG_UNIMP,
                       "digic-timer: read access to unknown register 0x"
-                      TARGET_FMT_plx, offset);
+                      TARGET_FMT_plx "\n", offset);
     }
 }
 
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Message-id: 20180606152128.449-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ppc/pnv_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pnv_core_xscom_read(void *opaque, hwaddr addr,
         val = 0x24f000000000000ull;
         break;
     default:
-        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx,
+        qemu_log_mask(LOG_UNIMP, "Warning: reading reg=0x%" HWADDR_PRIx "\n",
                   addr);
     }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t pnv_core_xscom_read(void *opaque, hwaddr addr,
 static void pnv_core_xscom_write(void *opaque, hwaddr addr, uint64_t val,
                                  unsigned int width)
 {
-    qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx,
+    qemu_log_mask(LOG_UNIMP, "Warning: writing to reg=0x%" HWADDR_PRIx "\n",
                   addr);
 }
 
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-7-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/mips/boston.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -XXX,XX +XXX,XX @@ static uint64_t boston_platreg_read(void *opaque, hwaddr addr,
     uint32_t gic_freq, val;
 
     if (size != 4) {
-        qemu_log_mask(LOG_UNIMP, "%uB platform register read", size);
+        qemu_log_mask(LOG_UNIMP, "%uB platform register read\n", size);
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t boston_platreg_read(void *opaque, hwaddr addr,
         val |= PLAT_DDR_CFG_MHZ;
         return val;
     default:
-        qemu_log_mask(LOG_UNIMP, "Read platform register 0x%" HWADDR_PRIx,
+        qemu_log_mask(LOG_UNIMP, "Read platform register 0x%" HWADDR_PRIx "\n",
                       addr & 0xffff);
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static void boston_platreg_write(void *opaque, hwaddr addr,
                                  uint64_t val, unsigned size)
 {
     if (size != 4) {
-        qemu_log_mask(LOG_UNIMP, "%uB platform register write", size);
+        qemu_log_mask(LOG_UNIMP, "%uB platform register write\n", size);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void boston_platreg_write(void *opaque, hwaddr addr,
         break;
     default:
         qemu_log_mask(LOG_UNIMP, "Write platform register 0x%" HWADDR_PRIx
-                      " = 0x%" PRIx64, addr & 0xffff, val);
+                      " = 0x%" PRIx64 "\n", addr & 0xffff, val);
         break;
     }
 }
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-8-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static uint64_t gptm_read(void *opaque, hwaddr offset,
             return s->rtc;
         }
         qemu_log_mask(LOG_UNIMP,
-                      "GPTM: read of TAR but timer read not supported");
+                      "GPTM: read of TAR but timer read not supported\n");
         return 0;
     case 0x4c: /* TBR */
         qemu_log_mask(LOG_UNIMP,
-                      "GPTM: read of TBR but timer read not supported");
+                      "GPTM: read of TBR but timer read not supported\n");
         return 0;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -XXX,XX +XXX,XX @@ static void stellaris_i2c_write(void *opaque, hwaddr offset,
         break;
     case 0x20: /* MCR */
         if (value & 1) {
-            qemu_log_mask(LOG_UNIMP, "stellaris_i2c: Loopback not implemented");
+            qemu_log_mask(LOG_UNIMP,
+                          "stellaris_i2c: Loopback not implemented\n");
         }
         if (value & 0x20) {
             qemu_log_mask(LOG_UNIMP,
-                          "stellaris_i2c: Slave mode not implemented");
+                          "stellaris_i2c: Slave mode not implemented\n");
         }
         s->mcr = value & 0x31;
         break;
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_write(void *opaque, hwaddr offset,
         s->sspri = value;
         break;
     case 0x28: /* PSSI */
-        qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented");
+        qemu_log_mask(LOG_UNIMP, "ADC: sample initiate unimplemented\n");
         break;
     case 0x30: /* SAC */
         s->sac = value;
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-9-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
     case 4: /* unlinked address mismatch (reserved if AArch64) */
     case 5: /* linked address mismatch (reserved if AArch64) */
         qemu_log_mask(LOG_UNIMP,
-                      "arm: address mismatch breakpoint types not implemented");
+                      "arm: address mismatch breakpoint types not implemented\n");
         return;
     case 0: /* unlinked address match */
     case 1: /* linked address match */
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
     case 8: /* unlinked VMID match (reserved if no EL2) */
     case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
         qemu_log_mask(LOG_UNIMP,
-                      "arm: unlinked context breakpoint types not implemented");
+                      "arm: unlinked context breakpoint types not implemented\n");
         return;
     case 9: /* linked VMID match (reserved if no EL2) */
     case 11: /* linked context ID and VMID match (reserved if no EL2) */
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180606152128.449-11-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/riscv/op_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -XXX,XX +XXX,XX @@ void csr_write_helper(CPURISCVState *env, target_ulong val_to_write,
         if ((val_to_write & 3) == 0) {
             env->stvec = val_to_write >> 2 << 2;
         } else {
-            qemu_log_mask(LOG_UNIMP, "CSR_STVEC: vectored traps not supported");
+            qemu_log_mask(LOG_UNIMP,
+                          "CSR_STVEC: vectored traps not supported\n");
         }
         break;
     case CSR_SCOUNTEREN:
@@ -XXX,XX +XXX,XX @@ void csr_write_helper(CPURISCVState *env, target_ulong val_to_write,
         if ((val_to_write & 3) == 0) {
             env->mtvec = val_to_write >> 2 << 2;
         } else {
-            qemu_log_mask(LOG_UNIMP, "CSR_MTVEC: vectored traps not supported");
+            qemu_log_mask(LOG_UNIMP,
+                          "CSR_MTVEC: vectored traps not supported\n");
         }
         break;
     case CSR_MCOUNTEREN:
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Max Filippov <jcmvbkbc@gmail.com>
Message-id: 20180606152128.449-12-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/xtensa/translate.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static void translate_rur(DisasContext *dc, const uint32_t arg[],
         if (uregnames[par[0]].name) {
             tcg_gen_mov_i32(cpu_R[arg[0]], cpu_UR[par[0]]);
         } else {
-            qemu_log_mask(LOG_UNIMP, "RUR %d not implemented, ", par[0]);
+            qemu_log_mask(LOG_UNIMP, "RUR %d not implemented\n", par[0]);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void translate_slli(DisasContext *dc, const uint32_t arg[],
 {
     if (gen_window_check2(dc, arg[0], arg[1])) {
         if (arg[2] == 32) {
-            qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined",
+            qemu_log_mask(LOG_GUEST_ERROR, "slli a%d, a%d, 32 is undefined\n",
                           arg[0], arg[1]);
         }
         tcg_gen_shli_i32(cpu_R[arg[0]], cpu_R[arg[1]], arg[2] & 0x1f);
@@ -XXX,XX +XXX,XX @@ static void translate_wur(DisasContext *dc, const uint32_t arg[],
         if (uregnames[par[0]].name) {
             gen_wur(par[0], cpu_R[arg[0]]);
         } else {
-            qemu_log_mask(LOG_UNIMP, "WUR %d not implemented, ", par[0]);
+            qemu_log_mask(LOG_UNIMP, "WUR %d not implemented\n", par[0]);
         }
     }
 }
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The initial implementation is based on the Specs v1.10 (see a1bb27b1e98).

However the SCR is anouncing the card being v1.01.

The new chapters added in version 1.10 are:

4.3.10 Switch function command

Switch function command (CMD6) 1 is used to switch or expand
    memory card functions. [...]
    This is a new feature, introduced in SD physical Layer
    Specification Version 1.10. Therefore, cards that are
    compatible with earlier versions of the spec do not support
    it. The host shall check the "SD_SPEC" field in the SCR
    register to recognize what version of the spec the card
    complies with before using CMD6. It is mandatory for SD
    memory card of Ver1.10 to support CMD6.

4.3.11 High-Speed mode (25MB/sec interface speed)

Though the Rev 1.01 SD memory card supports up to 12.5MB/sec
    interface speed, the speed of 25MB/sec is necessary to support
    increasing performance needs of the host and because of memory
    size which continues to grow.
    To achieve 25MB/sec interface speed, clock rate is increased to
    50MHz and CLK/CMD/DAT signal timing and circuit conditions are
    reconsidered and changed from Physical Layer Specification
    Version 1.01.

4.3.12 Command system (This chapter is newly added in version 1.10)

SD commands CMD34-37, CMD50, CMD57 are reserved for SD command
    system expansion via the switch command.
    [These commands] will be considered as illegal commands (as
    defined in revision 1.01 of the SD physical layer specification).

The SWITCH_FUNCTION is implemented since the first commit, a1bb27b1e98.

The 25MB/sec High-Speed mode was already updated in d7ecb867529.

The current implementation does not implements CMD34-37, CMD50 and
CMD57, thus these commands already return ILLEGAL.

With this patch, the SCR register now matches the description of the header:

* SD Memory Card emulation as defined in the "SD Memory Card Physical
 * layer specification, Version 1.10."

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180607180641.874-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
 
 static void sd_set_scr(SDState *sd)
 {
-    sd->scr[0] = (0 << 4)       /* SCR version 1.0 */
-                 | 0;           /* Spec Versions 1.0 and 1.01 */
+    sd->scr[0] = (0 << 4)       /* SCR structure version 1.0 */
+                 | 1;           /* Spec Version 1.10 */
     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

From the "Physical Layer Simplified Specification Version 1.10"
  Chapter 7.3 "SPI Mode Transaction Packets"
    Table 57: "Commands and arguments"

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20180607180641.874-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         return sd_illegal;
 
     case 6:	/* CMD6:   SWITCH_FUNCTION */
-        if (sd->spi)
-            goto bad_cmd;
         switch (sd->mode) {
         case sd_data_transfer_mode:
             sd_function_switch(sd, req.arg);
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
 
     /* Block write commands (Class 4) */
     case 24:	/* CMD24:  WRITE_SINGLE_BLOCK */
-        if (sd->spi) {
-            goto unimplemented_spi_cmd;
-        }
         switch (sd->state) {
         case sd_transfer_state:
             /* Writing in SPI mode not implemented.  */
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         break;
 
     case 25:	/* CMD25:  WRITE_MULTIPLE_BLOCK */
-        if (sd->spi) {
-            goto unimplemented_spi_cmd;
-        }
         switch (sd->state) {
         case sd_transfer_state:
             /* Writing in SPI mode not implemented.  */
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         break;
 
     case 27:	/* CMD27:  PROGRAM_CSD */
-        if (sd->spi) {
-            goto unimplemented_spi_cmd;
-        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
 
     /* Lock card commands (Class 7) */
     case 42:	/* CMD42:  LOCK_UNLOCK */
-        if (sd->spi) {
-            goto unimplemented_spi_cmd;
-        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->state = sd_receivingdata_state;
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As of this commit, the Spec v1 is not working, and all controllers
expect the cards to be conformant to Spec v2.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20180607180641.874-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sd.h |  5 +++++
 hw/sd/sd.c         | 23 ++++++++++++++++++++---
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -XXX,XX +XXX,XX @@
 #define APP_CMD			(1 << 5)
 #define AKE_SEQ_ERROR		(1 << 3)
 
+enum SDPhySpecificationVersion {
+    SD_PHY_SPECv1_10_VERS     = 1,
+    SD_PHY_SPECv2_00_VERS     = 2,
+};
+
 typedef enum {
     SD_VOLTAGE_0_4V     = 400,  /* currently not supported */
     SD_VOLTAGE_1_8V     = 1800,
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@
 /*
  * SD Memory Card emulation as defined in the "SD Memory Card Physical
- * layer specification, Version 1.10."
+ * layer specification, Version 2.00."
  *
  * Copyright (c) 2006 Andrzej Zaborowski  <balrog@zabor.org>
  * Copyright (c) 2007 CodeSourcery
+ * Copyright (c) 2018 Philippe Mathieu-Daudé <f4bug@amsat.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -XXX,XX +XXX,XX @@ struct SDState {
     uint8_t sd_status[64];
 
     /* Configurable properties */
+    uint8_t spec_version;
     BlockBackend *blk;
     bool spi;
 
@@ -XXX,XX +XXX,XX @@ static void sd_ocr_powerup(void *opaque)
 
 static void sd_set_scr(SDState *sd)
 {
-    sd->scr[0] = (0 << 4)       /* SCR structure version 1.0 */
-                 | 1;           /* Spec Version 1.10 */
+    sd->scr[0] = 0 << 4;        /* SCR structure version 1.0 */
+    if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
+        sd->scr[0] |= 1;        /* Spec Version 1.10 */
+    } else {
+        sd->scr[0] |= 2;        /* Spec Version 2.00 */
+    }
     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
 
     sd->proto_name = sd->spi ? "SPI" : "SD";
 
+    switch (sd->spec_version) {
+    case SD_PHY_SPECv1_10_VERS
+     ... SD_PHY_SPECv2_00_VERS:
+        break;
+    default:
+        error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
+        return;
+    }
+
     if (sd->blk && blk_is_read_only(sd->blk)) {
         error_setg(errp, "Cannot use read-only drive as SD card");
         return;
@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
 }
 
 static Property sd_properties[] = {
+    DEFINE_PROP_UINT8("spec_version", SDState,
+                      spec_version, SD_PHY_SPECv2_00_VERS),
     DEFINE_PROP_DRIVE("drive", SDState, blk),
     /* We do not model the chip select pin, so allow the board to select
      * whether card should be in SSI or MMC/SD mode.  It is also up to the
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

CMD8 is "Reserved" in Spec v1.10.

Spec v2.00 introduces the SEND_IF_COND command:

6.4.1 Power Up

CMD8 is newly added in the Physical Layer Specification Version
    2.00 to support multiple voltage ranges and used to check whether
    the card supports supplied voltage. The version 2.00 or later host
    shall issue CMD8 and verify voltage before card initialization.
    The host that does not support CMD8 shall supply high voltage range.

Message-Id: 201204252110.20873.paul@codesourcery.com
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180607180641.874-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         break;
 
     case 8:	/* CMD8:   SEND_IF_COND */
-        /* Physical Layer Specification Version 2.00 command */
+        if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
+            break;
+        }
         if (sd->state != sd_idle_state) {
             break;
         }
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20180607180641.874-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sd.h | 1 +
 hw/sd/sd.c         | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -XXX,XX +XXX,XX @@
 enum SDPhySpecificationVersion {
     SD_PHY_SPECv1_10_VERS     = 1,
     SD_PHY_SPECv2_00_VERS     = 2,
+    SD_PHY_SPECv3_01_VERS     = 3,
 };
 
 typedef enum {
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_set_scr(SDState *sd)
     if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
         sd->scr[0] |= 1;        /* Spec Version 1.10 */
     } else {
-        sd->scr[0] |= 2;        /* Spec Version 2.00 */
+        sd->scr[0] |= 2;        /* Spec Version 2.00 or Version 3.0X */
     }
     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
+    if (sd->spec_version >= SD_PHY_SPECv3_01_VERS) {
+        sd->scr[2] |= 1 << 7;   /* Spec Version 3.0X */
+    }
     sd->scr[3] = 0x00;
     /* reserved for manufacturer usage */
     sd->scr[4] = 0x00;
@@ -XXX,XX +XXX,XX @@ static void sd_realize(DeviceState *dev, Error **errp)
 
     switch (sd->spec_version) {
     case SD_PHY_SPECv1_10_VERS
-     ... SD_PHY_SPECv2_00_VERS:
+     ... SD_PHY_SPECv3_01_VERS:
         break;
     default:
         error_setg(errp, "Invalid SD card Spec version: %u", sd->spec_version);
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

These commands got introduced by Spec v3
(see 0c3fb03f7ec and 4481bbc79d2).

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180607180641.874-7-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         break;
 
     case 19:    /* CMD19: SEND_TUNING_BLOCK (SD) */
+        if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
+            break;
+        }
         if (sd->state == sd_transfer_state) {
             sd->state = sd_sendingdata_state;
             sd->data_offset = 0;
@@ -XXX,XX +XXX,XX @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
         break;
 
     case 23:    /* CMD23: SET_BLOCK_COUNT */
+        if (sd->spec_version < SD_PHY_SPECv3_01_VERS) {
+            break;
+        }
         switch (sd->state) {
         case sd_transfer_state:
             sd->multi_blk_cnt = req.arg;
-- 
2.17.1

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1