Series comparison

-[PULL 00/15] target-arm queue
+[PULL 00/31] target-arm queue
-Latest arm queue, a mixed bag of features and bug fixes.
+First arm pullreq for 7.1. The bulk of this is the qemu_split_irq
 removal.
 I have enough stuff in my to-review queue that I expect to do another
 pullreq early next week, but 31 patches is enough to not hang on to.
 thanks
 -- PMM
-The following changes since commit cbf01142b2aef0c0b4e995cecd7e79d342bbc47e:
+The following changes since commit 9c125d17e9402c232c46610802e5931b3639d77b:
-  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200115' into staging (2020-01-17 12:13:17 +0000)
+  Merge tag 'pull-tcg-20220420' of https://gitlab.com/rth7680/qemu into staging (2022-04-20 16:43:11 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200117-1
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220421
-for you to fetch changes up to 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9:
+for you to fetch changes up to 5b415dd61bdbf61fb4be0e9f1a7172b8bce682c6:
-  target/arm: Set ISSIs16Bit in make_issinfo (2020-01-17 14:27:16 +0000)
+  hw/arm: Use bit fields for NPCM7XX PWRON STRAPs (2022-04-21 11:37:05 +0100)
 ----------------------------------------------------------------
-Add model of the Netduino Plus 2 board
+target-arm queue:
-Some allwinner-a10 code cleanup
+ * hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
-New test cases for cubieboard
+ * versal: Add the Cortex-R5s in the Real-Time Processing Unit (RPU) subsystem
-target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+ * versal: model enough of the Clock/Reset Low-power domain (CRL) to allow control of the Cortex-R5s
-i.MX: add an emulation for RNGC device
+ * xlnx-zynqmp: Connect 4 TTC timers
-target/arm: adjust program counter for wfi exception in AArch32
+ * exynos4210: Refactor GIC/combiner code to stop using qemu_split_irq
-arm/gicv3: update virtual irq state after IAR register read
+ * realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
-Set IL bit correctly for syndrome information for data aborts
+ * stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
  * hw/core/irq: remove unused 'qemu_irq_split' function
  * npcm7xx: use symbolic constants for PWRON STRAP bit fields
  * virt: document impact of gic-version on max CPUs
 ----------------------------------------------------------------
-Alistair Francis (4):
+Edgar E. Iglesias (6):
-      hw/misc: Add the STM32F4xx Sysconfig device
+      timer: cadence_ttc: Break out header file to allow embedding
-      hw/misc: Add the STM32F4xx EXTI device
+      hw/arm/xlnx-zynqmp: Connect 4 TTC timers
-      hw/arm: Add the STM32F4xx SoC
+      hw/arm: versal: Create an APU CPU Cluster
-      hw/arm: Add the Netduino Plus 2
+      hw/arm: versal: Add the Cortex-R5Fs
       hw/misc: Add a model of the Xilinx Versal CRL
       hw/arm: versal: Connect the CRL
-Jeff Kubascik (3):
+Hao Wu (2):
-      target/arm: adjust program counter for wfi exception in AArch32
+      hw/misc: Add PWRON STRAP bit fields in GCR module
-      arm/gicv3: update virtual irq state after IAR register read
+      hw/arm: Use bit fields for NPCM7XX PWRON STRAPs
       target/arm: Return correct IL bit in merge_syn_data_abort
-Martin Kaiser (1):
+Heinrich Schuchardt (1):
-      i.MX: add an emulation for RNGC
+      hw/arm/virt: impact of gic-version on max CPUs
-Masahiro Yamada (1):
+Peter Maydell (19):
-      target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+      hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
       hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
       hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
       hw/arm/exynos4210: Put a9mpcore device into state struct
       hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
       hw/arm/exynos4210: Coalesce board_irqs and irq_table
       hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
       hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
       hw/arm/exynos4210: Put external GIC into state struct
       hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
       hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
       hw/arm/exynos4210: Delete unused macro definitions
       hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
       hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
       hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
       hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
       hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
       hw/arm/exynos4210: Put combiners into state struct
       hw/arm/exynos4210: Drop Exynos4210Irq struct
-Philippe Mathieu-Daudé (5):
+Zongyuan Li (3):
-      tests/boot_linux_console: Add initrd test for the CubieBoard
+      hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
-      tests/boot_linux_console: Add a SD card test for the CubieBoard
+      hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
-      hw/arm/allwinner-a10: Move SoC definitions out of header
+      hw/core/irq: remove unused 'qemu_irq_split' function
       hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
       hw/arm/allwinner-a10: Remove local qemu_irq variables
-Richard Henderson (1):
+ docs/system/arm/virt.rst              |   4 +-
-      target/arm: Set ISSIs16Bit in make_issinfo
+ include/hw/arm/exynos4210.h           |  50 ++--
+ include/hw/arm/xlnx-versal.h          |  16 ++
- hw/arm/Makefile.objs                   |   2 +
+ include/hw/arm/xlnx-zynqmp.h          |   4 +
- hw/misc/Makefile.objs                  |   3 +
+ include/hw/intc/exynos4210_combiner.h |  57 +++++
- include/hw/arm/allwinner-a10.h         |   7 -
+ include/hw/intc/exynos4210_gic.h      |  43 ++++
- include/hw/arm/fsl-imx25.h             |   5 +
+ include/hw/irq.h                      |   5 -
- include/hw/arm/stm32f405_soc.h         |  73 ++++++++
+ include/hw/misc/npcm7xx_gcr.h         |  30 +++
- include/hw/misc/imx_rngc.h             |  35 ++++
+ include/hw/misc/xlnx-versal-crl.h     | 235 +++++++++++++++++++
- include/hw/misc/stm32f4xx_exti.h       |  60 +++++++
+ include/hw/timer/cadence_ttc.h        |  54 +++++
- include/hw/misc/stm32f4xx_syscfg.h     |  61 +++++++
+ hw/arm/exynos4210.c                   | 430 ++++++++++++++++++++++++++++++----
- hw/arm/allwinner-a10.c                 |  39 +++--
+ hw/arm/npcm7xx_boards.c               |  24 +-
- hw/arm/fsl-imx25.c                     |  11 ++
+ hw/arm/realview.c                     |  33 ++-
- hw/arm/netduinoplus2.c                 |  52 ++++++
+ hw/arm/stellaris.c                    |  15 +-
- hw/arm/stm32f405_soc.c                 | 302 +++++++++++++++++++++++++++++++++
+ hw/arm/virt.c                         |   7 +
- hw/intc/arm_gicv3_cpuif.c              |   3 +
+ hw/arm/xlnx-versal-virt.c             |   6 +-
- hw/misc/imx_rngc.c                     | 278 ++++++++++++++++++++++++++++++
+ hw/arm/xlnx-versal.c                  |  99 +++++++-
- hw/misc/stm32f4xx_exti.c               | 188 ++++++++++++++++++++
+ hw/arm/xlnx-zynqmp.c                  |  22 ++
- hw/misc/stm32f4xx_syscfg.c             | 171 +++++++++++++++++++
+ hw/core/irq.c                         |  15 --
- target/arm/arm-semi.c                  |   5 +-
+ hw/intc/exynos4210_combiner.c         | 108 +--------
- target/arm/op_helper.c                 |   7 +-
+ hw/intc/exynos4210_gic.c              | 344 +--------------------------
- target/arm/tlb_helper.c                |   2 +-
+ hw/misc/xlnx-versal-crl.c             | 421 +++++++++++++++++++++++++++++++++
- target/arm/translate.c                 |   3 +
+ hw/timer/cadence_ttc.c                |  32 +--
- MAINTAINERS                            |  14 ++
+ MAINTAINERS                           |   2 +-
- default-configs/arm-softmmu.mak        |   1 +
+ hw/misc/meson.build                   |   1 +
- hw/arm/Kconfig                         |  10 ++
+files changed, 1457 insertions(+), 600 deletions(-)
- hw/misc/Kconfig                        |   6 +
+ create mode 100644 include/hw/intc/exynos4210_combiner.h
- hw/misc/trace-events                   |  11 ++
+ create mode 100644 include/hw/intc/exynos4210_gic.h
- tests/acceptance/boot_linux_console.py |  85 ++++++++++
+ create mode 100644 include/hw/misc/xlnx-versal-crl.h
-files changed, 1405 insertions(+), 29 deletions(-)
+ create mode 100644 include/hw/timer/cadence_ttc.h
- create mode 100644 include/hw/arm/stm32f405_soc.h
+ create mode 100644 hw/misc/xlnx-versal-crl.c
  create mode 100644 include/hw/misc/imx_rngc.h
  create mode 100644 include/hw/misc/stm32f4xx_exti.h
  create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
  create mode 100644 hw/arm/netduinoplus2.c
  create mode 100644 hw/arm/stm32f405_soc.c
  create mode 100644 hw/misc/imx_rngc.c
  create mode 100644 hw/misc/stm32f4xx_exti.c
  create mode 100644 hw/misc/stm32f4xx_syscfg.c

-New patch
+[PULL 01/31] hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
+It's not possible to provide the guest with the Security extensions
+(TrustZone) when using KVM or HVF, because the hardware
+virtualization extensions don't permit running EL3 guest code.
+However, we weren't checking for this combination, with the result
+that QEMU would assert if you tried it:
+$ qemu-system-aarch64 -enable-kvm -machine virt,secure=on -cpu host -display none
+Unexpected error in object_property_find_err() at ../../qom/object.c:1304:
+qemu-system-aarch64: Property 'host-arm-cpu.secure-memory' not found
+Aborted
+Check for this combination of options and report an error, in the
+same way we already do for attempts to give a KVM or HVF guest the
+Virtualization or MTE extensions. Now we will report:
+qemu-system-aarch64: mach-virt: KVM does not support providing Security extensions (TrustZone) to the guest CPU
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/961
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404155301.566542-1-peter.maydell@linaro.org
+---
+ hw/arm/virt.c | 7 +++++++
+file changed, 7 insertions(+)
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+         exit(1);
+     }
++    if (vms->secure && (kvm_enabled() || hvf_enabled())) {
++        error_report("mach-virt: %s does not support providing "
++                     "Security extensions (TrustZone) to the guest CPU",
++                     kvm_enabled() ? "KVM" : "HVF");
++        exit(1);
++    }
++
+     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
+         error_report("mach-virt: %s does not support providing "
+                      "Virtualization extensions to the guest CPU",
+--
+.25.1

-[PULL 01/15] hw/misc: Add the STM32F4xx Sysconfig device
+[PULL 02/31] timer: cadence_ttc: Break out header file to allow embedding
-From: Alistair Francis <alistair@alistair23.me>
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+Break out header file to allow embedding of the the TTC.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 49b01423a09cef2ca832ff73a84a996568f1a8fc.1576658572.git.alistair@alistair23.me
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20220331222017.2914409-2-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs              |   1 +
+ include/hw/timer/cadence_ttc.h | 54 ++++++++++++++++++++++++++++++++++
- include/hw/misc/stm32f4xx_syscfg.h |  61 ++++++++++
+ hw/timer/cadence_ttc.c         | 32 ++------------------
- hw/misc/stm32f4xx_syscfg.c         | 171 +++++++++++++++++++++++++++++
+files changed, 56 insertions(+), 30 deletions(-)
- default-configs/arm-softmmu.mak    |   1 +
+ create mode 100644 include/hw/timer/cadence_ttc.h
  hw/arm/Kconfig                     |   9 ++
  hw/misc/Kconfig                    |   3 +
  hw/misc/trace-events               |   6 +
 files changed, 252 insertions(+)
  create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
  create mode 100644 hw/misc/stm32f4xx_syscfg.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/include/hw/timer/cadence_ttc.h b/include/hw/timer/cadence_ttc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SLAVIO) += slavio_misc.o
  common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
  common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
  common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
 +common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
  obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
  obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
  obj-$(CONFIG_MIPS_ITU) += mips_itu.o
 diff --git a/include/hw/misc/stm32f4xx_syscfg.h b/include/hw/misc/stm32f4xx_syscfg.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/stm32f4xx_syscfg.h
++++ b/include/hw/timer/cadence_ttc.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * STM32F4xx SYSCFG
++ * Xilinx Zynq cadence TTC model
 + *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++ * Copyright (c) 2011 Xilinx Inc.
 + * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
 + * Copyright (c) 2012 PetaLogix Pty Ltd.
 + * Written By Haibing Ma
 + *            M. Habib
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * This program is free software; you can redistribute it and/or
-+ * of this software and associated documentation files (the "Software"), to deal
++ * modify it under the terms of the GNU General Public License
-+ * in the Software without restriction, including without limitation the rights
++ * as published by the Free Software Foundation; either version
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * 2 of the License, or (at your option) any later version.
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
-+ * The above copyright notice and this permission notice shall be included in
++ * You should have received a copy of the GNU General Public License along
-+ * all copies or substantial portions of the Software.
++ * with this program; if not, see <http://www.gnu.org/licenses/>.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
-+
++#ifndef HW_TIMER_CADENCE_TTC_H
-+#ifndef HW_STM_SYSCFG_H
++#define HW_TIMER_CADENCE_TTC_H
 +#define HW_STM_SYSCFG_H
 +
 +#include "hw/sysbus.h"
-+#include "hw/hw.h"
++#include "qemu/timer.h"
 +
 +#define SYSCFG_MEMRMP  0x00
 +#define SYSCFG_PMC     0x04
 +#define SYSCFG_EXTICR1 0x08
 +#define SYSCFG_EXTICR2 0x0C
 +#define SYSCFG_EXTICR3 0x10
 +#define SYSCFG_EXTICR4 0x14
 +#define SYSCFG_CMPCR   0x20
 +
 +#define TYPE_STM32F4XX_SYSCFG "stm32f4xx-syscfg"
 +#define STM32F4XX_SYSCFG(obj) \
 +    OBJECT_CHECK(STM32F4xxSyscfgState, (obj), TYPE_STM32F4XX_SYSCFG)
 +
 +#define SYSCFG_NUM_EXTICR 4
 +
 +typedef struct {
-+    /* <private> */
++    QEMUTimer *timer;
 +    int freq;
 +
 +    uint32_t reg_clock;
 +    uint32_t reg_count;
 +    uint32_t reg_value;
 +    uint16_t reg_interval;
 +    uint16_t reg_match[3];
 +    uint32_t reg_intr;
 +    uint32_t reg_intr_en;
 +    uint32_t reg_event_ctrl;
 +    uint32_t reg_event;
 +
 +    uint64_t cpu_time;
 +    unsigned int cpu_time_valid;
 +
 +    qemu_irq irq;
 +} CadenceTimerState;
 +
 +#define TYPE_CADENCE_TTC "cadence_ttc"
 +OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
 +
 +struct CadenceTTCState {
 +    SysBusDevice parent_obj;
 +
-+    /* <public> */
++    MemoryRegion iomem;
-+    MemoryRegion mmio;
++    CadenceTimerState timer[3];
-+
++};
 +    uint32_t syscfg_memrmp;
 +    uint32_t syscfg_pmc;
 +    uint32_t syscfg_exticr[SYSCFG_NUM_EXTICR];
 +    uint32_t syscfg_cmpcr;
 +
 +    qemu_irq irq;
 +    qemu_irq gpio_out[16];
 +} STM32F4xxSyscfgState;
 +
 +#endif
-diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
+diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/hw/timer/cadence_ttc.c
---- /dev/null
++++ b/hw/timer/cadence_ttc.c
 +++ b/hw/misc/stm32f4xx_syscfg.c
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #include "qemu/timer.h"
-+ * STM32F4xx SYSCFG
+ #include "qom/object.h"
-+ *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++#include "hw/timer/cadence_ttc.h"
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#include "qemu/osdep.h"
+ #ifdef CADENCE_TTC_ERR_DEBUG
-+#include "qemu/log.h"
+ #define DB_PRINT(...) do { \
-+#include "trace.h"
+     fprintf(stderr,  ": %s: ", __func__); \
-+#include "hw/irq.h"
+@@ -XXX,XX +XXX,XX @@
-+#include "migration/vmstate.h"
+ #define CLOCK_CTRL_PS_EN    0x00000001
-+#include "hw/misc/stm32f4xx_syscfg.h"
+ #define CLOCK_CTRL_PS_V     0x0000001e
-+
-+static void stm32f4xx_syscfg_reset(DeviceState *dev)
+-typedef struct {
-+{
+-    QEMUTimer *timer;
-+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(dev);
+-    int freq;
-+
+-
-+    s->syscfg_memrmp = 0x00000000;
+-    uint32_t reg_clock;
-+    s->syscfg_pmc = 0x00000000;
+-    uint32_t reg_count;
-+    s->syscfg_exticr[0] = 0x00000000;
+-    uint32_t reg_value;
-+    s->syscfg_exticr[1] = 0x00000000;
+-    uint16_t reg_interval;
-+    s->syscfg_exticr[2] = 0x00000000;
+-    uint16_t reg_match[3];
-+    s->syscfg_exticr[3] = 0x00000000;
+-    uint32_t reg_intr;
-+    s->syscfg_cmpcr = 0x00000000;
+-    uint32_t reg_intr_en;
-+}
+-    uint32_t reg_event_ctrl;
-+
+-    uint32_t reg_event;
-+static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
+-
-+{
+-    uint64_t cpu_time;
-+    STM32F4xxSyscfgState *s = opaque;
+-    unsigned int cpu_time_valid;
-+    int icrreg = irq / 4;
+-
-+    int startbit = (irq & 3) * 4;
+-    qemu_irq irq;
-+    uint8_t config = config = irq / 16;
+-} CadenceTimerState;
-+
+-
-+    trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
+-#define TYPE_CADENCE_TTC "cadence_ttc"
-+
+-OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
-+    g_assert(icrreg < SYSCFG_NUM_EXTICR);
+-
-+
+-struct CadenceTTCState {
-+    if (extract32(s->syscfg_exticr[icrreg], startbit, 4) == config) {
+-    SysBusDevice parent_obj;
-+        qemu_set_irq(s->gpio_out[irq], level);
+-
-+        trace_stm32f4xx_pulse_exti(irq);
+-    MemoryRegion iomem;
-+   }
+-    CadenceTimerState timer[3];
-+}
+-};
-+
+-
-+static uint64_t stm32f4xx_syscfg_read(void *opaque, hwaddr addr,
+ static void cadence_timer_update(CadenceTimerState *s)
-+                                     unsigned int size)
+ {
-+{
+     qemu_set_irq(s->irq, !!(s->reg_intr & s->reg_intr_en));
 +    STM32F4xxSyscfgState *s = opaque;
 +
 +    trace_stm32f4xx_syscfg_read(addr);
 +
 +    switch (addr) {
 +    case SYSCFG_MEMRMP:
 +        return s->syscfg_memrmp;
 +    case SYSCFG_PMC:
 +        return s->syscfg_pmc;
 +    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
 +        return s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4];
 +    case SYSCFG_CMPCR:
 +        return s->syscfg_cmpcr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
 +        return 0;
 +    }
 +}
 +
 +static void stm32f4xx_syscfg_write(void *opaque, hwaddr addr,
 +                       uint64_t val64, unsigned int size)
 +{
 +    STM32F4xxSyscfgState *s = opaque;
 +    uint32_t value = val64;
 +
 +    trace_stm32f4xx_syscfg_write(value, addr);
 +
 +    switch (addr) {
 +    case SYSCFG_MEMRMP:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing the memory mapping isn't supported " \
 +                      "in QEMU\n", __func__);
 +        return;
 +    case SYSCFG_PMC:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing the memory mapping isn't supported " \
 +                      "in QEMU\n", __func__);
 +        return;
 +    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
 +        s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4] = (value & 0xFFFF);
 +        return;
 +    case SYSCFG_CMPCR:
 +        s->syscfg_cmpcr = value;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
 +    }
 +}
 +
 +static const MemoryRegionOps stm32f4xx_syscfg_ops = {
 +    .read = stm32f4xx_syscfg_read,
 +    .write = stm32f4xx_syscfg_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void stm32f4xx_syscfg_init(Object *obj)
 +{
 +    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(obj);
 +
 +    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 +
 +    memory_region_init_io(&s->mmio, obj, &stm32f4xx_syscfg_ops, s,
 +                          TYPE_STM32F4XX_SYSCFG, 0x400);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 +
 +    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_syscfg_set_irq, 16 * 9);
 +    qdev_init_gpio_out(DEVICE(obj), s->gpio_out, 16);
 +}
 +
 +static const VMStateDescription vmstate_stm32f4xx_syscfg = {
 +    .name = TYPE_STM32F4XX_SYSCFG,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(syscfg_memrmp, STM32F4xxSyscfgState),
 +        VMSTATE_UINT32(syscfg_pmc, STM32F4xxSyscfgState),
 +        VMSTATE_UINT32_ARRAY(syscfg_exticr, STM32F4xxSyscfgState,
 +                             SYSCFG_NUM_EXTICR),
 +        VMSTATE_UINT32(syscfg_cmpcr, STM32F4xxSyscfgState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void stm32f4xx_syscfg_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = stm32f4xx_syscfg_reset;
 +    dc->vmsd = &vmstate_stm32f4xx_syscfg;
 +}
 +
 +static const TypeInfo stm32f4xx_syscfg_info = {
 +    .name          = TYPE_STM32F4XX_SYSCFG,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(STM32F4xxSyscfgState),
 +    .instance_init = stm32f4xx_syscfg_init,
 +    .class_init    = stm32f4xx_syscfg_class_init,
 +};
 +
 +static void stm32f4xx_syscfg_register_types(void)
 +{
 +    type_register_static(&stm32f4xx_syscfg_info);
 +}
 +
 +type_init(stm32f4xx_syscfg_register_types)
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_Z2=y
  CONFIG_COLLIE=y
  CONFIG_ASPEED_SOC=y
  CONFIG_NETDUINO2=y
 +CONFIG_NETDUINOPLUS2=y
  CONFIG_MPS2=y
  CONFIG_RASPI=y
  CONFIG_DIGIC=y
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config NETDUINO2
      bool
      select STM32F205_SOC
 +config NETDUINOPLUS2
 +    bool
 +    select STM32F405_SOC
 +
  config NSERIES
      bool
      select OMAP
@@ -XXX,XX +XXX,XX @@ config STM32F205_SOC
      select STM32F2XX_ADC
      select STM32F2XX_SPI
 +config STM32F405_SOC
 +    bool
 +    select ARM_V7M
 +    select STM32F4XX_SYSCFG
 +
  config XLNX_ZYNQMP_ARM
      bool
      select AHCI
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IMX
  config STM32F2XX_SYSCFG
      bool
 +config STM32F4XX_SYSCFG
 +    bool
 +
  config MIPS_ITU
      bool
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ mos6522_set_sr_int(void) "set sr_int"
  mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
  mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
 +# stm32f4xx_syscfg
 +stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
 +stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
 +stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
 +stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +
  # tz-mpc.c
  tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
  tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 --
-.20.1
+.25.1

-New patch
+[PULL 03/31] hw/arm/xlnx-zynqmp: Connect 4 TTC timers
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+Connect the 4 TTC timers on the ZynqMP.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20220331222017.2914409-3-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-zynqmp.h |  4 ++++
+ hw/arm/xlnx-zynqmp.c         | 22 ++++++++++++++++++++++
+files changed, 26 insertions(+)
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-zynqmp.h
++++ b/include/hw/arm/xlnx-zynqmp.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/or-irq.h"
+ #include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
+ #include "hw/misc/xlnx-zynqmp-crf.h"
++#include "hw/timer/cadence_ttc.h"
+ #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
+ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
+ #define XLNX_ZYNQMP_MAX_RAM_SIZE (XLNX_ZYNQMP_MAX_LOW_RAM_SIZE + \
+                                   XLNX_ZYNQMP_MAX_HIGH_RAM_SIZE)
++#define XLNX_ZYNQMP_NUM_TTC 4
++
+ /*
+  * Unimplemented mmio regions needed to boot some images.
+  */
+@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
+     qemu_or_irq qspi_irq_orgate;
+     XlnxZynqMPAPUCtrl apu_ctrl;
+     XlnxZynqMPCRF crf;
++    CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
+     char *boot_cpu;
+     ARMCPU *boot_cpu_ptr;
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-zynqmp.c
++++ b/hw/arm/xlnx-zynqmp.c
+@@ -XXX,XX +XXX,XX @@
+ #define APU_ADDR            0xfd5c0000
+ #define APU_IRQ             153
++#define TTC0_ADDR           0xFF110000
++#define TTC0_IRQ            36
++
+ #define IPI_ADDR            0xFF300000
+ #define IPI_IRQ             64
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
+     sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
+ }
++static void xlnx_zynqmp_create_ttc(XlnxZynqMPState *s, qemu_irq *gic)
++{
++    SysBusDevice *sbd;
++    int i, irq;
++
++    for (i = 0; i < XLNX_ZYNQMP_NUM_TTC; i++) {
++        object_initialize_child(OBJECT(s), "ttc[*]", &s->ttc[i],
++                                TYPE_CADENCE_TTC);
++        sbd = SYS_BUS_DEVICE(&s->ttc[i]);
++
++        sysbus_realize(sbd, &error_fatal);
++        sysbus_mmio_map(sbd, 0, TTC0_ADDR + i * 0x10000);
++        for (irq = 0; irq < 3; irq++) {
++            sysbus_connect_irq(sbd, irq, gic[TTC0_IRQ + i * 3 + irq]);
++        }
++    }
++}
++
+ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
+ {
+     static const struct UnimpInfo {
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+     xlnx_zynqmp_create_efuse(s, gic_spi);
+     xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
+     xlnx_zynqmp_create_crf(s, gic_spi);
++    xlnx_zynqmp_create_ttc(s, gic_spi);
+     xlnx_zynqmp_create_unimp_mmio(s);
+     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
+--
+.25.1

-New patch
+[PULL 04/31] hw/arm: versal: Create an APU CPU Cluster
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+Create an APU CPU Cluster. This is in preparation to add the RPU.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
+Message-id: 20220406174303.2022038-2-edgar.iglesias@xilinx.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h | 2 ++
+ hw/arm/xlnx-versal.c         | 9 ++++++++-
+files changed, 10 insertions(+), 1 deletion(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/arm/boot.h"
++#include "hw/cpu/cluster.h"
+ #include "hw/or-irq.h"
+ #include "hw/sd/sdhci.h"
+ #include "hw/intc/arm_gicv3.h"
+@@ -XXX,XX +XXX,XX @@ struct Versal {
+     struct {
+         struct {
+             MemoryRegion mr;
++            CPUClusterState cluster;
+             ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
+             GICv3State gic;
+         } apu;
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+ {
+     int i;
++    object_initialize_child(OBJECT(s), "apu-cluster", &s->fpd.apu.cluster,
++                            TYPE_CPU_CLUSTER);
++    qdev_prop_set_uint32(DEVICE(&s->fpd.apu.cluster), "cluster-id", 0);
++
+     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
+         Object *obj;
+-        object_initialize_child(OBJECT(s), "apu-cpu[*]", &s->fpd.apu.cpu[i],
++        object_initialize_child(OBJECT(&s->fpd.apu.cluster),
++                                "apu-cpu[*]", &s->fpd.apu.cpu[i],
+                                 XLNX_VERSAL_ACPU_TYPE);
+         obj = OBJECT(&s->fpd.apu.cpu[i]);
+         if (i) {
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+                                  &error_abort);
+         qdev_realize(DEVICE(obj), NULL, &error_fatal);
+     }
++
++    qdev_realize(DEVICE(&s->fpd.apu.cluster), NULL, &error_fatal);
+ }
+ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+--
+.25.1

-New patch
+[PULL 05/31] hw/arm: versal: Add the Cortex-R5Fs
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+Add the Cortex-R5Fs of the Versal RPU (Real-time Processing Unit)
+subsystem.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
+Message-id: 20220406174303.2022038-3-edgar.iglesias@xilinx.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h | 10 ++++++++++
+ hw/arm/xlnx-versal-virt.c    |  6 +++---
+ hw/arm/xlnx-versal.c         | 36 ++++++++++++++++++++++++++++++++++++
+files changed, 49 insertions(+), 3 deletions(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
+ #define XLNX_VERSAL_NR_ACPUS   2
++#define XLNX_VERSAL_NR_RCPUS   2
+ #define XLNX_VERSAL_NR_UARTS   2
+ #define XLNX_VERSAL_NR_GEMS    2
+ #define XLNX_VERSAL_NR_ADMAS   8
+@@ -XXX,XX +XXX,XX @@ struct Versal {
+             VersalUsb2 usb;
+         } iou;
++        /* Real-time Processing Unit.  */
++        struct {
++            MemoryRegion mr;
++            MemoryRegion mr_ps_alias;
++
++            CPUClusterState cluster;
++            ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
++        } rpu;
++
+         struct {
+             qemu_or_irq irq_orgate;
+             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
+diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal-virt.c
++++ b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
+     mc->desc = "Xilinx Versal Virtual development board";
+     mc->init = versal_virt_init;
+-    mc->min_cpus = XLNX_VERSAL_NR_ACPUS;
+-    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
+-    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
++    mc->min_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
++    mc->max_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
++    mc->default_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+     mc->no_cdrom = true;
+     mc->default_ram_id = "ddr";
+ }
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
++#define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
+ #define GEM_REVISION        0x40070106
+ #define VERSAL_NUM_PMC_APB_IRQS 3
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+     }
+ }
++static void versal_create_rpu_cpus(Versal *s)
++{
++    int i;
++
++    object_initialize_child(OBJECT(s), "rpu-cluster", &s->lpd.rpu.cluster,
++                            TYPE_CPU_CLUSTER);
++    qdev_prop_set_uint32(DEVICE(&s->lpd.rpu.cluster), "cluster-id", 1);
++
++    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
++        Object *obj;
++
++        object_initialize_child(OBJECT(&s->lpd.rpu.cluster),
++                                "rpu-cpu[*]", &s->lpd.rpu.cpu[i],
++                                XLNX_VERSAL_RCPU_TYPE);
++        obj = OBJECT(&s->lpd.rpu.cpu[i]);
++        object_property_set_bool(obj, "start-powered-off", true,
++                                 &error_abort);
++
++        object_property_set_int(obj, "mp-affinity", 0x100 | i, &error_abort);
++        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->lpd.rpu.cpu),
++                                &error_abort);
++        object_property_set_link(obj, "memory", OBJECT(&s->lpd.rpu.mr),
++                                 &error_abort);
++        qdev_realize(DEVICE(obj), NULL, &error_fatal);
++    }
++
++    qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
++}
++
+ static void versal_create_uarts(Versal *s, qemu_irq *pic)
+ {
+     int i;
+@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+     versal_create_apu_cpus(s);
+     versal_create_apu_gic(s, pic);
++    versal_create_rpu_cpus(s);
+     versal_create_uarts(s, pic);
+     versal_create_usbs(s, pic);
+     versal_create_gems(s, pic);
+@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+     memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
+     memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
++    memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
++                                        &s->lpd.rpu.mr_ps_alias, 0);
+ }
+ static void versal_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void versal_init(Object *obj)
+     Versal *s = XLNX_VERSAL(obj);
+     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
++    memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
+     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
++    memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
++                             "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
+ }
+ static Property versal_properties[] = {
+--
+.25.1

-[PULL 02/15] hw/misc: Add the STM32F4xx EXTI device
+[PULL 06/31] hw/misc: Add a model of the Xilinx Versal CRL
-From: Alistair Francis <alistair@alistair23.me>
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+Add a model of the Xilinx Versal CRL.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: ef941d59fd8658589d34ed432e1d6dfdcf7fb1d0.1576658572.git.alistair@alistair23.me
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Frederic Konrad <fkonrad@amd.com>
 Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
 Message-id: 20220406174303.2022038-4-edgar.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs            |   1 +
+ include/hw/misc/xlnx-versal-crl.h | 235 +++++++++++++++++
- include/hw/misc/stm32f4xx_exti.h |  60 ++++++++++
+ hw/misc/xlnx-versal-crl.c         | 421 ++++++++++++++++++++++++++++++
- hw/misc/stm32f4xx_exti.c         | 188 +++++++++++++++++++++++++++++++
+ hw/misc/meson.build               |   1 +
- hw/arm/Kconfig                   |   1 +
+files changed, 657 insertions(+)
- hw/misc/Kconfig                  |   3 +
+ create mode 100644 include/hw/misc/xlnx-versal-crl.h
- hw/misc/trace-events             |   5 +
+ create mode 100644 hw/misc/xlnx-versal-crl.c
 files changed, 258 insertions(+)
  create mode 100644 include/hw/misc/stm32f4xx_exti.h
  create mode 100644 hw/misc/stm32f4xx_exti.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Makefile.objs
 +++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
  common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
  common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
  common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
 +common-obj-$(CONFIG_STM32F4XX_EXTI) += stm32f4xx_exti.o
  obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
  obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
  obj-$(CONFIG_MIPS_ITU) += mips_itu.o
 diff --git a/include/hw/misc/stm32f4xx_exti.h b/include/hw/misc/stm32f4xx_exti.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/stm32f4xx_exti.h
++++ b/include/hw/misc/xlnx-versal-crl.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * STM32F4XX EXTI
++ * QEMU model of the Clock-Reset-LPD (CRL).
 + *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++ * Copyright (c) 2022 Xilinx Inc.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
-+
++#ifndef HW_MISC_XLNX_VERSAL_CRL_H
-+#ifndef HW_STM_EXTI_H
++#define HW_MISC_XLNX_VERSAL_CRL_H
 +#define HW_STM_EXTI_H
 +
 +#include "hw/sysbus.h"
-+#include "hw/hw.h"
++#include "hw/register.h"
-+
++#include "target/arm/cpu.h"
-+#define EXTI_IMR   0x00
++
-+#define EXTI_EMR   0x04
++#define TYPE_XLNX_VERSAL_CRL "xlnx,versal-crl"
-+#define EXTI_RTSR  0x08
++OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
-+#define EXTI_FTSR  0x0C
++
-+#define EXTI_SWIER 0x10
++REG32(ERR_CTRL, 0x0)
-+#define EXTI_PR    0x14
++    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
-+
++REG32(IR_STATUS, 0x4)
-+#define TYPE_STM32F4XX_EXTI "stm32f4xx-exti"
++    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
-+#define STM32F4XX_EXTI(obj) \
++REG32(IR_MASK, 0x8)
-+    OBJECT_CHECK(STM32F4xxExtiState, (obj), TYPE_STM32F4XX_EXTI)
++    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
-+
++REG32(IR_ENABLE, 0xc)
-+#define NUM_GPIO_EVENT_IN_LINES 16
++    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
-+#define NUM_INTERRUPT_OUT_LINES 16
++REG32(IR_DISABLE, 0x10)
-+
++    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
-+typedef struct {
++REG32(WPROT, 0x1c)
 +    FIELD(WPROT, ACTIVE, 0, 1)
 +REG32(PLL_CLK_OTHER_DMN, 0x20)
 +    FIELD(PLL_CLK_OTHER_DMN, APLL_BYPASS, 0, 1)
 +REG32(RPLL_CTRL, 0x40)
 +    FIELD(RPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(RPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(RPLL_CTRL, CLKOUTDIV, 16, 2)
 +    FIELD(RPLL_CTRL, FBDIV, 8, 8)
 +    FIELD(RPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(RPLL_CTRL, RESET, 0, 1)
 +REG32(RPLL_CFG, 0x44)
 +    FIELD(RPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(RPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(RPLL_CFG, LFHF, 10, 2)
 +    FIELD(RPLL_CFG, CP, 5, 4)
 +    FIELD(RPLL_CFG, RES, 0, 4)
 +REG32(RPLL_FRAC_CFG, 0x48)
 +    FIELD(RPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(RPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(RPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(RPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(RPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(PLL_STATUS, 0x50)
 +    FIELD(PLL_STATUS, RPLL_STABLE, 2, 1)
 +    FIELD(PLL_STATUS, RPLL_LOCK, 0, 1)
 +REG32(RPLL_TO_XPD_CTRL, 0x100)
 +    FIELD(RPLL_TO_XPD_CTRL, CLKACT, 25, 1)
 +    FIELD(RPLL_TO_XPD_CTRL, DIVISOR0, 8, 10)
 +REG32(LPD_TOP_SWITCH_CTRL, 0x104)
 +    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT_ADMA, 26, 1)
 +    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT, 25, 1)
 +    FIELD(LPD_TOP_SWITCH_CTRL, DIVISOR0, 8, 10)
 +    FIELD(LPD_TOP_SWITCH_CTRL, SRCSEL, 0, 3)
 +REG32(LPD_LSBUS_CTRL, 0x108)
 +    FIELD(LPD_LSBUS_CTRL, CLKACT, 25, 1)
 +    FIELD(LPD_LSBUS_CTRL, DIVISOR0, 8, 10)
 +    FIELD(LPD_LSBUS_CTRL, SRCSEL, 0, 3)
 +REG32(CPU_R5_CTRL, 0x10c)
 +    FIELD(CPU_R5_CTRL, CLKACT_OCM2, 28, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT_OCM, 27, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT_CORE, 26, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT, 25, 1)
 +    FIELD(CPU_R5_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CPU_R5_CTRL, SRCSEL, 0, 3)
 +REG32(IOU_SWITCH_CTRL, 0x114)
 +    FIELD(IOU_SWITCH_CTRL, CLKACT, 25, 1)
 +    FIELD(IOU_SWITCH_CTRL, DIVISOR0, 8, 10)
 +    FIELD(IOU_SWITCH_CTRL, SRCSEL, 0, 3)
 +REG32(GEM0_REF_CTRL, 0x118)
 +    FIELD(GEM0_REF_CTRL, CLKACT_RX, 27, 1)
 +    FIELD(GEM0_REF_CTRL, CLKACT_TX, 26, 1)
 +    FIELD(GEM0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GEM1_REF_CTRL, 0x11c)
 +    FIELD(GEM1_REF_CTRL, CLKACT_RX, 27, 1)
 +    FIELD(GEM1_REF_CTRL, CLKACT_TX, 26, 1)
 +    FIELD(GEM1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GEM_TSU_REF_CTRL, 0x120)
 +    FIELD(GEM_TSU_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM_TSU_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM_TSU_REF_CTRL, SRCSEL, 0, 3)
 +REG32(USB0_BUS_REF_CTRL, 0x124)
 +    FIELD(USB0_BUS_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(USB0_BUS_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(USB0_BUS_REF_CTRL, SRCSEL, 0, 3)
 +REG32(UART0_REF_CTRL, 0x128)
 +    FIELD(UART0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(UART0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(UART0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(UART1_REF_CTRL, 0x12c)
 +    FIELD(UART1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(UART1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(UART1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SPI0_REF_CTRL, 0x130)
 +    FIELD(SPI0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(SPI0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(SPI0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SPI1_REF_CTRL, 0x134)
 +    FIELD(SPI1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(SPI1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(SPI1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CAN0_REF_CTRL, 0x138)
 +    FIELD(CAN0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CAN0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CAN0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CAN1_REF_CTRL, 0x13c)
 +    FIELD(CAN1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CAN1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CAN1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(I2C0_REF_CTRL, 0x140)
 +    FIELD(I2C0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(I2C0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(I2C0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(I2C1_REF_CTRL, 0x144)
 +    FIELD(I2C1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(I2C1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(I2C1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_LPD_CTRL, 0x148)
 +    FIELD(DBG_LPD_CTRL, CLKACT, 25, 1)
 +    FIELD(DBG_LPD_CTRL, DIVISOR0, 8, 10)
 +    FIELD(DBG_LPD_CTRL, SRCSEL, 0, 3)
 +REG32(TIMESTAMP_REF_CTRL, 0x14c)
 +    FIELD(TIMESTAMP_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(TIMESTAMP_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(TIMESTAMP_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CRL_SAFETY_CHK, 0x150)
 +REG32(PSM_REF_CTRL, 0x154)
 +    FIELD(PSM_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(PSM_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TSTMP_CTRL, 0x158)
 +    FIELD(DBG_TSTMP_CTRL, CLKACT, 25, 1)
 +    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 10)
 +    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
 +REG32(CPM_TOPSW_REF_CTRL, 0x15c)
 +    FIELD(CPM_TOPSW_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CPM_TOPSW_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CPM_TOPSW_REF_CTRL, SRCSEL, 0, 3)
 +REG32(USB3_DUAL_REF_CTRL, 0x160)
 +    FIELD(USB3_DUAL_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(USB3_DUAL_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(USB3_DUAL_REF_CTRL, SRCSEL, 0, 3)
 +REG32(RST_CPU_R5, 0x300)
 +    FIELD(RST_CPU_R5, RESET_PGE, 4, 1)
 +    FIELD(RST_CPU_R5, RESET_AMBA, 2, 1)
 +    FIELD(RST_CPU_R5, RESET_CPU1, 1, 1)
 +    FIELD(RST_CPU_R5, RESET_CPU0, 0, 1)
 +REG32(RST_ADMA, 0x304)
 +    FIELD(RST_ADMA, RESET, 0, 1)
 +REG32(RST_GEM0, 0x308)
 +    FIELD(RST_GEM0, RESET, 0, 1)
 +REG32(RST_GEM1, 0x30c)
 +    FIELD(RST_GEM1, RESET, 0, 1)
 +REG32(RST_SPARE, 0x310)
 +    FIELD(RST_SPARE, RESET, 0, 1)
 +REG32(RST_USB0, 0x314)
 +    FIELD(RST_USB0, RESET, 0, 1)
 +REG32(RST_UART0, 0x318)
 +    FIELD(RST_UART0, RESET, 0, 1)
 +REG32(RST_UART1, 0x31c)
 +    FIELD(RST_UART1, RESET, 0, 1)
 +REG32(RST_SPI0, 0x320)
 +    FIELD(RST_SPI0, RESET, 0, 1)
 +REG32(RST_SPI1, 0x324)
 +    FIELD(RST_SPI1, RESET, 0, 1)
 +REG32(RST_CAN0, 0x328)
 +    FIELD(RST_CAN0, RESET, 0, 1)
 +REG32(RST_CAN1, 0x32c)
 +    FIELD(RST_CAN1, RESET, 0, 1)
 +REG32(RST_I2C0, 0x330)
 +    FIELD(RST_I2C0, RESET, 0, 1)
 +REG32(RST_I2C1, 0x334)
 +    FIELD(RST_I2C1, RESET, 0, 1)
 +REG32(RST_DBG_LPD, 0x338)
 +    FIELD(RST_DBG_LPD, RPU_DBG1_RESET, 5, 1)
 +    FIELD(RST_DBG_LPD, RPU_DBG0_RESET, 4, 1)
 +    FIELD(RST_DBG_LPD, RESET_HSDP, 1, 1)
 +    FIELD(RST_DBG_LPD, RESET, 0, 1)
 +REG32(RST_GPIO, 0x33c)
 +    FIELD(RST_GPIO, RESET, 0, 1)
 +REG32(RST_TTC, 0x344)
 +    FIELD(RST_TTC, TTC3_RESET, 3, 1)
 +    FIELD(RST_TTC, TTC2_RESET, 2, 1)
 +    FIELD(RST_TTC, TTC1_RESET, 1, 1)
 +    FIELD(RST_TTC, TTC0_RESET, 0, 1)
 +REG32(RST_TIMESTAMP, 0x348)
 +    FIELD(RST_TIMESTAMP, RESET, 0, 1)
 +REG32(RST_SWDT, 0x34c)
 +    FIELD(RST_SWDT, RESET, 0, 1)
 +REG32(RST_OCM, 0x350)
 +    FIELD(RST_OCM, RESET, 0, 1)
 +REG32(RST_IPI, 0x354)
 +    FIELD(RST_IPI, RESET, 0, 1)
 +REG32(RST_SYSMON, 0x358)
 +    FIELD(RST_SYSMON, SEQ_RST, 1, 1)
 +    FIELD(RST_SYSMON, CFG_RST, 0, 1)
 +REG32(RST_FPD, 0x360)
 +    FIELD(RST_FPD, SRST, 1, 1)
 +    FIELD(RST_FPD, POR, 0, 1)
 +REG32(PSM_RST_MODE, 0x370)
 +    FIELD(PSM_RST_MODE, WAKEUP, 2, 1)
 +    FIELD(PSM_RST_MODE, RST_MODE, 0, 2)
 +
 +#define CRL_R_MAX (R_PSM_RST_MODE + 1)
 +
 +#define RPU_MAX_CPU 2
 +
 +struct XlnxVersalCRL {
 +    SysBusDevice parent_obj;
-+
++    qemu_irq irq;
-+    MemoryRegion mmio;
++
-+
++    struct {
-+    uint32_t exti_imr;
++        ARMCPU *cpu_r5[RPU_MAX_CPU];
-+    uint32_t exti_emr;
++        DeviceState *adma[8];
-+    uint32_t exti_rtsr;
++        DeviceState *uart[2];
-+    uint32_t exti_ftsr;
++        DeviceState *gem[2];
-+    uint32_t exti_swier;
++        DeviceState *usb;
-+    uint32_t exti_pr;
++    } cfg;
 +
-+    qemu_irq irq[NUM_INTERRUPT_OUT_LINES];
++    RegisterInfoArray *reg_array;
-+} STM32F4xxExtiState;
++    uint32_t regs[CRL_R_MAX];
-+
++    RegisterInfo regs_info[CRL_R_MAX];
 +};
 +#endif
-diff --git a/hw/misc/stm32f4xx_exti.c b/hw/misc/stm32f4xx_exti.c
+diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/stm32f4xx_exti.c
++++ b/hw/misc/xlnx-versal-crl.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * STM32F4XX EXTI
++ * QEMU model of the Clock-Reset-LPD (CRL).
 + *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++ * Copyright (c) 2022 Advanced Micro Devices, Inc.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * Written by Edgar E. Iglesias <edgar.iglesias@amd.com>
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
++#include "qapi/error.h"
 +#include "qemu/log.h"
-+#include "trace.h"
++#include "qemu/bitops.h"
 +#include "migration/vmstate.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/sysbus.h"
 +#include "hw/irq.h"
-+#include "migration/vmstate.h"
++#include "hw/register.h"
-+#include "hw/misc/stm32f4xx_exti.h"
++#include "hw/resettable.h"
 +
-+static void stm32f4xx_exti_reset(DeviceState *dev)
++#include "target/arm/arm-powerctl.h"
-+{
++#include "hw/misc/xlnx-versal-crl.h"
-+    STM32F4xxExtiState *s = STM32F4XX_EXTI(dev);
++
-+
++#ifndef XLNX_VERSAL_CRL_ERR_DEBUG
-+    s->exti_imr = 0x00000000;
++#define XLNX_VERSAL_CRL_ERR_DEBUG 0
-+    s->exti_emr = 0x00000000;
++#endif
-+    s->exti_rtsr = 0x00000000;
++
-+    s->exti_ftsr = 0x00000000;
++static void crl_update_irq(XlnxVersalCRL *s)
-+    s->exti_swier = 0x00000000;
++{
-+    s->exti_pr = 0x00000000;
++    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
-+}
++    qemu_set_irq(s->irq, pending);
-+
++}
-+static void stm32f4xx_exti_set_irq(void *opaque, int irq, int level)
++
-+{
++static void crl_status_postw(RegisterInfo *reg, uint64_t val64)
-+    STM32F4xxExtiState *s = opaque;
++{
-+
++    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-+    trace_stm32f4xx_exti_set_irq(irq, level);
++    crl_update_irq(s);
-+
++}
-+    if (((1 << irq) & s->exti_rtsr) && level) {
++
-+        /* Rising Edge */
++static uint64_t crl_enable_prew(RegisterInfo *reg, uint64_t val64)
-+        s->exti_pr |= 1 << irq;
++{
-+    }
++    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-+
++    uint32_t val = val64;
-+    if (((1 << irq) & s->exti_ftsr) && !level) {
++
-+        /* Falling Edge */
++    s->regs[R_IR_MASK] &= ~val;
-+        s->exti_pr |= 1 << irq;
++    crl_update_irq(s);
 +    }
 +
 +    if (!((1 << irq) & s->exti_imr)) {
 +        /* Interrupt is masked */
 +        return;
 +    }
 +    qemu_irq_pulse(s->irq[irq]);
 +}
 +
 +static uint64_t stm32f4xx_exti_read(void *opaque, hwaddr addr,
 +                                     unsigned int size)
 +{
 +    STM32F4xxExtiState *s = opaque;
 +
 +    trace_stm32f4xx_exti_read(addr);
 +
 +    switch (addr) {
 +    case EXTI_IMR:
 +        return s->exti_imr;
 +    case EXTI_EMR:
 +        return s->exti_emr;
 +    case EXTI_RTSR:
 +        return s->exti_rtsr;
 +    case EXTI_FTSR:
 +        return s->exti_ftsr;
 +    case EXTI_SWIER:
 +        return s->exti_swier;
 +    case EXTI_PR:
 +        return s->exti_pr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "STM32F4XX_exti_read: Bad offset %x\n", (int)addr);
 +        return 0;
 +    }
 +    return 0;
 +}
 +
-+static void stm32f4xx_exti_write(void *opaque, hwaddr addr,
++static uint64_t crl_disable_prew(RegisterInfo *reg, uint64_t val64)
-+                       uint64_t val64, unsigned int size)
++{
-+{
++    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-+    STM32F4xxExtiState *s = opaque;
++    uint32_t val = val64;
-+    uint32_t value = (uint32_t) val64;
++
-+
++    s->regs[R_IR_MASK] |= val;
-+    trace_stm32f4xx_exti_write(addr, value);
++    crl_update_irq(s);
-+
++    return 0;
-+    switch (addr) {
++}
-+    case EXTI_IMR:
++
-+        s->exti_imr = value;
++static void crl_reset_dev(XlnxVersalCRL *s, DeviceState *dev,
-+        return;
++                          bool rst_old, bool rst_new)
-+    case EXTI_EMR:
++{
-+        s->exti_emr = value;
++    device_cold_reset(dev);
-+        return;
++}
-+    case EXTI_RTSR:
++
-+        s->exti_rtsr = value;
++static void crl_reset_cpu(XlnxVersalCRL *s, ARMCPU *armcpu,
-+        return;
++                          bool rst_old, bool rst_new)
-+    case EXTI_FTSR:
++{
-+        s->exti_ftsr = value;
++    if (rst_new) {
-+        return;
++        arm_set_cpu_off(armcpu->mp_affinity);
-+    case EXTI_SWIER:
++    } else {
-+        s->exti_swier = value;
++        arm_set_cpu_on_and_reset(armcpu->mp_affinity);
-+        return;
++    }
-+    case EXTI_PR:
++}
-+        /* This bit is cleared by writing a 1 to it */
++
-+        s->exti_pr &= ~value;
++#define REGFIELD_RESET(type, s, reg, f, new_val, dev) {     \
-+        return;
++    bool old_f = ARRAY_FIELD_EX32((s)->regs, reg, f);       \
-+    default:
++    bool new_f = FIELD_EX32(new_val, reg, f);               \
-+        qemu_log_mask(LOG_GUEST_ERROR,
++                                                            \
-+                      "STM32F4XX_exti_write: Bad offset %x\n", (int)addr);
++    /* Detect edges.  */                                    \
-+    }
++    if (dev && old_f != new_f) {                            \
-+}
++        crl_reset_ ## type(s, dev, old_f, new_f);           \
-+
++    }                                                       \
-+static const MemoryRegionOps stm32f4xx_exti_ops = {
++}
-+    .read = stm32f4xx_exti_read,
++
-+    .write = stm32f4xx_exti_write,
++static uint64_t crl_rst_r5_prew(RegisterInfo *reg, uint64_t val64)
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU0, val64, s->cfg.cpu_r5[0]);
 +    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU1, val64, s->cfg.cpu_r5[1]);
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_adma_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +    int i;
 +
 +    /* A single register fans out to all ADMA reset inputs.  */
 +    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); i++) {
 +        REGFIELD_RESET(dev, s, RST_ADMA, RESET, val64, s->cfg.adma[i]);
 +    }
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_uart0_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(dev, s, RST_UART0, RESET, val64, s->cfg.uart[0]);
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_uart1_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(dev, s, RST_UART1, RESET, val64, s->cfg.uart[1]);
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_gem0_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(dev, s, RST_GEM0, RESET, val64, s->cfg.gem[0]);
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_gem1_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(dev, s, RST_GEM1, RESET, val64, s->cfg.gem[1]);
 +    return val64;
 +}
 +
 +static uint64_t crl_rst_usb_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
 +
 +    REGFIELD_RESET(dev, s, RST_USB0, RESET, val64, s->cfg.usb);
 +    return val64;
 +}
 +
 +static const RegisterAccessInfo crl_regs_info[] = {
 +    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
 +    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
 +        .w1c = 0x1,
 +        .post_write = crl_status_postw,
 +    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
 +        .reset = 0x1,
 +        .ro = 0x1,
 +    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
 +        .pre_write = crl_enable_prew,
 +    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
 +        .pre_write = crl_disable_prew,
 +    },{ .name = "WPROT",  .addr = A_WPROT,
 +    },{ .name = "PLL_CLK_OTHER_DMN",  .addr = A_PLL_CLK_OTHER_DMN,
 +        .reset = 0x1,
 +        .rsvd = 0xe,
 +    },{ .name = "RPLL_CTRL",  .addr = A_RPLL_CTRL,
 +        .reset = 0x24809,
 +        .rsvd = 0xf88c00f6,
 +    },{ .name = "RPLL_CFG",  .addr = A_RPLL_CFG,
 +        .reset = 0x2000000,
 +        .rsvd = 0x1801210,
 +    },{ .name = "RPLL_FRAC_CFG",  .addr = A_RPLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
 +        .reset = R_PLL_STATUS_RPLL_STABLE_MASK |
 +                 R_PLL_STATUS_RPLL_LOCK_MASK,
 +        .rsvd = 0xfa,
 +        .ro = 0x5,
 +    },{ .name = "RPLL_TO_XPD_CTRL",  .addr = A_RPLL_TO_XPD_CTRL,
 +        .reset = 0x2000100,
 +        .rsvd = 0xfdfc00ff,
 +    },{ .name = "LPD_TOP_SWITCH_CTRL",  .addr = A_LPD_TOP_SWITCH_CTRL,
 +        .reset = 0x6000300,
 +        .rsvd = 0xf9fc00f8,
 +    },{ .name = "LPD_LSBUS_CTRL",  .addr = A_LPD_LSBUS_CTRL,
 +        .reset = 0x2000800,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "CPU_R5_CTRL",  .addr = A_CPU_R5_CTRL,
 +        .reset = 0xe000300,
 +        .rsvd = 0xe1fc00f8,
 +    },{ .name = "IOU_SWITCH_CTRL",  .addr = A_IOU_SWITCH_CTRL,
 +        .reset = 0x2000500,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "GEM0_REF_CTRL",  .addr = A_GEM0_REF_CTRL,
 +        .reset = 0xe000a00,
 +        .rsvd = 0xf1fc00f8,
 +    },{ .name = "GEM1_REF_CTRL",  .addr = A_GEM1_REF_CTRL,
 +        .reset = 0xe000a00,
 +        .rsvd = 0xf1fc00f8,
 +    },{ .name = "GEM_TSU_REF_CTRL",  .addr = A_GEM_TSU_REF_CTRL,
 +        .reset = 0x300,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "USB0_BUS_REF_CTRL",  .addr = A_USB0_BUS_REF_CTRL,
 +        .reset = 0x2001900,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "UART0_REF_CTRL",  .addr = A_UART0_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "UART1_REF_CTRL",  .addr = A_UART1_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "SPI0_REF_CTRL",  .addr = A_SPI0_REF_CTRL,
 +        .reset = 0x600,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "SPI1_REF_CTRL",  .addr = A_SPI1_REF_CTRL,
 +        .reset = 0x600,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "CAN0_REF_CTRL",  .addr = A_CAN0_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "CAN1_REF_CTRL",  .addr = A_CAN1_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "I2C0_REF_CTRL",  .addr = A_I2C0_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "I2C1_REF_CTRL",  .addr = A_I2C1_REF_CTRL,
 +        .reset = 0xc00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "DBG_LPD_CTRL",  .addr = A_DBG_LPD_CTRL,
 +        .reset = 0x300,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "TIMESTAMP_REF_CTRL",  .addr = A_TIMESTAMP_REF_CTRL,
 +        .reset = 0x2000c00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "CRL_SAFETY_CHK",  .addr = A_CRL_SAFETY_CHK,
 +    },{ .name = "PSM_REF_CTRL",  .addr = A_PSM_REF_CTRL,
 +        .reset = 0xf04,
 +        .rsvd = 0xfffc00f8,
 +    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
 +        .reset = 0x300,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "CPM_TOPSW_REF_CTRL",  .addr = A_CPM_TOPSW_REF_CTRL,
 +        .reset = 0x300,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "USB3_DUAL_REF_CTRL",  .addr = A_USB3_DUAL_REF_CTRL,
 +        .reset = 0x3c00,
 +        .rsvd = 0xfdfc00f8,
 +    },{ .name = "RST_CPU_R5",  .addr = A_RST_CPU_R5,
 +        .reset = 0x17,
 +        .rsvd = 0x8,
 +        .pre_write = crl_rst_r5_prew,
 +    },{ .name = "RST_ADMA",  .addr = A_RST_ADMA,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_adma_prew,
 +    },{ .name = "RST_GEM0",  .addr = A_RST_GEM0,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_gem0_prew,
 +    },{ .name = "RST_GEM1",  .addr = A_RST_GEM1,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_gem1_prew,
 +    },{ .name = "RST_SPARE",  .addr = A_RST_SPARE,
 +        .reset = 0x1,
 +    },{ .name = "RST_USB0",  .addr = A_RST_USB0,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_usb_prew,
 +    },{ .name = "RST_UART0",  .addr = A_RST_UART0,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_uart0_prew,
 +    },{ .name = "RST_UART1",  .addr = A_RST_UART1,
 +        .reset = 0x1,
 +        .pre_write = crl_rst_uart1_prew,
 +    },{ .name = "RST_SPI0",  .addr = A_RST_SPI0,
 +        .reset = 0x1,
 +    },{ .name = "RST_SPI1",  .addr = A_RST_SPI1,
 +        .reset = 0x1,
 +    },{ .name = "RST_CAN0",  .addr = A_RST_CAN0,
 +        .reset = 0x1,
 +    },{ .name = "RST_CAN1",  .addr = A_RST_CAN1,
 +        .reset = 0x1,
 +    },{ .name = "RST_I2C0",  .addr = A_RST_I2C0,
 +        .reset = 0x1,
 +    },{ .name = "RST_I2C1",  .addr = A_RST_I2C1,
 +        .reset = 0x1,
 +    },{ .name = "RST_DBG_LPD",  .addr = A_RST_DBG_LPD,
 +        .reset = 0x33,
 +        .rsvd = 0xcc,
 +    },{ .name = "RST_GPIO",  .addr = A_RST_GPIO,
 +        .reset = 0x1,
 +    },{ .name = "RST_TTC",  .addr = A_RST_TTC,
 +        .reset = 0xf,
 +    },{ .name = "RST_TIMESTAMP",  .addr = A_RST_TIMESTAMP,
 +        .reset = 0x1,
 +    },{ .name = "RST_SWDT",  .addr = A_RST_SWDT,
 +        .reset = 0x1,
 +    },{ .name = "RST_OCM",  .addr = A_RST_OCM,
 +    },{ .name = "RST_IPI",  .addr = A_RST_IPI,
 +    },{ .name = "RST_FPD",  .addr = A_RST_FPD,
 +        .reset = 0x3,
 +    },{ .name = "PSM_RST_MODE",  .addr = A_PSM_RST_MODE,
 +        .reset = 0x1,
 +        .rsvd = 0xf8,
 +    }
 +};
 +
-+static void stm32f4xx_exti_init(Object *obj)
++static void crl_reset_enter(Object *obj, ResetType type)
 +{
-+    STM32F4xxExtiState *s = STM32F4XX_EXTI(obj);
++    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 +    unsigned int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 +        register_reset(&s->regs_info[i]);
 +    }
 +}
 +
 +static void crl_reset_hold(Object *obj)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 +
 +    crl_update_irq(s);
 +}
 +
 +static const MemoryRegionOps crl_ops = {
 +    .read = register_read_memory,
 +    .write = register_write_memory,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static void crl_init(Object *obj)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    int i;
 +
-+    for (i = 0; i < NUM_INTERRUPT_OUT_LINES; i++) {
++    s->reg_array =
-+        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq[i]);
++        register_init_block32(DEVICE(obj), crl_regs_info,
-+    }
++                              ARRAY_SIZE(crl_regs_info),
-+
++                              s->regs_info, s->regs,
-+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_exti_ops, s,
++                              &crl_ops,
-+                          TYPE_STM32F4XX_EXTI, 0x400);
++                              XLNX_VERSAL_CRL_ERR_DEBUG,
-+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
++                              CRL_R_MAX * 4);
-+
++    sysbus_init_mmio(sbd, &s->reg_array->mem);
-+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_exti_set_irq,
++    sysbus_init_irq(sbd, &s->irq);
-+                      NUM_GPIO_EVENT_IN_LINES);
++
-+}
++    for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
-+
++        object_property_add_link(obj, "cpu_r5[*]", TYPE_ARM_CPU,
-+static const VMStateDescription vmstate_stm32f4xx_exti = {
++                                 (Object **)&s->cfg.cpu_r5[i],
-+    .name = TYPE_STM32F4XX_EXTI,
++                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); ++i) {
 +        object_property_add_link(obj, "adma[*]", TYPE_DEVICE,
 +                                 (Object **)&s->cfg.adma[i],
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(s->cfg.uart); ++i) {
 +        object_property_add_link(obj, "uart[*]", TYPE_DEVICE,
 +                                 (Object **)&s->cfg.uart[i],
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(s->cfg.gem); ++i) {
 +        object_property_add_link(obj, "gem[*]", TYPE_DEVICE,
 +                                 (Object **)&s->cfg.gem[i],
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    object_property_add_link(obj, "usb", TYPE_DEVICE,
 +                             (Object **)&s->cfg.gem[i],
 +                             qdev_prop_allow_set_link_before_realize,
 +                             OBJ_PROP_LINK_STRONG);
 +}
 +
 +static void crl_finalize(Object *obj)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 +    register_finalize_block(s->reg_array);
 +}
 +
 +static const VMStateDescription vmstate_crl = {
 +    .name = TYPE_XLNX_VERSAL_CRL,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(exti_imr, STM32F4xxExtiState),
++        VMSTATE_UINT32_ARRAY(regs, XlnxVersalCRL, CRL_R_MAX),
-+        VMSTATE_UINT32(exti_emr, STM32F4xxExtiState),
++        VMSTATE_END_OF_LIST(),
 +        VMSTATE_UINT32(exti_rtsr, STM32F4xxExtiState),
 +        VMSTATE_UINT32(exti_ftsr, STM32F4xxExtiState),
 +        VMSTATE_UINT32(exti_swier, STM32F4xxExtiState),
 +        VMSTATE_UINT32(exti_pr, STM32F4xxExtiState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static void stm32f4xx_exti_class_init(ObjectClass *klass, void *data)
++static void crl_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
-+    dc->reset = stm32f4xx_exti_reset;
++    dc->vmsd = &vmstate_crl;
-+    dc->vmsd = &vmstate_stm32f4xx_exti;
++
-+}
++    rc->phases.enter = crl_reset_enter;
-+
++    rc->phases.hold = crl_reset_hold;
-+static const TypeInfo stm32f4xx_exti_info = {
++}
-+    .name          = TYPE_STM32F4XX_EXTI,
++
 +static const TypeInfo crl_info = {
 +    .name          = TYPE_XLNX_VERSAL_CRL,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(STM32F4xxExtiState),
++    .instance_size = sizeof(XlnxVersalCRL),
-+    .instance_init = stm32f4xx_exti_init,
++    .class_init    = crl_class_init,
-+    .class_init    = stm32f4xx_exti_class_init,
++    .instance_init = crl_init,
 +    .instance_finalize = crl_finalize,
 +};
 +
-+static void stm32f4xx_exti_register_types(void)
++static void crl_register_types(void)
 +{
-+    type_register_static(&stm32f4xx_exti_info);
++    type_register_static(&crl_info);
 +}
 +
-+type_init(stm32f4xx_exti_register_types)
++type_init(crl_register_types)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
+--- a/hw/misc/meson.build
-+++ b/hw/arm/Kconfig
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
-     bool
+ softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
-     select ARM_V7M
+ specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
-     select STM32F4XX_SYSCFG
+ specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
-+    select STM32F4XX_EXTI
++specific_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-crl.c'))
+ softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
- config XLNX_ZYNQMP_ARM
+   'xlnx-versal-xramc.c',
-     bool
+   'xlnx-versal-pmc-iou-slcr.c',
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32F2XX_SYSCFG
  config STM32F4XX_SYSCFG
      bool
 +config STM32F4XX_EXTI
 +    bool
 +
  config MIPS_ITU
      bool
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
  stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
  stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +# stm32f4xx_exti
 +stm32f4xx_exti_set_irq(int irq, int leve) "Set EXTI: %d to %d"
 +stm32f4xx_exti_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
 +stm32f4xx_exti_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +
  # tz-mpc.c
  tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
  tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
 --
-.20.1
+.25.1

-[PULL 03/15] hw/arm: Add the STM32F4xx SoC
+[PULL 07/31] hw/arm: versal: Connect the CRL
-From: Alistair Francis <alistair@alistair23.me>
+From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
+Connect the CRL (Clock Reset LPD) to the Versal SoC.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1d145c4c13e5fa140caf131232a6f524c88fcd72.1576658572.git.alistair@alistair23.me
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
 Reviewed-by: Frederic Konrad <fkonrad@amd.com>
 Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
 Message-id: 20220406174303.2022038-5-edgar.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs           |   1 +
+ include/hw/arm/xlnx-versal.h |  4 +++
- include/hw/arm/stm32f405_soc.h |  73 ++++++++
+ hw/arm/xlnx-versal.c         | 54 ++++++++++++++++++++++++++++++++++--
- hw/arm/stm32f405_soc.c         | 302 +++++++++++++++++++++++++++++++++
+files changed, 56 insertions(+), 2 deletions(-)
  MAINTAINERS                    |   8 +
 files changed, 384 insertions(+)
  create mode 100644 include/hw/arm/stm32f405_soc.h
  create mode 100644 hw/arm/stm32f405_soc.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/include/hw/arm/xlnx-versal.h
-+++ b/hw/arm/Makefile.objs
++++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STRONGARM) += strongarm.o
  obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 +obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
  obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
  obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/arm/stm32f405_soc.h
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #include "hw/nvram/xlnx-versal-efuse.h"
-+ * STM32F405 SoC
+ #include "hw/ssi/xlnx-versal-ospi.h"
-+ *
+ #include "hw/dma/xlnx_csu_dma.h"
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++#include "hw/misc/xlnx-versal-crl.h"
-+ *
+ #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
-+ * in the Software without restriction, including without limitation the rights
+@@ -XXX,XX +XXX,XX @@ struct Versal {
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+             qemu_or_irq irq_orgate;
-+ * copies of the Software, and to permit persons to whom the Software is
+             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
-+ * furnished to do so, subject to the following conditions:
+         } xram;
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
-+#ifndef HW_ARM_STM32F405_SOC_H
++        XlnxVersalCRL crl;
-+#define HW_ARM_STM32F405_SOC_H
+     } lpd;
-+
-+#include "hw/misc/stm32f4xx_syscfg.h"
+     /* The Platform Management Controller subsystem.  */
-+#include "hw/timer/stm32f2xx_timer.h"
+@@ -XXX,XX +XXX,XX @@ struct Versal {
-+#include "hw/char/stm32f2xx_usart.h"
+ #define VERSAL_TIMER_NS_EL1_IRQ     14
-+#include "hw/adc/stm32f2xx_adc.h"
+ #define VERSAL_TIMER_NS_EL2_IRQ     10
-+#include "hw/misc/stm32f4xx_exti.h"
-+#include "hw/or-irq.h"
++#define VERSAL_CRL_IRQ             10
-+#include "hw/ssi/stm32f2xx_spi.h"
+ #define VERSAL_UART0_IRQ_0         18
-+#include "hw/arm/armv7m.h"
+ #define VERSAL_UART1_IRQ_0         19
-+
+ #define VERSAL_USB0_IRQ_0          22
-+#define TYPE_STM32F405_SOC "stm32f405-soc"
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-+#define STM32F405_SOC(obj) \
+index XXXXXXX..XXXXXXX 100644
-+    OBJECT_CHECK(STM32F405State, (obj), TYPE_STM32F405_SOC)
+--- a/hw/arm/xlnx-versal.c
-+
++++ b/hw/arm/xlnx-versal.c
-+#define STM_NUM_USARTS 7
+@@ -XXX,XX +XXX,XX @@ static void versal_create_ospi(Versal *s, qemu_irq *pic)
-+#define STM_NUM_TIMERS 4
+     qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
-+#define STM_NUM_ADCS 6
+ }
-+#define STM_NUM_SPIS 6
-+
++static void versal_create_crl(Versal *s, qemu_irq *pic)
 +#define FLASH_BASE_ADDRESS 0x08000000
 +#define FLASH_SIZE (1024 * 1024)
 +#define SRAM_BASE_ADDRESS 0x20000000
 +#define SRAM_SIZE (192 * 1024)
 +
 +typedef struct STM32F405State {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +    /*< public >*/
 +
 +    char *cpu_type;
 +
 +    ARMv7MState armv7m;
 +
 +    STM32F4xxSyscfgState syscfg;
 +    STM32F4xxExtiState exti;
 +    STM32F2XXUsartState usart[STM_NUM_USARTS];
 +    STM32F2XXTimerState timer[STM_NUM_TIMERS];
 +    qemu_or_irq adc_irqs;
 +    STM32F2XXADCState adc[STM_NUM_ADCS];
 +    STM32F2XXSPIState spi[STM_NUM_SPIS];
 +
 +    MemoryRegion sram;
 +    MemoryRegion flash;
 +    MemoryRegion flash_alias;
 +} STM32F405State;
 +
 +#endif
 diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32F405 SoC
 + *
 + * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qapi/error.h"
 +#include "qemu-common.h"
 +#include "exec/address-spaces.h"
 +#include "sysemu/sysemu.h"
 +#include "hw/arm/stm32f405_soc.h"
 +#include "hw/misc/unimp.h"
 +
 +#define SYSCFG_ADD                     0x40013800
 +static const uint32_t usart_addr[] = { 0x40011000, 0x40004400, 0x40004800,
 +                                       0x40004C00, 0x40005000, 0x40011400,
 +                                       0x40007800, 0x40007C00 };
 +/* At the moment only Timer 2 to 5 are modelled */
 +static const uint32_t timer_addr[] = { 0x40000000, 0x40000400,
 +                                       0x40000800, 0x40000C00 };
 +#define ADC_ADDR                       0x40012000
 +static const uint32_t spi_addr[] =   { 0x40013000, 0x40003800, 0x40003C00,
 +                                       0x40013400, 0x40015000, 0x40015400 };
 +#define EXTI_ADDR                      0x40013C00
 +
 +#define SYSCFG_IRQ               71
 +static const int usart_irq[] = { 37, 38, 39, 52, 53, 71, 82, 83 };
 +static const int timer_irq[] = { 28, 29, 30, 50 };
 +#define ADC_IRQ 18
 +static const int spi_irq[] =   { 35, 36, 51, 0, 0, 0 };
 +static const int exti_irq[] =  { 6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
 +                                 40, 40, 40, 40, 40} ;
 +
 +
 +static void stm32f405_soc_initfn(Object *obj)
 +{
-+    STM32F405State *s = STM32F405_SOC(obj);
++    SysBusDevice *sbd;
 +    int i;
 +
-+    sysbus_init_child_obj(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
++    object_initialize_child(OBJECT(s), "crl", &s->lpd.crl,
-+                          TYPE_ARMV7M);
++                            TYPE_XLNX_VERSAL_CRL);
 +    sbd = SYS_BUS_DEVICE(&s->lpd.crl);
 +
-+    sysbus_init_child_obj(obj, "syscfg", &s->syscfg, sizeof(s->syscfg),
++    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
-+                          TYPE_STM32F4XX_SYSCFG);
++        g_autofree gchar *name = g_strdup_printf("cpu_r5[%d]", i);
 +
-+    for (i = 0; i < STM_NUM_USARTS; i++) {
++        object_property_set_link(OBJECT(&s->lpd.crl),
-+        sysbus_init_child_obj(obj, "usart[*]", &s->usart[i],
++                                 name, OBJECT(&s->lpd.rpu.cpu[i]),
-+                              sizeof(s->usart[i]), TYPE_STM32F2XX_USART);
++                                 &error_abort);
 +    }
 +
-+    for (i = 0; i < STM_NUM_TIMERS; i++) {
++    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
-+        sysbus_init_child_obj(obj, "timer[*]", &s->timer[i],
++        g_autofree gchar *name = g_strdup_printf("gem[%d]", i);
-+                              sizeof(s->timer[i]), TYPE_STM32F2XX_TIMER);
++
 +        object_property_set_link(OBJECT(&s->lpd.crl),
 +                                 name, OBJECT(&s->lpd.iou.gem[i]),
 +                                 &error_abort);
 +    }
 +
-+    for (i = 0; i < STM_NUM_ADCS; i++) {
++    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
-+        sysbus_init_child_obj(obj, "adc[*]", &s->adc[i], sizeof(s->adc[i]),
++        g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
-+                              TYPE_STM32F2XX_ADC);
++
 +        object_property_set_link(OBJECT(&s->lpd.crl),
 +                                 name, OBJECT(&s->lpd.iou.adma[i]),
 +                                 &error_abort);
 +    }
 +
-+    for (i = 0; i < STM_NUM_SPIS; i++) {
++    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
-+        sysbus_init_child_obj(obj, "spi[*]", &s->spi[i], sizeof(s->spi[i]),
++        g_autofree gchar *name = g_strdup_printf("uart[%d]", i);
-+                              TYPE_STM32F2XX_SPI);
++
 +        object_property_set_link(OBJECT(&s->lpd.crl),
 +                                 name, OBJECT(&s->lpd.iou.uart[i]),
 +                                 &error_abort);
 +    }
 +
-+    sysbus_init_child_obj(obj, "exti", &s->exti, sizeof(s->exti),
++    object_property_set_link(OBJECT(&s->lpd.crl),
-+                          TYPE_STM32F4XX_EXTI);
++                             "usb", OBJECT(&s->lpd.iou.usb),
 +                             &error_abort);
 +
 +    sysbus_realize(sbd, &error_fatal);
 +    memory_region_add_subregion(&s->mr_ps, MM_CRL,
 +                                sysbus_mmio_get_region(sbd, 0));
 +    sysbus_connect_irq(sbd, 0, pic[VERSAL_CRL_IRQ]);
 +}
 +
-+static void stm32f405_soc_realize(DeviceState *dev_soc, Error **errp)
+ /* This takes the board allocated linear DDR memory and creates aliases
-+{
+  * for each split DDR range/aperture on the Versal address map.
-+    STM32F405State *s = STM32F405_SOC(dev_soc);
+  */
-+    MemoryRegion *system_memory = get_system_memory();
+@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
-+    DeviceState *dev, *armv7m;
-+    SysBusDevice *busdev;
+     versal_unimp_area(s, "psm", &s->mr_ps,
-+    Error *err = NULL;
+                         MM_PSM_START, MM_PSM_END - MM_PSM_START);
-+    int i;
+-    versal_unimp_area(s, "crl", &s->mr_ps,
-+
+-                        MM_CRL, MM_CRL_SIZE);
-+    memory_region_init_ram(&s->flash, NULL, "STM32F405.flash", FLASH_SIZE,
+     versal_unimp_area(s, "crf", &s->mr_ps,
-+                           &err);
+                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
-+    if (err != NULL) {
+     versal_unimp_area(s, "apu", &s->mr_ps,
-+        error_propagate(errp, err);
+@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
-+        return;
+     versal_create_efuse(s, pic);
-+    }
+     versal_create_pmc_iou_slcr(s, pic);
-+    memory_region_init_alias(&s->flash_alias, NULL, "STM32F405.flash.alias",
+     versal_create_ospi(s, pic);
-+                             &s->flash, 0, FLASH_SIZE);
++    versal_create_crl(s, pic);
-+
+     versal_map_ddr(s);
-+    memory_region_set_readonly(&s->flash, true);
+     versal_unimp(s);
-+    memory_region_set_readonly(&s->flash_alias, true);
 +
 +    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
 +    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
 +
 +    memory_region_init_ram(&s->sram, NULL, "STM32F405.sram", SRAM_SIZE,
 +                           &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
 +
 +    armv7m = DEVICE(&s->armv7m);
 +    qdev_prop_set_uint32(armv7m, "num-irq", 96);
 +    qdev_prop_set_string(armv7m, "cpu-type", s->cpu_type);
 +    qdev_prop_set_bit(armv7m, "enable-bitband", true);
 +    object_property_set_link(OBJECT(&s->armv7m), OBJECT(system_memory),
 +                                     "memory", &error_abort);
 +    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    /* System configuration controller */
 +    dev = DEVICE(&s->syscfg);
 +    object_property_set_bool(OBJECT(&s->syscfg), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, SYSCFG_ADD);
 +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, SYSCFG_IRQ));
 +
 +    /* Attach UART (uses USART registers) and USART controllers */
 +    for (i = 0; i < STM_NUM_USARTS; i++) {
 +        dev = DEVICE(&(s->usart[i]));
 +        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
 +        object_property_set_bool(OBJECT(&s->usart[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, usart_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
 +    }
 +
 +    /* Timer 2 to 5 */
 +    for (i = 0; i < STM_NUM_TIMERS; i++) {
 +        dev = DEVICE(&(s->timer[i]));
 +        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
 +        object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, timer_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
 +    }
 +
 +    /* ADC device, the IRQs are ORed together */
 +    object_initialize_child(OBJECT(s), "adc-orirq", &s->adc_irqs,
 +                            sizeof(s->adc_irqs), TYPE_OR_IRQ,
 +                            &err, NULL);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    object_property_set_int(OBJECT(&s->adc_irqs), STM_NUM_ADCS,
 +                            "num-lines", &err);
 +    object_property_set_bool(OBJECT(&s->adc_irqs), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->adc_irqs), 0,
 +                          qdev_get_gpio_in(armv7m, ADC_IRQ));
 +
 +    dev = DEVICE(&(s->adc[i]));
 +    object_property_set_bool(OBJECT(&s->adc[i]), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, ADC_ADDR);
 +    sysbus_connect_irq(busdev, 0,
 +                       qdev_get_gpio_in(DEVICE(&s->adc_irqs), i));
 +
 +    /* SPI devices */
 +    for (i = 0; i < STM_NUM_SPIS; i++) {
 +        dev = DEVICE(&(s->spi[i]));
 +        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +        busdev = SYS_BUS_DEVICE(dev);
 +        sysbus_mmio_map(busdev, 0, spi_addr[i]);
 +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, spi_irq[i]));
 +    }
 +
 +    /* EXTI device */
 +    dev = DEVICE(&s->exti);
 +    object_property_set_bool(OBJECT(&s->exti), true, "realized", &err);
 +    if (err != NULL) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, EXTI_ADDR);
 +    for (i = 0; i < 16; i++) {
 +        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
 +    }
 +    for (i = 0; i < 16; i++) {
 +        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
 +    }
 +
 +    create_unimplemented_device("timer[7]",    0x40001400, 0x400);
 +    create_unimplemented_device("timer[12]",   0x40001800, 0x400);
 +    create_unimplemented_device("timer[6]",    0x40001000, 0x400);
 +    create_unimplemented_device("timer[13]",   0x40001C00, 0x400);
 +    create_unimplemented_device("timer[14]",   0x40002000, 0x400);
 +    create_unimplemented_device("RTC and BKP", 0x40002800, 0x400);
 +    create_unimplemented_device("WWDG",        0x40002C00, 0x400);
 +    create_unimplemented_device("IWDG",        0x40003000, 0x400);
 +    create_unimplemented_device("I2S2ext",     0x40003000, 0x400);
 +    create_unimplemented_device("I2S3ext",     0x40004000, 0x400);
 +    create_unimplemented_device("I2C1",        0x40005400, 0x400);
 +    create_unimplemented_device("I2C2",        0x40005800, 0x400);
 +    create_unimplemented_device("I2C3",        0x40005C00, 0x400);
 +    create_unimplemented_device("CAN1",        0x40006400, 0x400);
 +    create_unimplemented_device("CAN2",        0x40006800, 0x400);
 +    create_unimplemented_device("PWR",         0x40007000, 0x400);
 +    create_unimplemented_device("DAC",         0x40007400, 0x400);
 +    create_unimplemented_device("timer[1]",    0x40010000, 0x400);
 +    create_unimplemented_device("timer[8]",    0x40010400, 0x400);
 +    create_unimplemented_device("SDIO",        0x40012C00, 0x400);
 +    create_unimplemented_device("timer[9]",    0x40014000, 0x400);
 +    create_unimplemented_device("timer[10]",   0x40014400, 0x400);
 +    create_unimplemented_device("timer[11]",   0x40014800, 0x400);
 +    create_unimplemented_device("GPIOA",       0x40020000, 0x400);
 +    create_unimplemented_device("GPIOB",       0x40020400, 0x400);
 +    create_unimplemented_device("GPIOC",       0x40020800, 0x400);
 +    create_unimplemented_device("GPIOD",       0x40020C00, 0x400);
 +    create_unimplemented_device("GPIOE",       0x40021000, 0x400);
 +    create_unimplemented_device("GPIOF",       0x40021400, 0x400);
 +    create_unimplemented_device("GPIOG",       0x40021800, 0x400);
 +    create_unimplemented_device("GPIOH",       0x40021C00, 0x400);
 +    create_unimplemented_device("GPIOI",       0x40022000, 0x400);
 +    create_unimplemented_device("CRC",         0x40023000, 0x400);
 +    create_unimplemented_device("RCC",         0x40023800, 0x400);
 +    create_unimplemented_device("Flash Int",   0x40023C00, 0x400);
 +    create_unimplemented_device("BKPSRAM",     0x40024000, 0x400);
 +    create_unimplemented_device("DMA1",        0x40026000, 0x400);
 +    create_unimplemented_device("DMA2",        0x40026400, 0x400);
 +    create_unimplemented_device("Ethernet",    0x40028000, 0x1400);
 +    create_unimplemented_device("USB OTG HS",  0x40040000, 0x30000);
 +    create_unimplemented_device("USB OTG FS",  0x50000000, 0x31000);
 +    create_unimplemented_device("DCMI",        0x50050000, 0x400);
 +    create_unimplemented_device("RNG",         0x50060800, 0x400);
 +}
 +
 +static Property stm32f405_soc_properties[] = {
 +    DEFINE_PROP_STRING("cpu-type", STM32F405State, cpu_type),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32f405_soc_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = stm32f405_soc_realize;
 +    dc->props = stm32f405_soc_properties;
 +    /* No vmstate or reset required: device has no internal state */
 +}
 +
 +static const TypeInfo stm32f405_soc_info = {
 +    .name          = TYPE_STM32F405_SOC,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(STM32F405State),
 +    .instance_init = stm32f405_soc_initfn,
 +    .class_init    = stm32f405_soc_class_init,
 +};
 +
 +static void stm32f405_soc_types(void)
 +{
 +    type_register_static(&stm32f405_soc_info);
 +}
 +
 +type_init(stm32f405_soc_types)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/adc/*
  F: hw/ssi/stm32f2xx_spi.c
  F: include/hw/*/stm32*.h
 +STM32F405
 +M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
 +S: Maintained
 +F: hw/arm/stm32f405_soc.c
 +F: hw/misc/stm32f4xx_syscfg.c
 +F: hw/misc/stm32f4xx_exti.c
 +
  Netduino 2
  M: Alistair Francis <alistair@alistair23.me>
  M: Peter Maydell <peter.maydell@linaro.org>
 --
-.20.1
+.25.1

-New patch
+[PULL 08/31] hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
+The Exynos4210 SoC device currently uses a custom device
+"exynos4210.irq_gate" to model the OR gate that feeds each CPU's IRQ
+line.  We have a standard TYPE_OR_IRQ device for this now, so use
+that instead.
+(This is a migration compatibility break, but that is OK for this
+machine type.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-2-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h |  1 +
+ hw/arm/exynos4210.c         | 31 ++++++++++++++++---------------
+files changed, 17 insertions(+), 15 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
+     MemoryRegion bootreg_mem;
+     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
+     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
++    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+ };
+ #define TYPE_EXYNOS4210_SOC "exynos4210"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+ {
+     Exynos4210State *s = EXYNOS4210_SOC(socdev);
+     MemoryRegion *system_mem = get_system_memory();
+-    qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
+     SysBusDevice *busdev;
+     DeviceState *dev, *uart[4], *pl330[3];
+     int i, n;
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     /* IRQ Gate */
+     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
+-        dev = qdev_new("exynos4210.irq_gate");
+-        qdev_prop_set_uint32(dev, "n_in", EXYNOS4210_IRQ_GATE_NINPUTS);
+-        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+-        /* Get IRQ Gate input in gate_irq */
+-        for (n = 0; n < EXYNOS4210_IRQ_GATE_NINPUTS; n++) {
+-            gate_irq[i][n] = qdev_get_gpio_in(dev, n);
+-        }
+-        busdev = SYS_BUS_DEVICE(dev);
+-
+-        /* Connect IRQ Gate output to CPU's IRQ line */
+-        sysbus_connect_irq(busdev, 0,
+-                           qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
++        DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
++        object_property_set_int(OBJECT(orgate), "num-lines",
++                                EXYNOS4210_IRQ_GATE_NINPUTS,
++                                &error_abort);
++        qdev_realize(orgate, NULL, &error_abort);
++        qdev_connect_gpio_out(orgate, 0,
++                              qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
+     }
+     /* Private memory region and Internal GIC */
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     sysbus_realize_and_unref(busdev, &error_fatal);
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
+     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
+-        sysbus_connect_irq(busdev, n, gate_irq[n][0]);
++        sysbus_connect_irq(busdev, n,
++                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
+     }
+     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
+         s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     /* Map Distributer interface */
+     sysbus_mmio_map(busdev, 1, EXYNOS4210_EXT_GIC_DIST_BASE_ADDR);
+     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
+-        sysbus_connect_irq(busdev, n, gate_irq[n][1]);
++        sysbus_connect_irq(busdev, n,
++                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
+     }
+     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
+         s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
+         object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
+         g_free(name);
+     }
++
++    for (i = 0; i < ARRAY_SIZE(s->cpu_irq_orgate); i++) {
++        g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
++        object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
++    }
+ }
+ static void exynos4210_class_init(ObjectClass *klass, void *data)
+--
+.25.1

-New patch
+[PULL 09/31] hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
+Now we have removed the only use of TYPE_EXYNOS4210_IRQ_GATE we can
+delete the device entirely.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20220404154658.565020-3-peter.maydell@linaro.org
+---
+ hw/intc/exynos4210_gic.c | 107 ---------------------------------------
+file changed, 107 deletions(-)
+diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/exynos4210_gic.c
++++ b/hw/intc/exynos4210_gic.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_register_types(void)
+ }
+ type_init(exynos4210_gic_register_types)
+-
+-/* IRQ OR Gate struct.
+- *
+- * This device models an OR gate. There are n_in input qdev gpio lines and one
+- * output sysbus IRQ line. The output IRQ level is formed as OR between all
+- * gpio inputs.
+- */
+-
+-#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
+-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210IRQGateState, EXYNOS4210_IRQ_GATE)
+-
+-struct Exynos4210IRQGateState {
+-    SysBusDevice parent_obj;
+-
+-    uint32_t n_in;      /* inputs amount */
+-    uint32_t *level;    /* input levels */
+-    qemu_irq out;       /* output IRQ */
+-};
+-
+-static Property exynos4210_irq_gate_properties[] = {
+-    DEFINE_PROP_UINT32("n_in", Exynos4210IRQGateState, n_in, 1),
+-    DEFINE_PROP_END_OF_LIST(),
+-};
+-
+-static const VMStateDescription vmstate_exynos4210_irq_gate = {
+-    .name = "exynos4210.irq_gate",
+-    .version_id = 2,
+-    .minimum_version_id = 2,
+-    .fields = (VMStateField[]) {
+-        VMSTATE_VBUFFER_UINT32(level, Exynos4210IRQGateState, 1, NULL, n_in),
+-        VMSTATE_END_OF_LIST()
+-    }
+-};
+-
+-/* Process a change in IRQ input. */
+-static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
+-{
+-    Exynos4210IRQGateState *s = (Exynos4210IRQGateState *)opaque;
+-    uint32_t i;
+-
+-    assert(irq < s->n_in);
+-
+-    s->level[irq] = level;
+-
+-    for (i = 0; i < s->n_in; i++) {
+-        if (s->level[i] >= 1) {
+-            qemu_irq_raise(s->out);
+-            return;
+-        }
+-    }
+-
+-    qemu_irq_lower(s->out);
+-}
+-
+-static void exynos4210_irq_gate_reset(DeviceState *d)
+-{
+-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
+-
+-    memset(s->level, 0, s->n_in * sizeof(*s->level));
+-}
+-
+-/*
+- * IRQ Gate initialization.
+- */
+-static void exynos4210_irq_gate_init(Object *obj)
+-{
+-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(obj);
+-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+-
+-    sysbus_init_irq(sbd, &s->out);
+-}
+-
+-static void exynos4210_irq_gate_realize(DeviceState *dev, Error **errp)
+-{
+-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
+-
+-    /* Allocate general purpose input signals and connect a handler to each of
+-     * them */
+-    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
+-
+-    s->level = g_malloc0(s->n_in * sizeof(*s->level));
+-}
+-
+-static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
+-{
+-    DeviceClass *dc = DEVICE_CLASS(klass);
+-
+-    dc->reset = exynos4210_irq_gate_reset;
+-    dc->vmsd = &vmstate_exynos4210_irq_gate;
+-    device_class_set_props(dc, exynos4210_irq_gate_properties);
+-    dc->realize = exynos4210_irq_gate_realize;
+-}
+-
+-static const TypeInfo exynos4210_irq_gate_info = {
+-    .name          = TYPE_EXYNOS4210_IRQ_GATE,
+-    .parent        = TYPE_SYS_BUS_DEVICE,
+-    .instance_size = sizeof(Exynos4210IRQGateState),
+-    .instance_init = exynos4210_irq_gate_init,
+-    .class_init    = exynos4210_irq_gate_class_init,
+-};
+-
+-static void exynos4210_irq_gate_register_types(void)
+-{
+-    type_register_static(&exynos4210_irq_gate_info);
+-}
+-
+-type_init(exynos4210_irq_gate_register_types)
+--
+.25.1

-New patch
+[PULL 10/31] hw/arm/exynos4210: Put a9mpcore device into state struct
+The exynos4210 SoC mostly creates its child devices as if it were
+board code.  This includes the a9mpcore object.  Switch that to a
+new-style "embedded in the state struct" creation, because in the
+next commit we're going to want to refer to the object again further
+down in the exynos4210_realize() function.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-4-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h |  2 ++
+ hw/arm/exynos4210.c         | 11 ++++++-----
+files changed, 8 insertions(+), 5 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/or-irq.h"
+ #include "hw/sysbus.h"
++#include "hw/cpu/a9mpcore.h"
+ #include "target/arm/cpu-qom.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
+     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
+     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
+     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
++    A9MPPrivState a9mpcore;
+ };
+ #define TYPE_EXYNOS4210_SOC "exynos4210"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     }
+     /* Private memory region and Internal GIC */
+-    dev = qdev_new(TYPE_A9MPCORE_PRIV);
+-    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
+-    busdev = SYS_BUS_DEVICE(dev);
+-    sysbus_realize_and_unref(busdev, &error_fatal);
++    qdev_prop_set_uint32(DEVICE(&s->a9mpcore), "num-cpu", EXYNOS4210_NCPUS);
++    busdev = SYS_BUS_DEVICE(&s->a9mpcore);
++    sysbus_realize(busdev, &error_fatal);
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
+     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
+         sysbus_connect_irq(busdev, n,
+                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
+     }
+     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
+-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
++        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
+     }
+     /* Cache controller */
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
+         g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
+         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
+     }
++
++    object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
+ }
+ static void exynos4210_class_init(ObjectClass *klass, void *data)
+--
+.25.1

-New patch
+[PULL 11/31] hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
+The only time we use the int_gic_irq[] array in the Exynos4210Irq
+struct is in the exynos4210_realize() function: we initialize it with
+the GPIO inputs of the a9mpcore device, and then a bit later on we
+connect those to the outputs of the internal combiner.  Now that the
+a9mpcore object is easily accessible as s->a9mpcore we can make the
+connection directly from one device to the other without going via
+this array.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-5-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h | 1 -
+ hw/arm/exynos4210.c         | 6 ++----
+files changed, 2 insertions(+), 5 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ typedef struct Exynos4210Irq {
+     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
+-    qemu_irq int_gic_irq[EXYNOS4210_INT_GIC_NIRQ];
+     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
+     qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+ } Exynos4210Irq;
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+         sysbus_connect_irq(busdev, n,
+                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
+     }
+-    for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
+-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
+-    }
+     /* Cache controller */
+     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     busdev = SYS_BUS_DEVICE(dev);
+     sysbus_realize_and_unref(busdev, &error_fatal);
+     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
+-        sysbus_connect_irq(busdev, n, s->irqs.int_gic_irq[n]);
++        sysbus_connect_irq(busdev, n,
++                           qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
+     }
+     exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
+--
+.25.1

-[PULL 12/15] target/arm: adjust program counter for wfi exception in AArch32
+[PULL 12/31] hw/arm/exynos4210: Coalesce board_irqs and irq_table
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+The exynos4210 code currently has two very similar arrays of IRQs:
-The wfi instruction can be configured to be trapped by a higher exception
+ * board_irqs is a field of the Exynos4210Irq struct which is filled
-level, such as the EL2 hypervisor. When the instruction is trapped, the
+   in by exynos4210_init_board_irqs() with the appropriate qemu_irqs
-program counter should contain the address of the wfi instruction that
+   for each IRQ the board/SoC can assert
-caused the exception. The program counter is adjusted for this in the wfi op
+ * irq_table is a set of qemu_irqs pointed to from the
-helper function.
+   Exynos4210State struct.  It's allocated in exynos4210_init_irq,
    and the only behaviour these irqs have is that they pass on the
    level to the equivalent board_irqs[] irq
-However, this correction is done to env->pc, which only applies to AArch64
+The extra indirection through irq_table is unnecessary, so coalesce
-mode. For AArch32, the program counter is stored in env->regs[15]. This
+these into a single irq_table[] array as a direct field in
-adds an if-else statement to modify the correct program counter location
+Exynos4210State which exynos4210_init_board_irqs() fills in.
 based on the the current CPU mode.
-Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220404154658.565020-6-peter.maydell@linaro.org
 ---
- target/arm/op_helper.c | 7 ++++++-
+ include/hw/arm/exynos4210.h |  8 ++------
-file changed, 6 insertions(+), 1 deletion(-)
+ hw/arm/exynos4210.c         |  6 +-----
  hw/intc/exynos4210_gic.c    | 32 ++++++++------------------------
 files changed, 11 insertions(+), 35 deletions(-)
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
+--- a/include/hw/arm/exynos4210.h
-+++ b/target/arm/op_helper.c
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
+@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
      qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
      qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
      qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
 -    qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
  } Exynos4210Irq;
  struct Exynos4210State {
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
      Exynos4210Irq irqs;
 -    qemu_irq *irq_table;
 +    qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
      MemoryRegion chipid_mem;
      MemoryRegion iram_mem;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -/* Initialize exynos4210 IRQ subsystem stub */
 -qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 -
  /* Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
 -void exynos4210_init_board_irqs(Exynos4210Irq *s);
 +void exynos4210_init_board_irqs(Exynos4210State *s);
  /* Get IRQ number from exynos4210 IRQ subsystem stub.
   * To identify IRQ source use internal combiner group and bit number
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
          qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);
      }
-     if (target_el) {
+-    /*** IRQs ***/
--        env->pc -= insn_len;
+-
-+        if (env->aarch64) {
+-    s->irq_table = exynos4210_init_irq(&s->irqs);
-+            env->pc -= insn_len;
+-
-+        } else {
+     /* IRQ Gate */
-+            env->regs[15] -= insn_len;
+     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
-+        }
+         DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
-+
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
-                         target_el);
      /* Initialize board IRQs. */
 -    exynos4210_init_board_irqs(&s->irqs);
 +    exynos4210_init_board_irqs(s);
      /*** Memory ***/
 diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_gic.c
 +++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -static void exynos4210_irq_handler(void *opaque, int irq, int level)
 -{
 -    Exynos4210Irq *s = (Exynos4210Irq *)opaque;
 -
 -    /* Bypass */
 -    qemu_set_irq(s->board_irqs[irq], level);
 -}
 -
 -/*
 - * Initialize exynos4210 IRQ subsystem stub.
 - */
 -qemu_irq *exynos4210_init_irq(Exynos4210Irq *s)
 -{
 -    return qemu_allocate_irqs(exynos4210_irq_handler, s,
 -            EXYNOS4210_MAX_INT_COMBINER_IN_IRQ);
 -}
 -
  /*
   * Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
   */
 -void exynos4210_init_board_irqs(Exynos4210Irq *s)
 +void exynos4210_init_board_irqs(Exynos4210State *s)
  {
      uint32_t grp, bit, irq_id, n;
 +    Exynos4210Irq *is = &s->irqs;
      for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
          irq_id = 0;
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
              irq_id = EXT_GIC_ID_MCT_G1;
          }
          if (irq_id) {
 -            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
 -                    s->ext_gic_irq[irq_id-32]);
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
          } else {
 -            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
 -                    s->ext_combiner_irq[n]);
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_combiner_irq[n]);
          }
      }
+     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
+                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
+         if (irq_id) {
+-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
+-                    s->ext_gic_irq[irq_id-32]);
++            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
++                    is->ext_gic_irq[irq_id - 32]);
+         }
+     }
+ }
 --
-.20.1
+.25.1

-New patch
+[PULL 13/31] hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
+Fix a missing set of spaces around '-' in the definition of
+combiner_grp_to_gic_id[]. We're about to move this code, so
+fix the style issue first to keep checkpatch happy with the
+code-motion patch.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-7-peter.maydell@linaro.org
+---
+ hw/intc/exynos4210_gic.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/exynos4210_gic.c
++++ b/hw/intc/exynos4210_gic.c
+@@ -XXX,XX +XXX,XX @@ enum ExtInt {
+  */
+ static const uint32_t
+-combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
++combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+     /* int combiner groups 16-19 */
+     { }, { }, { }, { },
+     /* int combiner group 20 */
+--
+.25.1

-[PULL 08/15] hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
+[PULL 14/31] hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The function exynos4210_init_board_irqs() currently lives in
 exynos4210_gic.c, but it isn't really part of the exynos4210.gic
 device -- it is a function that implements (some of) the wiring up of
 interrupts between the SoC's GIC and combiner components.  This means
 it fits better in exynos4210.c, which is the SoC-level code.  Move it
 there. Similarly, exynos4210_git_irq() is used almost only in the
 SoC-level code, so move it too.
-By calling qdev_pass_gpios() we don't need to hold a copy of the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-IRQs from the INTC into the SoC state.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Instead of filling an array of qemu_irq and passing it around, we
+Message-id: 20220404154658.565020-8-peter.maydell@linaro.org
-can now directly call qdev_get_gpio_in() on the SoC.
+---
  include/hw/arm/exynos4210.h |   4 -
  hw/arm/exynos4210.c         | 202 +++++++++++++++++++++++++++++++++++
  hw/intc/exynos4210_gic.c    | 204 ------------------------------------
 files changed, 202 insertions(+), 208 deletions(-)
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 Message-id: 20191230110953.25496-5-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/allwinner-a10.h |  1 -
  hw/arm/allwinner-a10.c         | 24 +++++++++++-------------
 files changed, 11 insertions(+), 14 deletions(-)
 diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
+--- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
-     /*< public >*/
+ void exynos4210_write_secondary(ARMCPU *cpu,
+         const struct arm_boot_info *info);
-     ARMCPU cpu;
--    qemu_irq irq[AW_A10_PIC_INT_NR];
+-/* Initialize board IRQs.
-     AwA10PITState timer;
+- * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
-     AwA10PICState intc;
+-void exynos4210_init_board_irqs(Exynos4210State *s);
-     AwEmacState emac;
+-
-diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
+ /* Get IRQ number from exynos4210 IRQ subsystem stub.
   * To identify IRQ source use internal combiner group and bit number
   *  grp - group number
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-a10.c
+--- a/hw/arm/exynos4210.c
-+++ b/hw/arm/allwinner-a10.c
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
- {
+ #define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
-     AwA10State *s = AW_A10(dev);
+ #define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
-     SysBusDevice *sysbusdev;
--    uint8_t i;
++enum ExtGicId {
-     qemu_irq fiq, irq;
++    EXT_GIC_ID_MDMA_LCD0 = 66,
-     Error *err = NULL;
++    EXT_GIC_ID_PDMA0,
++    EXT_GIC_ID_PDMA1,
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
++    EXT_GIC_ID_TIMER0,
-     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
++    EXT_GIC_ID_TIMER1,
-     sysbus_connect_irq(sysbusdev, 0, irq);
++    EXT_GIC_ID_TIMER2,
-     sysbus_connect_irq(sysbusdev, 1, fiq);
++    EXT_GIC_ID_TIMER3,
--    for (i = 0; i < AW_A10_PIC_INT_NR; i++) {
++    EXT_GIC_ID_TIMER4,
--        s->irq[i] = qdev_get_gpio_in(DEVICE(&s->intc), i);
++    EXT_GIC_ID_MCT_L0,
 +    EXT_GIC_ID_WDT,
 +    EXT_GIC_ID_RTC_ALARM,
 +    EXT_GIC_ID_RTC_TIC,
 +    EXT_GIC_ID_GPIO_XB,
 +    EXT_GIC_ID_GPIO_XA,
 +    EXT_GIC_ID_MCT_L1,
 +    EXT_GIC_ID_IEM_APC,
 +    EXT_GIC_ID_IEM_IEC,
 +    EXT_GIC_ID_NFC,
 +    EXT_GIC_ID_UART0,
 +    EXT_GIC_ID_UART1,
 +    EXT_GIC_ID_UART2,
 +    EXT_GIC_ID_UART3,
 +    EXT_GIC_ID_UART4,
 +    EXT_GIC_ID_MCT_G0,
 +    EXT_GIC_ID_I2C0,
 +    EXT_GIC_ID_I2C1,
 +    EXT_GIC_ID_I2C2,
 +    EXT_GIC_ID_I2C3,
 +    EXT_GIC_ID_I2C4,
 +    EXT_GIC_ID_I2C5,
 +    EXT_GIC_ID_I2C6,
 +    EXT_GIC_ID_I2C7,
 +    EXT_GIC_ID_SPI0,
 +    EXT_GIC_ID_SPI1,
 +    EXT_GIC_ID_SPI2,
 +    EXT_GIC_ID_MCT_G1,
 +    EXT_GIC_ID_USB_HOST,
 +    EXT_GIC_ID_USB_DEVICE,
 +    EXT_GIC_ID_MODEMIF,
 +    EXT_GIC_ID_HSMMC0,
 +    EXT_GIC_ID_HSMMC1,
 +    EXT_GIC_ID_HSMMC2,
 +    EXT_GIC_ID_HSMMC3,
 +    EXT_GIC_ID_SDMMC,
 +    EXT_GIC_ID_MIPI_CSI_4LANE,
 +    EXT_GIC_ID_MIPI_DSI_4LANE,
 +    EXT_GIC_ID_MIPI_CSI_2LANE,
 +    EXT_GIC_ID_MIPI_DSI_2LANE,
 +    EXT_GIC_ID_ONENAND_AUDI,
 +    EXT_GIC_ID_ROTATOR,
 +    EXT_GIC_ID_FIMC0,
 +    EXT_GIC_ID_FIMC1,
 +    EXT_GIC_ID_FIMC2,
 +    EXT_GIC_ID_FIMC3,
 +    EXT_GIC_ID_JPEG,
 +    EXT_GIC_ID_2D,
 +    EXT_GIC_ID_PCIe,
 +    EXT_GIC_ID_MIXER,
 +    EXT_GIC_ID_HDMI,
 +    EXT_GIC_ID_HDMI_I2C,
 +    EXT_GIC_ID_MFC,
 +    EXT_GIC_ID_TVENC,
 +};
 +
 +enum ExtInt {
 +    EXT_GIC_ID_EXTINT0 = 48,
 +    EXT_GIC_ID_EXTINT1,
 +    EXT_GIC_ID_EXTINT2,
 +    EXT_GIC_ID_EXTINT3,
 +    EXT_GIC_ID_EXTINT4,
 +    EXT_GIC_ID_EXTINT5,
 +    EXT_GIC_ID_EXTINT6,
 +    EXT_GIC_ID_EXTINT7,
 +    EXT_GIC_ID_EXTINT8,
 +    EXT_GIC_ID_EXTINT9,
 +    EXT_GIC_ID_EXTINT10,
 +    EXT_GIC_ID_EXTINT11,
 +    EXT_GIC_ID_EXTINT12,
 +    EXT_GIC_ID_EXTINT13,
 +    EXT_GIC_ID_EXTINT14,
 +    EXT_GIC_ID_EXTINT15
 +};
 +
 +/*
 + * External GIC sources which are not from External Interrupt Combiner or
 + * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
 + * which is INTG16 in Internal Interrupt Combiner.
 + */
 +
 +static const uint32_t
 +combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 +    /* int combiner groups 16-19 */
 +    { }, { }, { }, { },
 +    /* int combiner group 20 */
 +    { 0, EXT_GIC_ID_MDMA_LCD0 },
 +    /* int combiner group 21 */
 +    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
 +    /* int combiner group 22 */
 +    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
 +            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
 +    /* int combiner group 23 */
 +    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
 +    /* int combiner group 24 */
 +    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
 +    /* int combiner group 25 */
 +    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
 +    /* int combiner group 26 */
 +    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
 +            EXT_GIC_ID_UART4 },
 +    /* int combiner group 27 */
 +    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
 +            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
 +            EXT_GIC_ID_I2C7 },
 +    /* int combiner group 28 */
 +    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
 +    /* int combiner group 29 */
 +    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
 +     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
 +    /* int combiner group 30 */
 +    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
 +    /* int combiner group 31 */
 +    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
 +    /* int combiner group 32 */
 +    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
 +    /* int combiner group 33 */
 +    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
 +    /* int combiner group 34 */
 +    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
 +    /* int combiner group 35 */
 +    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* int combiner group 36 */
 +    { EXT_GIC_ID_MIXER },
 +    /* int combiner group 37 */
 +    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
 +     EXT_GIC_ID_EXTINT7 },
 +    /* groups 38-50 */
 +    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
 +    /* int combiner group 51 */
 +    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* group 52 */
 +    { },
 +    /* int combiner group 53 */
 +    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* groups 54-63 */
 +    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 +};
 +
 +/*
 + * Initialize board IRQs.
 + * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
 + */
 +static void exynos4210_init_board_irqs(Exynos4210State *s)
 +{
 +    uint32_t grp, bit, irq_id, n;
 +    Exynos4210Irq *is = &s->irqs;
 +
 +    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
 +        irq_id = 0;
 +        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
 +                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
 +            /* MCT_G0 is passed to External GIC */
 +            irq_id = EXT_GIC_ID_MCT_G0;
 +        }
 +        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
 +                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
 +            /* MCT_G1 is passed to External and GIC */
 +            irq_id = EXT_GIC_ID_MCT_G1;
 +        }
 +        if (irq_id) {
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
 +        } else {
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_combiner_irq[n]);
 +        }
 +    }
 +    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
 +        /* these IDs are passed to Internal Combiner and External GIC */
 +        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
 +        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 +        irq_id = combiner_grp_to_gic_id[grp -
 +                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 +
 +        if (irq_id) {
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
 +        }
 +    }
 +}
 +
 +/*
 + * Get IRQ number from exynos4210 IRQ subsystem stub.
 + * To identify IRQ source use internal combiner group and bit number
 + *  grp - group number
 + *  bit - bit number inside group
 + */
 +uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
 +{
 +    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 +}
 +
  static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
 diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_gic.c
 +++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/exynos4210.h"
  #include "qom/object.h"
 -enum ExtGicId {
 -    EXT_GIC_ID_MDMA_LCD0 = 66,
 -    EXT_GIC_ID_PDMA0,
 -    EXT_GIC_ID_PDMA1,
 -    EXT_GIC_ID_TIMER0,
 -    EXT_GIC_ID_TIMER1,
 -    EXT_GIC_ID_TIMER2,
 -    EXT_GIC_ID_TIMER3,
 -    EXT_GIC_ID_TIMER4,
 -    EXT_GIC_ID_MCT_L0,
 -    EXT_GIC_ID_WDT,
 -    EXT_GIC_ID_RTC_ALARM,
 -    EXT_GIC_ID_RTC_TIC,
 -    EXT_GIC_ID_GPIO_XB,
 -    EXT_GIC_ID_GPIO_XA,
 -    EXT_GIC_ID_MCT_L1,
 -    EXT_GIC_ID_IEM_APC,
 -    EXT_GIC_ID_IEM_IEC,
 -    EXT_GIC_ID_NFC,
 -    EXT_GIC_ID_UART0,
 -    EXT_GIC_ID_UART1,
 -    EXT_GIC_ID_UART2,
 -    EXT_GIC_ID_UART3,
 -    EXT_GIC_ID_UART4,
 -    EXT_GIC_ID_MCT_G0,
 -    EXT_GIC_ID_I2C0,
 -    EXT_GIC_ID_I2C1,
 -    EXT_GIC_ID_I2C2,
 -    EXT_GIC_ID_I2C3,
 -    EXT_GIC_ID_I2C4,
 -    EXT_GIC_ID_I2C5,
 -    EXT_GIC_ID_I2C6,
 -    EXT_GIC_ID_I2C7,
 -    EXT_GIC_ID_SPI0,
 -    EXT_GIC_ID_SPI1,
 -    EXT_GIC_ID_SPI2,
 -    EXT_GIC_ID_MCT_G1,
 -    EXT_GIC_ID_USB_HOST,
 -    EXT_GIC_ID_USB_DEVICE,
 -    EXT_GIC_ID_MODEMIF,
 -    EXT_GIC_ID_HSMMC0,
 -    EXT_GIC_ID_HSMMC1,
 -    EXT_GIC_ID_HSMMC2,
 -    EXT_GIC_ID_HSMMC3,
 -    EXT_GIC_ID_SDMMC,
 -    EXT_GIC_ID_MIPI_CSI_4LANE,
 -    EXT_GIC_ID_MIPI_DSI_4LANE,
 -    EXT_GIC_ID_MIPI_CSI_2LANE,
 -    EXT_GIC_ID_MIPI_DSI_2LANE,
 -    EXT_GIC_ID_ONENAND_AUDI,
 -    EXT_GIC_ID_ROTATOR,
 -    EXT_GIC_ID_FIMC0,
 -    EXT_GIC_ID_FIMC1,
 -    EXT_GIC_ID_FIMC2,
 -    EXT_GIC_ID_FIMC3,
 -    EXT_GIC_ID_JPEG,
 -    EXT_GIC_ID_2D,
 -    EXT_GIC_ID_PCIe,
 -    EXT_GIC_ID_MIXER,
 -    EXT_GIC_ID_HDMI,
 -    EXT_GIC_ID_HDMI_I2C,
 -    EXT_GIC_ID_MFC,
 -    EXT_GIC_ID_TVENC,
 -};
 -
 -enum ExtInt {
 -    EXT_GIC_ID_EXTINT0 = 48,
 -    EXT_GIC_ID_EXTINT1,
 -    EXT_GIC_ID_EXTINT2,
 -    EXT_GIC_ID_EXTINT3,
 -    EXT_GIC_ID_EXTINT4,
 -    EXT_GIC_ID_EXTINT5,
 -    EXT_GIC_ID_EXTINT6,
 -    EXT_GIC_ID_EXTINT7,
 -    EXT_GIC_ID_EXTINT8,
 -    EXT_GIC_ID_EXTINT9,
 -    EXT_GIC_ID_EXTINT10,
 -    EXT_GIC_ID_EXTINT11,
 -    EXT_GIC_ID_EXTINT12,
 -    EXT_GIC_ID_EXTINT13,
 -    EXT_GIC_ID_EXTINT14,
 -    EXT_GIC_ID_EXTINT15
 -};
 -
 -/*
 - * External GIC sources which are not from External Interrupt Combiner or
 - * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
 - * which is INTG16 in Internal Interrupt Combiner.
 - */
 -
 -static const uint32_t
 -combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 -    /* int combiner groups 16-19 */
 -    { }, { }, { }, { },
 -    /* int combiner group 20 */
 -    { 0, EXT_GIC_ID_MDMA_LCD0 },
 -    /* int combiner group 21 */
 -    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
 -    /* int combiner group 22 */
 -    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
 -            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
 -    /* int combiner group 23 */
 -    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
 -    /* int combiner group 24 */
 -    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
 -    /* int combiner group 25 */
 -    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
 -    /* int combiner group 26 */
 -    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
 -            EXT_GIC_ID_UART4 },
 -    /* int combiner group 27 */
 -    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
 -            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
 -            EXT_GIC_ID_I2C7 },
 -    /* int combiner group 28 */
 -    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
 -    /* int combiner group 29 */
 -    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
 -     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
 -    /* int combiner group 30 */
 -    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
 -    /* int combiner group 31 */
 -    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
 -    /* int combiner group 32 */
 -    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
 -    /* int combiner group 33 */
 -    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
 -    /* int combiner group 34 */
 -    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
 -    /* int combiner group 35 */
 -    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* int combiner group 36 */
 -    { EXT_GIC_ID_MIXER },
 -    /* int combiner group 37 */
 -    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
 -     EXT_GIC_ID_EXTINT7 },
 -    /* groups 38-50 */
 -    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
 -    /* int combiner group 51 */
 -    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* group 52 */
 -    { },
 -    /* int combiner group 53 */
 -    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* groups 54-63 */
 -    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 -};
 -
  #define EXYNOS4210_GIC_NIRQ 160
  #define EXYNOS4210_EXT_GIC_CPU_REGION_SIZE     0x10000
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -/*
 - * Initialize board IRQs.
 - * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
 - */
 -void exynos4210_init_board_irqs(Exynos4210State *s)
 -{
 -    uint32_t grp, bit, irq_id, n;
 -    Exynos4210Irq *is = &s->irqs;
 -
 -    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
 -        irq_id = 0;
 -        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
 -                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
 -            /* MCT_G0 is passed to External GIC */
 -            irq_id = EXT_GIC_ID_MCT_G0;
 -        }
 -        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
 -                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
 -            /* MCT_G1 is passed to External and GIC */
 -            irq_id = EXT_GIC_ID_MCT_G1;
 -        }
 -        if (irq_id) {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_gic_irq[irq_id - 32]);
 -        } else {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_combiner_irq[n]);
 -        }
 -    }
-+    qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
+-    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+-        /* these IDs are passed to Internal Combiner and External GIC */
-     object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
+-        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
-     if (err != NULL) {
+-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+-        irq_id = combiner_grp_to_gic_id[grp -
-     }
+-                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
-     sysbusdev = SYS_BUS_DEVICE(&s->timer);
+-
-     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIT_REG_BASE);
+-        if (irq_id) {
--    sysbus_connect_irq(sysbusdev, 0, s->irq[22]);
+-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
--    sysbus_connect_irq(sysbusdev, 1, s->irq[23]);
+-                    is->ext_gic_irq[irq_id - 32]);
--    sysbus_connect_irq(sysbusdev, 2, s->irq[24]);
+-        }
--    sysbus_connect_irq(sysbusdev, 3, s->irq[25]);
+-    }
--    sysbus_connect_irq(sysbusdev, 4, s->irq[67]);
+-}
--    sysbus_connect_irq(sysbusdev, 5, s->irq[68]);
+-
-+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 22));
+-/*
-+    sysbus_connect_irq(sysbusdev, 1, qdev_get_gpio_in(dev, 23));
+- * Get IRQ number from exynos4210 IRQ subsystem stub.
-+    sysbus_connect_irq(sysbusdev, 2, qdev_get_gpio_in(dev, 24));
+- * To identify IRQ source use internal combiner group and bit number
-+    sysbus_connect_irq(sysbusdev, 3, qdev_get_gpio_in(dev, 25));
+- *  grp - group number
-+    sysbus_connect_irq(sysbusdev, 4, qdev_get_gpio_in(dev, 67));
+- *  bit - bit number inside group
-+    sysbus_connect_irq(sysbusdev, 5, qdev_get_gpio_in(dev, 68));
+- */
+-uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
-     memory_region_init_ram(&s->sram_a, OBJECT(dev), "sram A", 48 * KiB,
+-{
-                            &error_fatal);
+-    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+-}
-     }
+-
-     sysbusdev = SYS_BUS_DEVICE(&s->emac);
+-/********* GIC part *********/
-     sysbus_mmio_map(sysbusdev, 0, AW_A10_EMAC_BASE);
+-
--    sysbus_connect_irq(sysbusdev, 0, s->irq[55]);
+ #define TYPE_EXYNOS4210_GIC "exynos4210.gic"
-+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 55));
+ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
      object_property_set_bool(OBJECT(&s->sata), true, "realized", &err);
      if (err) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sata), 0, AW_A10_SATA_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, s->irq[56]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, qdev_get_gpio_in(dev, 56));
      /* FIXME use a qdev chardev prop instead of serial_hd() */
 -    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2, s->irq[1],
 +    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2,
 +                   qdev_get_gpio_in(dev, 1),
 , serial_hd(0), DEVICE_NATIVE_ENDIAN);
  }
 --
-.20.1
+.25.1

-[PULL 04/15] hw/arm: Add the Netduino Plus 2
+[PULL 15/31] hw/arm/exynos4210: Put external GIC into state struct
-From: Alistair Francis <alistair@alistair23.me>
+Switch the creation of the external GIC to the new-style "embedded in
 state struct" approach, so we can easily refer to the object
 elsewhere during realize.
-Signed-off-by: Alistair Francis <alistair@alistair23.me>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: dad8d8d47f7625913e35e27a1c00f603a6b08f9a.1576658572.git.alistair@alistair23.me
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-9-peter.maydell@linaro.org
 ---
- hw/arm/Makefile.objs   |  1 +
+ include/hw/arm/exynos4210.h      |  2 ++
- hw/arm/netduinoplus2.c | 52 ++++++++++++++++++++++++++++++++++++++++++
+ include/hw/intc/exynos4210_gic.h | 43 ++++++++++++++++++++++++++++++++
- MAINTAINERS            |  6 +++++
+ hw/arm/exynos4210.c              | 10 ++++----
-files changed, 59 insertions(+)
+ hw/intc/exynos4210_gic.c         | 17 ++-----------
- create mode 100644 hw/arm/netduinoplus2.c
+ MAINTAINERS                      |  2 +-
 files changed, 53 insertions(+), 21 deletions(-)
  create mode 100644 include/hw/intc/exynos4210_gic.h
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/include/hw/arm/exynos4210.h
-+++ b/hw/arm/Makefile.objs
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MAINSTONE) += mainstone.o
+@@ -XXX,XX +XXX,XX @@
- obj-$(CONFIG_MICROBIT) += microbit.o
+ #include "hw/or-irq.h"
- obj-$(CONFIG_MUSICPAL) += musicpal.o
+ #include "hw/sysbus.h"
- obj-$(CONFIG_NETDUINO2) += netduino2.o
+ #include "hw/cpu/a9mpcore.h"
-+obj-$(CONFIG_NETDUINOPLUS2) += netduinoplus2.o
++#include "hw/intc/exynos4210_gic.h"
- obj-$(CONFIG_NSERIES) += nseries.o
+ #include "target/arm/cpu-qom.h"
- obj-$(CONFIG_SX1) += omap_sx1.o
+ #include "qom/object.h"
- obj-$(CONFIG_CHEETAH) += palm.o
-diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
+@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
      qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
      A9MPPrivState a9mpcore;
 +    Exynos4210GicState ext_gic;
  };
  #define TYPE_EXYNOS4210_SOC "exynos4210"
 diff --git a/include/hw/intc/exynos4210_gic.h b/include/hw/intc/exynos4210_gic.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/netduinoplus2.c
++++ b/include/hw/intc/exynos4210_gic.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Netduino Plus 2 Machine Model
++ * Samsung exynos4210 GIC implementation. Based on hw/arm_gic.c
 + *
-+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
++ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
 + * All rights reserved.
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * Evgeny Voevodin <e.voevodin@samsung.com>
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
-+ * The above copyright notice and this permission notice shall be included in
++ * This program is free software; you can redistribute it and/or modify it
-+ * all copies or substantial portions of the Software.
++ * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or (at your
 + * option) any later version.
 + *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * This program is distributed in the hope that it will be useful,
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * See the GNU General Public License for more details.
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ *
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * You should have received a copy of the GNU General Public License along
-+ * THE SOFTWARE.
++ * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
++#ifndef HW_INTC_EXYNOS4210_GIC_H
++#define HW_INTC_EXYNOS4210_GIC_H
 +
-+#include "qemu/osdep.h"
++#include "hw/sysbus.h"
 +#include "qapi/error.h"
 +#include "hw/boards.h"
 +#include "hw/qdev-properties.h"
 +#include "qemu/error-report.h"
 +#include "hw/arm/stm32f405_soc.h"
 +#include "hw/arm/boot.h"
 +
-+static void netduinoplus2_init(MachineState *machine)
++#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
-+{
++OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 +    DeviceState *dev;
 +
-+    dev = qdev_create(NULL, TYPE_STM32F405_SOC);
++#define EXYNOS4210_GIC_NCPUS 2
 +    qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
 +    object_property_set_bool(OBJECT(dev), true, "realized", &error_fatal);
 +
-+    armv7m_load_kernel(ARM_CPU(first_cpu),
++struct Exynos4210GicState {
-+                       machine->kernel_filename,
++    SysBusDevice parent_obj;
 +                       FLASH_SIZE);
 +}
 +
-+static void netduinoplus2_machine_init(MachineClass *mc)
++    MemoryRegion cpu_container;
-+{
++    MemoryRegion dist_container;
-+    mc->desc = "Netduino Plus 2 Machine";
++    MemoryRegion cpu_alias[EXYNOS4210_GIC_NCPUS];
-+    mc->init = netduinoplus2_init;
++    MemoryRegion dist_alias[EXYNOS4210_GIC_NCPUS];
-+}
++    uint32_t num_cpu;
 +    DeviceState *gic;
 +};
 +
-+DEFINE_MACHINE("netduinoplus2", netduinoplus2_machine_init)
++#endif
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
      /* External GIC */
 -    dev = qdev_new("exynos4210.gic");
 -    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
 -    busdev = SYS_BUS_DEVICE(dev);
 -    sysbus_realize_and_unref(busdev, &error_fatal);
 +    qdev_prop_set_uint32(DEVICE(&s->ext_gic), "num-cpu", EXYNOS4210_NCPUS);
 +    busdev = SYS_BUS_DEVICE(&s->ext_gic);
 +    sysbus_realize(busdev, &error_fatal);
      /* Map CPU interface */
      sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_GIC_CPU_BASE_ADDR);
      /* Map Distributer interface */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
                             qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
      }
      for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
 -        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
 +        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
      }
      /* Internal Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
      }
      object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
 +    object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
  }
  static void exynos4210_class_init(ObjectClass *klass, void *data)
 diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_gic.c
 +++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
 +#include "hw/intc/exynos4210_gic.h"
  #include "hw/arm/exynos4210.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
 -OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 -
 -struct Exynos4210GicState {
 -    SysBusDevice parent_obj;
 -
 -    MemoryRegion cpu_container;
 -    MemoryRegion dist_container;
 -    MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
 -    MemoryRegion dist_alias[EXYNOS4210_NCPUS];
 -    uint32_t num_cpu;
 -    DeviceState *gic;
 -};
 -
  static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
  {
      Exynos4210GicState *s = (Exynos4210GicState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_realize(DeviceState *dev, Error **errp)
       * enough room for the cpu numbers.  gcc 9.2.1 on 32-bit x86
       * doesn't figure this out, otherwise and gives spurious warnings.
       */
 -    assert(n <= EXYNOS4210_NCPUS);
 +    assert(n <= EXYNOS4210_GIC_NCPUS);
      for (i = 0; i < n; i++) {
          /* Map CPU interface per SMP Core */
          sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
 @@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
- S: Maintained
+ L: qemu-arm@nongnu.org
- F: hw/arm/netduino2.c
+ S: Odd Fixes
+ F: hw/*/exynos*
-+Netduino Plus 2
+-F: include/hw/arm/exynos4210.h
-+M: Alistair Francis <alistair@alistair23.me>
++F: include/hw/*/exynos*
-+M: Peter Maydell <peter.maydell@linaro.org>
-+S: Maintained
+ Calxeda Highbank
-+F: hw/arm/netduinoplus2.c
+ M: Rob Herring <robh@kernel.org>
 +
  SmartFusion2
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
  M: Peter Maydell <peter.maydell@linaro.org>
 --
-.20.1
+.25.1

-New patch
+[PULL 16/31] hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
+The only time we use the ext_gic_irq[] array in the Exynos4210Irq
+struct is during realize of the SoC -- we initialize it with the
+input IRQs of the external GIC device, and then connect those to
+outputs of other devices further on in realize (including in the
+exynos4210_init_board_irqs() function).  Now that the ext_gic object
+is easily accessible as s->ext_gic we can make the connections
+directly from one device to the other without going via this array.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-10-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h |  1 -
+ hw/arm/exynos4210.c         | 12 ++++++------
+files changed, 6 insertions(+), 7 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ typedef struct Exynos4210Irq {
+     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
+-    qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
+ } Exynos4210Irq;
+ struct Exynos4210State {
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+ {
+     uint32_t grp, bit, irq_id, n;
+     Exynos4210Irq *is = &s->irqs;
++    DeviceState *extgicdev = DEVICE(&s->ext_gic);
+     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
+         irq_id = 0;
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+         }
+         if (irq_id) {
+             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+-                    is->ext_gic_irq[irq_id - 32]);
++                                             qdev_get_gpio_in(extgicdev,
++                                                              irq_id - 32));
+         } else {
+             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                     is->ext_combiner_irq[n]);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+         if (irq_id) {
+             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+-                    is->ext_gic_irq[irq_id - 32]);
++                                             qdev_get_gpio_in(extgicdev,
++                                                              irq_id - 32));
+         }
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+         sysbus_connect_irq(busdev, n,
+                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
+     }
+-    for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
+-        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
+-    }
+     /* Internal Interrupt Combiner */
+     dev = qdev_new("exynos4210.combiner");
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+     busdev = SYS_BUS_DEVICE(dev);
+     sysbus_realize_and_unref(busdev, &error_fatal);
+     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
+-        sysbus_connect_irq(busdev, n, s->irqs.ext_gic_irq[n]);
++        sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
+     }
+     exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
+--
+.25.1

-New patch
+[PULL 17/31] hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
+The function exynos4210_combiner_get_gpioin() currently lives in
+exynos4210_combiner.c, but it isn't really part of the combiner
+device itself -- it is a function that implements the wiring up of
+some interrupt sources to multiple combiner inputs.  Move it to live
+with the other SoC-level code in exynos4210.c, along with a few
+macros previously defined in exynos4210.h which are now used only
+in exynos4210.c.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-11-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h   | 11 -----
+ hw/arm/exynos4210.c           | 82 +++++++++++++++++++++++++++++++++++
+ hw/intc/exynos4210_combiner.c | 77 --------------------------------
+files changed, 82 insertions(+), 88 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
+     (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
+-#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp)*8 + (bit))
+-#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
+-#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
+-    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
+-
+ /* IRQs number for external and internal GIC */
+ #define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
+ #define EXYNOS4210_INT_GIC_NIRQ     64
+@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
+  *  bit - bit number inside group */
+ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit);
+-/*
+- * Get Combiner input GPIO into irqs structure
+- */
+-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
+-        int ext);
+-
+ /*
+  * exynos4210 UART
+  */
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
+ };
++#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp) * 8 + (bit))
++#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
++#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
++    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
++
+ /*
+  * Initialize board IRQs.
+  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
+@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
+     return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
+ }
++/*
++ * Get Combiner input GPIO into irqs structure
++ */
++static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
++                                           DeviceState *dev, int ext)
++{
++    int n;
++    int bit;
++    int max;
++    qemu_irq *irq;
++
++    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
++        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
++    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
++
++    /*
++     * Some IRQs of Int/External Combiner are going to two Combiners groups,
++     * so let split them.
++     */
++    for (n = 0; n < max; n++) {
++
++        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
++
++        switch (n) {
++        /* MDNIE_LCD1 INTG1 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
++            continue;
++
++        /* TMU INTG3 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
++            continue;
++
++        /* LCD1 INTG12 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
++            continue;
++
++        /* Multi-Core Timer INTG12 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
++               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
++            continue;
++
++        /* Multi-Core Timer INTG35 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
++            continue;
++
++        /* Multi-Core Timer INTG51 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
++            continue;
++
++        /* Multi-Core Timer INTG53 */
++        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
++             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
++            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
++            continue;
++        }
++
++        irq[n] = qdev_get_gpio_in(dev, n);
++    }
++}
++
+ static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
+x09, 0x00, 0x00, 0x00 };
+diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/exynos4210_combiner.c
++++ b/hw/intc/exynos4210_combiner.c
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_combiner = {
+     }
+ };
+-/*
+- * Get Combiner input GPIO into irqs structure
+- */
+-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
+-        int ext)
+-{
+-    int n;
+-    int bit;
+-    int max;
+-    qemu_irq *irq;
+-
+-    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
+-        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
+-    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
+-
+-    /*
+-     * Some IRQs of Int/External Combiner are going to two Combiners groups,
+-     * so let split them.
+-     */
+-    for (n = 0; n < max; n++) {
+-
+-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
+-
+-        switch (n) {
+-        /* MDNIE_LCD1 INTG1 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
+-            continue;
+-
+-        /* TMU INTG3 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
+-            continue;
+-
+-        /* LCD1 INTG12 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
+-            continue;
+-
+-        /* Multi-Core Timer INTG12 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
+-               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+-            continue;
+-
+-        /* Multi-Core Timer INTG35 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+-            continue;
+-
+-        /* Multi-Core Timer INTG51 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+-            continue;
+-
+-        /* Multi-Core Timer INTG53 */
+-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
+-             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
+-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+-            continue;
+-        }
+-
+-        irq[n] = qdev_get_gpio_in(dev, n);
+-    }
+-}
+-
+ static uint64_t
+ exynos4210_combiner_read(void *opaque, hwaddr offset, unsigned size)
+ {
+--
+.25.1

-New patch
+[PULL 18/31] hw/arm/exynos4210: Delete unused macro definitions
+Delete a couple of #defines which are never used.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-12-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h | 4 ----
+file changed, 4 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
+     (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
+-/* IRQs number for external and internal GIC */
+-#define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
+-#define EXYNOS4210_INT_GIC_NIRQ     64
+-
+ #define EXYNOS4210_I2C_NUMBER               9
+ #define EXYNOS4210_NUM_DMA      3
+--
+.25.1

-New patch
+[PULL 19/31] hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
+In exynos4210_init_board_irqs(), use the TYPE_SPLIT_IRQ device
+instead of qemu_irq_split().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-13-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h |  9 ++++++++
+ hw/arm/exynos4210.c         | 41 +++++++++++++++++++++++++++++--------
+files changed, 42 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/cpu/a9mpcore.h"
+ #include "hw/intc/exynos4210_gic.h"
++#include "hw/core/split-irq.h"
+ #include "target/arm/cpu-qom.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@
+ #define EXYNOS4210_NUM_DMA      3
++/*
++ * We need one splitter for every external combiner input, plus
++ * one for every non-zero entry in combiner_grp_to_gic_id[].
++ * We'll assert in exynos4210_init_board_irqs() if this is wrong.
++ */
++#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
++
+ typedef struct Exynos4210Irq {
+     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
+@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
+     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+     A9MPPrivState a9mpcore;
+     Exynos4210GicState ext_gic;
++    SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
+ };
+ #define TYPE_EXYNOS4210_SOC "exynos4210"
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+     uint32_t grp, bit, irq_id, n;
+     Exynos4210Irq *is = &s->irqs;
+     DeviceState *extgicdev = DEVICE(&s->ext_gic);
++    int splitcount = 0;
++    DeviceState *splitter;
+     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
+         irq_id = 0;
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+             /* MCT_G1 is passed to External and GIC */
+             irq_id = EXT_GIC_ID_MCT_G1;
+         }
++
++        assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
++        splitter = DEVICE(&s->splitter[splitcount]);
++        qdev_prop_set_uint16(splitter, "num-lines", 2);
++        qdev_realize(splitter, NULL, &error_abort);
++        splitcount++;
++        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
++        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+         if (irq_id) {
+-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+-                                             qdev_get_gpio_in(extgicdev,
+-                                                              irq_id - 32));
++            qdev_connect_gpio_out(splitter, 1,
++                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
+         } else {
+-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+-                    is->ext_combiner_irq[n]);
++            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
+         }
+     }
+     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
+         if (irq_id) {
+-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+-                                             qdev_get_gpio_in(extgicdev,
+-                                                              irq_id - 32));
++            assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
++            splitter = DEVICE(&s->splitter[splitcount]);
++            qdev_prop_set_uint16(splitter, "num-lines", 2);
++            qdev_realize(splitter, NULL, &error_abort);
++            splitcount++;
++            s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
++            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
++            qdev_connect_gpio_out(splitter, 1,
++                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
+         }
+     }
++    /*
++     * We check this here to avoid a more obscure assert later when
++     * qdev_assert_realized_properly() checks that we realized every
++     * child object we initialized.
++     */
++    assert(splitcount == EXYNOS4210_NUM_SPLITTERS);
+ }
+ /*
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
+         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
+     }
++    for (i = 0; i < ARRAY_SIZE(s->splitter); i++) {
++        g_autofree char *name = g_strdup_printf("irq-splitter%d", i);
++        object_initialize_child(obj, name, &s->splitter[i], TYPE_SPLIT_IRQ);
++    }
++
+     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
+     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
+ }
+--
+.25.1

-New patch
+[PULL 20/31] hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
+In exynos4210_init_board_irqs(), the loop that handles IRQ lines that
+are in a range that applies to the internal combiner only creates a
+splitter for those interrupts which go to both the internal combiner
+and to the external GIC, but it does nothing at all for the
+interrupts which don't go to the external GIC, leaving the
+irq_table[] array element empty for those.  (This will result in
+those interrupts simply being lost, not in a QEMU crash.)
+I don't have a reliable datasheet for this SoC, but since we do wire
+up one interrupt line in this category (the HDMI I2C device on
+interrupt 16,1), this seems like it must be a bug in the existing
+QEMU code.  Fill in the irq_table[] entries where we're not splitting
+the IRQ to both the internal combiner and the external GIC with the
+IRQ line of the internal combiner.  (That is, these IRQ lines go to
+just one device, not multiple.)
+This bug didn't have any visible guest effects because the only
+implemented device that was affected was the HDMI I2C controller,
+and we never connect any I2C devices to that bus.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-14-peter.maydell@linaro.org
+---
+ hw/arm/exynos4210.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+             qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+             qdev_connect_gpio_out(splitter, 1,
+                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
++        } else {
++            s->irq_table[n] = is->int_combiner_irq[n];
+         }
+     }
+     /*
+--
+.25.1

-New patch
+[PULL 21/31] hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
+Currently for the interrupts MCT_G0 and MCT_G1 which are
+the only ones in the input range of the external combiner
+and which are also wired to the external GIC, we connect
+them only to the internal combiner and the external GIC.
+This seems likely to be a bug, as all other interrupts
+which are in the input range of both combiners are
+connected to both combiners. (The fact that the code in
+exynos4210_combiner_get_gpioin() is also trying to wire
+up these inputs on both combiners also suggests this.)
+Wire these interrupts up to both combiners, like the rest.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-15-peter.maydell@linaro.org
+---
+ hw/arm/exynos4210.c | 7 +++----
+file changed, 3 insertions(+), 4 deletions(-)
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
+         splitter = DEVICE(&s->splitter[splitcount]);
+-        qdev_prop_set_uint16(splitter, "num-lines", 2);
++        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
+         qdev_realize(splitter, NULL, &error_abort);
+         splitcount++;
+         s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
+         qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
++        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
+         if (irq_id) {
+-            qdev_connect_gpio_out(splitter, 1,
++            qdev_connect_gpio_out(splitter, 2,
+                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
+-        } else {
+-            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
+         }
+     }
+     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+--
+.25.1

-New patch
+[PULL 22/31] hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
+The combiner_grp_to_gic_id[] array includes the EXT_GIC_ID_MCT_G0
+and EXT_GIC_ID_MCT_G1 multiple times. This means that we will
+connect multiple IRQs up to the same external GIC input, which
+is not permitted. We do the same thing in the code in
+exynos4210_init_board_irqs() because the conditionals selecting
+an irq_id in the first loop match multiple interrupt IDs.
+Overall we do this for interrupt IDs
+(1, 4), (12, 4), (35, 4), (51, 4), (53, 4) for EXT_GIC_ID_MCT_G0
+and
+(1, 5), (12, 5), (35, 5), (51, 5), (53, 5) for EXT_GIC_ID_MCT_G1
+These correspond to the cases for the multi-core timer that we are
+wiring up to multiple inputs on the combiner in
+exynos4210_combiner_get_gpioin().  That code already deals with all
+these interrupt IDs being the same input source, so we don't need to
+connect the external GIC interrupt for any of them except the first
+(1, 4) and (1, 5). Remove the array entries and conditionals which
+were incorrectly causing us to wire up extra lines.
+This bug didn't cause any visible effects, because we only connect
+up a device to the "primary" ID values (1, 4) and (1, 5), so the
+extra lines would never be set to a level.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220404154658.565020-16-peter.maydell@linaro.org
+---
+ include/hw/arm/exynos4210.h |  2 +-
+ hw/arm/exynos4210.c         | 12 +++++-------
+files changed, 6 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/exynos4210.h
++++ b/include/hw/arm/exynos4210.h
+@@ -XXX,XX +XXX,XX @@
+  * one for every non-zero entry in combiner_grp_to_gic_id[].
+  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
+  */
+-#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
++#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
+ typedef struct Exynos4210Irq {
+     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/exynos4210.c
++++ b/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+     /* int combiner group 34 */
+     { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
+     /* int combiner group 35 */
+-    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++    { 0, 0, 0, EXT_GIC_ID_MCT_L1 },
+     /* int combiner group 36 */
+     { EXT_GIC_ID_MIXER },
+     /* int combiner group 37 */
+@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+     /* groups 38-50 */
+     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
+     /* int combiner group 51 */
+-    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++    { EXT_GIC_ID_MCT_L0 },
+     /* group 52 */
+     { },
+     /* int combiner group 53 */
+-    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++    { EXT_GIC_ID_WDT },
+     /* groups 54-63 */
+     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
+ };
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
+         irq_id = 0;
+-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
+-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
++        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4)) {
+             /* MCT_G0 is passed to External GIC */
+             irq_id = EXT_GIC_ID_MCT_G0;
+         }
+-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
+-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
++        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5)) {
+             /* MCT_G1 is passed to External and GIC */
+             irq_id = EXT_GIC_ID_MCT_G1;
+         }
+--
+.25.1

-[PULL 09/15] hw/arm/allwinner-a10: Remove local qemu_irq variables
+[PULL 23/31] hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+At this point, the function exynos4210_init_board_irqs() splits input
+IRQ lines to connect them to the input combiner, output combiner and
-We won't reuse the CPU IRQ/FIQ variables. Simplify by calling
+external GIC.  The function exynos4210_combiner_get_gpioin() splits
-qdev_get_gpio_in() in place.
+some of the combiner input lines further to connect them to multiple
+different inputs on the combiner.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-6-f4bug@amsat.org
+Because (unlike qemu_irq_split()) the TYPE_SPLIT_IRQ device has a
 configurable number of outputs, we can do all this in one place, by
 making exynos4210_init_board_irqs() add extra outputs to the splitter
 device when it must be connected to more than one input on each
 combiner.
 We do this with a new data structure, the combinermap, which is an
 array each of whose elements is a list of the interrupt IDs on the
 combiner which must be tied together.  As we loop through each
 interrupt ID, if we find that it is the first one in one of these
 lists, we configure the splitter device with eonugh extra outputs and
 wire them up to the other interrupt IDs in the list.
 Conveniently, for all the cases where this is necessary, the
 lowest-numbered interrupt ID in each group is in the range of the
 external combiner, so we only need to code for this in the first of
 the two loops in exynos4210_init_board_irqs().
 The old code in exynos4210_combiner_get_gpioin() which is being
 deleted here had several problems which don't exist in the new code
 in its handling of the multi-core timer interrupts:
  (1) the case labels specified bits 4 ... 8, but bit '8' doesn't
      exist; these should have been 4 ... 7
  (2) it used the input irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]
      multiple times as the input of several different splitters,
      which isn't allowed
  (3) in an apparent cut-and-paste error, the cases for all the
      multi-core timer inputs used "bit + 4" even though the
      bit range for the case was (intended to be) 4 ... 7, which
      meant it was looking at non-existent bits 8 ... 11.
 None of these exist in the new code.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220404154658.565020-17-peter.maydell@linaro.org
 ---
- hw/arm/allwinner-a10.c | 9 ++++-----
+ include/hw/arm/exynos4210.h |   6 +-
-file changed, 4 insertions(+), 5 deletions(-)
+ hw/arm/exynos4210.c         | 178 +++++++++++++++++++++++-------------
+files changed, 119 insertions(+), 65 deletions(-)
-diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
 diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-a10.c
+--- a/include/hw/arm/exynos4210.h
-+++ b/hw/arm/allwinner-a10.c
++++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
  /*
   * We need one splitter for every external combiner input, plus
 - * one for every non-zero entry in combiner_grp_to_gic_id[].
 + * one for every non-zero entry in combiner_grp_to_gic_id[],
 + * minus one for every external combiner ID in second or later
 + * places in a combinermap[] line.
   * We'll assert in exynos4210_init_board_irqs() if this is wrong.
   */
 -#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
 +#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
  typedef struct Exynos4210Irq {
      qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
      ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 +/*
 + * Some interrupt lines go to multiple combiner inputs.
 + * This data structure defines those: each array element is
 + * a list of combiner inputs which are connected together;
 + * the one with the smallest interrupt ID value must be first.
 + * As with combiner_grp_to_gic_id[], we rely on (0, 0) not being
 + * wired to anything so we can use 0 as a terminator.
 + */
 +#define IRQNO(G, B) EXYNOS4210_COMBINER_GET_IRQ_NUM(G, B)
 +#define IRQNONE 0
 +
 +#define COMBINERMAP_SIZE 16
 +
 +static const int combinermap[COMBINERMAP_SIZE][6] = {
 +    /* MDNIE_LCD1 */
 +    { IRQNO(0, 4), IRQNO(1, 0), IRQNONE },
 +    { IRQNO(0, 5), IRQNO(1, 1), IRQNONE },
 +    { IRQNO(0, 6), IRQNO(1, 2), IRQNONE },
 +    { IRQNO(0, 7), IRQNO(1, 3), IRQNONE },
 +    /* TMU */
 +    { IRQNO(2, 4), IRQNO(3, 4), IRQNONE },
 +    { IRQNO(2, 5), IRQNO(3, 5), IRQNONE },
 +    { IRQNO(2, 6), IRQNO(3, 6), IRQNONE },
 +    { IRQNO(2, 7), IRQNO(3, 7), IRQNONE },
 +    /* LCD1 */
 +    { IRQNO(11, 4), IRQNO(12, 0), IRQNONE },
 +    { IRQNO(11, 5), IRQNO(12, 1), IRQNONE },
 +    { IRQNO(11, 6), IRQNO(12, 2), IRQNONE },
 +    { IRQNO(11, 7), IRQNO(12, 3), IRQNONE },
 +    /* Multi-core timer */
 +    { IRQNO(1, 4), IRQNO(12, 4), IRQNO(35, 4), IRQNO(51, 4), IRQNO(53, 4), IRQNONE },
 +    { IRQNO(1, 5), IRQNO(12, 5), IRQNO(35, 5), IRQNO(51, 5), IRQNO(53, 5), IRQNONE },
 +    { IRQNO(1, 6), IRQNO(12, 6), IRQNO(35, 6), IRQNO(51, 6), IRQNO(53, 6), IRQNONE },
 +    { IRQNO(1, 7), IRQNO(12, 7), IRQNO(35, 7), IRQNO(51, 7), IRQNO(53, 7), IRQNONE },
 +};
 +
 +#undef IRQNO
 +
 +static const int *combinermap_entry(int irq)
 +{
 +    /*
 +     * If the interrupt number passed in is the first entry in some
 +     * line of the combinermap, return a pointer to that line;
 +     * otherwise return NULL.
 +     */
 +    int i;
 +    for (i = 0; i < COMBINERMAP_SIZE; i++) {
 +        if (combinermap[i][0] == irq) {
 +            return combinermap[i];
 +        }
 +    }
 +    return NULL;
 +}
 +
 +static int mapline_size(const int *mapline)
 +{
 +    /* Return number of entries in this mapline in total */
 +    int i = 0;
 +
 +    if (!mapline) {
 +        /* Not in the map? IRQ goes to exactly one combiner input */
 +        return 1;
 +    }
 +    while (*mapline != IRQNONE) {
 +        mapline++;
 +        i++;
 +    }
 +    return i;
 +}
 +
  /*
   * Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
      DeviceState *extgicdev = DEVICE(&s->ext_gic);
      int splitcount = 0;
      DeviceState *splitter;
 +    const int *mapline;
 +    int numlines, splitin, in;
      for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
          irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
              irq_id = EXT_GIC_ID_MCT_G1;
          }
 +        if (s->irq_table[n]) {
 +            /*
 +             * This must be some non-first entry in a combinermap line,
 +             * and we've already filled it in.
 +             */
 +            continue;
 +        }
 +        mapline = combinermap_entry(n);
 +        /*
 +         * We need to connect the IRQ to multiple inputs on both combiners
 +         * and possibly also to the external GIC.
 +         */
 +        numlines = 2 * mapline_size(mapline);
 +        if (irq_id) {
 +            numlines++;
 +        }
          assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
          splitter = DEVICE(&s->splitter[splitcount]);
 -        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
 +        qdev_prop_set_uint16(splitter, "num-lines", numlines);
          qdev_realize(splitter, NULL, &error_abort);
          splitcount++;
 -        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 -        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
 -        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
 +
 +        in = n;
 +        splitin = 0;
 +        for (;;) {
 +            s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
 +            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
 +            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
 +            splitin += 2;
 +            if (!mapline) {
 +                break;
 +            }
 +            mapline++;
 +            in = *mapline;
 +            if (in == IRQNONE) {
 +                break;
 +            }
 +        }
          if (irq_id) {
 -            qdev_connect_gpio_out(splitter, 2,
 +            qdev_connect_gpio_out(splitter, splitin,
                                    qdev_get_gpio_in(extgicdev, irq_id - 32));
          }
      }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
          irq_id = combiner_grp_to_gic_id[grp -
                       EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 +        if (s->irq_table[n]) {
 +            /*
 +             * This must be some non-first entry in a combinermap line,
 +             * and we've already filled it in.
 +             */
 +            continue;
 +        }
 +
          if (irq_id) {
              assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
              splitter = DEVICE(&s->splitter[splitcount]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
                                             DeviceState *dev, int ext)
  {
-     AwA10State *s = AW_A10(dev);
+     int n;
-     SysBusDevice *sysbusdev;
+-    int bit;
--    qemu_irq fiq, irq;
+     int max;
-     Error *err = NULL;
+     qemu_irq *irq;
-     object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
-@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
+         EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
-         error_propagate(errp, err);
+     irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
-         return;
 -    /*
 -     * Some IRQs of Int/External Combiner are going to two Combiners groups,
 -     * so let split them.
 -     */
      for (n = 0; n < max; n++) {
 -
 -        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 -
 -        switch (n) {
 -        /* MDNIE_LCD1 INTG1 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
 -            continue;
 -
 -        /* TMU INTG3 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
 -            continue;
 -
 -        /* LCD1 INTG12 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG12 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
 -               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG35 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG51 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG53 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -        }
 -
          irq[n] = qdev_get_gpio_in(dev, n);
      }
--    irq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ);
+ }
 -    fiq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ);
      object_property_set_bool(OBJECT(&s->intc), true, "realized", &err);
      if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
      }
      sysbusdev = SYS_BUS_DEVICE(&s->intc);
      sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
 -    sysbus_connect_irq(sysbusdev, 0, irq);
 -    sysbus_connect_irq(sysbusdev, 1, fiq);
 +    sysbus_connect_irq(sysbusdev, 0,
 +                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
 +    sysbus_connect_irq(sysbusdev, 1,
 +                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
      qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
      object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
 --
-.20.1
+.25.1

-[PULL 11/15] i.MX: add an emulation for RNGC
+[PULL 24/31] hw/arm/exynos4210: Put combiners into state struct
-From: Martin Kaiser <martin@kaiser.cx>
+Switch the creation of the combiner devices to the new-style
 "embedded in state struct" approach, so we can easily refer
 to the object elsewhere during realize.
-Add an emulation for the RNGC random number generator and the compatible
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-RNGB variant. These peripherals are included (at least) in imx25 and
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-imx35 chipsets.
+Message-id: 20220404154658.565020-18-peter.maydell@linaro.org
 ---
  include/hw/arm/exynos4210.h           |  3 ++
  include/hw/intc/exynos4210_combiner.h | 57 +++++++++++++++++++++++++++
  hw/arm/exynos4210.c                   | 20 +++++-----
  hw/intc/exynos4210_combiner.c         | 31 +--------------
 files changed, 72 insertions(+), 39 deletions(-)
  create mode 100644 include/hw/intc/exynos4210_combiner.h
-The emulation supports the initial self test, reseeding the prng and
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 reading random numbers.
 Signed-off-by: Martin Kaiser <martin@kaiser.cx>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/misc/Makefile.objs      |   1 +
  include/hw/arm/fsl-imx25.h |   5 +
  include/hw/misc/imx_rngc.h |  35 +++++
  hw/arm/fsl-imx25.c         |  11 ++
  hw/misc/imx_rngc.c         | 278 +++++++++++++++++++++++++++++++++++++
 files changed, 330 insertions(+)
  create mode 100644 include/hw/misc/imx_rngc.h
  create mode 100644 hw/misc/imx_rngc.c
 diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/include/hw/arm/exynos4210.h
-+++ b/hw/misc/Makefile.objs
++++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx7_ccm.o
  common-obj-$(CONFIG_IMX) += imx2_wdt.o
  common-obj-$(CONFIG_IMX) += imx7_snvs.o
  common-obj-$(CONFIG_IMX) += imx7_gpr.o
 +common-obj-$(CONFIG_IMX) += imx_rngc.o
  common-obj-$(CONFIG_MILKYMIST) += milkymist-hpdmc.o
  common-obj-$(CONFIG_MILKYMIST) += milkymist-pfpu.o
  common-obj-$(CONFIG_MAINSTONE) += mst_fpga.o
 diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx25.h
 +++ b/include/hw/arm/fsl-imx25.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/timer/imx_gpt.h"
+ #include "hw/sysbus.h"
- #include "hw/timer/imx_epit.h"
+ #include "hw/cpu/a9mpcore.h"
- #include "hw/net/imx_fec.h"
+ #include "hw/intc/exynos4210_gic.h"
-+#include "hw/misc/imx_rngc.h"
++#include "hw/intc/exynos4210_combiner.h"
- #include "hw/i2c/imx_i2c.h"
+ #include "hw/core/split-irq.h"
- #include "hw/gpio/imx_gpio.h"
+ #include "target/arm/cpu-qom.h"
- #include "exec/memory.h"
+ #include "qom/object.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
+@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
-     IMXGPTState    gpt[FSL_IMX25_NUM_GPTS];
+     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
-     IMXEPITState   epit[FSL_IMX25_NUM_EPITS];
+     A9MPPrivState a9mpcore;
-     IMXFECState    fec;
+     Exynos4210GicState ext_gic;
-+    IMXRNGCState   rngc;
++    Exynos4210CombinerState int_combiner;
-     IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
++    Exynos4210CombinerState ext_combiner;
-     IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
+     SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
-     MemoryRegion   rom[2];
+ };
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
- #define FSL_IMX25_GPIO4_SIZE    0x4000
+diff --git a/include/hw/intc/exynos4210_combiner.h b/include/hw/intc/exynos4210_combiner.h
  #define FSL_IMX25_GPIO3_ADDR    0x53FA4000
  #define FSL_IMX25_GPIO3_SIZE    0x4000
 +#define FSL_IMX25_RNGC_ADDR     0x53FB0000
 +#define FSL_IMX25_RNGC_SIZE     0x4000
  #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
  #define FSL_IMX25_GPIO1_SIZE    0x4000
  #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
  #define FSL_IMX25_EPIT1_IRQ     28
  #define FSL_IMX25_EPIT2_IRQ     27
  #define FSL_IMX25_FEC_IRQ       57
 +#define FSL_IMX25_RNGC_IRQ      22
  #define FSL_IMX25_I2C1_IRQ      3
  #define FSL_IMX25_I2C2_IRQ      4
  #define FSL_IMX25_I2C3_IRQ      10
 diff --git a/include/hw/misc/imx_rngc.h b/include/hw/misc/imx_rngc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/imx_rngc.h
++++ b/include/hw/intc/exynos4210_combiner.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Freescale i.MX RNGC emulation
++ * Samsung exynos4210 Interrupt Combiner
 + *
-+ * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
++ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
 + * All rights reserved.
 + *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * Evgeny Voevodin <e.voevodin@samsung.com>
-+ * See the COPYING file in the top-level directory.
++ *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or (at your
 + * option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 + * See the GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef IMX_RNGC_H
++#ifndef HW_INTC_EXYNOS4210_COMBINER
-+#define IMX_RNGC_H
++#define HW_INTC_EXYNOS4210_COMBINER
 +
 +#include "hw/sysbus.h"
 +
-+#define TYPE_IMX_RNGC "imx.rngc"
++/*
-+#define IMX_RNGC(obj) OBJECT_CHECK(IMXRNGCState, (obj), TYPE_IMX_RNGC)
++ * State for each output signal of internal combiner
 + */
 +typedef struct CombinerGroupState {
 +    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
 +    uint8_t src_pending;        /* Pending source interrupts before masking */
 +} CombinerGroupState;
 +
-+typedef struct IMXRNGCState {
++#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
-+    /*< private >*/
++OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
 +
 +/* Number of groups and total number of interrupts for the internal combiner */
 +#define IIC_NGRP 64
 +#define IIC_NIRQ (IIC_NGRP * 8)
 +#define IIC_REGSET_SIZE 0x41
 +
 +struct Exynos4210CombinerState {
 +    SysBusDevice parent_obj;
 +
-+    /*< public >*/
++    MemoryRegion iomem;
 +    MemoryRegion  iomem;
 +
-+    uint8_t op_self_test;
++    struct CombinerGroupState group[IIC_NGRP];
-+    uint8_t op_seed;
++    uint32_t reg_set[IIC_REGSET_SIZE];
-+    uint8_t mask;
++    uint32_t icipsr[2];
-+    bool    auto_seed;
++    uint32_t external;          /* 1 means that this combiner is external */
 +
-+    QEMUBH *self_test_bh;
++    qemu_irq output_irq[IIC_NGRP];
 +    QEMUBH *seed_bh;
 +    qemu_irq irq;
 +} IMXRNGCState;
 +
 +#endif /* IMX_RNGC_H */
 diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx25.c
 +++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
      sysbus_init_child_obj(obj, "fec", &s->fec, sizeof(s->fec), TYPE_IMX_FEC);
 +    sysbus_init_child_obj(obj, "rngc", &s->rngc, sizeof(s->rngc),
 +                          TYPE_IMX_RNGC);
 +
      for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
          sysbus_init_child_obj(obj, "i2c[*]", &s->i2c[i], sizeof(s->i2c[i]),
                                TYPE_IMX_I2C);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->fec), 0,
                         qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_FEC_IRQ));
 +    object_property_set_bool(OBJECT(&s->rngc), true, "realized", &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rngc), 0, FSL_IMX25_RNGC_ADDR);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rngc), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_RNGC_IRQ));
      /* Initialize all I2C */
      for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
 diff --git a/hw/misc/imx_rngc.c b/hw/misc/imx_rngc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/imx_rngc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Freescale i.MX RNGC emulation
 + *
 + * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + * This driver provides the minimum functionality to initialize and seed
 + * an rngc and to read random numbers. The rngb that is found in imx25
 + * chipsets is also supported.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/module.h"
 +#include "qemu/log.h"
 +#include "qemu/guest-random.h"
 +#include "hw/irq.h"
 +#include "hw/misc/imx_rngc.h"
 +#include "migration/vmstate.h"
 +
 +#define RNGC_NAME "i.MX RNGC"
 +
 +#define RNGC_VER_ID  0x00
 +#define RNGC_COMMAND 0x04
 +#define RNGC_CONTROL 0x08
 +#define RNGC_STATUS  0x0C
 +#define RNGC_FIFO    0x14
 +
 +/* These version info are reported by the rngb in an imx258 chip. */
 +#define RNG_TYPE_RNGB 0x1
 +#define V_MAJ 0x2
 +#define V_MIN 0x40
 +
 +#define RNGC_CMD_BIT_SW_RST    0x40
 +#define RNGC_CMD_BIT_CLR_ERR   0x20
 +#define RNGC_CMD_BIT_CLR_INT   0x10
 +#define RNGC_CMD_BIT_SEED      0x02
 +#define RNGC_CMD_BIT_SELF_TEST 0x01
 +
 +#define RNGC_CTRL_BIT_MASK_ERR  0x40
 +#define RNGC_CTRL_BIT_MASK_DONE 0x20
 +#define RNGC_CTRL_BIT_AUTO_SEED 0x10
 +
 +/* the current status for self-test and seed operations */
 +#define OP_IDLE 0
 +#define OP_RUN  1
 +#define OP_DONE 2
 +
 +static uint64_t imx_rngc_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +    uint64_t val = 0;
 +
 +    switch (offset) {
 +    case RNGC_VER_ID:
 +        val |= RNG_TYPE_RNGB << 28 | V_MAJ << 8 | V_MIN;
 +        break;
 +
 +    case RNGC_COMMAND:
 +        if (s->op_seed == OP_RUN) {
 +            val |= RNGC_CMD_BIT_SEED;
 +        }
 +        if (s->op_self_test == OP_RUN) {
 +            val |= RNGC_CMD_BIT_SELF_TEST;
 +        }
 +        break;
 +
 +    case RNGC_CONTROL:
 +        /*
 +         * The CTL_ACC and VERIF_MODE bits are not supported yet.
 +         * They read as 0.
 +         */
 +        val |= s->mask;
 +        if (s->auto_seed) {
 +            val |= RNGC_CTRL_BIT_AUTO_SEED;
 +        }
 +        /*
 +         * We don't have an internal fifo like the real hardware.
 +         * There's no need for strategy to handle fifo underflows.
 +         * We return the FIFO_UFLOW_RESPONSE bits as 0.
 +         */
 +        break;
 +
 +    case RNGC_STATUS:
 +        /*
 +         * We never report any statistics test or self-test errors or any
 +         * other errors. STAT_TEST_PF, ST_PF and ERROR are always 0.
 +         */
 +
 +        /*
 +         * We don't have an internal fifo, see above. Therefore, we
 +         * report back the default fifo size (5 32-bit words) and
 +         * indicate that our fifo is always full.
 +         */
 +        val |= 5 << 12 | 5 << 8;
 +
 +        /* We always have a new seed available. */
 +        val |= 1 << 6;
 +
 +        if (s->op_seed == OP_DONE) {
 +            val |= 1 << 5;
 +        }
 +        if (s->op_self_test == OP_DONE) {
 +            val |= 1 << 4;
 +        }
 +        if (s->op_seed == OP_RUN || s->op_self_test == OP_RUN) {
 +            /*
 +             * We're busy if self-test is running or if we're
 +             * seeding the prng.
 +             */
 +            val |= 1 << 1;
 +        } else {
 +            /*
 +             * We're ready to provide secure random numbers whenever
 +             * we're not busy.
 +             */
 +            val |= 1;
 +        }
 +        break;
 +
 +    case RNGC_FIFO:
 +        qemu_guest_getrandom_nofail(&val, sizeof(val));
 +        break;
 +    }
 +
 +    return val;
 +}
 +
 +static void imx_rngc_do_reset(IMXRNGCState *s)
 +{
 +    s->op_self_test = OP_IDLE;
 +    s->op_seed = OP_IDLE;
 +    s->mask = 0;
 +    s->auto_seed = false;
 +}
 +
 +static void imx_rngc_write(void *opaque, hwaddr offset, uint64_t value,
 +                           unsigned size)
 +{
 +    IMXRNGCState *s = IMX_RNGC(opaque);
 +
 +    switch (offset) {
 +    case RNGC_COMMAND:
 +        if (value & RNGC_CMD_BIT_SW_RST) {
 +            imx_rngc_do_reset(s);
 +        }
 +
 +        /*
 +         * For now, both CLR_ERR and CLR_INT clear the interrupt. We
 +         * don't report any errors yet.
 +         */
 +        if (value & (RNGC_CMD_BIT_CLR_ERR | RNGC_CMD_BIT_CLR_INT)) {
 +            qemu_irq_lower(s->irq);
 +        }
 +
 +        if (value & RNGC_CMD_BIT_SEED) {
 +            s->op_seed = OP_RUN;
 +            qemu_bh_schedule(s->seed_bh);
 +        }
 +
 +        if (value & RNGC_CMD_BIT_SELF_TEST) {
 +            s->op_self_test = OP_RUN;
 +            qemu_bh_schedule(s->self_test_bh);
 +        }
 +        break;
 +
 +    case RNGC_CONTROL:
 +        /*
 +         * The CTL_ACC and VERIF_MODE bits are not supported yet.
 +         * We ignore them if they're set by the caller.
 +         */
 +
 +        if (value & RNGC_CTRL_BIT_MASK_ERR) {
 +            s->mask |= RNGC_CTRL_BIT_MASK_ERR;
 +        } else {
 +            s->mask &= ~RNGC_CTRL_BIT_MASK_ERR;
 +        }
 +
 +        if (value & RNGC_CTRL_BIT_MASK_DONE) {
 +            s->mask |= RNGC_CTRL_BIT_MASK_DONE;
 +        } else {
 +            s->mask &= ~RNGC_CTRL_BIT_MASK_DONE;
 +        }
 +
 +        if (value & RNGC_CTRL_BIT_AUTO_SEED) {
 +            s->auto_seed = true;
 +        } else {
 +            s->auto_seed = false;
 +        }
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps imx_rngc_ops = {
 +    .read  = imx_rngc_read,
 +    .write = imx_rngc_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
-+static void imx_rngc_self_test(void *opaque)
++#endif
-+{
+diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-+    IMXRNGCState *s = IMX_RNGC(opaque);
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/hw/arm/exynos4210.c
-+    s->op_self_test = OP_DONE;
++++ b/hw/arm/exynos4210.c
-+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-+        qemu_irq_raise(s->irq);
+     }
-+    }
-+}
+     /* Internal Interrupt Combiner */
-+
+-    dev = qdev_new("exynos4210.combiner");
-+static void imx_rngc_seed(void *opaque)
+-    busdev = SYS_BUS_DEVICE(dev);
-+{
+-    sysbus_realize_and_unref(busdev, &error_fatal);
-+    IMXRNGCState *s = IMX_RNGC(opaque);
++    busdev = SYS_BUS_DEVICE(&s->int_combiner);
-+
++    sysbus_realize(busdev, &error_fatal);
-+    s->op_seed = OP_DONE;
+     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+         sysbus_connect_irq(busdev, n,
-+        qemu_irq_raise(s->irq);
+                            qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
-+    }
+     }
-+}
+-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
-+
++    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
-+static void imx_rngc_realize(DeviceState *dev, Error **errp)
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
-+{
-+    IMXRNGCState *s = IMX_RNGC(dev);
+     /* External Interrupt Combiner */
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+-    dev = qdev_new("exynos4210.combiner");
-+
+-    qdev_prop_set_uint32(dev, "external", 1);
-+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_rngc_ops, s,
+-    busdev = SYS_BUS_DEVICE(dev);
-+                          TYPE_IMX_RNGC, 0x1000);
+-    sysbus_realize_and_unref(busdev, &error_fatal);
-+    sysbus_init_mmio(sbd, &s->iomem);
++    qdev_prop_set_uint32(DEVICE(&s->ext_combiner), "external", 1);
-+
++    busdev = SYS_BUS_DEVICE(&s->ext_combiner);
-+    sysbus_init_irq(sbd, &s->irq);
++    sysbus_realize(busdev, &error_fatal);
-+    s->self_test_bh = qemu_bh_new(imx_rngc_self_test, s);
+     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-+    s->seed_bh = qemu_bh_new(imx_rngc_seed, s);
+         sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
-+}
+     }
-+
+-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
-+static void imx_rngc_reset(DeviceState *dev)
++    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
-+{
+     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
-+    IMXRNGCState *s = IMX_RNGC(dev);
-+
+     /* Initialize board IRQs. */
-+    imx_rngc_do_reset(s);
+@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
-+}
-+
+     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
-+static const VMStateDescription vmstate_imx_rngc = {
+     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
-+    .name = RNGC_NAME,
++    object_initialize_child(obj, "int-combiner", &s->int_combiner,
-+    .version_id = 1,
++                            TYPE_EXYNOS4210_COMBINER);
-+    .minimum_version_id = 1,
++    object_initialize_child(obj, "ext-combiner", &s->ext_combiner,
-+    .fields = (VMStateField[]) {
++                            TYPE_EXYNOS4210_COMBINER);
-+        VMSTATE_UINT8(op_self_test, IMXRNGCState),
+ }
-+        VMSTATE_UINT8(op_seed, IMXRNGCState),
-+        VMSTATE_UINT8(mask, IMXRNGCState),
+ static void exynos4210_class_init(ObjectClass *klass, void *data)
-+        VMSTATE_BOOL(auto_seed, IMXRNGCState),
+diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
-+        VMSTATE_END_OF_LIST()
+index XXXXXXX..XXXXXXX 100644
-+    }
+--- a/hw/intc/exynos4210_combiner.c
-+};
++++ b/hw/intc/exynos4210_combiner.c
-+
+@@ -XXX,XX +XXX,XX @@
-+static void imx_rngc_class_init(ObjectClass *klass, void *data)
+ #include "hw/sysbus.h"
-+{
+ #include "migration/vmstate.h"
-+    DeviceClass *dc = DEVICE_CLASS(klass);
+ #include "qemu/module.h"
-+
+-
-+    dc->realize = imx_rngc_realize;
++#include "hw/intc/exynos4210_combiner.h"
-+    dc->reset = imx_rngc_reset;
+ #include "hw/arm/exynos4210.h"
-+    dc->desc = RNGC_NAME,
+ #include "hw/hw.h"
-+    dc->vmsd = &vmstate_imx_rngc;
+ #include "hw/irq.h"
-+}
+@@ -XXX,XX +XXX,XX @@
-+
+ #define DPRINTF(fmt, ...) do {} while (0)
-+static const TypeInfo imx_rngc_info = {
+ #endif
-+    .name          = TYPE_IMX_RNGC,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
+-#define    IIC_NGRP        64            /* Internal Interrupt Combiner
-+    .instance_size = sizeof(IMXRNGCState),
+-                                            Groups number */
-+    .class_init    = imx_rngc_class_init,
+-#define    IIC_NIRQ        (IIC_NGRP * 8)/* Internal Interrupt Combiner
-+};
+-                                            Interrupts number */
-+
+ #define IIC_REGION_SIZE    0x108         /* Size of memory mapped region */
-+static void imx_rngc_register_types(void)
+-#define IIC_REGSET_SIZE    0x41
-+{
+-
-+    type_register_static(&imx_rngc_info);
+-/*
-+}
+- * State for each output signal of internal combiner
-+
+- */
-+type_init(imx_rngc_register_types)
+-typedef struct CombinerGroupState {
 -    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
 -    uint8_t src_pending;        /* Pending source interrupts before masking */
 -} CombinerGroupState;
 -
 -#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
 -OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
 -
 -struct Exynos4210CombinerState {
 -    SysBusDevice parent_obj;
 -
 -    MemoryRegion iomem;
 -
 -    struct CombinerGroupState group[IIC_NGRP];
 -    uint32_t reg_set[IIC_REGSET_SIZE];
 -    uint32_t icipsr[2];
 -    uint32_t external;          /* 1 means that this combiner is external */
 -
 -    qemu_irq output_irq[IIC_NGRP];
 -};
  static const VMStateDescription vmstate_exynos4210_combiner_group_state = {
      .name = "exynos4210.combiner.groupstate",
 --
-.20.1
+.25.1

-[PULL 07/15] hw/arm/allwinner-a10: Move SoC definitions out of header
+[PULL 25/31] hw/arm/exynos4210: Drop Exynos4210Irq struct
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The only time we use the int_combiner_irq[] and ext_combiner_irq[]
 arrays in the Exynos4210Irq struct is during realize of the SoC -- we
 initialize them with the input IRQs of the combiner devices, and then
 connect those to outputs of other devices in
 exynos4210_init_board_irqs().  Now that the combiner objects are
 easily accessible as s->int_combiner and s->ext_combiner we can make
 the connections directly from one device to the other without going
 via these arrays.
-These definitions are specific to the A10 SoC and don't need
+Since these are the only two remaining elements of Exynos4210Irq,
-to be exported to the different Allwinner peripherals.
+we can remove that struct entirely.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20191230110953.25496-4-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220404154658.565020-19-peter.maydell@linaro.org
 ---
- include/hw/arm/allwinner-a10.h | 6 ------
+ include/hw/arm/exynos4210.h |  6 ------
- hw/arm/allwinner-a10.c         | 6 ++++++
+ hw/arm/exynos4210.c         | 34 ++++++++--------------------------
-files changed, 6 insertions(+), 6 deletions(-)
+files changed, 8 insertions(+), 32 deletions(-)
-diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
+--- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/exynos4210.h
 @@ -XXX,XX +XXX,XX @@
- #include "target/arm/cpu.h"
+  */
+ #define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
--#define AW_A10_PIC_REG_BASE     0x01c20400
+-typedef struct Exynos4210Irq {
--#define AW_A10_PIT_REG_BASE     0x01c20c00
+-    qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
--#define AW_A10_UART0_REG_BASE   0x01c28000
+-    qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
--#define AW_A10_EMAC_BASE        0x01c0b000
+-} Exynos4210Irq;
 -#define AW_A10_SATA_BASE        0x01c18000
 -
- #define AW_A10_SDRAM_BASE       0x40000000
+ struct Exynos4210State {
+     /*< private >*/
- #define TYPE_AW_A10 "allwinner-a10"
+     SysBusDevice parent_obj;
-diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
+     /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
 -    Exynos4210Irq irqs;
      qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
      MemoryRegion chipid_mem;
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-a10.c
+--- a/hw/arm/exynos4210.c
-+++ b/hw/arm/allwinner-a10.c
++++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int mapline_size(const int *mapline)
- #include "hw/misc/unimp.h"
+ static void exynos4210_init_board_irqs(Exynos4210State *s)
  #include "sysemu/sysemu.h"
 +#define AW_A10_PIC_REG_BASE     0x01c20400
 +#define AW_A10_PIT_REG_BASE     0x01c20c00
 +#define AW_A10_UART0_REG_BASE   0x01c28000
 +#define AW_A10_EMAC_BASE        0x01c0b000
 +#define AW_A10_SATA_BASE        0x01c18000
 +
  static void aw_a10_init(Object *obj)
  {
-     AwA10State *s = AW_A10(obj);
+     uint32_t grp, bit, irq_id, n;
 -    Exynos4210Irq *is = &s->irqs;
      DeviceState *extgicdev = DEVICE(&s->ext_gic);
 +    DeviceState *intcdev = DEVICE(&s->int_combiner);
 +    DeviceState *extcdev = DEVICE(&s->ext_combiner);
      int splitcount = 0;
      DeviceState *splitter;
      const int *mapline;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
          splitin = 0;
          for (;;) {
              s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
 -            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
 -            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
 +            qdev_connect_gpio_out(splitter, splitin,
 +                                  qdev_get_gpio_in(intcdev, in));
 +            qdev_connect_gpio_out(splitter, splitin + 1,
 +                                  qdev_get_gpio_in(extcdev, in));
              splitin += 2;
              if (!mapline) {
                  break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
              qdev_realize(splitter, NULL, &error_abort);
              splitcount++;
              s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 -            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
 +            qdev_connect_gpio_out(splitter, 0, qdev_get_gpio_in(intcdev, n));
              qdev_connect_gpio_out(splitter, 1,
                                    qdev_get_gpio_in(extgicdev, irq_id - 32));
          } else {
 -            s->irq_table[n] = is->int_combiner_irq[n];
 +            s->irq_table[n] = qdev_get_gpio_in(intcdev, n);
          }
      }
      /*
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
      return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
  }
 -/*
 - * Get Combiner input GPIO into irqs structure
 - */
 -static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
 -                                           DeviceState *dev, int ext)
 -{
 -    int n;
 -    int max;
 -    qemu_irq *irq;
 -
 -    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
 -        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
 -    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 -
 -    for (n = 0; n < max; n++) {
 -        irq[n] = qdev_get_gpio_in(dev, n);
 -    }
 -}
 -
  static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
          sysbus_connect_irq(busdev, n,
                             qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
      /* External Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
          sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
      /* Initialize board IRQs. */
 --
-.20.1
+.25.1

-[PULL 05/15] tests/boot_linux_console: Add initrd test for the CubieBoard
+[PULL 26/31] hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Zongyuan Li <zongyuan.li@smartx.com>
-This test boots a Linux kernel on a CubieBoard and verify
+Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-the serial output is working.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220324181557.203805-2-zongyuan.li@smartx.com
 The kernel image and DeviceTree blob are built by the Armbian
 project (based on Debian):
 https://docs.armbian.com/Developer-Guide_Build-Preparation/
 The cpio image used comes from the linux-build-test project:
 https://github.com/groeck/linux-build-test
 If ARM is a target being built, "make check-acceptance" will
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   console: CPU: ARMv7 Processor [410fc080] revision 0 (ARMv7), cr=50c5387d
   console: CPU: PIPT / VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
   console: OF: fdt: Machine model: Cubietech Cubieboard
   [...]
   console: Boot successful.
   console: cat /proc/cpuinfo
   console: / # cat /proc/cpuinfo
   console: processor      : 0
   console: model name     : ARMv7 Processor rev 0 (v7l)
   console: BogoMIPS       : 832.51
   [...]
   console: Hardware       : Allwinner sun4i/sun5i Families
   console: Revision       : 0000
   console: Serial         : 0000000000000000
   console: cat /proc/iomem
   console: / # cat /proc/iomem
   console: 01c00000-01c0002f : system-control@1c00000
   console: 01c02000-01c02fff : dma-controller@1c02000
   console: 01c05000-01c05fff : spi@1c05000
   console: 01c0b080-01c0b093 : mdio@1c0b080
   console: 01c0c000-01c0cfff : lcd-controller@1c0c000
   console: 01c0d000-01c0dfff : lcd-controller@1c0d000
   console: 01c0f000-01c0ffff : mmc@1c0f000
   [...]
   PASS (54.35 s)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
 Tested-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
 Message-id: 20191230110953.25496-2-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/acceptance/boot_linux_console.py | 41 ++++++++++++++++++++++++++
+ hw/arm/realview.c | 33 ++++++++++++++++++++++++---------
-file changed, 41 insertions(+)
+file changed, 24 insertions(+), 9 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
+diff --git a/hw/arm/realview.c b/hw/arm/realview.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
+--- a/hw/arm/realview.c
-+++ b/tests/acceptance/boot_linux_console.py
++++ b/hw/arm/realview.c
-@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
+@@ -XXX,XX +XXX,XX @@
-         self.wait_for_console_pattern('Boot successful.')
+ #include "hw/sysbus.h"
-         # TODO user command, for now the uart is stuck
+ #include "hw/arm/boot.h"
+ #include "hw/arm/primecell.h"
-+    def test_arm_cubieboard_initrd(self):
++#include "hw/core/split-irq.h"
-+        """
+ #include "hw/net/lan9118.h"
-+        :avocado: tags=arch:arm
+ #include "hw/net/smc91c111.h"
-+        :avocado: tags=machine:cubieboard
+ #include "hw/pci/pci.h"
-+        """
++#include "hw/qdev-core.h"
-+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+ #include "net/net.h"
-+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+ #include "sysemu/sysemu.h"
-+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+ #include "hw/boards.h"
-+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+@@ -XXX,XX +XXX,XX @@ static const int realview_board_id[] = {
-+        kernel_path = self.extract_from_deb(deb_path,
+x76d
-+                                            '/boot/vmlinuz-4.20.7-sunxi')
+ };
-+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
-+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
++static void split_irq_from_named(DeviceState *src, const char* outname,
-+        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
++                                 qemu_irq out1, qemu_irq out2) {
-+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
++    DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
 +                      'arm/rootfs-armv5.cpio.gz')
 +        initrd_hash = '2b50f1873e113523967806f4da2afe385462ff9b'
 +        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
 +        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
 +        archive.gzip_uncompress(initrd_path_gz, initrd_path)
 +
-+        self.vm.set_console()
++    qdev_prop_set_uint32(splitter, "num-lines", 2);
 +        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
 +                               'console=ttyS0,115200 '
 +                               'usbcore.nousb '
 +                               'panic=-1 noreboot')
 +        self.vm.add_args('-kernel', kernel_path,
 +                         '-dtb', dtb_path,
 +                         '-initrd', initrd_path,
 +                         '-append', kernel_command_line,
 +                         '-no-reboot')
 +        self.vm.launch()
 +        self.wait_for_console_pattern('Boot successful.')
 +
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
++    qdev_realize_and_unref(splitter, NULL, &error_fatal);
 +                                                'Allwinner sun4i/sun5i')
 +        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
 +                                                'system-control@1c00000')
 +        exec_command_and_wait_for_pattern(self, 'reboot',
 +                                                'reboot: Restarting system')
 +
-     def test_s390x_s390_ccw_virtio(self):
++    qdev_connect_gpio_out(splitter, 0, out1);
-         """
++    qdev_connect_gpio_out(splitter, 1, out2);
-         :avocado: tags=arch:s390x
++    qdev_connect_gpio_out_named(src, outname, 0,
 +                                qdev_get_gpio_in(splitter, 0));
 +}
 +
  static void realview_init(MachineState *machine,
                            enum realview_board_type board_type)
  {
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
      DeviceState *dev, *sysctl, *gpio2, *pl041;
      SysBusDevice *busdev;
      qemu_irq pic[64];
 -    qemu_irq mmc_irq[2];
      PCIBus *pci_bus = NULL;
      NICInfo *nd;
      DriveInfo *dinfo;
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
       * and the PL061 has them the other way about. Also the card
       * detect line is inverted.
       */
 -    mmc_irq[0] = qemu_irq_split(
 -        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
 -        qdev_get_gpio_in(gpio2, 1));
 -    mmc_irq[1] = qemu_irq_split(
 -        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
 -        qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
 -    qdev_connect_gpio_out_named(dev, "card-read-only", 0, mmc_irq[0]);
 -    qdev_connect_gpio_out_named(dev, "card-inserted", 0, mmc_irq[1]);
 +    split_irq_from_named(dev, "card-read-only",
 +                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
 +                   qdev_get_gpio_in(gpio2, 1));
 +
 +    split_irq_from_named(dev, "card-inserted",
 +                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
 +                   qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
 +
      dinfo = drive_get(IF_SD, 0, 0);
      if (dinfo) {
          DeviceState *card;
 --
-.20.1
+.25.1

-[PULL 06/15] tests/boot_linux_console: Add a SD card test for the CubieBoard
+[PULL 27/31] hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Zongyuan Li <zongyuan.li@smartx.com>
-The kernel image and DeviceTree blob are built by the Armbian
+Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-project (based on Debian):
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-https://docs.armbian.com/Developer-Guide_Build-Preparation/
+Message-id: 20220324181557.203805-3-zongyuan.li@smartx.com
 The cpio image used comes from the linux-build-test project:
 https://github.com/groeck/linux-build-test
 If ARM is a target being built, "make check-acceptance" will
 automatically include this test by the use of the "arch:arm" tags.
 Alternatively, this test can be run using:
   $ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
   console: Uncompressing Linux... done, booting the kernel.
   console: Booting Linux on physical CPU 0x0
   console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
   [...]
   console: ahci-sunxi 1c18000.sata: Linked as a consumer to regulator.4
   console: ahci-sunxi 1c18000.sata: controller can't do 64bit DMA, forcing 32bit
   console: ahci-sunxi 1c18000.sata: AHCI 0001.0000 32 slots 1 ports 1.5 Gbps 0x1 impl platform mode
   console: ahci-sunxi 1c18000.sata: flags: ncq only
   console: scsi host0: ahci-sunxi
   console: ata1: SATA max UDMA/133 mmio [mem 0x01c18000-0x01c18fff] port 0x100 irq 27
   console: of_cfs_init
   console: of_cfs_init: OK
   console: vcc3v0: disabling
   console: vcc5v0: disabling
   console: usb1-vbus: disabling
   console: usb2-vbus: disabling
   console: ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
   console: ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100
   console: ata1.00: 40960 sectors, multi 16: LBA48 NCQ (depth 32)
   console: ata1.00: applying bridge limits
   console: ata1.00: configured for UDMA/100
   console: scsi 0:0:0:0: Direct-Access     ATA      QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
   console: sd 0:0:0:0: Attached scsi generic sg0 type 0
   console: sd 0:0:0:0: [sda] 40960 512-byte logical blocks: (21.0 MB/20.0 MiB)
   console: sd 0:0:0:0: [sda] Write Protect is off
   console: sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
   console: sd 0:0:0:0: [sda] Attached SCSI disk
   console: EXT4-fs (sda): mounting ext2 file system using the ext4 subsystem
   console: EXT4-fs (sda): mounted filesystem without journal. Opts: (null)
   console: VFS: Mounted root (ext2 filesystem) readonly on device 8:0.
   [...]
   console: cat /proc/partitions
   console: / # cat /proc/partitions
   console: major minor  #blocks  name
   console: 1        0       4096 ram0
   console: 1        1       4096 ram1
   console: 1        2       4096 ram2
   console: 1        3       4096 ram3
   console: 8        0      20480 sda
   console: reboot
   console: / # reboot
   [...]
   console: sd 0:0:0:0: [sda] Synchronizing SCSI cache
   console: reboot: Restarting system
   PASS (48.39 s)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20191230110953.25496-3-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/acceptance/boot_linux_console.py | 44 ++++++++++++++++++++++++++
+ hw/arm/stellaris.c | 15 +++++++++++++--
-file changed, 44 insertions(+)
+file changed, 13 insertions(+), 2 deletions(-)
-diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/boot_linux_console.py
+--- a/hw/arm/stellaris.c
-+++ b/tests/acceptance/boot_linux_console.py
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
+@@ -XXX,XX +XXX,XX @@
-         exec_command_and_wait_for_pattern(self, 'reboot',
-                                                 'reboot: Restarting system')
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
-+    def test_arm_cubieboard_sata(self):
++#include "hw/core/split-irq.h"
-+        """
+ #include "hw/sysbus.h"
-+        :avocado: tags=arch:arm
+ #include "hw/sd/sd.h"
-+        :avocado: tags=machine:cubieboard
+ #include "hw/ssi/ssi.h"
-+        """
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+             DeviceState *ssddev;
-+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+             DriveInfo *dinfo;
-+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+             DeviceState *carddev;
-+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
++            DeviceState *gpio_d_splitter;
-+        kernel_path = self.extract_from_deb(deb_path,
+             BlockBackend *blk;
-+                                            '/boot/vmlinuz-4.20.7-sunxi')
-+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+             /*
-+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+        rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
+                                    &error_fatal);
-+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-+                      'arm/rootfs-armv5.ext2.gz')
+             ssddev = ssi_create_peripheral(bus, "ssd0323");
-+        rootfs_hash = '093e89d2b4d982234bf528bc9fb2f2f17a9d1f93'
+-            gpio_out[GPIO_D][0] = qemu_irq_split(
-+        rootfs_path_gz = self.fetch_asset(rootfs_url, asset_hash=rootfs_hash)
+-                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
 +        rootfs_path = os.path.join(self.workdir, 'rootfs.cpio')
 +        archive.gzip_uncompress(rootfs_path_gz, rootfs_path)
 +
-+        self.vm.set_console()
++            gpio_d_splitter = qdev_new(TYPE_SPLIT_IRQ);
-+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
++            qdev_prop_set_uint32(gpio_d_splitter, "num-lines", 2);
-+                               'console=ttyS0,115200 '
++            qdev_realize_and_unref(gpio_d_splitter, NULL, &error_fatal);
-+                               'usbcore.nousb '
++            qdev_connect_gpio_out(
-+                               'root=/dev/sda ro '
++                    gpio_d_splitter, 0,
-+                               'panic=-1 noreboot')
++                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0));
-+        self.vm.add_args('-kernel', kernel_path,
++            qdev_connect_gpio_out(
-+                         '-dtb', dtb_path,
++                    gpio_d_splitter, 1,
-+                         '-drive', 'if=none,format=raw,id=disk0,file='
+                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
-+                                   + rootfs_path,
++            gpio_out[GPIO_D][0] = qdev_get_gpio_in(gpio_d_splitter, 0);
 +                         '-device', 'ide-hd,bus=ide.0,drive=disk0',
 +                         '-append', kernel_command_line,
 +                         '-no-reboot')
 +        self.vm.launch()
 +        self.wait_for_console_pattern('Boot successful.')
 +
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
-+                                                'Allwinner sun4i/sun5i')
-+        exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
+             /* Make sure the select pin is high.  */
 +                                                'sda')
 +        exec_command_and_wait_for_pattern(self, 'reboot',
 +                                                'reboot: Restarting system')
 +
      def test_s390x_s390_ccw_virtio(self):
          """
          :avocado: tags=arch:s390x
 --
-.20.1
+.25.1

-[PULL 13/15] arm/gicv3: update virtual irq state after IAR register read
+[PULL 28/31] hw/core/irq: remove unused 'qemu_irq_split' function
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+From: Zongyuan Li <zongyuan.li@smartx.com>
-The IAR0/IAR1 register is used to acknowledge an interrupt - a read of the
+Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-register activates the highest priority pending interrupt and provides its
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-interrupt ID. Activating an interrupt can change the CPU's virtual interrupt
+Message-id: 20220324181557.203805-5-zongyuan.li@smartx.com
-state - this change makes sure the virtual irq state is updated.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/811
 Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200113154607.97032-1-jeff.kubascik@dornerworks.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_cpuif.c | 3 +++
+ include/hw/irq.h |  5 -----
-file changed, 3 insertions(+)
+ hw/core/irq.c    | 15 ---------------
 files changed, 20 deletions(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/include/hw/irq.h b/include/hw/irq.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/include/hw/irq.h
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/include/hw/irq.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
+ /* Returns a new IRQ with opposite polarity.  */
-     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
+ qemu_irq qemu_irq_invert(qemu_irq irq);
-                              gicv3_redist_affid(cs), intid);
-+
+-/* Returns a new IRQ which feeds into both the passed IRQs.
-+    gicv3_cpuif_virt_update(cs);
+- * It's probably better to use the TYPE_SPLIT_IRQ device instead.
-+
+- */
-     return intid;
+-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
 -
  /* For internal use in qtest.  Similar to qemu_irq_split, but operating
     on an existing vector of qemu_irq.  */
  void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
 diff --git a/hw/core/irq.c b/hw/core/irq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/irq.c
 +++ b/hw/core/irq.c
@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_invert(qemu_irq irq)
      return qemu_allocate_irq(qemu_notirq, irq, 0);
  }
+-static void qemu_splitirq(void *opaque, int line, int level)
+-{
+-    struct IRQState **irq = opaque;
+-    irq[0]->handler(irq[0]->opaque, irq[0]->n, level);
+-    irq[1]->handler(irq[1]->opaque, irq[1]->n, level);
+-}
+-
+-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
+-{
+-    qemu_irq *s = g_new0(qemu_irq, 2);
+-    s[0] = irq1;
+-    s[1] = irq2;
+-    return qemu_allocate_irq(qemu_splitirq, s, 0);
+-}
+-
+ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
+ {
+     int i;
 --
-.20.1
+.25.1

-[PULL 14/15] target/arm: Return correct IL bit in merge_syn_data_abort
+[PULL 29/31] hw/arm/virt: impact of gic-version on max CPUs
-From: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-The IL bit is set for 32-bit instructions, thus passing false
+Describe that the gic-version influences the maximum number of CPUs.
 with the is_16bit parameter to syn_data_abort_with_iss() makes
 a syn mask that always has the IL bit set.
-Pass is_16bit as true to make the initial syn mask have IL=0,
+Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-so that the final IL value comes from or'ing template_syn.
+Message-id: 20220413231456.35811-1-heinrich.schuchardt@canonical.com
+[PMM: minor punctuation tweaks]
 Cc: qemu-stable@nongnu.org
 Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
 Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200117004618.2742-2-richard.henderson@linaro.org
 [rth: Extracted this as a self-contained bug fix from a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tlb_helper.c | 2 +-
+ docs/system/arm/virt.rst | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tlb_helper.c
+--- a/docs/system/arm/virt.rst
-+++ b/target/arm/tlb_helper.c
++++ b/docs/system/arm/virt.rst
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+@@ -XXX,XX +XXX,XX @@ gic-version
-         syn = syn_data_abort_with_iss(same_el,
+   Valid values are:
-, 0, 0, 0, 0,
-                                       ea, 0, s1ptw, is_write, fsc,
+   ``2``
--                                      false);
+-    GICv2
-+                                      true);
++    GICv2. Note that this limits the number of CPUs to 8.
-         /* Merge the runtime syndrome with the template syndrome.  */
+   ``3``
-         syn |= template_syn;
+-    GICv3
-     }
++    GICv3. This allows up to 512 CPUs.
    ``host``
      Use the same GIC version the host provides, when using KVM
    ``max``
 --
-.20.1
+.25.1

-[PULL 15/15] target/arm: Set ISSIs16Bit in make_issinfo
+[PULL 30/31] hw/misc: Add PWRON STRAP bit fields in GCR module
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Hao Wu <wuhaotsh@google.com>
-During the conversion to decodetree, the setting of
+Similar to the Aspeed code in include/misc/aspeed_scu.h, we define
-ISSIs16Bit got lost.  This causes the guest os to
+the PWRON STRAP fields in their corresponding module for NPCM7XX.
 incorrectly adjust trapping memory operations.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
+Reviewed-by: Patrick Venture <venture@google.com>
-Reported-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
+Message-id: 20220411165842.3912945-2-wuhaotsh@google.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200117004618.2742-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 3 +++
+ include/hw/misc/npcm7xx_gcr.h | 30 ++++++++++++++++++++++++++++++
-file changed, 3 insertions(+)
+file changed, 30 insertions(+)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/include/hw/misc/npcm7xx_gcr.h b/include/hw/misc/npcm7xx_gcr.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/include/hw/misc/npcm7xx_gcr.h
-+++ b/target/arm/translate.c
++++ b/include/hw/misc/npcm7xx_gcr.h
-@@ -XXX,XX +XXX,XX @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
+@@ -XXX,XX +XXX,XX @@
-     /* ISS not valid if writeback */
+ #include "exec/memory.h"
-     if (p && !w) {
+ #include "hw/sysbus.h"
-         ret = rd;
-+        if (s->base.pc_next - s->pc_curr == 2) {
++/*
-+            ret |= ISSIs16Bit;
++ * NPCM7XX PWRON STRAP bit fields
-+        }
++ * 12: SPI0 powered by VSBV3 at 1.8V
-     } else {
++ * 11: System flash attached to BMC
-         ret = ISSInvalid;
++ * 10: BSP alternative pins.
-     }
++ * 9:8: Flash UART command route enabled.
 + * 7: Security enabled.
 + * 6: HI-Z state control.
 + * 5: ECC disabled.
 + * 4: Reserved
 + * 3: JTAG2 enabled.
 + * 2:0: CPU and DRAM clock frequency.
 + */
 +#define NPCM7XX_PWRON_STRAP_SPI0F18                 BIT(12)
 +#define NPCM7XX_PWRON_STRAP_SFAB                    BIT(11)
 +#define NPCM7XX_PWRON_STRAP_BSPA                    BIT(10)
 +#define NPCM7XX_PWRON_STRAP_FUP(x)                  ((x) << 8)
 +#define     FUP_NORM_UART2      3
 +#define     FUP_PROG_UART3      2
 +#define     FUP_PROG_UART2      1
 +#define     FUP_NORM_UART3      0
 +#define NPCM7XX_PWRON_STRAP_SECEN                   BIT(7)
 +#define NPCM7XX_PWRON_STRAP_HIZ                     BIT(6)
 +#define NPCM7XX_PWRON_STRAP_ECC                     BIT(5)
 +#define NPCM7XX_PWRON_STRAP_RESERVE1                BIT(4)
 +#define NPCM7XX_PWRON_STRAP_J2EN                    BIT(3)
 +#define NPCM7XX_PWRON_STRAP_CKFRQ(x)                (x)
 +#define     CKFRQ_SKIPINIT      0x000
 +#define     CKFRQ_DEFAULT       0x111
 +
  /*
   * Number of registers in our device state structure. Don't change this without
   * incrementing the version_id in the vmstate.
 --
-.20.1
+.25.1

-[PULL 10/15] target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
+[PULL 31/31] hw/arm: Use bit fields for NPCM7XX PWRON STRAPs
-From: Masahiro Yamada <masahiroy@kernel.org>
+From: Hao Wu <wuhaotsh@google.com>
-According to the specification "Semihosting for AArch32 and Aarch64",
+This patch uses the defined fields to describe PWRON STRAPs for
-the SYS_OPEN operation should return:
+better readability.
- - A nonzero handle if the call is successful
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
- - -1 if the call is not successful
+Reviewed-by: Patrick Venture <venture@google.com>
+Message-id: 20220411165842.3912945-3-wuhaotsh@google.com
-So, it should never return 0.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
 code hand out its own file descriptors"), the guest fd matched to the
 host fd. It returned a nonzero handle on success since the fd 0 is
 already used for stdin.
 Now that the guest fd is the index of guestfd_array, it starts from 0.
 I noticed this issue particularly because Trusted Firmware-A built with
 PLAT=qemu is no longer working. Its io_semihosting driver only handles
 a positive return value as a valid filehandle.
 Basically, there are two ways to fix this:
   - Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
     increment/decrement to convert the guestfd and the array index back
     and forth.
   - Keep using guestfd as the index of guestfs_array. The first entry
     of guestfs_array is left unused.
 I thought the latter is simpler. We end up with wasting a small piece
 of memory for the unused first entry of guestfd_array, but this is
 probably not a big deal.
 Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200109041228.10131-1-masahiroy@kernel.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arm-semi.c | 5 +++--
+ hw/arm/npcm7xx_boards.c | 24 +++++++++++++++++++-----
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 19 insertions(+), 5 deletions(-)
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arm-semi.c
+--- a/hw/arm/npcm7xx_boards.c
-+++ b/target/arm/arm-semi.c
++++ b/hw/arm/npcm7xx_boards.c
-@@ -XXX,XX +XXX,XX @@ static int alloc_guestfd(void)
+@@ -XXX,XX +XXX,XX @@
-         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
+ #include "sysemu/sysemu.h"
-     }
+ #include "sysemu/block-backend.h"
--    for (i = 0; i < guestfd_array->len; i++) {
+-#define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
-+    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
+-#define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
-+    for (i = 1; i < guestfd_array->len; i++) {
+-#define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
-         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
+-#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
+-#define MORI_BMC_POWER_ON_STRAPS 0x00001fff
-         if (gf->type == GuestFDUnused) {
++#define NPCM7XX_POWER_ON_STRAPS_DEFAULT (           \
-@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
++        NPCM7XX_PWRON_STRAP_SPI0F18 |               \
-         return NULL;
++        NPCM7XX_PWRON_STRAP_SFAB |                  \
-     }
++        NPCM7XX_PWRON_STRAP_BSPA |                  \
++        NPCM7XX_PWRON_STRAP_FUP(FUP_NORM_UART2) |   \
--    if (guestfd < 0 || guestfd >= guestfd_array->len) {
++        NPCM7XX_PWRON_STRAP_SECEN |                 \
-+    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
++        NPCM7XX_PWRON_STRAP_HIZ |                   \
-         return NULL;
++        NPCM7XX_PWRON_STRAP_ECC |                   \
-     }
++        NPCM7XX_PWRON_STRAP_RESERVE1 |              \
 +        NPCM7XX_PWRON_STRAP_J2EN |                  \
 +        NPCM7XX_PWRON_STRAP_CKFRQ(CKFRQ_DEFAULT))
 +
 +#define NPCM750_EVB_POWER_ON_STRAPS ( \
 +        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_J2EN)
 +#define QUANTA_GSJ_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 +#define QUANTA_GBS_POWER_ON_STRAPS ( \
 +        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_SFAB)
 +#define KUDO_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 +#define MORI_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
  static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 --
-.20.1
+.25.1

Latest arm queue, a mixed bag of features and bug fixes.

thanks
-- PMM

The following changes since commit cbf01142b2aef0c0b4e995cecd7e79d342bbc47e:

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200115' into staging (2020-01-17 12:13:17 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200117-1

for you to fetch changes up to 1a1fbc6cbb34c26d43d8360c66c1d21681af14a9:

target/arm: Set ISSIs16Bit in make_issinfo (2020-01-17 14:27:16 +0000)

----------------------------------------------------------------
Add model of the Netduino Plus 2 board
Some allwinner-a10 code cleanup
New test cases for cubieboard
target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle
i.MX: add an emulation for RNGC device
target/arm: adjust program counter for wfi exception in AArch32
arm/gicv3: update virtual irq state after IAR register read
Set IL bit correctly for syndrome information for data aborts

----------------------------------------------------------------
Alistair Francis (4):
      hw/misc: Add the STM32F4xx Sysconfig device
      hw/misc: Add the STM32F4xx EXTI device
      hw/arm: Add the STM32F4xx SoC
      hw/arm: Add the Netduino Plus 2

Jeff Kubascik (3):
      target/arm: adjust program counter for wfi exception in AArch32
      arm/gicv3: update virtual irq state after IAR register read
      target/arm: Return correct IL bit in merge_syn_data_abort

Martin Kaiser (1):
      i.MX: add an emulation for RNGC

Masahiro Yamada (1):
      target/arm/arm-semi: fix SYS_OPEN to return nonzero filehandle

Philippe Mathieu-Daudé (5):
      tests/boot_linux_console: Add initrd test for the CubieBoard
      tests/boot_linux_console: Add a SD card test for the CubieBoard
      hw/arm/allwinner-a10: Move SoC definitions out of header
      hw/arm/allwinner-a10: Simplify by passing IRQs with qdev_pass_gpios()
      hw/arm/allwinner-a10: Remove local qemu_irq variables

Richard Henderson (1):
      target/arm: Set ISSIs16Bit in make_issinfo

hw/arm/Makefile.objs                   |   2 +
 hw/misc/Makefile.objs                  |   3 +
 include/hw/arm/allwinner-a10.h         |   7 -
 include/hw/arm/fsl-imx25.h             |   5 +
 include/hw/arm/stm32f405_soc.h         |  73 ++++++++
 include/hw/misc/imx_rngc.h             |  35 ++++
 include/hw/misc/stm32f4xx_exti.h       |  60 +++++++
 include/hw/misc/stm32f4xx_syscfg.h     |  61 +++++++
 hw/arm/allwinner-a10.c                 |  39 +++--
 hw/arm/fsl-imx25.c                     |  11 ++
 hw/arm/netduinoplus2.c                 |  52 ++++++
 hw/arm/stm32f405_soc.c                 | 302 +++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_cpuif.c              |   3 +
 hw/misc/imx_rngc.c                     | 278 ++++++++++++++++++++++++++++++
 hw/misc/stm32f4xx_exti.c               | 188 ++++++++++++++++++++
 hw/misc/stm32f4xx_syscfg.c             | 171 +++++++++++++++++++
 target/arm/arm-semi.c                  |   5 +-
 target/arm/op_helper.c                 |   7 +-
 target/arm/tlb_helper.c                |   2 +-
 target/arm/translate.c                 |   3 +
 MAINTAINERS                            |  14 ++
 default-configs/arm-softmmu.mak        |   1 +
 hw/arm/Kconfig                         |  10 ++
 hw/misc/Kconfig                        |   6 +
 hw/misc/trace-events                   |  11 ++
 tests/acceptance/boot_linux_console.py |  85 ++++++++++
 26 files changed, 1405 insertions(+), 29 deletions(-)
 create mode 100644 include/hw/arm/stm32f405_soc.h
 create mode 100644 include/hw/misc/imx_rngc.h
 create mode 100644 include/hw/misc/stm32f4xx_exti.h
 create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
 create mode 100644 hw/arm/netduinoplus2.c
 create mode 100644 hw/arm/stm32f405_soc.c
 create mode 100644 hw/misc/imx_rngc.c
 create mode 100644 hw/misc/stm32f4xx_exti.c
 create mode 100644 hw/misc/stm32f4xx_syscfg.c

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 49b01423a09cef2ca832ff73a84a996568f1a8fc.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs              |   1 +
 include/hw/misc/stm32f4xx_syscfg.h |  61 ++++++++++
 hw/misc/stm32f4xx_syscfg.c         | 171 +++++++++++++++++++++++++++++
 default-configs/arm-softmmu.mak    |   1 +
 hw/arm/Kconfig                     |   9 ++
 hw/misc/Kconfig                    |   3 +
 hw/misc/trace-events               |   6 +
 7 files changed, 252 insertions(+)
 create mode 100644 include/hw/misc/stm32f4xx_syscfg.h
 create mode 100644 hw/misc/stm32f4xx_syscfg.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_SLAVIO) += slavio_misc.o
 common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
 common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
+common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
 obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
 obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
 obj-$(CONFIG_MIPS_ITU) += mips_itu.o
diff --git a/include/hw/misc/stm32f4xx_syscfg.h b/include/hw/misc/stm32f4xx_syscfg.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/stm32f4xx_syscfg.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4xx SYSCFG
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_STM_SYSCFG_H
+#define HW_STM_SYSCFG_H
+
+#include "hw/sysbus.h"
+#include "hw/hw.h"
+
+#define SYSCFG_MEMRMP  0x00
+#define SYSCFG_PMC     0x04
+#define SYSCFG_EXTICR1 0x08
+#define SYSCFG_EXTICR2 0x0C
+#define SYSCFG_EXTICR3 0x10
+#define SYSCFG_EXTICR4 0x14
+#define SYSCFG_CMPCR   0x20
+
+#define TYPE_STM32F4XX_SYSCFG "stm32f4xx-syscfg"
+#define STM32F4XX_SYSCFG(obj) \
+    OBJECT_CHECK(STM32F4xxSyscfgState, (obj), TYPE_STM32F4XX_SYSCFG)
+
+#define SYSCFG_NUM_EXTICR 4
+
+typedef struct {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion mmio;
+
+    uint32_t syscfg_memrmp;
+    uint32_t syscfg_pmc;
+    uint32_t syscfg_exticr[SYSCFG_NUM_EXTICR];
+    uint32_t syscfg_cmpcr;
+
+    qemu_irq irq;
+    qemu_irq gpio_out[16];
+} STM32F4xxSyscfgState;
+
+#endif
diff --git a/hw/misc/stm32f4xx_syscfg.c b/hw/misc/stm32f4xx_syscfg.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/stm32f4xx_syscfg.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4xx SYSCFG
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/stm32f4xx_syscfg.h"
+
+static void stm32f4xx_syscfg_reset(DeviceState *dev)
+{
+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(dev);
+
+    s->syscfg_memrmp = 0x00000000;
+    s->syscfg_pmc = 0x00000000;
+    s->syscfg_exticr[0] = 0x00000000;
+    s->syscfg_exticr[1] = 0x00000000;
+    s->syscfg_exticr[2] = 0x00000000;
+    s->syscfg_exticr[3] = 0x00000000;
+    s->syscfg_cmpcr = 0x00000000;
+}
+
+static void stm32f4xx_syscfg_set_irq(void *opaque, int irq, int level)
+{
+    STM32F4xxSyscfgState *s = opaque;
+    int icrreg = irq / 4;
+    int startbit = (irq & 3) * 4;
+    uint8_t config = config = irq / 16;
+
+    trace_stm32f4xx_syscfg_set_irq(irq / 16, irq % 16, level);
+
+    g_assert(icrreg < SYSCFG_NUM_EXTICR);
+
+    if (extract32(s->syscfg_exticr[icrreg], startbit, 4) == config) {
+        qemu_set_irq(s->gpio_out[irq], level);
+        trace_stm32f4xx_pulse_exti(irq);
+   }
+}
+
+static uint64_t stm32f4xx_syscfg_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    STM32F4xxSyscfgState *s = opaque;
+
+    trace_stm32f4xx_syscfg_read(addr);
+
+    switch (addr) {
+    case SYSCFG_MEMRMP:
+        return s->syscfg_memrmp;
+    case SYSCFG_PMC:
+        return s->syscfg_pmc;
+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
+        return s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4];
+    case SYSCFG_CMPCR:
+        return s->syscfg_cmpcr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+        return 0;
+    }
+}
+
+static void stm32f4xx_syscfg_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    STM32F4xxSyscfgState *s = opaque;
+    uint32_t value = val64;
+
+    trace_stm32f4xx_syscfg_write(value, addr);
+
+    switch (addr) {
+    case SYSCFG_MEMRMP:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing the memory mapping isn't supported " \
+                      "in QEMU\n", __func__);
+        return;
+    case SYSCFG_PMC:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing the memory mapping isn't supported " \
+                      "in QEMU\n", __func__);
+        return;
+    case SYSCFG_EXTICR1...SYSCFG_EXTICR4:
+        s->syscfg_exticr[addr / 4 - SYSCFG_EXTICR1 / 4] = (value & 0xFFFF);
+        return;
+    case SYSCFG_CMPCR:
+        s->syscfg_cmpcr = value;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%"HWADDR_PRIx"\n", __func__, addr);
+    }
+}
+
+static const MemoryRegionOps stm32f4xx_syscfg_ops = {
+    .read = stm32f4xx_syscfg_read,
+    .write = stm32f4xx_syscfg_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void stm32f4xx_syscfg_init(Object *obj)
+{
+    STM32F4xxSyscfgState *s = STM32F4XX_SYSCFG(obj);
+
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+
+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_syscfg_ops, s,
+                          TYPE_STM32F4XX_SYSCFG, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_syscfg_set_irq, 16 * 9);
+    qdev_init_gpio_out(DEVICE(obj), s->gpio_out, 16);
+}
+
+static const VMStateDescription vmstate_stm32f4xx_syscfg = {
+    .name = TYPE_STM32F4XX_SYSCFG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(syscfg_memrmp, STM32F4xxSyscfgState),
+        VMSTATE_UINT32(syscfg_pmc, STM32F4xxSyscfgState),
+        VMSTATE_UINT32_ARRAY(syscfg_exticr, STM32F4xxSyscfgState,
+                             SYSCFG_NUM_EXTICR),
+        VMSTATE_UINT32(syscfg_cmpcr, STM32F4xxSyscfgState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void stm32f4xx_syscfg_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = stm32f4xx_syscfg_reset;
+    dc->vmsd = &vmstate_stm32f4xx_syscfg;
+}
+
+static const TypeInfo stm32f4xx_syscfg_info = {
+    .name          = TYPE_STM32F4XX_SYSCFG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F4xxSyscfgState),
+    .instance_init = stm32f4xx_syscfg_init,
+    .class_init    = stm32f4xx_syscfg_class_init,
+};
+
+static void stm32f4xx_syscfg_register_types(void)
+{
+    type_register_static(&stm32f4xx_syscfg_info);
+}
+
+type_init(stm32f4xx_syscfg_register_types)
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_Z2=y
 CONFIG_COLLIE=y
 CONFIG_ASPEED_SOC=y
 CONFIG_NETDUINO2=y
+CONFIG_NETDUINOPLUS2=y
 CONFIG_MPS2=y
 CONFIG_RASPI=y
 CONFIG_DIGIC=y
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config NETDUINO2
     bool
     select STM32F205_SOC
 
+config NETDUINOPLUS2
+    bool
+    select STM32F405_SOC
+
 config NSERIES
     bool
     select OMAP
@@ -XXX,XX +XXX,XX @@ config STM32F205_SOC
     select STM32F2XX_ADC
     select STM32F2XX_SPI
 
+config STM32F405_SOC
+    bool
+    select ARM_V7M
+    select STM32F4XX_SYSCFG
+
 config XLNX_ZYNQMP_ARM
     bool
     select AHCI
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IMX
 config STM32F2XX_SYSCFG
     bool
 
+config STM32F4XX_SYSCFG
+    bool
+
 config MIPS_ITU
     bool
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ mos6522_set_sr_int(void) "set sr_int"
 mos6522_write(uint64_t addr, uint64_t val) "reg=0x%"PRIx64 " val=0x%"PRIx64
 mos6522_read(uint64_t addr, unsigned val) "reg=0x%"PRIx64 " val=0x%x"
 
+# stm32f4xx_syscfg
+stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
+stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
+stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
+stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+
 # tz-mpc.c
 tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: ef941d59fd8658589d34ed432e1d6dfdcf7fb1d0.1576658572.git.alistair@alistair23.me
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs            |   1 +
 include/hw/misc/stm32f4xx_exti.h |  60 ++++++++++
 hw/misc/stm32f4xx_exti.c         | 188 +++++++++++++++++++++++++++++++
 hw/arm/Kconfig                   |   1 +
 hw/misc/Kconfig                  |   3 +
 hw/misc/trace-events             |   5 +
 6 files changed, 258 insertions(+)
 create mode 100644 include/hw/misc/stm32f4xx_exti.h
 create mode 100644 hw/misc/stm32f4xx_exti.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 common-obj-$(CONFIG_ZYNQ) += zynq-xadc.o
 common-obj-$(CONFIG_STM32F2XX_SYSCFG) += stm32f2xx_syscfg.o
 common-obj-$(CONFIG_STM32F4XX_SYSCFG) += stm32f4xx_syscfg.o
+common-obj-$(CONFIG_STM32F4XX_EXTI) += stm32f4xx_exti.o
 obj-$(CONFIG_MIPS_CPS) += mips_cmgcr.o
 obj-$(CONFIG_MIPS_CPS) += mips_cpc.o
 obj-$(CONFIG_MIPS_ITU) += mips_itu.o
diff --git a/include/hw/misc/stm32f4xx_exti.h b/include/hw/misc/stm32f4xx_exti.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/stm32f4xx_exti.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4XX EXTI
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_STM_EXTI_H
+#define HW_STM_EXTI_H
+
+#include "hw/sysbus.h"
+#include "hw/hw.h"
+
+#define EXTI_IMR   0x00
+#define EXTI_EMR   0x04
+#define EXTI_RTSR  0x08
+#define EXTI_FTSR  0x0C
+#define EXTI_SWIER 0x10
+#define EXTI_PR    0x14
+
+#define TYPE_STM32F4XX_EXTI "stm32f4xx-exti"
+#define STM32F4XX_EXTI(obj) \
+    OBJECT_CHECK(STM32F4xxExtiState, (obj), TYPE_STM32F4XX_EXTI)
+
+#define NUM_GPIO_EVENT_IN_LINES 16
+#define NUM_INTERRUPT_OUT_LINES 16
+
+typedef struct {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    uint32_t exti_imr;
+    uint32_t exti_emr;
+    uint32_t exti_rtsr;
+    uint32_t exti_ftsr;
+    uint32_t exti_swier;
+    uint32_t exti_pr;
+
+    qemu_irq irq[NUM_INTERRUPT_OUT_LINES];
+} STM32F4xxExtiState;
+
+#endif
diff --git a/hw/misc/stm32f4xx_exti.c b/hw/misc/stm32f4xx_exti.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/stm32f4xx_exti.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F4XX EXTI
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+#include "hw/misc/stm32f4xx_exti.h"
+
+static void stm32f4xx_exti_reset(DeviceState *dev)
+{
+    STM32F4xxExtiState *s = STM32F4XX_EXTI(dev);
+
+    s->exti_imr = 0x00000000;
+    s->exti_emr = 0x00000000;
+    s->exti_rtsr = 0x00000000;
+    s->exti_ftsr = 0x00000000;
+    s->exti_swier = 0x00000000;
+    s->exti_pr = 0x00000000;
+}
+
+static void stm32f4xx_exti_set_irq(void *opaque, int irq, int level)
+{
+    STM32F4xxExtiState *s = opaque;
+
+    trace_stm32f4xx_exti_set_irq(irq, level);
+
+    if (((1 << irq) & s->exti_rtsr) && level) {
+        /* Rising Edge */
+        s->exti_pr |= 1 << irq;
+    }
+
+    if (((1 << irq) & s->exti_ftsr) && !level) {
+        /* Falling Edge */
+        s->exti_pr |= 1 << irq;
+    }
+
+    if (!((1 << irq) & s->exti_imr)) {
+        /* Interrupt is masked */
+        return;
+    }
+    qemu_irq_pulse(s->irq[irq]);
+}
+
+static uint64_t stm32f4xx_exti_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    STM32F4xxExtiState *s = opaque;
+
+    trace_stm32f4xx_exti_read(addr);
+
+    switch (addr) {
+    case EXTI_IMR:
+        return s->exti_imr;
+    case EXTI_EMR:
+        return s->exti_emr;
+    case EXTI_RTSR:
+        return s->exti_rtsr;
+    case EXTI_FTSR:
+        return s->exti_ftsr;
+    case EXTI_SWIER:
+        return s->exti_swier;
+    case EXTI_PR:
+        return s->exti_pr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "STM32F4XX_exti_read: Bad offset %x\n", (int)addr);
+        return 0;
+    }
+    return 0;
+}
+
+static void stm32f4xx_exti_write(void *opaque, hwaddr addr,
+                       uint64_t val64, unsigned int size)
+{
+    STM32F4xxExtiState *s = opaque;
+    uint32_t value = (uint32_t) val64;
+
+    trace_stm32f4xx_exti_write(addr, value);
+
+    switch (addr) {
+    case EXTI_IMR:
+        s->exti_imr = value;
+        return;
+    case EXTI_EMR:
+        s->exti_emr = value;
+        return;
+    case EXTI_RTSR:
+        s->exti_rtsr = value;
+        return;
+    case EXTI_FTSR:
+        s->exti_ftsr = value;
+        return;
+    case EXTI_SWIER:
+        s->exti_swier = value;
+        return;
+    case EXTI_PR:
+        /* This bit is cleared by writing a 1 to it */
+        s->exti_pr &= ~value;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "STM32F4XX_exti_write: Bad offset %x\n", (int)addr);
+    }
+}
+
+static const MemoryRegionOps stm32f4xx_exti_ops = {
+    .read = stm32f4xx_exti_read,
+    .write = stm32f4xx_exti_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void stm32f4xx_exti_init(Object *obj)
+{
+    STM32F4xxExtiState *s = STM32F4XX_EXTI(obj);
+    int i;
+
+    for (i = 0; i < NUM_INTERRUPT_OUT_LINES; i++) {
+        sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq[i]);
+    }
+
+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_exti_ops, s,
+                          TYPE_STM32F4XX_EXTI, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_in(DEVICE(obj), stm32f4xx_exti_set_irq,
+                      NUM_GPIO_EVENT_IN_LINES);
+}
+
+static const VMStateDescription vmstate_stm32f4xx_exti = {
+    .name = TYPE_STM32F4XX_EXTI,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(exti_imr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_emr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_rtsr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_ftsr, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_swier, STM32F4xxExtiState),
+        VMSTATE_UINT32(exti_pr, STM32F4xxExtiState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void stm32f4xx_exti_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = stm32f4xx_exti_reset;
+    dc->vmsd = &vmstate_stm32f4xx_exti;
+}
+
+static const TypeInfo stm32f4xx_exti_info = {
+    .name          = TYPE_STM32F4XX_EXTI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F4xxExtiState),
+    .instance_init = stm32f4xx_exti_init,
+    .class_init    = stm32f4xx_exti_class_init,
+};
+
+static void stm32f4xx_exti_register_types(void)
+{
+    type_register_static(&stm32f4xx_exti_info);
+}
+
+type_init(stm32f4xx_exti_register_types)
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
     bool
     select ARM_V7M
     select STM32F4XX_SYSCFG
+    select STM32F4XX_EXTI
 
 config XLNX_ZYNQMP_ARM
     bool
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32F2XX_SYSCFG
 config STM32F4XX_SYSCFG
     bool
 
+config STM32F4XX_EXTI
+    bool
+
 config MIPS_ITU
     bool
 
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
 stm32f4xx_syscfg_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
 stm32f4xx_syscfg_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 
+# stm32f4xx_exti
+stm32f4xx_exti_set_irq(int irq, int leve) "Set EXTI: %d to %d"
+stm32f4xx_exti_read(uint64_t addr) "reg read: addr: 0x%" PRIx64 " "
+stm32f4xx_exti_write(uint64_t addr, uint64_t data) "reg write: addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+
 # tz-mpc.c
 tz_mpc_reg_read(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs read: offset 0x%x data 0x%" PRIx64 " size %u"
 tz_mpc_reg_write(uint32_t offset, uint64_t data, unsigned size) "TZ MPC regs write: offset 0x%x data 0x%" PRIx64 " size %u"
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1d145c4c13e5fa140caf131232a6f524c88fcd72.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs           |   1 +
 include/hw/arm/stm32f405_soc.h |  73 ++++++++
 hw/arm/stm32f405_soc.c         | 302 +++++++++++++++++++++++++++++++++
 MAINTAINERS                    |   8 +
 4 files changed, 384 insertions(+)
 create mode 100644 include/hw/arm/stm32f405_soc.h
 create mode 100644 hw/arm/stm32f405_soc.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_STRONGARM) += strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
+obj-$(CONFIG_STM32F405_SOC) += stm32f405_soc.o
 obj-$(CONFIG_XLNX_ZYNQMP_ARM) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_XLNX_VERSAL) += xlnx-versal.o xlnx-versal-virt.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
diff --git a/include/hw/arm/stm32f405_soc.h b/include/hw/arm/stm32f405_soc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/stm32f405_soc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F405 SoC
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef HW_ARM_STM32F405_SOC_H
+#define HW_ARM_STM32F405_SOC_H
+
+#include "hw/misc/stm32f4xx_syscfg.h"
+#include "hw/timer/stm32f2xx_timer.h"
+#include "hw/char/stm32f2xx_usart.h"
+#include "hw/adc/stm32f2xx_adc.h"
+#include "hw/misc/stm32f4xx_exti.h"
+#include "hw/or-irq.h"
+#include "hw/ssi/stm32f2xx_spi.h"
+#include "hw/arm/armv7m.h"
+
+#define TYPE_STM32F405_SOC "stm32f405-soc"
+#define STM32F405_SOC(obj) \
+    OBJECT_CHECK(STM32F405State, (obj), TYPE_STM32F405_SOC)
+
+#define STM_NUM_USARTS 7
+#define STM_NUM_TIMERS 4
+#define STM_NUM_ADCS 6
+#define STM_NUM_SPIS 6
+
+#define FLASH_BASE_ADDRESS 0x08000000
+#define FLASH_SIZE (1024 * 1024)
+#define SRAM_BASE_ADDRESS 0x20000000
+#define SRAM_SIZE (192 * 1024)
+
+typedef struct STM32F405State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    char *cpu_type;
+
+    ARMv7MState armv7m;
+
+    STM32F4xxSyscfgState syscfg;
+    STM32F4xxExtiState exti;
+    STM32F2XXUsartState usart[STM_NUM_USARTS];
+    STM32F2XXTimerState timer[STM_NUM_TIMERS];
+    qemu_or_irq adc_irqs;
+    STM32F2XXADCState adc[STM_NUM_ADCS];
+    STM32F2XXSPIState spi[STM_NUM_SPIS];
+
+    MemoryRegion sram;
+    MemoryRegion flash;
+    MemoryRegion flash_alias;
+} STM32F405State;
+
+#endif
diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32F405 SoC
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "exec/address-spaces.h"
+#include "sysemu/sysemu.h"
+#include "hw/arm/stm32f405_soc.h"
+#include "hw/misc/unimp.h"
+
+#define SYSCFG_ADD                     0x40013800
+static const uint32_t usart_addr[] = { 0x40011000, 0x40004400, 0x40004800,
+                                       0x40004C00, 0x40005000, 0x40011400,
+                                       0x40007800, 0x40007C00 };
+/* At the moment only Timer 2 to 5 are modelled */
+static const uint32_t timer_addr[] = { 0x40000000, 0x40000400,
+                                       0x40000800, 0x40000C00 };
+#define ADC_ADDR                       0x40012000
+static const uint32_t spi_addr[] =   { 0x40013000, 0x40003800, 0x40003C00,
+                                       0x40013400, 0x40015000, 0x40015400 };
+#define EXTI_ADDR                      0x40013C00
+
+#define SYSCFG_IRQ               71
+static const int usart_irq[] = { 37, 38, 39, 52, 53, 71, 82, 83 };
+static const int timer_irq[] = { 28, 29, 30, 50 };
+#define ADC_IRQ 18
+static const int spi_irq[] =   { 35, 36, 51, 0, 0, 0 };
+static const int exti_irq[] =  { 6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
+                                 40, 40, 40, 40, 40} ;
+
+
+static void stm32f405_soc_initfn(Object *obj)
+{
+    STM32F405State *s = STM32F405_SOC(obj);
+    int i;
+
+    sysbus_init_child_obj(obj, "armv7m", &s->armv7m, sizeof(s->armv7m),
+                          TYPE_ARMV7M);
+
+    sysbus_init_child_obj(obj, "syscfg", &s->syscfg, sizeof(s->syscfg),
+                          TYPE_STM32F4XX_SYSCFG);
+
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        sysbus_init_child_obj(obj, "usart[*]", &s->usart[i],
+                              sizeof(s->usart[i]), TYPE_STM32F2XX_USART);
+    }
+
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        sysbus_init_child_obj(obj, "timer[*]", &s->timer[i],
+                              sizeof(s->timer[i]), TYPE_STM32F2XX_TIMER);
+    }
+
+    for (i = 0; i < STM_NUM_ADCS; i++) {
+        sysbus_init_child_obj(obj, "adc[*]", &s->adc[i], sizeof(s->adc[i]),
+                              TYPE_STM32F2XX_ADC);
+    }
+
+    for (i = 0; i < STM_NUM_SPIS; i++) {
+        sysbus_init_child_obj(obj, "spi[*]", &s->spi[i], sizeof(s->spi[i]),
+                              TYPE_STM32F2XX_SPI);
+    }
+
+    sysbus_init_child_obj(obj, "exti", &s->exti, sizeof(s->exti),
+                          TYPE_STM32F4XX_EXTI);
+}
+
+static void stm32f405_soc_realize(DeviceState *dev_soc, Error **errp)
+{
+    STM32F405State *s = STM32F405_SOC(dev_soc);
+    MemoryRegion *system_memory = get_system_memory();
+    DeviceState *dev, *armv7m;
+    SysBusDevice *busdev;
+    Error *err = NULL;
+    int i;
+
+    memory_region_init_ram(&s->flash, NULL, "STM32F405.flash", FLASH_SIZE,
+                           &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_init_alias(&s->flash_alias, NULL, "STM32F405.flash.alias",
+                             &s->flash, 0, FLASH_SIZE);
+
+    memory_region_set_readonly(&s->flash, true);
+    memory_region_set_readonly(&s->flash_alias, true);
+
+    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
+    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
+
+    memory_region_init_ram(&s->sram, NULL, "STM32F405.sram", SRAM_SIZE,
+                           &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
+
+    armv7m = DEVICE(&s->armv7m);
+    qdev_prop_set_uint32(armv7m, "num-irq", 96);
+    qdev_prop_set_string(armv7m, "cpu-type", s->cpu_type);
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    object_property_set_link(OBJECT(&s->armv7m), OBJECT(system_memory),
+                                     "memory", &error_abort);
+    object_property_set_bool(OBJECT(&s->armv7m), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    /* System configuration controller */
+    dev = DEVICE(&s->syscfg);
+    object_property_set_bool(OBJECT(&s->syscfg), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, SYSCFG_ADD);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, SYSCFG_IRQ));
+
+    /* Attach UART (uses USART registers) and USART controllers */
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        dev = DEVICE(&(s->usart[i]));
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        object_property_set_bool(OBJECT(&s->usart[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, usart_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
+    }
+
+    /* Timer 2 to 5 */
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        dev = DEVICE(&(s->timer[i]));
+        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
+        object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, timer_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
+    }
+
+    /* ADC device, the IRQs are ORed together */
+    object_initialize_child(OBJECT(s), "adc-orirq", &s->adc_irqs,
+                            sizeof(s->adc_irqs), TYPE_OR_IRQ,
+                            &err, NULL);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    object_property_set_int(OBJECT(&s->adc_irqs), STM_NUM_ADCS,
+                            "num-lines", &err);
+    object_property_set_bool(OBJECT(&s->adc_irqs), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->adc_irqs), 0,
+                          qdev_get_gpio_in(armv7m, ADC_IRQ));
+
+    dev = DEVICE(&(s->adc[i]));
+    object_property_set_bool(OBJECT(&s->adc[i]), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, ADC_ADDR);
+    sysbus_connect_irq(busdev, 0,
+                       qdev_get_gpio_in(DEVICE(&s->adc_irqs), i));
+
+    /* SPI devices */
+    for (i = 0; i < STM_NUM_SPIS; i++) {
+        dev = DEVICE(&(s->spi[i]));
+        object_property_set_bool(OBJECT(&s->spi[i]), true, "realized", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, spi_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, spi_irq[i]));
+    }
+
+    /* EXTI device */
+    dev = DEVICE(&s->exti);
+    object_property_set_bool(OBJECT(&s->exti), true, "realized", &err);
+    if (err != NULL) {
+        error_propagate(errp, err);
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, EXTI_ADDR);
+    for (i = 0; i < 16; i++) {
+        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
+    }
+    for (i = 0; i < 16; i++) {
+        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
+    }
+
+    create_unimplemented_device("timer[7]",    0x40001400, 0x400);
+    create_unimplemented_device("timer[12]",   0x40001800, 0x400);
+    create_unimplemented_device("timer[6]",    0x40001000, 0x400);
+    create_unimplemented_device("timer[13]",   0x40001C00, 0x400);
+    create_unimplemented_device("timer[14]",   0x40002000, 0x400);
+    create_unimplemented_device("RTC and BKP", 0x40002800, 0x400);
+    create_unimplemented_device("WWDG",        0x40002C00, 0x400);
+    create_unimplemented_device("IWDG",        0x40003000, 0x400);
+    create_unimplemented_device("I2S2ext",     0x40003000, 0x400);
+    create_unimplemented_device("I2S3ext",     0x40004000, 0x400);
+    create_unimplemented_device("I2C1",        0x40005400, 0x400);
+    create_unimplemented_device("I2C2",        0x40005800, 0x400);
+    create_unimplemented_device("I2C3",        0x40005C00, 0x400);
+    create_unimplemented_device("CAN1",        0x40006400, 0x400);
+    create_unimplemented_device("CAN2",        0x40006800, 0x400);
+    create_unimplemented_device("PWR",         0x40007000, 0x400);
+    create_unimplemented_device("DAC",         0x40007400, 0x400);
+    create_unimplemented_device("timer[1]",    0x40010000, 0x400);
+    create_unimplemented_device("timer[8]",    0x40010400, 0x400);
+    create_unimplemented_device("SDIO",        0x40012C00, 0x400);
+    create_unimplemented_device("timer[9]",    0x40014000, 0x400);
+    create_unimplemented_device("timer[10]",   0x40014400, 0x400);
+    create_unimplemented_device("timer[11]",   0x40014800, 0x400);
+    create_unimplemented_device("GPIOA",       0x40020000, 0x400);
+    create_unimplemented_device("GPIOB",       0x40020400, 0x400);
+    create_unimplemented_device("GPIOC",       0x40020800, 0x400);
+    create_unimplemented_device("GPIOD",       0x40020C00, 0x400);
+    create_unimplemented_device("GPIOE",       0x40021000, 0x400);
+    create_unimplemented_device("GPIOF",       0x40021400, 0x400);
+    create_unimplemented_device("GPIOG",       0x40021800, 0x400);
+    create_unimplemented_device("GPIOH",       0x40021C00, 0x400);
+    create_unimplemented_device("GPIOI",       0x40022000, 0x400);
+    create_unimplemented_device("CRC",         0x40023000, 0x400);
+    create_unimplemented_device("RCC",         0x40023800, 0x400);
+    create_unimplemented_device("Flash Int",   0x40023C00, 0x400);
+    create_unimplemented_device("BKPSRAM",     0x40024000, 0x400);
+    create_unimplemented_device("DMA1",        0x40026000, 0x400);
+    create_unimplemented_device("DMA2",        0x40026400, 0x400);
+    create_unimplemented_device("Ethernet",    0x40028000, 0x1400);
+    create_unimplemented_device("USB OTG HS",  0x40040000, 0x30000);
+    create_unimplemented_device("USB OTG FS",  0x50000000, 0x31000);
+    create_unimplemented_device("DCMI",        0x50050000, 0x400);
+    create_unimplemented_device("RNG",         0x50060800, 0x400);
+}
+
+static Property stm32f405_soc_properties[] = {
+    DEFINE_PROP_STRING("cpu-type", STM32F405State, cpu_type),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32f405_soc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = stm32f405_soc_realize;
+    dc->props = stm32f405_soc_properties;
+    /* No vmstate or reset required: device has no internal state */
+}
+
+static const TypeInfo stm32f405_soc_info = {
+    .name          = TYPE_STM32F405_SOC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F405State),
+    .instance_init = stm32f405_soc_initfn,
+    .class_init    = stm32f405_soc_class_init,
+};
+
+static void stm32f405_soc_types(void)
+{
+    type_register_static(&stm32f405_soc_info);
+}
+
+type_init(stm32f405_soc_types)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/adc/*
 F: hw/ssi/stm32f2xx_spi.c
 F: include/hw/*/stm32*.h
 
+STM32F405
+M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
+S: Maintained
+F: hw/arm/stm32f405_soc.c
+F: hw/misc/stm32f4xx_syscfg.c
+F: hw/misc/stm32f4xx_exti.c
+
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Alistair Francis <alistair@alistair23.me>

Signed-off-by: Alistair Francis <alistair@alistair23.me>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: dad8d8d47f7625913e35e27a1c00f603a6b08f9a.1576658572.git.alistair@alistair23.me
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs   |  1 +
 hw/arm/netduinoplus2.c | 52 ++++++++++++++++++++++++++++++++++++++++++
 MAINTAINERS            |  6 +++++
 3 files changed, 59 insertions(+)
 create mode 100644 hw/arm/netduinoplus2.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MAINSTONE) += mainstone.o
 obj-$(CONFIG_MICROBIT) += microbit.o
 obj-$(CONFIG_MUSICPAL) += musicpal.o
 obj-$(CONFIG_NETDUINO2) += netduino2.o
+obj-$(CONFIG_NETDUINOPLUS2) += netduinoplus2.o
 obj-$(CONFIG_NSERIES) += nseries.o
 obj-$(CONFIG_SX1) += omap_sx1.o
 obj-$(CONFIG_CHEETAH) += palm.o
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Netduino Plus 2 Machine Model
+ *
+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "qemu/error-report.h"
+#include "hw/arm/stm32f405_soc.h"
+#include "hw/arm/boot.h"
+
+static void netduinoplus2_init(MachineState *machine)
+{
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, TYPE_STM32F405_SOC);
+    qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+    object_property_set_bool(OBJECT(dev), true, "realized", &error_fatal);
+
+    armv7m_load_kernel(ARM_CPU(first_cpu),
+                       machine->kernel_filename,
+                       FLASH_SIZE);
+}
+
+static void netduinoplus2_machine_init(MachineClass *mc)
+{
+    mc->desc = "Netduino Plus 2 Machine";
+    mc->init = netduinoplus2_init;
+}
+
+DEFINE_MACHINE("netduinoplus2", netduinoplus2_machine_init)
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/netduino2.c
 
+Netduino Plus 2
+M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
+S: Maintained
+F: hw/arm/netduinoplus2.c
+
 SmartFusion2
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 M: Peter Maydell <peter.maydell@linaro.org>
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This test boots a Linux kernel on a CubieBoard and verify
the serial output is working.

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://docs.armbian.com/Developer-Guide_Build-Preparation/

The cpio image used comes from the linux-build-test project:
https://github.com/groeck/linux-build-test

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Tested-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-id: 20191230110953.25496-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 41 ++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
         self.wait_for_console_pattern('Boot successful.')
         # TODO user command, for now the uart is stuck
 
+    def test_arm_cubieboard_initrd(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:cubieboard
+        """
+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        kernel_path = self.extract_from_deb(deb_path,
+                                            '/boot/vmlinuz-4.20.7-sunxi')
+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+                      'arm/rootfs-armv5.cpio.gz')
+        initrd_hash = '2b50f1873e113523967806f4da2afe385462ff9b'
+        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
+        archive.gzip_uncompress(initrd_path_gz, initrd_path)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'console=ttyS0,115200 '
+                               'usbcore.nousb '
+                               'panic=-1 noreboot')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-dtb', dtb_path,
+                         '-initrd', initrd_path,
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                                                'Allwinner sun4i/sun5i')
+        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
+                                                'system-control@1c00000')
+        exec_command_and_wait_for_pattern(self, 'reboot',
+                                                'reboot: Restarting system')
+
     def test_s390x_s390_ccw_virtio(self):
         """
         :avocado: tags=arch:s390x
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The kernel image and DeviceTree blob are built by the Armbian
project (based on Debian):
https://docs.armbian.com/Developer-Guide_Build-Preparation/

The cpio image used comes from the linux-build-test project:
https://github.com/groeck/linux-build-test

If ARM is a target being built, "make check-acceptance" will
automatically include this test by the use of the "arch:arm" tags.

Alternatively, this test can be run using:

$ avocado --show=console run -t machine:cubieboard tests/acceptance/boot_linux_console.py
  console: Uncompressing Linux... done, booting the kernel.
  console: Booting Linux on physical CPU 0x0
  console: Linux version 4.20.7-sunxi (root@armbian.com) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #5.75 SMP Fri Feb 8 09:02:10 CET 2019
  [...]
  console: ahci-sunxi 1c18000.sata: Linked as a consumer to regulator.4
  console: ahci-sunxi 1c18000.sata: controller can't do 64bit DMA, forcing 32bit
  console: ahci-sunxi 1c18000.sata: AHCI 0001.0000 32 slots 1 ports 1.5 Gbps 0x1 impl platform mode
  console: ahci-sunxi 1c18000.sata: flags: ncq only
  console: scsi host0: ahci-sunxi
  console: ata1: SATA max UDMA/133 mmio [mem 0x01c18000-0x01c18fff] port 0x100 irq 27
  console: of_cfs_init
  console: of_cfs_init: OK
  console: vcc3v0: disabling
  console: vcc5v0: disabling
  console: usb1-vbus: disabling
  console: usb2-vbus: disabling
  console: ata1: SATA link up 1.5 Gbps (SStatus 113 SControl 300)
  console: ata1.00: ATA-7: QEMU HARDDISK, 2.5+, max UDMA/100
  console: ata1.00: 40960 sectors, multi 16: LBA48 NCQ (depth 32)
  console: ata1.00: applying bridge limits
  console: ata1.00: configured for UDMA/100
  console: scsi 0:0:0:0: Direct-Access     ATA      QEMU HARDDISK    2.5+ PQ: 0 ANSI: 5
  console: sd 0:0:0:0: Attached scsi generic sg0 type 0
  console: sd 0:0:0:0: [sda] 40960 512-byte logical blocks: (21.0 MB/20.0 MiB)
  console: sd 0:0:0:0: [sda] Write Protect is off
  console: sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
  console: sd 0:0:0:0: [sda] Attached SCSI disk
  console: EXT4-fs (sda): mounting ext2 file system using the ext4 subsystem
  console: EXT4-fs (sda): mounted filesystem without journal. Opts: (null)
  console: VFS: Mounted root (ext2 filesystem) readonly on device 8:0.
  [...]
  console: cat /proc/partitions
  console: / # cat /proc/partitions
  console: major minor  #blocks  name
  console: 1        0       4096 ram0
  console: 1        1       4096 ram1
  console: 1        2       4096 ram2
  console: 1        3       4096 ram3
  console: 8        0      20480 sda
  console: reboot
  console: / # reboot
  [...]
  console: sd 0:0:0:0: [sda] Synchronizing SCSI cache
  console: reboot: Restarting system
  PASS (48.39 s)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 44 ++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ class BootLinuxConsole(Test):
         exec_command_and_wait_for_pattern(self, 'reboot',
                                                 'reboot: Restarting system')
 
+    def test_arm_cubieboard_sata(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:cubieboard
+        """
+        deb_url = ('https://apt.armbian.com/pool/main/l/'
+                   'linux-4.20.7-sunxi/linux-image-dev-sunxi_5.75_armhf.deb')
+        deb_hash = '1334c29c44d984ffa05ed10de8c3361f33d78315'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        kernel_path = self.extract_from_deb(deb_path,
+                                            '/boot/vmlinuz-4.20.7-sunxi')
+        dtb_path = '/usr/lib/linux-image-dev-sunxi/sun4i-a10-cubieboard.dtb'
+        dtb_path = self.extract_from_deb(deb_path, dtb_path)
+        rootfs_url = ('https://github.com/groeck/linux-build-test/raw/'
+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+                      'arm/rootfs-armv5.ext2.gz')
+        rootfs_hash = '093e89d2b4d982234bf528bc9fb2f2f17a9d1f93'
+        rootfs_path_gz = self.fetch_asset(rootfs_url, asset_hash=rootfs_hash)
+        rootfs_path = os.path.join(self.workdir, 'rootfs.cpio')
+        archive.gzip_uncompress(rootfs_path_gz, rootfs_path)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'console=ttyS0,115200 '
+                               'usbcore.nousb '
+                               'root=/dev/sda ro '
+                               'panic=-1 noreboot')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-dtb', dtb_path,
+                         '-drive', 'if=none,format=raw,id=disk0,file='
+                                   + rootfs_path,
+                         '-device', 'ide-hd,bus=ide.0,drive=disk0',
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                                                'Allwinner sun4i/sun5i')
+        exec_command_and_wait_for_pattern(self, 'cat /proc/partitions',
+                                                'sda')
+        exec_command_and_wait_for_pattern(self, 'reboot',
+                                                'reboot: Restarting system')
+
     def test_s390x_s390_ccw_virtio(self):
         """
         :avocado: tags=arch:s390x
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

These definitions are specific to the A10 SoC and don't need
to be exported to the different Allwinner peripherals.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-a10.h | 6 ------
 hw/arm/allwinner-a10.c         | 6 ++++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/cpu.h"
 
 
-#define AW_A10_PIC_REG_BASE     0x01c20400
-#define AW_A10_PIT_REG_BASE     0x01c20c00
-#define AW_A10_UART0_REG_BASE   0x01c28000
-#define AW_A10_EMAC_BASE        0x01c0b000
-#define AW_A10_SATA_BASE        0x01c18000
-
 #define AW_A10_SDRAM_BASE       0x40000000
 
 #define TYPE_AW_A10 "allwinner-a10"
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "sysemu/sysemu.h"
 
+#define AW_A10_PIC_REG_BASE     0x01c20400
+#define AW_A10_PIT_REG_BASE     0x01c20c00
+#define AW_A10_UART0_REG_BASE   0x01c28000
+#define AW_A10_EMAC_BASE        0x01c0b000
+#define AW_A10_SATA_BASE        0x01c18000
+
 static void aw_a10_init(Object *obj)
 {
     AwA10State *s = AW_A10(obj);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

By calling qdev_pass_gpios() we don't need to hold a copy of the
IRQs from the INTC into the SoC state.
Instead of filling an array of qemu_irq and passing it around, we
can now directly call qdev_get_gpio_in() on the SoC.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-a10.h |  1 -
 hw/arm/allwinner-a10.c         | 24 +++++++++++-------------
 2 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@ typedef struct AwA10State {
     /*< public >*/
 
     ARMCPU cpu;
-    qemu_irq irq[AW_A10_PIC_INT_NR];
     AwA10PITState timer;
     AwA10PICState intc;
     AwEmacState emac;
diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 {
     AwA10State *s = AW_A10(dev);
     SysBusDevice *sysbusdev;
-    uint8_t i;
     qemu_irq fiq, irq;
     Error *err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
     sysbus_connect_irq(sysbusdev, 0, irq);
     sysbus_connect_irq(sysbusdev, 1, fiq);
-    for (i = 0; i < AW_A10_PIC_INT_NR; i++) {
-        s->irq[i] = qdev_get_gpio_in(DEVICE(&s->intc), i);
-    }
+    qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
 
     object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
     if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->timer);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIT_REG_BASE);
-    sysbus_connect_irq(sysbusdev, 0, s->irq[22]);
-    sysbus_connect_irq(sysbusdev, 1, s->irq[23]);
-    sysbus_connect_irq(sysbusdev, 2, s->irq[24]);
-    sysbus_connect_irq(sysbusdev, 3, s->irq[25]);
-    sysbus_connect_irq(sysbusdev, 4, s->irq[67]);
-    sysbus_connect_irq(sysbusdev, 5, s->irq[68]);
+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 22));
+    sysbus_connect_irq(sysbusdev, 1, qdev_get_gpio_in(dev, 23));
+    sysbus_connect_irq(sysbusdev, 2, qdev_get_gpio_in(dev, 24));
+    sysbus_connect_irq(sysbusdev, 3, qdev_get_gpio_in(dev, 25));
+    sysbus_connect_irq(sysbusdev, 4, qdev_get_gpio_in(dev, 67));
+    sysbus_connect_irq(sysbusdev, 5, qdev_get_gpio_in(dev, 68));
 
     memory_region_init_ram(&s->sram_a, OBJECT(dev), "sram A", 48 * KiB,
                            &error_fatal);
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->emac);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_EMAC_BASE);
-    sysbus_connect_irq(sysbusdev, 0, s->irq[55]);
+    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 55));
 
     object_property_set_bool(OBJECT(&s->sata), true, "realized", &err);
     if (err) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sata), 0, AW_A10_SATA_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, s->irq[56]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->sata), 0, qdev_get_gpio_in(dev, 56));
 
     /* FIXME use a qdev chardev prop instead of serial_hd() */
-    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2, s->irq[1],
+    serial_mm_init(get_system_memory(), AW_A10_UART0_REG_BASE, 2,
+                   qdev_get_gpio_in(dev, 1),
                    115200, serial_hd(0), DEVICE_NATIVE_ENDIAN);
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We won't reuse the CPU IRQ/FIQ variables. Simplify by calling
qdev_get_gpio_in() in place.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20191230110953.25496-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/allwinner-a10.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/allwinner-a10.c b/hw/arm/allwinner-a10.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-a10.c
+++ b/hw/arm/allwinner-a10.c
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
 {
     AwA10State *s = AW_A10(dev);
     SysBusDevice *sysbusdev;
-    qemu_irq fiq, irq;
     Error *err = NULL;
 
     object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
-    irq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ);
-    fiq = qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ);
 
     object_property_set_bool(OBJECT(&s->intc), true, "realized", &err);
     if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static void aw_a10_realize(DeviceState *dev, Error **errp)
     }
     sysbusdev = SYS_BUS_DEVICE(&s->intc);
     sysbus_mmio_map(sysbusdev, 0, AW_A10_PIC_REG_BASE);
-    sysbus_connect_irq(sysbusdev, 0, irq);
-    sysbus_connect_irq(sysbusdev, 1, fiq);
+    sysbus_connect_irq(sysbusdev, 0,
+                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));
+    sysbus_connect_irq(sysbusdev, 1,
+                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
     qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);
 
     object_property_set_bool(OBJECT(&s->timer), true, "realized", &err);
-- 
2.20.1

From: Masahiro Yamada <masahiroy@kernel.org>

According to the specification "Semihosting for AArch32 and Aarch64",
the SYS_OPEN operation should return:

- A nonzero handle if the call is successful
 - -1 if the call is not successful

So, it should never return 0.

Prior to commit 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting
code hand out its own file descriptors"), the guest fd matched to the
host fd. It returned a nonzero handle on success since the fd 0 is
already used for stdin.

Now that the guest fd is the index of guestfd_array, it starts from 0.

I noticed this issue particularly because Trusted Firmware-A built with
PLAT=qemu is no longer working. Its io_semihosting driver only handles
a positive return value as a valid filehandle.

Basically, there are two ways to fix this:

- Use (guestfd - 1) as the index of guestfs_arrary. We need to insert
    increment/decrement to convert the guestfd and the array index back
    and forth.

- Keep using guestfd as the index of guestfs_array. The first entry
    of guestfs_array is left unused.

I thought the latter is simpler. We end up with wasting a small piece
of memory for the unused first entry of guestfd_array, but this is
probably not a big deal.

Fixes: 35e9a0a8ce4b ("target/arm/arm-semi: Make semihosting code hand out its own file descriptors")
Cc: qemu-stable@nongnu.org
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200109041228.10131-1-masahiroy@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-semi.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ static int alloc_guestfd(void)
         guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
     }
 
-    for (i = 0; i < guestfd_array->len; i++) {
+    /* SYS_OPEN should return nonzero handle on success. Start guestfd from 1 */
+    for (i = 1; i < guestfd_array->len; i++) {
         GuestFD *gf = &g_array_index(guestfd_array, GuestFD, i);
 
         if (gf->type == GuestFDUnused) {
@@ -XXX,XX +XXX,XX @@ static GuestFD *do_get_guestfd(int guestfd)
         return NULL;
     }
 
-    if (guestfd < 0 || guestfd >= guestfd_array->len) {
+    if (guestfd <= 0 || guestfd >= guestfd_array->len) {
         return NULL;
     }
 
-- 
2.20.1

From: Martin Kaiser <martin@kaiser.cx>

Add an emulation for the RNGC random number generator and the compatible
RNGB variant. These peripherals are included (at least) in imx25 and
imx35 chipsets.

The emulation supports the initial self test, reseeding the prng and
reading random numbers.

Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs      |   1 +
 include/hw/arm/fsl-imx25.h |   5 +
 include/hw/misc/imx_rngc.h |  35 +++++
 hw/arm/fsl-imx25.c         |  11 ++
 hw/misc/imx_rngc.c         | 278 +++++++++++++++++++++++++++++++++++++
 5 files changed, 330 insertions(+)
 create mode 100644 include/hw/misc/imx_rngc.h
 create mode 100644 hw/misc/imx_rngc.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX) += imx7_ccm.o
 common-obj-$(CONFIG_IMX) += imx2_wdt.o
 common-obj-$(CONFIG_IMX) += imx7_snvs.o
 common-obj-$(CONFIG_IMX) += imx7_gpr.o
+common-obj-$(CONFIG_IMX) += imx_rngc.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-hpdmc.o
 common-obj-$(CONFIG_MILKYMIST) += milkymist-pfpu.o
 common-obj-$(CONFIG_MAINSTONE) += mst_fpga.o
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/timer/imx_gpt.h"
 #include "hw/timer/imx_epit.h"
 #include "hw/net/imx_fec.h"
+#include "hw/misc/imx_rngc.h"
 #include "hw/i2c/imx_i2c.h"
 #include "hw/gpio/imx_gpio.h"
 #include "exec/memory.h"
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
     IMXGPTState    gpt[FSL_IMX25_NUM_GPTS];
     IMXEPITState   epit[FSL_IMX25_NUM_EPITS];
     IMXFECState    fec;
+    IMXRNGCState   rngc;
     IMXI2CState    i2c[FSL_IMX25_NUM_I2CS];
     IMXGPIOState   gpio[FSL_IMX25_NUM_GPIOS];
     MemoryRegion   rom[2];
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_GPIO4_SIZE    0x4000
 #define FSL_IMX25_GPIO3_ADDR    0x53FA4000
 #define FSL_IMX25_GPIO3_SIZE    0x4000
+#define FSL_IMX25_RNGC_ADDR     0x53FB0000
+#define FSL_IMX25_RNGC_SIZE     0x4000
 #define FSL_IMX25_GPIO1_ADDR    0x53FCC000
 #define FSL_IMX25_GPIO1_SIZE    0x4000
 #define FSL_IMX25_GPIO2_ADDR    0x53FD0000
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX25State {
 #define FSL_IMX25_EPIT1_IRQ     28
 #define FSL_IMX25_EPIT2_IRQ     27
 #define FSL_IMX25_FEC_IRQ       57
+#define FSL_IMX25_RNGC_IRQ      22
 #define FSL_IMX25_I2C1_IRQ      3
 #define FSL_IMX25_I2C2_IRQ      4
 #define FSL_IMX25_I2C3_IRQ      10
diff --git a/include/hw/misc/imx_rngc.h b/include/hw/misc/imx_rngc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/imx_rngc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Freescale i.MX RNGC emulation
+ *
+ * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef IMX_RNGC_H
+#define IMX_RNGC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_IMX_RNGC "imx.rngc"
+#define IMX_RNGC(obj) OBJECT_CHECK(IMXRNGCState, (obj), TYPE_IMX_RNGC)
+
+typedef struct IMXRNGCState {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion  iomem;
+
+    uint8_t op_self_test;
+    uint8_t op_seed;
+    uint8_t mask;
+    bool    auto_seed;
+
+    QEMUBH *self_test_bh;
+    QEMUBH *seed_bh;
+    qemu_irq irq;
+} IMXRNGCState;
+
+#endif /* IMX_RNGC_H */
diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_init(Object *obj)
 
     sysbus_init_child_obj(obj, "fec", &s->fec, sizeof(s->fec), TYPE_IMX_FEC);
 
+    sysbus_init_child_obj(obj, "rngc", &s->rngc, sizeof(s->rngc),
+                          TYPE_IMX_RNGC);
+
     for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
         sysbus_init_child_obj(obj, "i2c[*]", &s->i2c[i], sizeof(s->i2c[i]),
                               TYPE_IMX_I2C);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fec), 0,
                        qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_FEC_IRQ));
 
+    object_property_set_bool(OBJECT(&s->rngc), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->rngc), 0, FSL_IMX25_RNGC_ADDR);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->rngc), 0,
+                       qdev_get_gpio_in(DEVICE(&s->avic), FSL_IMX25_RNGC_IRQ));
 
     /* Initialize all I2C */
     for (i = 0; i < FSL_IMX25_NUM_I2CS; i++) {
diff --git a/hw/misc/imx_rngc.c b/hw/misc/imx_rngc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/imx_rngc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Freescale i.MX RNGC emulation
+ *
+ * Copyright (C) 2020 Martin Kaiser <martin@kaiser.cx>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ * This driver provides the minimum functionality to initialize and seed
+ * an rngc and to read random numbers. The rngb that is found in imx25
+ * chipsets is also supported.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+#include "qemu/module.h"
+#include "qemu/log.h"
+#include "qemu/guest-random.h"
+#include "hw/irq.h"
+#include "hw/misc/imx_rngc.h"
+#include "migration/vmstate.h"
+
+#define RNGC_NAME "i.MX RNGC"
+
+#define RNGC_VER_ID  0x00
+#define RNGC_COMMAND 0x04
+#define RNGC_CONTROL 0x08
+#define RNGC_STATUS  0x0C
+#define RNGC_FIFO    0x14
+
+/* These version info are reported by the rngb in an imx258 chip. */
+#define RNG_TYPE_RNGB 0x1
+#define V_MAJ 0x2
+#define V_MIN 0x40
+
+#define RNGC_CMD_BIT_SW_RST    0x40
+#define RNGC_CMD_BIT_CLR_ERR   0x20
+#define RNGC_CMD_BIT_CLR_INT   0x10
+#define RNGC_CMD_BIT_SEED      0x02
+#define RNGC_CMD_BIT_SELF_TEST 0x01
+
+#define RNGC_CTRL_BIT_MASK_ERR  0x40
+#define RNGC_CTRL_BIT_MASK_DONE 0x20
+#define RNGC_CTRL_BIT_AUTO_SEED 0x10
+
+/* the current status for self-test and seed operations */
+#define OP_IDLE 0
+#define OP_RUN  1
+#define OP_DONE 2
+
+static uint64_t imx_rngc_read(void *opaque, hwaddr offset, unsigned size)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+    uint64_t val = 0;
+
+    switch (offset) {
+    case RNGC_VER_ID:
+        val |= RNG_TYPE_RNGB << 28 | V_MAJ << 8 | V_MIN;
+        break;
+
+    case RNGC_COMMAND:
+        if (s->op_seed == OP_RUN) {
+            val |= RNGC_CMD_BIT_SEED;
+        }
+        if (s->op_self_test == OP_RUN) {
+            val |= RNGC_CMD_BIT_SELF_TEST;
+        }
+        break;
+
+    case RNGC_CONTROL:
+        /*
+         * The CTL_ACC and VERIF_MODE bits are not supported yet.
+         * They read as 0.
+         */
+        val |= s->mask;
+        if (s->auto_seed) {
+            val |= RNGC_CTRL_BIT_AUTO_SEED;
+        }
+        /*
+         * We don't have an internal fifo like the real hardware.
+         * There's no need for strategy to handle fifo underflows.
+         * We return the FIFO_UFLOW_RESPONSE bits as 0.
+         */
+        break;
+
+    case RNGC_STATUS:
+        /*
+         * We never report any statistics test or self-test errors or any
+         * other errors. STAT_TEST_PF, ST_PF and ERROR are always 0.
+         */
+
+        /*
+         * We don't have an internal fifo, see above. Therefore, we
+         * report back the default fifo size (5 32-bit words) and
+         * indicate that our fifo is always full.
+         */
+        val |= 5 << 12 | 5 << 8;
+
+        /* We always have a new seed available. */
+        val |= 1 << 6;
+
+        if (s->op_seed == OP_DONE) {
+            val |= 1 << 5;
+        }
+        if (s->op_self_test == OP_DONE) {
+            val |= 1 << 4;
+        }
+        if (s->op_seed == OP_RUN || s->op_self_test == OP_RUN) {
+            /*
+             * We're busy if self-test is running or if we're
+             * seeding the prng.
+             */
+            val |= 1 << 1;
+        } else {
+            /*
+             * We're ready to provide secure random numbers whenever
+             * we're not busy.
+             */
+            val |= 1;
+        }
+        break;
+
+    case RNGC_FIFO:
+        qemu_guest_getrandom_nofail(&val, sizeof(val));
+        break;
+    }
+
+    return val;
+}
+
+static void imx_rngc_do_reset(IMXRNGCState *s)
+{
+    s->op_self_test = OP_IDLE;
+    s->op_seed = OP_IDLE;
+    s->mask = 0;
+    s->auto_seed = false;
+}
+
+static void imx_rngc_write(void *opaque, hwaddr offset, uint64_t value,
+                           unsigned size)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    switch (offset) {
+    case RNGC_COMMAND:
+        if (value & RNGC_CMD_BIT_SW_RST) {
+            imx_rngc_do_reset(s);
+        }
+
+        /*
+         * For now, both CLR_ERR and CLR_INT clear the interrupt. We
+         * don't report any errors yet.
+         */
+        if (value & (RNGC_CMD_BIT_CLR_ERR | RNGC_CMD_BIT_CLR_INT)) {
+            qemu_irq_lower(s->irq);
+        }
+
+        if (value & RNGC_CMD_BIT_SEED) {
+            s->op_seed = OP_RUN;
+            qemu_bh_schedule(s->seed_bh);
+        }
+
+        if (value & RNGC_CMD_BIT_SELF_TEST) {
+            s->op_self_test = OP_RUN;
+            qemu_bh_schedule(s->self_test_bh);
+        }
+        break;
+
+    case RNGC_CONTROL:
+        /*
+         * The CTL_ACC and VERIF_MODE bits are not supported yet.
+         * We ignore them if they're set by the caller.
+         */
+
+        if (value & RNGC_CTRL_BIT_MASK_ERR) {
+            s->mask |= RNGC_CTRL_BIT_MASK_ERR;
+        } else {
+            s->mask &= ~RNGC_CTRL_BIT_MASK_ERR;
+        }
+
+        if (value & RNGC_CTRL_BIT_MASK_DONE) {
+            s->mask |= RNGC_CTRL_BIT_MASK_DONE;
+        } else {
+            s->mask &= ~RNGC_CTRL_BIT_MASK_DONE;
+        }
+
+        if (value & RNGC_CTRL_BIT_AUTO_SEED) {
+            s->auto_seed = true;
+        } else {
+            s->auto_seed = false;
+        }
+        break;
+    }
+}
+
+static const MemoryRegionOps imx_rngc_ops = {
+    .read  = imx_rngc_read,
+    .write = imx_rngc_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void imx_rngc_self_test(void *opaque)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    s->op_self_test = OP_DONE;
+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void imx_rngc_seed(void *opaque)
+{
+    IMXRNGCState *s = IMX_RNGC(opaque);
+
+    s->op_seed = OP_DONE;
+    if (!(s->mask & RNGC_CTRL_BIT_MASK_DONE)) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void imx_rngc_realize(DeviceState *dev, Error **errp)
+{
+    IMXRNGCState *s = IMX_RNGC(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &imx_rngc_ops, s,
+                          TYPE_IMX_RNGC, 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+
+    sysbus_init_irq(sbd, &s->irq);
+    s->self_test_bh = qemu_bh_new(imx_rngc_self_test, s);
+    s->seed_bh = qemu_bh_new(imx_rngc_seed, s);
+}
+
+static void imx_rngc_reset(DeviceState *dev)
+{
+    IMXRNGCState *s = IMX_RNGC(dev);
+
+    imx_rngc_do_reset(s);
+}
+
+static const VMStateDescription vmstate_imx_rngc = {
+    .name = RNGC_NAME,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(op_self_test, IMXRNGCState),
+        VMSTATE_UINT8(op_seed, IMXRNGCState),
+        VMSTATE_UINT8(mask, IMXRNGCState),
+        VMSTATE_BOOL(auto_seed, IMXRNGCState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void imx_rngc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = imx_rngc_realize;
+    dc->reset = imx_rngc_reset;
+    dc->desc = RNGC_NAME,
+    dc->vmsd = &vmstate_imx_rngc;
+}
+
+static const TypeInfo imx_rngc_info = {
+    .name          = TYPE_IMX_RNGC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(IMXRNGCState),
+    .class_init    = imx_rngc_class_init,
+};
+
+static void imx_rngc_register_types(void)
+{
+    type_register_static(&imx_rngc_info);
+}
+
+type_init(imx_rngc_register_types)
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The wfi instruction can be configured to be trapped by a higher exception
level, such as the EL2 hypervisor. When the instruction is trapped, the
program counter should contain the address of the wfi instruction that
caused the exception. The program counter is adjusted for this in the wfi op
helper function.

However, this correction is done to env->pc, which only applies to AArch64
mode. For AArch32, the program counter is stored in env->regs[15]. This
adds an if-else statement to modify the correct program counter location
based on the the current CPU mode.

Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/op_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(wfi)(CPUARMState *env, uint32_t insn_len)
     }
 
     if (target_el) {
-        env->pc -= insn_len;
+        if (env->aarch64) {
+            env->pc -= insn_len;
+        } else {
+            env->regs[15] -= insn_len;
+        }
+
         raise_exception(env, EXCP_UDEF, syn_wfx(1, 0xe, 0, insn_len == 2),
                         target_el);
     }
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The IAR0/IAR1 register is used to acknowledge an interrupt - a read of the
register activates the highest priority pending interrupt and provides its
interrupt ID. Activating an interrupt can change the CPU's virtual interrupt
state - this change makes sure the virtual irq state is updated.

Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200113154607.97032-1-jeff.kubascik@dornerworks.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static uint64_t icv_iar_read(CPUARMState *env, const ARMCPRegInfo *ri)
 
     trace_gicv3_icv_iar_read(ri->crm == 8 ? 0 : 1,
                              gicv3_redist_affid(cs), intid);
+
+    gicv3_cpuif_virt_update(cs);
+
     return intid;
 }
 
-- 
2.20.1

From: Jeff Kubascik <jeff.kubascik@dornerworks.com>

The IL bit is set for 32-bit instructions, thus passing false
with the is_16bit parameter to syn_data_abort_with_iss() makes
a syn mask that always has the IL bit set.

Pass is_16bit as true to make the initial syn mask have IL=0,
so that the final IL value comes from or'ing template_syn.

Cc: qemu-stable@nongnu.org
Fixes: aaa1f954d4ca ("target-arm: A64: Create Instruction Syndromes for Data Aborts")
Signed-off-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200117004618.2742-2-richard.henderson@linaro.org
[rth: Extracted this as a self-contained bug fix from a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tlb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
         syn = syn_data_abort_with_iss(same_el,
                                       0, 0, 0, 0, 0,
                                       ea, 0, s1ptw, is_write, fsc,
-                                      false);
+                                      true);
         /* Merge the runtime syndrome with the template syndrome.  */
         syn |= template_syn;
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

During the conversion to decodetree, the setting of
ISSIs16Bit got lost.  This causes the guest os to
incorrectly adjust trapping memory operations.

Cc: qemu-stable@nongnu.org
Fixes: 46beb58efbb8a2a32 ("target/arm: Convert T16, load (literal)")
Reported-by: Jeff Kubascik <jeff.kubascik@dornerworks.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200117004618.2742-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static ISSInfo make_issinfo(DisasContext *s, int rd, bool p, bool w)
     /* ISS not valid if writeback */
     if (p && !w) {
         ret = rd;
+        if (s->base.pc_next - s->pc_curr == 2) {
+            ret |= ISSIs16Bit;
+        }
     } else {
         ret = ISSInvalid;
     }
-- 
2.20.1

First arm pullreq for 7.1. The bulk of this is the qemu_split_irq
removal.

I have enough stuff in my to-review queue that I expect to do another
pullreq early next week, but 31 patches is enough to not hang on to.

thanks
-- PMM

The following changes since commit 9c125d17e9402c232c46610802e5931b3639d77b:

Merge tag 'pull-tcg-20220420' of https://gitlab.com/rth7680/qemu into staging (2022-04-20 16:43:11 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220421

for you to fetch changes up to 5b415dd61bdbf61fb4be0e9f1a7172b8bce682c6:

hw/arm: Use bit fields for NPCM7XX PWRON STRAPs (2022-04-21 11:37:05 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
 * versal: Add the Cortex-R5s in the Real-Time Processing Unit (RPU) subsystem
 * versal: model enough of the Clock/Reset Low-power domain (CRL) to allow control of the Cortex-R5s
 * xlnx-zynqmp: Connect 4 TTC timers
 * exynos4210: Refactor GIC/combiner code to stop using qemu_split_irq
 * realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
 * stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
 * hw/core/irq: remove unused 'qemu_irq_split' function
 * npcm7xx: use symbolic constants for PWRON STRAP bit fields
 * virt: document impact of gic-version on max CPUs

----------------------------------------------------------------
Edgar E. Iglesias (6):
      timer: cadence_ttc: Break out header file to allow embedding
      hw/arm/xlnx-zynqmp: Connect 4 TTC timers
      hw/arm: versal: Create an APU CPU Cluster
      hw/arm: versal: Add the Cortex-R5Fs
      hw/misc: Add a model of the Xilinx Versal CRL
      hw/arm: versal: Connect the CRL

Hao Wu (2):
      hw/misc: Add PWRON STRAP bit fields in GCR module
      hw/arm: Use bit fields for NPCM7XX PWRON STRAPs

Heinrich Schuchardt (1):
      hw/arm/virt: impact of gic-version on max CPUs

Peter Maydell (19):
      hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
      hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
      hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
      hw/arm/exynos4210: Put a9mpcore device into state struct
      hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
      hw/arm/exynos4210: Coalesce board_irqs and irq_table
      hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
      hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
      hw/arm/exynos4210: Put external GIC into state struct
      hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
      hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
      hw/arm/exynos4210: Delete unused macro definitions
      hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
      hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
      hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
      hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
      hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
      hw/arm/exynos4210: Put combiners into state struct
      hw/arm/exynos4210: Drop Exynos4210Irq struct

Zongyuan Li (3):
      hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
      hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
      hw/core/irq: remove unused 'qemu_irq_split' function

docs/system/arm/virt.rst              |   4 +-
 include/hw/arm/exynos4210.h           |  50 ++--
 include/hw/arm/xlnx-versal.h          |  16 ++
 include/hw/arm/xlnx-zynqmp.h          |   4 +
 include/hw/intc/exynos4210_combiner.h |  57 +++++
 include/hw/intc/exynos4210_gic.h      |  43 ++++
 include/hw/irq.h                      |   5 -
 include/hw/misc/npcm7xx_gcr.h         |  30 +++
 include/hw/misc/xlnx-versal-crl.h     | 235 +++++++++++++++++++
 include/hw/timer/cadence_ttc.h        |  54 +++++
 hw/arm/exynos4210.c                   | 430 ++++++++++++++++++++++++++++++----
 hw/arm/npcm7xx_boards.c               |  24 +-
 hw/arm/realview.c                     |  33 ++-
 hw/arm/stellaris.c                    |  15 +-
 hw/arm/virt.c                         |   7 +
 hw/arm/xlnx-versal-virt.c             |   6 +-
 hw/arm/xlnx-versal.c                  |  99 +++++++-
 hw/arm/xlnx-zynqmp.c                  |  22 ++
 hw/core/irq.c                         |  15 --
 hw/intc/exynos4210_combiner.c         | 108 +--------
 hw/intc/exynos4210_gic.c              | 344 +--------------------------
 hw/misc/xlnx-versal-crl.c             | 421 +++++++++++++++++++++++++++++++++
 hw/timer/cadence_ttc.c                |  32 +--
 MAINTAINERS                           |   2 +-
 hw/misc/meson.build                   |   1 +
 25 files changed, 1457 insertions(+), 600 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_combiner.h
 create mode 100644 include/hw/intc/exynos4210_gic.h
 create mode 100644 include/hw/misc/xlnx-versal-crl.h
 create mode 100644 include/hw/timer/cadence_ttc.h
 create mode 100644 hw/misc/xlnx-versal-crl.c

It's not possible to provide the guest with the Security extensions
(TrustZone) when using KVM or HVF, because the hardware
virtualization extensions don't permit running EL3 guest code.
However, we weren't checking for this combination, with the result
that QEMU would assert if you tried it:

$ qemu-system-aarch64 -enable-kvm -machine virt,secure=on -cpu host -display none
Unexpected error in object_property_find_err() at ../../qom/object.c:1304:
qemu-system-aarch64: Property 'host-arm-cpu.secure-memory' not found
Aborted

Check for this combination of options and report an error, in the
same way we already do for attempts to give a KVM or HVF guest the
Virtualization or MTE extensions. Now we will report:

qemu-system-aarch64: mach-virt: KVM does not support providing Security extensions (TrustZone) to the guest CPU

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/961
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404155301.566542-1-peter.maydell@linaro.org
---
 hw/arm/virt.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
+    if (vms->secure && (kvm_enabled() || hvf_enabled())) {
+        error_report("mach-virt: %s does not support providing "
+                     "Security extensions (TrustZone) to the guest CPU",
+                     kvm_enabled() ? "KVM" : "HVF");
+        exit(1);
+    }
+
     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
         error_report("mach-virt: %s does not support providing "
                      "Virtualization extensions to the guest CPU",
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Break out header file to allow embedding of the the TTC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220331222017.2914409-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/cadence_ttc.h | 54 ++++++++++++++++++++++++++++++++++
 hw/timer/cadence_ttc.c         | 32 ++------------------
 2 files changed, 56 insertions(+), 30 deletions(-)
 create mode 100644 include/hw/timer/cadence_ttc.h

diff --git a/include/hw/timer/cadence_ttc.h b/include/hw/timer/cadence_ttc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/timer/cadence_ttc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Zynq cadence TTC model
+ *
+ * Copyright (c) 2011 Xilinx Inc.
+ * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
+ * Copyright (c) 2012 PetaLogix Pty Ltd.
+ * Written By Haibing Ma
+ *            M. Habib
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef HW_TIMER_CADENCE_TTC_H
+#define HW_TIMER_CADENCE_TTC_H
+
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+
+typedef struct {
+    QEMUTimer *timer;
+    int freq;
+
+    uint32_t reg_clock;
+    uint32_t reg_count;
+    uint32_t reg_value;
+    uint16_t reg_interval;
+    uint16_t reg_match[3];
+    uint32_t reg_intr;
+    uint32_t reg_intr_en;
+    uint32_t reg_event_ctrl;
+    uint32_t reg_event;
+
+    uint64_t cpu_time;
+    unsigned int cpu_time_valid;
+
+    qemu_irq irq;
+} CadenceTimerState;
+
+#define TYPE_CADENCE_TTC "cadence_ttc"
+OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
+
+struct CadenceTTCState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    CadenceTimerState timer[3];
+};
+
+#endif
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qom/object.h"
 
+#include "hw/timer/cadence_ttc.h"
+
 #ifdef CADENCE_TTC_ERR_DEBUG
 #define DB_PRINT(...) do { \
     fprintf(stderr,  ": %s: ", __func__); \
@@ -XXX,XX +XXX,XX @@
 #define CLOCK_CTRL_PS_EN    0x00000001
 #define CLOCK_CTRL_PS_V     0x0000001e
 
-typedef struct {
-    QEMUTimer *timer;
-    int freq;
-
-    uint32_t reg_clock;
-    uint32_t reg_count;
-    uint32_t reg_value;
-    uint16_t reg_interval;
-    uint16_t reg_match[3];
-    uint32_t reg_intr;
-    uint32_t reg_intr_en;
-    uint32_t reg_event_ctrl;
-    uint32_t reg_event;
-
-    uint64_t cpu_time;
-    unsigned int cpu_time_valid;
-
-    qemu_irq irq;
-} CadenceTimerState;
-
-#define TYPE_CADENCE_TTC "cadence_ttc"
-OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
-
-struct CadenceTTCState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion iomem;
-    CadenceTimerState timer[3];
-};
-
 static void cadence_timer_update(CadenceTimerState *s)
 {
     qemu_set_irq(s->irq, !!(s->reg_intr & s->reg_intr_en));
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Connect the 4 TTC timers on the ZynqMP.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220331222017.2914409-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  4 ++++
 hw/arm/xlnx-zynqmp.c         | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/or-irq.h"
 #include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
 #include "hw/misc/xlnx-zynqmp-crf.h"
+#include "hw/timer/cadence_ttc.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 #define XLNX_ZYNQMP_MAX_RAM_SIZE (XLNX_ZYNQMP_MAX_LOW_RAM_SIZE + \
                                   XLNX_ZYNQMP_MAX_HIGH_RAM_SIZE)
 
+#define XLNX_ZYNQMP_NUM_TTC 4
+
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     qemu_or_irq qspi_irq_orgate;
     XlnxZynqMPAPUCtrl apu_ctrl;
     XlnxZynqMPCRF crf;
+    CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
 
     char *boot_cpu;
     ARMCPU *boot_cpu_ptr;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define APU_ADDR            0xfd5c0000
 #define APU_IRQ             153
 
+#define TTC0_ADDR           0xFF110000
+#define TTC0_IRQ            36
+
 #define IPI_ADDR            0xFF300000
 #define IPI_IRQ             64
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
 }
 
+static void xlnx_zynqmp_create_ttc(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+    int i, irq;
+
+    for (i = 0; i < XLNX_ZYNQMP_NUM_TTC; i++) {
+        object_initialize_child(OBJECT(s), "ttc[*]", &s->ttc[i],
+                                TYPE_CADENCE_TTC);
+        sbd = SYS_BUS_DEVICE(&s->ttc[i]);
+
+        sysbus_realize(sbd, &error_fatal);
+        sysbus_mmio_map(sbd, 0, TTC0_ADDR + i * 0x10000);
+        for (irq = 0; irq < 3; irq++) {
+            sysbus_connect_irq(sbd, irq, gic[TTC0_IRQ + i * 3 + irq]);
+        }
+    }
+}
+
 static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
 {
     static const struct UnimpInfo {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     xlnx_zynqmp_create_efuse(s, gic_spi);
     xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
     xlnx_zynqmp_create_crf(s, gic_spi);
+    xlnx_zynqmp_create_ttc(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Create an APU CPU Cluster. This is in preparation to add the RPU.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-2-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 2 ++
 hw/arm/xlnx-versal.c         | 9 ++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/cpu/cluster.h"
 #include "hw/or-irq.h"
 #include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
@@ -XXX,XX +XXX,XX @@ struct Versal {
     struct {
         struct {
             MemoryRegion mr;
+            CPUClusterState cluster;
             ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
             GICv3State gic;
         } apu;
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
 {
     int i;
 
+    object_initialize_child(OBJECT(s), "apu-cluster", &s->fpd.apu.cluster,
+                            TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->fpd.apu.cluster), "cluster-id", 0);
+
     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
         Object *obj;
 
-        object_initialize_child(OBJECT(s), "apu-cpu[*]", &s->fpd.apu.cpu[i],
+        object_initialize_child(OBJECT(&s->fpd.apu.cluster),
+                                "apu-cpu[*]", &s->fpd.apu.cpu[i],
                                 XLNX_VERSAL_ACPU_TYPE);
         obj = OBJECT(&s->fpd.apu.cpu[i]);
         if (i) {
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
                                  &error_abort);
         qdev_realize(DEVICE(obj), NULL, &error_fatal);
     }
+
+    qdev_realize(DEVICE(&s->fpd.apu.cluster), NULL, &error_fatal);
 }
 
 static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Add the Cortex-R5Fs of the Versal RPU (Real-time Processing Unit)
subsystem.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-3-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 10 ++++++++++
 hw/arm/xlnx-versal-virt.c    |  6 +++---
 hw/arm/xlnx-versal.c         | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
 
 #define XLNX_VERSAL_NR_ACPUS   2
+#define XLNX_VERSAL_NR_RCPUS   2
 #define XLNX_VERSAL_NR_UARTS   2
 #define XLNX_VERSAL_NR_GEMS    2
 #define XLNX_VERSAL_NR_ADMAS   8
@@ -XXX,XX +XXX,XX @@ struct Versal {
             VersalUsb2 usb;
         } iou;
 
+        /* Real-time Processing Unit.  */
+        struct {
+            MemoryRegion mr;
+            MemoryRegion mr_ps_alias;
+
+            CPUClusterState cluster;
+            ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
+        } rpu;
+
         struct {
             qemu_or_irq irq_orgate;
             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
 
     mc->desc = "Xilinx Versal Virtual development board";
     mc->init = versal_virt_init;
-    mc->min_cpus = XLNX_VERSAL_NR_ACPUS;
-    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
-    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->min_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+    mc->max_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+    mc->default_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
     mc->no_cdrom = true;
     mc->default_ram_id = "ddr";
 }
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+#define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
 #define GEM_REVISION        0x40070106
 
 #define VERSAL_NUM_PMC_APB_IRQS 3
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
     }
 }
 
+static void versal_create_rpu_cpus(Versal *s)
+{
+    int i;
+
+    object_initialize_child(OBJECT(s), "rpu-cluster", &s->lpd.rpu.cluster,
+                            TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->lpd.rpu.cluster), "cluster-id", 1);
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
+        Object *obj;
+
+        object_initialize_child(OBJECT(&s->lpd.rpu.cluster),
+                                "rpu-cpu[*]", &s->lpd.rpu.cpu[i],
+                                XLNX_VERSAL_RCPU_TYPE);
+        obj = OBJECT(&s->lpd.rpu.cpu[i]);
+        object_property_set_bool(obj, "start-powered-off", true,
+                                 &error_abort);
+
+        object_property_set_int(obj, "mp-affinity", 0x100 | i, &error_abort);
+        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->lpd.rpu.cpu),
+                                &error_abort);
+        object_property_set_link(obj, "memory", OBJECT(&s->lpd.rpu.mr),
+                                 &error_abort);
+        qdev_realize(DEVICE(obj), NULL, &error_fatal);
+    }
+
+    qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
+}
+
 static void versal_create_uarts(Versal *s, qemu_irq *pic)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     versal_create_apu_cpus(s);
     versal_create_apu_gic(s, pic);
+    versal_create_rpu_cpus(s);
     versal_create_uarts(s, pic);
     versal_create_usbs(s, pic);
     versal_create_gems(s, pic);
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
     memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
+    memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
+                                        &s->lpd.rpu.mr_ps_alias, 0);
 }
 
 static void versal_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void versal_init(Object *obj)
     Versal *s = XLNX_VERSAL(obj);
 
     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
+    memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
+    memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
+                             "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
 }
 
 static Property versal_properties[] = {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Add a model of the Xilinx Versal CRL.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-4-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-versal-crl.h | 235 +++++++++++++++++
 hw/misc/xlnx-versal-crl.c         | 421 ++++++++++++++++++++++++++++++
 hw/misc/meson.build               |   1 +
 3 files changed, 657 insertions(+)
 create mode 100644 include/hw/misc/xlnx-versal-crl.h
 create mode 100644 hw/misc/xlnx-versal-crl.c

diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Clock-Reset-LPD (CRL).
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+#ifndef HW_MISC_XLNX_VERSAL_CRL_H
+#define HW_MISC_XLNX_VERSAL_CRL_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "target/arm/cpu.h"
+
+#define TYPE_XLNX_VERSAL_CRL "xlnx,versal-crl"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
+
+REG32(ERR_CTRL, 0x0)
+    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
+REG32(IR_STATUS, 0x4)
+    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_MASK, 0x8)
+    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_ENABLE, 0xc)
+    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_DISABLE, 0x10)
+    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(WPROT, 0x1c)
+    FIELD(WPROT, ACTIVE, 0, 1)
+REG32(PLL_CLK_OTHER_DMN, 0x20)
+    FIELD(PLL_CLK_OTHER_DMN, APLL_BYPASS, 0, 1)
+REG32(RPLL_CTRL, 0x40)
+    FIELD(RPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(RPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(RPLL_CTRL, CLKOUTDIV, 16, 2)
+    FIELD(RPLL_CTRL, FBDIV, 8, 8)
+    FIELD(RPLL_CTRL, BYPASS, 3, 1)
+    FIELD(RPLL_CTRL, RESET, 0, 1)
+REG32(RPLL_CFG, 0x44)
+    FIELD(RPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(RPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(RPLL_CFG, LFHF, 10, 2)
+    FIELD(RPLL_CFG, CP, 5, 4)
+    FIELD(RPLL_CFG, RES, 0, 4)
+REG32(RPLL_FRAC_CFG, 0x48)
+    FIELD(RPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(RPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(RPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(RPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(RPLL_FRAC_CFG, DATA, 0, 16)
+REG32(PLL_STATUS, 0x50)
+    FIELD(PLL_STATUS, RPLL_STABLE, 2, 1)
+    FIELD(PLL_STATUS, RPLL_LOCK, 0, 1)
+REG32(RPLL_TO_XPD_CTRL, 0x100)
+    FIELD(RPLL_TO_XPD_CTRL, CLKACT, 25, 1)
+    FIELD(RPLL_TO_XPD_CTRL, DIVISOR0, 8, 10)
+REG32(LPD_TOP_SWITCH_CTRL, 0x104)
+    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT_ADMA, 26, 1)
+    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT, 25, 1)
+    FIELD(LPD_TOP_SWITCH_CTRL, DIVISOR0, 8, 10)
+    FIELD(LPD_TOP_SWITCH_CTRL, SRCSEL, 0, 3)
+REG32(LPD_LSBUS_CTRL, 0x108)
+    FIELD(LPD_LSBUS_CTRL, CLKACT, 25, 1)
+    FIELD(LPD_LSBUS_CTRL, DIVISOR0, 8, 10)
+    FIELD(LPD_LSBUS_CTRL, SRCSEL, 0, 3)
+REG32(CPU_R5_CTRL, 0x10c)
+    FIELD(CPU_R5_CTRL, CLKACT_OCM2, 28, 1)
+    FIELD(CPU_R5_CTRL, CLKACT_OCM, 27, 1)
+    FIELD(CPU_R5_CTRL, CLKACT_CORE, 26, 1)
+    FIELD(CPU_R5_CTRL, CLKACT, 25, 1)
+    FIELD(CPU_R5_CTRL, DIVISOR0, 8, 10)
+    FIELD(CPU_R5_CTRL, SRCSEL, 0, 3)
+REG32(IOU_SWITCH_CTRL, 0x114)
+    FIELD(IOU_SWITCH_CTRL, CLKACT, 25, 1)
+    FIELD(IOU_SWITCH_CTRL, DIVISOR0, 8, 10)
+    FIELD(IOU_SWITCH_CTRL, SRCSEL, 0, 3)
+REG32(GEM0_REF_CTRL, 0x118)
+    FIELD(GEM0_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(GEM0_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(GEM0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM0_REF_CTRL, SRCSEL, 0, 3)
+REG32(GEM1_REF_CTRL, 0x11c)
+    FIELD(GEM1_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(GEM1_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(GEM1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM1_REF_CTRL, SRCSEL, 0, 3)
+REG32(GEM_TSU_REF_CTRL, 0x120)
+    FIELD(GEM_TSU_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM_TSU_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM_TSU_REF_CTRL, SRCSEL, 0, 3)
+REG32(USB0_BUS_REF_CTRL, 0x124)
+    FIELD(USB0_BUS_REF_CTRL, CLKACT, 25, 1)
+    FIELD(USB0_BUS_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(USB0_BUS_REF_CTRL, SRCSEL, 0, 3)
+REG32(UART0_REF_CTRL, 0x128)
+    FIELD(UART0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(UART0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(UART0_REF_CTRL, SRCSEL, 0, 3)
+REG32(UART1_REF_CTRL, 0x12c)
+    FIELD(UART1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(UART1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(UART1_REF_CTRL, SRCSEL, 0, 3)
+REG32(SPI0_REF_CTRL, 0x130)
+    FIELD(SPI0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(SPI0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(SPI0_REF_CTRL, SRCSEL, 0, 3)
+REG32(SPI1_REF_CTRL, 0x134)
+    FIELD(SPI1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(SPI1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(SPI1_REF_CTRL, SRCSEL, 0, 3)
+REG32(CAN0_REF_CTRL, 0x138)
+    FIELD(CAN0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CAN0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CAN0_REF_CTRL, SRCSEL, 0, 3)
+REG32(CAN1_REF_CTRL, 0x13c)
+    FIELD(CAN1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CAN1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CAN1_REF_CTRL, SRCSEL, 0, 3)
+REG32(I2C0_REF_CTRL, 0x140)
+    FIELD(I2C0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(I2C0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(I2C0_REF_CTRL, SRCSEL, 0, 3)
+REG32(I2C1_REF_CTRL, 0x144)
+    FIELD(I2C1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(I2C1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(I2C1_REF_CTRL, SRCSEL, 0, 3)
+REG32(DBG_LPD_CTRL, 0x148)
+    FIELD(DBG_LPD_CTRL, CLKACT, 25, 1)
+    FIELD(DBG_LPD_CTRL, DIVISOR0, 8, 10)
+    FIELD(DBG_LPD_CTRL, SRCSEL, 0, 3)
+REG32(TIMESTAMP_REF_CTRL, 0x14c)
+    FIELD(TIMESTAMP_REF_CTRL, CLKACT, 25, 1)
+    FIELD(TIMESTAMP_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(TIMESTAMP_REF_CTRL, SRCSEL, 0, 3)
+REG32(CRL_SAFETY_CHK, 0x150)
+REG32(PSM_REF_CTRL, 0x154)
+    FIELD(PSM_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(PSM_REF_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TSTMP_CTRL, 0x158)
+    FIELD(DBG_TSTMP_CTRL, CLKACT, 25, 1)
+    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 10)
+    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
+REG32(CPM_TOPSW_REF_CTRL, 0x15c)
+    FIELD(CPM_TOPSW_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CPM_TOPSW_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CPM_TOPSW_REF_CTRL, SRCSEL, 0, 3)
+REG32(USB3_DUAL_REF_CTRL, 0x160)
+    FIELD(USB3_DUAL_REF_CTRL, CLKACT, 25, 1)
+    FIELD(USB3_DUAL_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(USB3_DUAL_REF_CTRL, SRCSEL, 0, 3)
+REG32(RST_CPU_R5, 0x300)
+    FIELD(RST_CPU_R5, RESET_PGE, 4, 1)
+    FIELD(RST_CPU_R5, RESET_AMBA, 2, 1)
+    FIELD(RST_CPU_R5, RESET_CPU1, 1, 1)
+    FIELD(RST_CPU_R5, RESET_CPU0, 0, 1)
+REG32(RST_ADMA, 0x304)
+    FIELD(RST_ADMA, RESET, 0, 1)
+REG32(RST_GEM0, 0x308)
+    FIELD(RST_GEM0, RESET, 0, 1)
+REG32(RST_GEM1, 0x30c)
+    FIELD(RST_GEM1, RESET, 0, 1)
+REG32(RST_SPARE, 0x310)
+    FIELD(RST_SPARE, RESET, 0, 1)
+REG32(RST_USB0, 0x314)
+    FIELD(RST_USB0, RESET, 0, 1)
+REG32(RST_UART0, 0x318)
+    FIELD(RST_UART0, RESET, 0, 1)
+REG32(RST_UART1, 0x31c)
+    FIELD(RST_UART1, RESET, 0, 1)
+REG32(RST_SPI0, 0x320)
+    FIELD(RST_SPI0, RESET, 0, 1)
+REG32(RST_SPI1, 0x324)
+    FIELD(RST_SPI1, RESET, 0, 1)
+REG32(RST_CAN0, 0x328)
+    FIELD(RST_CAN0, RESET, 0, 1)
+REG32(RST_CAN1, 0x32c)
+    FIELD(RST_CAN1, RESET, 0, 1)
+REG32(RST_I2C0, 0x330)
+    FIELD(RST_I2C0, RESET, 0, 1)
+REG32(RST_I2C1, 0x334)
+    FIELD(RST_I2C1, RESET, 0, 1)
+REG32(RST_DBG_LPD, 0x338)
+    FIELD(RST_DBG_LPD, RPU_DBG1_RESET, 5, 1)
+    FIELD(RST_DBG_LPD, RPU_DBG0_RESET, 4, 1)
+    FIELD(RST_DBG_LPD, RESET_HSDP, 1, 1)
+    FIELD(RST_DBG_LPD, RESET, 0, 1)
+REG32(RST_GPIO, 0x33c)
+    FIELD(RST_GPIO, RESET, 0, 1)
+REG32(RST_TTC, 0x344)
+    FIELD(RST_TTC, TTC3_RESET, 3, 1)
+    FIELD(RST_TTC, TTC2_RESET, 2, 1)
+    FIELD(RST_TTC, TTC1_RESET, 1, 1)
+    FIELD(RST_TTC, TTC0_RESET, 0, 1)
+REG32(RST_TIMESTAMP, 0x348)
+    FIELD(RST_TIMESTAMP, RESET, 0, 1)
+REG32(RST_SWDT, 0x34c)
+    FIELD(RST_SWDT, RESET, 0, 1)
+REG32(RST_OCM, 0x350)
+    FIELD(RST_OCM, RESET, 0, 1)
+REG32(RST_IPI, 0x354)
+    FIELD(RST_IPI, RESET, 0, 1)
+REG32(RST_SYSMON, 0x358)
+    FIELD(RST_SYSMON, SEQ_RST, 1, 1)
+    FIELD(RST_SYSMON, CFG_RST, 0, 1)
+REG32(RST_FPD, 0x360)
+    FIELD(RST_FPD, SRST, 1, 1)
+    FIELD(RST_FPD, POR, 0, 1)
+REG32(PSM_RST_MODE, 0x370)
+    FIELD(PSM_RST_MODE, WAKEUP, 2, 1)
+    FIELD(PSM_RST_MODE, RST_MODE, 0, 2)
+
+#define CRL_R_MAX (R_PSM_RST_MODE + 1)
+
+#define RPU_MAX_CPU 2
+
+struct XlnxVersalCRL {
+    SysBusDevice parent_obj;
+    qemu_irq irq;
+
+    struct {
+        ARMCPU *cpu_r5[RPU_MAX_CPU];
+        DeviceState *adma[8];
+        DeviceState *uart[2];
+        DeviceState *gem[2];
+        DeviceState *usb;
+    } cfg;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[CRL_R_MAX];
+    RegisterInfo regs_info[CRL_R_MAX];
+};
+#endif
diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-versal-crl.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Clock-Reset-LPD (CRL).
+ *
+ * Copyright (c) 2022 Advanced Micro Devices, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Edgar E. Iglesias <edgar.iglesias@amd.com>
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/bitops.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+#include "hw/register.h"
+#include "hw/resettable.h"
+
+#include "target/arm/arm-powerctl.h"
+#include "hw/misc/xlnx-versal-crl.h"
+
+#ifndef XLNX_VERSAL_CRL_ERR_DEBUG
+#define XLNX_VERSAL_CRL_ERR_DEBUG 0
+#endif
+
+static void crl_update_irq(XlnxVersalCRL *s)
+{
+    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
+    qemu_set_irq(s->irq, pending);
+}
+
+static void crl_status_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    crl_update_irq(s);
+}
+
+static uint64_t crl_enable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] &= ~val;
+    crl_update_irq(s);
+    return 0;
+}
+
+static uint64_t crl_disable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] |= val;
+    crl_update_irq(s);
+    return 0;
+}
+
+static void crl_reset_dev(XlnxVersalCRL *s, DeviceState *dev,
+                          bool rst_old, bool rst_new)
+{
+    device_cold_reset(dev);
+}
+
+static void crl_reset_cpu(XlnxVersalCRL *s, ARMCPU *armcpu,
+                          bool rst_old, bool rst_new)
+{
+    if (rst_new) {
+        arm_set_cpu_off(armcpu->mp_affinity);
+    } else {
+        arm_set_cpu_on_and_reset(armcpu->mp_affinity);
+    }
+}
+
+#define REGFIELD_RESET(type, s, reg, f, new_val, dev) {     \
+    bool old_f = ARRAY_FIELD_EX32((s)->regs, reg, f);       \
+    bool new_f = FIELD_EX32(new_val, reg, f);               \
+                                                            \
+    /* Detect edges.  */                                    \
+    if (dev && old_f != new_f) {                            \
+        crl_reset_ ## type(s, dev, old_f, new_f);           \
+    }                                                       \
+}
+
+static uint64_t crl_rst_r5_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU0, val64, s->cfg.cpu_r5[0]);
+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU1, val64, s->cfg.cpu_r5[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_adma_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    int i;
+
+    /* A single register fans out to all ADMA reset inputs.  */
+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); i++) {
+        REGFIELD_RESET(dev, s, RST_ADMA, RESET, val64, s->cfg.adma[i]);
+    }
+    return val64;
+}
+
+static uint64_t crl_rst_uart0_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_UART0, RESET, val64, s->cfg.uart[0]);
+    return val64;
+}
+
+static uint64_t crl_rst_uart1_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_UART1, RESET, val64, s->cfg.uart[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_gem0_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_GEM0, RESET, val64, s->cfg.gem[0]);
+    return val64;
+}
+
+static uint64_t crl_rst_gem1_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_GEM1, RESET, val64, s->cfg.gem[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_usb_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_USB0, RESET, val64, s->cfg.usb);
+    return val64;
+}
+
+static const RegisterAccessInfo crl_regs_info[] = {
+    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
+    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
+        .w1c = 0x1,
+        .post_write = crl_status_postw,
+    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
+        .pre_write = crl_enable_prew,
+    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
+        .pre_write = crl_disable_prew,
+    },{ .name = "WPROT",  .addr = A_WPROT,
+    },{ .name = "PLL_CLK_OTHER_DMN",  .addr = A_PLL_CLK_OTHER_DMN,
+        .reset = 0x1,
+        .rsvd = 0xe,
+    },{ .name = "RPLL_CTRL",  .addr = A_RPLL_CTRL,
+        .reset = 0x24809,
+        .rsvd = 0xf88c00f6,
+    },{ .name = "RPLL_CFG",  .addr = A_RPLL_CFG,
+        .reset = 0x2000000,
+        .rsvd = 0x1801210,
+    },{ .name = "RPLL_FRAC_CFG",  .addr = A_RPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
+        .reset = R_PLL_STATUS_RPLL_STABLE_MASK |
+                 R_PLL_STATUS_RPLL_LOCK_MASK,
+        .rsvd = 0xfa,
+        .ro = 0x5,
+    },{ .name = "RPLL_TO_XPD_CTRL",  .addr = A_RPLL_TO_XPD_CTRL,
+        .reset = 0x2000100,
+        .rsvd = 0xfdfc00ff,
+    },{ .name = "LPD_TOP_SWITCH_CTRL",  .addr = A_LPD_TOP_SWITCH_CTRL,
+        .reset = 0x6000300,
+        .rsvd = 0xf9fc00f8,
+    },{ .name = "LPD_LSBUS_CTRL",  .addr = A_LPD_LSBUS_CTRL,
+        .reset = 0x2000800,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CPU_R5_CTRL",  .addr = A_CPU_R5_CTRL,
+        .reset = 0xe000300,
+        .rsvd = 0xe1fc00f8,
+    },{ .name = "IOU_SWITCH_CTRL",  .addr = A_IOU_SWITCH_CTRL,
+        .reset = 0x2000500,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "GEM0_REF_CTRL",  .addr = A_GEM0_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM1_REF_CTRL",  .addr = A_GEM1_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM_TSU_REF_CTRL",  .addr = A_GEM_TSU_REF_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB0_BUS_REF_CTRL",  .addr = A_USB0_BUS_REF_CTRL,
+        .reset = 0x2001900,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART0_REF_CTRL",  .addr = A_UART0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART1_REF_CTRL",  .addr = A_UART1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI0_REF_CTRL",  .addr = A_SPI0_REF_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI1_REF_CTRL",  .addr = A_SPI1_REF_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN0_REF_CTRL",  .addr = A_CAN0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN1_REF_CTRL",  .addr = A_CAN1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I2C0_REF_CTRL",  .addr = A_I2C0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I2C1_REF_CTRL",  .addr = A_I2C1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "DBG_LPD_CTRL",  .addr = A_DBG_LPD_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "TIMESTAMP_REF_CTRL",  .addr = A_TIMESTAMP_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CRL_SAFETY_CHK",  .addr = A_CRL_SAFETY_CHK,
+    },{ .name = "PSM_REF_CTRL",  .addr = A_PSM_REF_CTRL,
+        .reset = 0xf04,
+        .rsvd = 0xfffc00f8,
+    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CPM_TOPSW_REF_CTRL",  .addr = A_CPM_TOPSW_REF_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB3_DUAL_REF_CTRL",  .addr = A_USB3_DUAL_REF_CTRL,
+        .reset = 0x3c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "RST_CPU_R5",  .addr = A_RST_CPU_R5,
+        .reset = 0x17,
+        .rsvd = 0x8,
+        .pre_write = crl_rst_r5_prew,
+    },{ .name = "RST_ADMA",  .addr = A_RST_ADMA,
+        .reset = 0x1,
+        .pre_write = crl_rst_adma_prew,
+    },{ .name = "RST_GEM0",  .addr = A_RST_GEM0,
+        .reset = 0x1,
+        .pre_write = crl_rst_gem0_prew,
+    },{ .name = "RST_GEM1",  .addr = A_RST_GEM1,
+        .reset = 0x1,
+        .pre_write = crl_rst_gem1_prew,
+    },{ .name = "RST_SPARE",  .addr = A_RST_SPARE,
+        .reset = 0x1,
+    },{ .name = "RST_USB0",  .addr = A_RST_USB0,
+        .reset = 0x1,
+        .pre_write = crl_rst_usb_prew,
+    },{ .name = "RST_UART0",  .addr = A_RST_UART0,
+        .reset = 0x1,
+        .pre_write = crl_rst_uart0_prew,
+    },{ .name = "RST_UART1",  .addr = A_RST_UART1,
+        .reset = 0x1,
+        .pre_write = crl_rst_uart1_prew,
+    },{ .name = "RST_SPI0",  .addr = A_RST_SPI0,
+        .reset = 0x1,
+    },{ .name = "RST_SPI1",  .addr = A_RST_SPI1,
+        .reset = 0x1,
+    },{ .name = "RST_CAN0",  .addr = A_RST_CAN0,
+        .reset = 0x1,
+    },{ .name = "RST_CAN1",  .addr = A_RST_CAN1,
+        .reset = 0x1,
+    },{ .name = "RST_I2C0",  .addr = A_RST_I2C0,
+        .reset = 0x1,
+    },{ .name = "RST_I2C1",  .addr = A_RST_I2C1,
+        .reset = 0x1,
+    },{ .name = "RST_DBG_LPD",  .addr = A_RST_DBG_LPD,
+        .reset = 0x33,
+        .rsvd = 0xcc,
+    },{ .name = "RST_GPIO",  .addr = A_RST_GPIO,
+        .reset = 0x1,
+    },{ .name = "RST_TTC",  .addr = A_RST_TTC,
+        .reset = 0xf,
+    },{ .name = "RST_TIMESTAMP",  .addr = A_RST_TIMESTAMP,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT",  .addr = A_RST_SWDT,
+        .reset = 0x1,
+    },{ .name = "RST_OCM",  .addr = A_RST_OCM,
+    },{ .name = "RST_IPI",  .addr = A_RST_IPI,
+    },{ .name = "RST_FPD",  .addr = A_RST_FPD,
+        .reset = 0x3,
+    },{ .name = "PSM_RST_MODE",  .addr = A_PSM_RST_MODE,
+        .reset = 0x1,
+        .rsvd = 0xf8,
+    }
+};
+
+static void crl_reset_enter(Object *obj, ResetType type)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
+static void crl_reset_hold(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+
+    crl_update_irq(s);
+}
+
+static const MemoryRegionOps crl_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void crl_init(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    int i;
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), crl_regs_info,
+                              ARRAY_SIZE(crl_regs_info),
+                              s->regs_info, s->regs,
+                              &crl_ops,
+                              XLNX_VERSAL_CRL_ERR_DEBUG,
+                              CRL_R_MAX * 4);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_irq(sbd, &s->irq);
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
+        object_property_add_link(obj, "cpu_r5[*]", TYPE_ARM_CPU,
+                                 (Object **)&s->cfg.cpu_r5[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); ++i) {
+        object_property_add_link(obj, "adma[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.adma[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.uart); ++i) {
+        object_property_add_link(obj, "uart[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.uart[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.gem); ++i) {
+        object_property_add_link(obj, "gem[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.gem[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    object_property_add_link(obj, "usb", TYPE_DEVICE,
+                             (Object **)&s->cfg.gem[i],
+                             qdev_prop_allow_set_link_before_realize,
+                             OBJ_PROP_LINK_STRONG);
+}
+
+static void crl_finalize(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_crl = {
+    .name = TYPE_XLNX_VERSAL_CRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxVersalCRL, CRL_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void crl_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_crl;
+
+    rc->phases.enter = crl_reset_enter;
+    rc->phases.hold = crl_reset_hold;
+}
+
+static const TypeInfo crl_info = {
+    .name          = TYPE_XLNX_VERSAL_CRL,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxVersalCRL),
+    .class_init    = crl_class_init,
+    .instance_init = crl_init,
+    .instance_finalize = crl_finalize,
+};
+
+static void crl_register_types(void)
+{
+    type_register_static(&crl_info);
+}
+
+type_init(crl_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
+specific_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-crl.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Connect the CRL (Clock Reset LPD) to the Versal SoC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-5-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  4 +++
 hw/arm/xlnx-versal.c         | 54 ++++++++++++++++++++++++++++++++++--
 2 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
 #include "hw/dma/xlnx_csu_dma.h"
+#include "hw/misc/xlnx-versal-crl.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
@@ -XXX,XX +XXX,XX @@ struct Versal {
             qemu_or_irq irq_orgate;
             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
         } xram;
+
+        XlnxVersalCRL crl;
     } lpd;
 
     /* The Platform Management Controller subsystem.  */
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define VERSAL_TIMER_NS_EL1_IRQ     14
 #define VERSAL_TIMER_NS_EL2_IRQ     10
 
+#define VERSAL_CRL_IRQ             10
 #define VERSAL_UART0_IRQ_0         18
 #define VERSAL_UART1_IRQ_0         19
 #define VERSAL_USB0_IRQ_0          22
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_ospi(Versal *s, qemu_irq *pic)
     qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
 }
 
+static void versal_create_crl(Versal *s, qemu_irq *pic)
+{
+    SysBusDevice *sbd;
+    int i;
+
+    object_initialize_child(OBJECT(s), "crl", &s->lpd.crl,
+                            TYPE_XLNX_VERSAL_CRL);
+    sbd = SYS_BUS_DEVICE(&s->lpd.crl);
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
+        g_autofree gchar *name = g_strdup_printf("cpu_r5[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.rpu.cpu[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
+        g_autofree gchar *name = g_strdup_printf("gem[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.gem[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
+        g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.adma[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
+        g_autofree gchar *name = g_strdup_printf("uart[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.uart[i]),
+                                 &error_abort);
+    }
+
+    object_property_set_link(OBJECT(&s->lpd.crl),
+                             "usb", OBJECT(&s->lpd.iou.usb),
+                             &error_abort);
+
+    sysbus_realize(sbd, &error_fatal);
+    memory_region_add_subregion(&s->mr_ps, MM_CRL,
+                                sysbus_mmio_get_region(sbd, 0));
+    sysbus_connect_irq(sbd, 0, pic[VERSAL_CRL_IRQ]);
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
 
     versal_unimp_area(s, "psm", &s->mr_ps,
                         MM_PSM_START, MM_PSM_END - MM_PSM_START);
-    versal_unimp_area(s, "crl", &s->mr_ps,
-                        MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
     versal_unimp_area(s, "apu", &s->mr_ps,
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_efuse(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
     versal_create_ospi(s, pic);
+    versal_create_crl(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.25.1

The Exynos4210 SoC device currently uses a custom device
"exynos4210.irq_gate" to model the OR gate that feeds each CPU's IRQ
line.  We have a standard TYPE_OR_IRQ device for this now, so use
that instead.

(This is a migration compatibility break, but that is OK for this
machine type.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-2-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  1 +
 hw/arm/exynos4210.c         | 31 ++++++++++++++++---------------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
+    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
     Exynos4210State *s = EXYNOS4210_SOC(socdev);
     MemoryRegion *system_mem = get_system_memory();
-    qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev, *uart[4], *pl330[3];
     int i, n;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
 
     /* IRQ Gate */
     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
-        dev = qdev_new("exynos4210.irq_gate");
-        qdev_prop_set_uint32(dev, "n_in", EXYNOS4210_IRQ_GATE_NINPUTS);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-        /* Get IRQ Gate input in gate_irq */
-        for (n = 0; n < EXYNOS4210_IRQ_GATE_NINPUTS; n++) {
-            gate_irq[i][n] = qdev_get_gpio_in(dev, n);
-        }
-        busdev = SYS_BUS_DEVICE(dev);
-
-        /* Connect IRQ Gate output to CPU's IRQ line */
-        sysbus_connect_irq(busdev, 0,
-                           qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
+        DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
+        object_property_set_int(OBJECT(orgate), "num-lines",
+                                EXYNOS4210_IRQ_GATE_NINPUTS,
+                                &error_abort);
+        qdev_realize(orgate, NULL, &error_abort);
+        qdev_connect_gpio_out(orgate, 0,
+                              qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
     }
 
     /* Private memory region and Internal GIC */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_realize_and_unref(busdev, &error_fatal);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-        sysbus_connect_irq(busdev, n, gate_irq[n][0]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
         s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     /* Map Distributer interface */
     sysbus_mmio_map(busdev, 1, EXYNOS4210_EXT_GIC_DIST_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-        sysbus_connect_irq(busdev, n, gate_irq[n][1]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
         s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
         g_free(name);
     }
+
+    for (i = 0; i < ARRAY_SIZE(s->cpu_irq_orgate); i++) {
+        g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
+        object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
+    }
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
-- 
2.25.1

Now we have removed the only use of TYPE_EXYNOS4210_IRQ_GATE we can
delete the device entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220404154658.565020-3-peter.maydell@linaro.org
---
 hw/intc/exynos4210_gic.c | 107 ---------------------------------------
 1 file changed, 107 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_register_types(void)
 }
 
 type_init(exynos4210_gic_register_types)
-
-/* IRQ OR Gate struct.
- *
- * This device models an OR gate. There are n_in input qdev gpio lines and one
- * output sysbus IRQ line. The output IRQ level is formed as OR between all
- * gpio inputs.
- */
-
-#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210IRQGateState, EXYNOS4210_IRQ_GATE)
-
-struct Exynos4210IRQGateState {
-    SysBusDevice parent_obj;
-
-    uint32_t n_in;      /* inputs amount */
-    uint32_t *level;    /* input levels */
-    qemu_irq out;       /* output IRQ */
-};
-
-static Property exynos4210_irq_gate_properties[] = {
-    DEFINE_PROP_UINT32("n_in", Exynos4210IRQGateState, n_in, 1),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static const VMStateDescription vmstate_exynos4210_irq_gate = {
-    .name = "exynos4210.irq_gate",
-    .version_id = 2,
-    .minimum_version_id = 2,
-    .fields = (VMStateField[]) {
-        VMSTATE_VBUFFER_UINT32(level, Exynos4210IRQGateState, 1, NULL, n_in),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-/* Process a change in IRQ input. */
-static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
-{
-    Exynos4210IRQGateState *s = (Exynos4210IRQGateState *)opaque;
-    uint32_t i;
-
-    assert(irq < s->n_in);
-
-    s->level[irq] = level;
-
-    for (i = 0; i < s->n_in; i++) {
-        if (s->level[i] >= 1) {
-            qemu_irq_raise(s->out);
-            return;
-        }
-    }
-
-    qemu_irq_lower(s->out);
-}
-
-static void exynos4210_irq_gate_reset(DeviceState *d)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
-
-    memset(s->level, 0, s->n_in * sizeof(*s->level));
-}
-
-/*
- * IRQ Gate initialization.
- */
-static void exynos4210_irq_gate_init(Object *obj)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(obj);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-
-    sysbus_init_irq(sbd, &s->out);
-}
-
-static void exynos4210_irq_gate_realize(DeviceState *dev, Error **errp)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
-
-    /* Allocate general purpose input signals and connect a handler to each of
-     * them */
-    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
-
-    s->level = g_malloc0(s->n_in * sizeof(*s->level));
-}
-
-static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->reset = exynos4210_irq_gate_reset;
-    dc->vmsd = &vmstate_exynos4210_irq_gate;
-    device_class_set_props(dc, exynos4210_irq_gate_properties);
-    dc->realize = exynos4210_irq_gate_realize;
-}
-
-static const TypeInfo exynos4210_irq_gate_info = {
-    .name          = TYPE_EXYNOS4210_IRQ_GATE,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(Exynos4210IRQGateState),
-    .instance_init = exynos4210_irq_gate_init,
-    .class_init    = exynos4210_irq_gate_class_init,
-};
-
-static void exynos4210_irq_gate_register_types(void)
-{
-    type_register_static(&exynos4210_irq_gate_info);
-}
-
-type_init(exynos4210_irq_gate_register_types)
-- 
2.25.1

The exynos4210 SoC mostly creates its child devices as if it were
board code.  This includes the a9mpcore object.  Switch that to a
new-style "embedded in the state struct" creation, because in the
next commit we're going to want to refer to the object again further
down in the exynos4210_realize() function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-4-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  2 ++
 hw/arm/exynos4210.c         | 11 ++++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/or-irq.h"
 #include "hw/sysbus.h"
+#include "hw/cpu/a9mpcore.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+    A9MPPrivState a9mpcore;
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     }
 
     /* Private memory region and Internal GIC */
-    dev = qdev_new(TYPE_A9MPCORE_PRIV);
-    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->a9mpcore), "num-cpu", EXYNOS4210_NCPUS);
+    busdev = SYS_BUS_DEVICE(&s->a9mpcore);
+    sysbus_realize(busdev, &error_fatal);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
+        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
     }
 
     /* Cache controller */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
     }
+
+    object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
-- 
2.25.1

The only time we use the int_gic_irq[] array in the Exynos4210Irq
struct is in the exynos4210_realize() function: we initialize it with
the GPIO inputs of the a9mpcore device, and then a bit later on we
connect those to the outputs of the internal combiner.  Now that the
a9mpcore object is easily accessible as s->a9mpcore we can make the
connection directly from one device to the other without going via
this array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-5-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h | 1 -
 hw/arm/exynos4210.c         | 6 ++----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-    qemu_irq int_gic_irq[EXYNOS4210_INT_GIC_NIRQ];
     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
     qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 } Exynos4210Irq;
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
-    for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
-    }
 
     /* Cache controller */
     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-        sysbus_connect_irq(busdev, n, s->irqs.int_gic_irq[n]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
     exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
-- 
2.25.1

The exynos4210 code currently has two very similar arrays of IRQs:

* board_irqs is a field of the Exynos4210Irq struct which is filled
   in by exynos4210_init_board_irqs() with the appropriate qemu_irqs
   for each IRQ the board/SoC can assert
 * irq_table is a set of qemu_irqs pointed to from the
   Exynos4210State struct.  It's allocated in exynos4210_init_irq,
   and the only behaviour these irqs have is that they pass on the
   level to the equivalent board_irqs[] irq

The extra indirection through irq_table is unnecessary, so coalesce
these into a single irq_table[] array as a direct field in
Exynos4210State which exynos4210_init_board_irqs() fills in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-6-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  8 ++------
 hw/arm/exynos4210.c         |  6 +-----
 hw/intc/exynos4210_gic.c    | 32 ++++++++------------------------
 3 files changed, 11 insertions(+), 35 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
-    qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 } Exynos4210Irq;
 
 struct Exynos4210State {
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
-    qemu_irq *irq_table;
+    qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 
     MemoryRegion chipid_mem;
     MemoryRegion iram_mem;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-/* Initialize exynos4210 IRQ subsystem stub */
-qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
-
 /* Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
-void exynos4210_init_board_irqs(Exynos4210Irq *s);
+void exynos4210_init_board_irqs(Exynos4210State *s);
 
 /* Get IRQ number from exynos4210 IRQ subsystem stub.
  * To identify IRQ source use internal combiner group and bit number
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);
     }
 
-    /*** IRQs ***/
-
-    s->irq_table = exynos4210_init_irq(&s->irqs);
-
     /* IRQ Gate */
     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
         DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
-    exynos4210_init_board_irqs(&s->irqs);
+    exynos4210_init_board_irqs(s);
 
     /*** Memory ***/
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-static void exynos4210_irq_handler(void *opaque, int irq, int level)
-{
-    Exynos4210Irq *s = (Exynos4210Irq *)opaque;
-
-    /* Bypass */
-    qemu_set_irq(s->board_irqs[irq], level);
-}
-
-/*
- * Initialize exynos4210 IRQ subsystem stub.
- */
-qemu_irq *exynos4210_init_irq(Exynos4210Irq *s)
-{
-    return qemu_allocate_irqs(exynos4210_irq_handler, s,
-            EXYNOS4210_MAX_INT_COMBINER_IN_IRQ);
-}
-
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
  */
-void exynos4210_init_board_irqs(Exynos4210Irq *s)
+void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
+    Exynos4210Irq *is = &s->irqs;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
             irq_id = EXT_GIC_ID_MCT_G1;
         }
         if (irq_id) {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_gic_irq[irq_id-32]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
         } else {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_combiner_irq[n]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
         if (irq_id) {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_gic_irq[irq_id-32]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
         }
     }
 }
-- 
2.25.1

The function exynos4210_init_board_irqs() currently lives in
exynos4210_gic.c, but it isn't really part of the exynos4210.gic
device -- it is a function that implements (some of) the wiring up of
interrupts between the SoC's GIC and combiner components.  This means
it fits better in exynos4210.c, which is the SoC-level code.  Move it
there. Similarly, exynos4210_git_irq() is used almost only in the
SoC-level code, so move it too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-8-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |   4 -
 hw/arm/exynos4210.c         | 202 +++++++++++++++++++++++++++++++++++
 hw/intc/exynos4210_gic.c    | 204 ------------------------------------
 3 files changed, 202 insertions(+), 208 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-/* Initialize board IRQs.
- * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
-void exynos4210_init_board_irqs(Exynos4210State *s);
-
 /* Get IRQ number from exynos4210 IRQ subsystem stub.
  * To identify IRQ source use internal combiner group and bit number
  *  grp - group number
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
 #define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
 
+enum ExtGicId {
+    EXT_GIC_ID_MDMA_LCD0 = 66,
+    EXT_GIC_ID_PDMA0,
+    EXT_GIC_ID_PDMA1,
+    EXT_GIC_ID_TIMER0,
+    EXT_GIC_ID_TIMER1,
+    EXT_GIC_ID_TIMER2,
+    EXT_GIC_ID_TIMER3,
+    EXT_GIC_ID_TIMER4,
+    EXT_GIC_ID_MCT_L0,
+    EXT_GIC_ID_WDT,
+    EXT_GIC_ID_RTC_ALARM,
+    EXT_GIC_ID_RTC_TIC,
+    EXT_GIC_ID_GPIO_XB,
+    EXT_GIC_ID_GPIO_XA,
+    EXT_GIC_ID_MCT_L1,
+    EXT_GIC_ID_IEM_APC,
+    EXT_GIC_ID_IEM_IEC,
+    EXT_GIC_ID_NFC,
+    EXT_GIC_ID_UART0,
+    EXT_GIC_ID_UART1,
+    EXT_GIC_ID_UART2,
+    EXT_GIC_ID_UART3,
+    EXT_GIC_ID_UART4,
+    EXT_GIC_ID_MCT_G0,
+    EXT_GIC_ID_I2C0,
+    EXT_GIC_ID_I2C1,
+    EXT_GIC_ID_I2C2,
+    EXT_GIC_ID_I2C3,
+    EXT_GIC_ID_I2C4,
+    EXT_GIC_ID_I2C5,
+    EXT_GIC_ID_I2C6,
+    EXT_GIC_ID_I2C7,
+    EXT_GIC_ID_SPI0,
+    EXT_GIC_ID_SPI1,
+    EXT_GIC_ID_SPI2,
+    EXT_GIC_ID_MCT_G1,
+    EXT_GIC_ID_USB_HOST,
+    EXT_GIC_ID_USB_DEVICE,
+    EXT_GIC_ID_MODEMIF,
+    EXT_GIC_ID_HSMMC0,
+    EXT_GIC_ID_HSMMC1,
+    EXT_GIC_ID_HSMMC2,
+    EXT_GIC_ID_HSMMC3,
+    EXT_GIC_ID_SDMMC,
+    EXT_GIC_ID_MIPI_CSI_4LANE,
+    EXT_GIC_ID_MIPI_DSI_4LANE,
+    EXT_GIC_ID_MIPI_CSI_2LANE,
+    EXT_GIC_ID_MIPI_DSI_2LANE,
+    EXT_GIC_ID_ONENAND_AUDI,
+    EXT_GIC_ID_ROTATOR,
+    EXT_GIC_ID_FIMC0,
+    EXT_GIC_ID_FIMC1,
+    EXT_GIC_ID_FIMC2,
+    EXT_GIC_ID_FIMC3,
+    EXT_GIC_ID_JPEG,
+    EXT_GIC_ID_2D,
+    EXT_GIC_ID_PCIe,
+    EXT_GIC_ID_MIXER,
+    EXT_GIC_ID_HDMI,
+    EXT_GIC_ID_HDMI_I2C,
+    EXT_GIC_ID_MFC,
+    EXT_GIC_ID_TVENC,
+};
+
+enum ExtInt {
+    EXT_GIC_ID_EXTINT0 = 48,
+    EXT_GIC_ID_EXTINT1,
+    EXT_GIC_ID_EXTINT2,
+    EXT_GIC_ID_EXTINT3,
+    EXT_GIC_ID_EXTINT4,
+    EXT_GIC_ID_EXTINT5,
+    EXT_GIC_ID_EXTINT6,
+    EXT_GIC_ID_EXTINT7,
+    EXT_GIC_ID_EXTINT8,
+    EXT_GIC_ID_EXTINT9,
+    EXT_GIC_ID_EXTINT10,
+    EXT_GIC_ID_EXTINT11,
+    EXT_GIC_ID_EXTINT12,
+    EXT_GIC_ID_EXTINT13,
+    EXT_GIC_ID_EXTINT14,
+    EXT_GIC_ID_EXTINT15
+};
+
+/*
+ * External GIC sources which are not from External Interrupt Combiner or
+ * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
+ * which is INTG16 in Internal Interrupt Combiner.
+ */
+
+static const uint32_t
+combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+    /* int combiner groups 16-19 */
+    { }, { }, { }, { },
+    /* int combiner group 20 */
+    { 0, EXT_GIC_ID_MDMA_LCD0 },
+    /* int combiner group 21 */
+    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
+    /* int combiner group 22 */
+    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
+            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
+    /* int combiner group 23 */
+    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
+    /* int combiner group 24 */
+    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
+    /* int combiner group 25 */
+    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
+    /* int combiner group 26 */
+    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
+            EXT_GIC_ID_UART4 },
+    /* int combiner group 27 */
+    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
+            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
+            EXT_GIC_ID_I2C7 },
+    /* int combiner group 28 */
+    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
+    /* int combiner group 29 */
+    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
+     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
+    /* int combiner group 30 */
+    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
+    /* int combiner group 31 */
+    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
+    /* int combiner group 32 */
+    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
+    /* int combiner group 33 */
+    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
+    /* int combiner group 34 */
+    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
+    /* int combiner group 35 */
+    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* int combiner group 36 */
+    { EXT_GIC_ID_MIXER },
+    /* int combiner group 37 */
+    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
+     EXT_GIC_ID_EXTINT7 },
+    /* groups 38-50 */
+    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
+    /* int combiner group 51 */
+    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* group 52 */
+    { },
+    /* int combiner group 53 */
+    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* groups 54-63 */
+    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
+};
+
+/*
+ * Initialize board IRQs.
+ * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
+ */
+static void exynos4210_init_board_irqs(Exynos4210State *s)
+{
+    uint32_t grp, bit, irq_id, n;
+    Exynos4210Irq *is = &s->irqs;
+
+    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
+        irq_id = 0;
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
+                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
+            /* MCT_G0 is passed to External GIC */
+            irq_id = EXT_GIC_ID_MCT_G0;
+        }
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
+                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
+            /* MCT_G1 is passed to External and GIC */
+            irq_id = EXT_GIC_ID_MCT_G1;
+        }
+        if (irq_id) {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
+        } else {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_combiner_irq[n]);
+        }
+    }
+    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+        /* these IDs are passed to Internal Combiner and External GIC */
+        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
+        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
+        irq_id = combiner_grp_to_gic_id[grp -
+                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
+
+        if (irq_id) {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
+        }
+    }
+}
+
+/*
+ * Get IRQ number from exynos4210 IRQ subsystem stub.
+ * To identify IRQ source use internal combiner group and bit number
+ *  grp - group number
+ *  bit - bit number inside group
+ */
+uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
+{
+    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
+}
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/exynos4210.h"
 #include "qom/object.h"
 
-enum ExtGicId {
-    EXT_GIC_ID_MDMA_LCD0 = 66,
-    EXT_GIC_ID_PDMA0,
-    EXT_GIC_ID_PDMA1,
-    EXT_GIC_ID_TIMER0,
-    EXT_GIC_ID_TIMER1,
-    EXT_GIC_ID_TIMER2,
-    EXT_GIC_ID_TIMER3,
-    EXT_GIC_ID_TIMER4,
-    EXT_GIC_ID_MCT_L0,
-    EXT_GIC_ID_WDT,
-    EXT_GIC_ID_RTC_ALARM,
-    EXT_GIC_ID_RTC_TIC,
-    EXT_GIC_ID_GPIO_XB,
-    EXT_GIC_ID_GPIO_XA,
-    EXT_GIC_ID_MCT_L1,
-    EXT_GIC_ID_IEM_APC,
-    EXT_GIC_ID_IEM_IEC,
-    EXT_GIC_ID_NFC,
-    EXT_GIC_ID_UART0,
-    EXT_GIC_ID_UART1,
-    EXT_GIC_ID_UART2,
-    EXT_GIC_ID_UART3,
-    EXT_GIC_ID_UART4,
-    EXT_GIC_ID_MCT_G0,
-    EXT_GIC_ID_I2C0,
-    EXT_GIC_ID_I2C1,
-    EXT_GIC_ID_I2C2,
-    EXT_GIC_ID_I2C3,
-    EXT_GIC_ID_I2C4,
-    EXT_GIC_ID_I2C5,
-    EXT_GIC_ID_I2C6,
-    EXT_GIC_ID_I2C7,
-    EXT_GIC_ID_SPI0,
-    EXT_GIC_ID_SPI1,
-    EXT_GIC_ID_SPI2,
-    EXT_GIC_ID_MCT_G1,
-    EXT_GIC_ID_USB_HOST,
-    EXT_GIC_ID_USB_DEVICE,
-    EXT_GIC_ID_MODEMIF,
-    EXT_GIC_ID_HSMMC0,
-    EXT_GIC_ID_HSMMC1,
-    EXT_GIC_ID_HSMMC2,
-    EXT_GIC_ID_HSMMC3,
-    EXT_GIC_ID_SDMMC,
-    EXT_GIC_ID_MIPI_CSI_4LANE,
-    EXT_GIC_ID_MIPI_DSI_4LANE,
-    EXT_GIC_ID_MIPI_CSI_2LANE,
-    EXT_GIC_ID_MIPI_DSI_2LANE,
-    EXT_GIC_ID_ONENAND_AUDI,
-    EXT_GIC_ID_ROTATOR,
-    EXT_GIC_ID_FIMC0,
-    EXT_GIC_ID_FIMC1,
-    EXT_GIC_ID_FIMC2,
-    EXT_GIC_ID_FIMC3,
-    EXT_GIC_ID_JPEG,
-    EXT_GIC_ID_2D,
-    EXT_GIC_ID_PCIe,
-    EXT_GIC_ID_MIXER,
-    EXT_GIC_ID_HDMI,
-    EXT_GIC_ID_HDMI_I2C,
-    EXT_GIC_ID_MFC,
-    EXT_GIC_ID_TVENC,
-};
-
-enum ExtInt {
-    EXT_GIC_ID_EXTINT0 = 48,
-    EXT_GIC_ID_EXTINT1,
-    EXT_GIC_ID_EXTINT2,
-    EXT_GIC_ID_EXTINT3,
-    EXT_GIC_ID_EXTINT4,
-    EXT_GIC_ID_EXTINT5,
-    EXT_GIC_ID_EXTINT6,
-    EXT_GIC_ID_EXTINT7,
-    EXT_GIC_ID_EXTINT8,
-    EXT_GIC_ID_EXTINT9,
-    EXT_GIC_ID_EXTINT10,
-    EXT_GIC_ID_EXTINT11,
-    EXT_GIC_ID_EXTINT12,
-    EXT_GIC_ID_EXTINT13,
-    EXT_GIC_ID_EXTINT14,
-    EXT_GIC_ID_EXTINT15
-};
-
-/*
- * External GIC sources which are not from External Interrupt Combiner or
- * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
- * which is INTG16 in Internal Interrupt Combiner.
- */
-
-static const uint32_t
-combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-    /* int combiner groups 16-19 */
-    { }, { }, { }, { },
-    /* int combiner group 20 */
-    { 0, EXT_GIC_ID_MDMA_LCD0 },
-    /* int combiner group 21 */
-    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
-    /* int combiner group 22 */
-    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
-            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
-    /* int combiner group 23 */
-    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
-    /* int combiner group 24 */
-    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
-    /* int combiner group 25 */
-    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
-    /* int combiner group 26 */
-    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
-            EXT_GIC_ID_UART4 },
-    /* int combiner group 27 */
-    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
-            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
-            EXT_GIC_ID_I2C7 },
-    /* int combiner group 28 */
-    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
-    /* int combiner group 29 */
-    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
-     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
-    /* int combiner group 30 */
-    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
-    /* int combiner group 31 */
-    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
-    /* int combiner group 32 */
-    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
-    /* int combiner group 33 */
-    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
-    /* int combiner group 34 */
-    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
-    /* int combiner group 35 */
-    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* int combiner group 36 */
-    { EXT_GIC_ID_MIXER },
-    /* int combiner group 37 */
-    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
-     EXT_GIC_ID_EXTINT7 },
-    /* groups 38-50 */
-    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
-    /* int combiner group 51 */
-    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* group 52 */
-    { },
-    /* int combiner group 53 */
-    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* groups 54-63 */
-    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
-};
-
 #define EXYNOS4210_GIC_NIRQ 160
 
 #define EXYNOS4210_EXT_GIC_CPU_REGION_SIZE     0x10000
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-/*
- * Initialize board IRQs.
- * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
- */
-void exynos4210_init_board_irqs(Exynos4210State *s)
-{
-    uint32_t grp, bit, irq_id, n;
-    Exynos4210Irq *is = &s->irqs;
-
-    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
-        irq_id = 0;
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
-            /* MCT_G0 is passed to External GIC */
-            irq_id = EXT_GIC_ID_MCT_G0;
-        }
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
-            /* MCT_G1 is passed to External and GIC */
-            irq_id = EXT_GIC_ID_MCT_G1;
-        }
-        if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
-        } else {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_combiner_irq[n]);
-        }
-    }
-    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
-        /* these IDs are passed to Internal Combiner and External GIC */
-        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-        irq_id = combiner_grp_to_gic_id[grp -
-                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
-
-        if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
-        }
-    }
-}
-
-/*
- * Get IRQ number from exynos4210 IRQ subsystem stub.
- * To identify IRQ source use internal combiner group and bit number
- *  grp - group number
- *  bit - bit number inside group
- */
-uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
-{
-    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
-}
-
-/********* GIC part *********/
-
 #define TYPE_EXYNOS4210_GIC "exynos4210.gic"
 OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 
-- 
2.25.1

Switch the creation of the external GIC to the new-style "embedded in
state struct" approach, so we can easily refer to the object
elsewhere during realize.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-9-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h      |  2 ++
 include/hw/intc/exynos4210_gic.h | 43 ++++++++++++++++++++++++++++++++
 hw/arm/exynos4210.c              | 10 ++++----
 hw/intc/exynos4210_gic.c         | 17 ++-----------
 MAINTAINERS                      |  2 +-
 5 files changed, 53 insertions(+), 21 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_gic.h

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/or-irq.h"
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
+#include "hw/intc/exynos4210_gic.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
+    Exynos4210GicState ext_gic;
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/include/hw/intc/exynos4210_gic.h b/include/hw/intc/exynos4210_gic.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/intc/exynos4210_gic.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Samsung exynos4210 GIC implementation. Based on hw/arm_gic.c
+ *
+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
+ * All rights reserved.
+ *
+ * Evgeny Voevodin <e.voevodin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef HW_INTC_EXYNOS4210_GIC_H
+#define HW_INTC_EXYNOS4210_GIC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
+
+#define EXYNOS4210_GIC_NCPUS 2
+
+struct Exynos4210GicState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion cpu_container;
+    MemoryRegion dist_container;
+    MemoryRegion cpu_alias[EXYNOS4210_GIC_NCPUS];
+    MemoryRegion dist_alias[EXYNOS4210_GIC_NCPUS];
+    uint32_t num_cpu;
+    DeviceState *gic;
+};
+
+#endif
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
 
     /* External GIC */
-    dev = qdev_new("exynos4210.gic");
-    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->ext_gic), "num-cpu", EXYNOS4210_NCPUS);
+    busdev = SYS_BUS_DEVICE(&s->ext_gic);
+    sysbus_realize(busdev, &error_fatal);
     /* Map CPU interface */
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_GIC_CPU_BASE_ADDR);
     /* Map Distributer interface */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
-        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
+        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
     }
 
     /* Internal Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
     }
 
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
+    object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "hw/intc/exynos4210_gic.h"
 #include "hw/arm/exynos4210.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
-
-struct Exynos4210GicState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion cpu_container;
-    MemoryRegion dist_container;
-    MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
-    MemoryRegion dist_alias[EXYNOS4210_NCPUS];
-    uint32_t num_cpu;
-    DeviceState *gic;
-};
-
 static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
 {
     Exynos4210GicState *s = (Exynos4210GicState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_realize(DeviceState *dev, Error **errp)
      * enough room for the cpu numbers.  gcc 9.2.1 on 32-bit x86
      * doesn't figure this out, otherwise and gives spurious warnings.
      */
-    assert(n <= EXYNOS4210_NCPUS);
+    assert(n <= EXYNOS4210_GIC_NCPUS);
     for (i = 0; i < n; i++) {
         /* Map CPU interface per SMP Core */
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/*/exynos*
-F: include/hw/arm/exynos4210.h
+F: include/hw/*/exynos*
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
-- 
2.25.1

The only time we use the ext_gic_irq[] array in the Exynos4210Irq
struct is during realize of the SoC -- we initialize it with the
input IRQs of the external GIC device, and then connect those to
outputs of other devices further on in realize (including in the
exynos4210_init_board_irqs() function).  Now that the ext_gic object
is easily accessible as s->ext_gic we can make the connections
directly from one device to the other without going via this array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-10-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  1 -
 hw/arm/exynos4210.c         | 12 ++++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-    qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
 } Exynos4210Irq;
 
 struct Exynos4210State {
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
     Exynos4210Irq *is = &s->irqs;
+    DeviceState *extgicdev = DEVICE(&s->ext_gic);
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         }
         if (irq_id) {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
+                                             qdev_get_gpio_in(extgicdev,
+                                                              irq_id - 32));
         } else {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
                     is->ext_combiner_irq[n]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
         if (irq_id) {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
+                                             qdev_get_gpio_in(extgicdev,
+                                                              irq_id - 32));
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
-    for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
-        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
-    }
 
     /* Internal Interrupt Combiner */
     dev = qdev_new("exynos4210.combiner");
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-        sysbus_connect_irq(busdev, n, s->irqs.ext_gic_irq[n]);
+        sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
     exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
-- 
2.25.1

The function exynos4210_combiner_get_gpioin() currently lives in
exynos4210_combiner.c, but it isn't really part of the combiner
device itself -- it is a function that implements the wiring up of
some interrupt sources to multiple combiner inputs.  Move it to live
with the other SoC-level code in exynos4210.c, along with a few
macros previously defined in exynos4210.h which are now used only
in exynos4210.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-11-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h   | 11 -----
 hw/arm/exynos4210.c           | 82 +++++++++++++++++++++++++++++++++++
 hw/intc/exynos4210_combiner.c | 77 --------------------------------
 3 files changed, 82 insertions(+), 88 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
     (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
 
-#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp)*8 + (bit))
-#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
-#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
-    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
-
 /* IRQs number for external and internal GIC */
 #define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
 #define EXYNOS4210_INT_GIC_NIRQ     64
@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
  *  bit - bit number inside group */
 uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit);
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
-        int ext);
-
 /*
  * exynos4210 UART
  */
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 };
 
+#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp) * 8 + (bit))
+#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
+#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
+    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
+
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
     return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 }
 
+/*
+ * Get Combiner input GPIO into irqs structure
+ */
+static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
+                                           DeviceState *dev, int ext)
+{
+    int n;
+    int bit;
+    int max;
+    qemu_irq *irq;
+
+    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
+        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
+    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
+
+    /*
+     * Some IRQs of Int/External Combiner are going to two Combiners groups,
+     * so let split them.
+     */
+    for (n = 0; n < max; n++) {
+
+        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
+
+        switch (n) {
+        /* MDNIE_LCD1 INTG1 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
+            continue;
+
+        /* TMU INTG3 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
+            continue;
+
+        /* LCD1 INTG12 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG12 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
+               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG35 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG51 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG53 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+        }
+
+        irq[n] = qdev_get_gpio_in(dev, n);
+    }
+}
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_combiner = {
     }
 };
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
-        int ext)
-{
-    int n;
-    int bit;
-    int max;
-    qemu_irq *irq;
-
-    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
-        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
-    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
-
-    /*
-     * Some IRQs of Int/External Combiner are going to two Combiners groups,
-     * so let split them.
-     */
-    for (n = 0; n < max; n++) {
-
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-
-        switch (n) {
-        /* MDNIE_LCD1 INTG1 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
-            continue;
-
-        /* TMU INTG3 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
-            continue;
-
-        /* LCD1 INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
-               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG35 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG51 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG53 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-        }
-
-        irq[n] = qdev_get_gpio_in(dev, n);
-    }
-}
-
 static uint64_t
 exynos4210_combiner_read(void *opaque, hwaddr offset, unsigned size)
 {
-- 
2.25.1

In exynos4210_init_board_irqs(), use the TYPE_SPLIT_IRQ device
instead of qemu_irq_split().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-13-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  9 ++++++++
 hw/arm/exynos4210.c         | 41 +++++++++++++++++++++++++++++--------
 2 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/intc/exynos4210_gic.h"
+#include "hw/core/split-irq.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@
 
 #define EXYNOS4210_NUM_DMA      3
 
+/*
+ * We need one splitter for every external combiner input, plus
+ * one for every non-zero entry in combiner_grp_to_gic_id[].
+ * We'll assert in exynos4210_init_board_irqs() if this is wrong.
+ */
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
+
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
     Exynos4210GicState ext_gic;
+    SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
     uint32_t grp, bit, irq_id, n;
     Exynos4210Irq *is = &s->irqs;
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
+    int splitcount = 0;
+    DeviceState *splitter;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             /* MCT_G1 is passed to External and GIC */
             irq_id = EXT_GIC_ID_MCT_G1;
         }
+
+        assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
+        splitter = DEVICE(&s->splitter[splitcount]);
+        qdev_prop_set_uint16(splitter, "num-lines", 2);
+        qdev_realize(splitter, NULL, &error_abort);
+        splitcount++;
+        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
+        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
         if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                                             qdev_get_gpio_in(extgicdev,
-                                                              irq_id - 32));
+            qdev_connect_gpio_out(splitter, 1,
+                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
         } else {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
         if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                                             qdev_get_gpio_in(extgicdev,
-                                                              irq_id - 32));
+            assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
+            splitter = DEVICE(&s->splitter[splitcount]);
+            qdev_prop_set_uint16(splitter, "num-lines", 2);
+            qdev_realize(splitter, NULL, &error_abort);
+            splitcount++;
+            s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
+            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 1,
+                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
         }
     }
+    /*
+     * We check this here to avoid a more obscure assert later when
+     * qdev_assert_realized_properly() checks that we realized every
+     * child object we initialized.
+     */
+    assert(splitcount == EXYNOS4210_NUM_SPLITTERS);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
     }
 
+    for (i = 0; i < ARRAY_SIZE(s->splitter); i++) {
+        g_autofree char *name = g_strdup_printf("irq-splitter%d", i);
+        object_initialize_child(obj, name, &s->splitter[i], TYPE_SPLIT_IRQ);
+    }
+
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
 }
-- 
2.25.1

In exynos4210_init_board_irqs(), the loop that handles IRQ lines that
are in a range that applies to the internal combiner only creates a
splitter for those interrupts which go to both the internal combiner
and to the external GIC, but it does nothing at all for the
interrupts which don't go to the external GIC, leaving the
irq_table[] array element empty for those.  (This will result in
those interrupts simply being lost, not in a QEMU crash.)

I don't have a reliable datasheet for this SoC, but since we do wire
up one interrupt line in this category (the HDMI I2C device on
interrupt 16,1), this seems like it must be a bug in the existing
QEMU code.  Fill in the irq_table[] entries where we're not splitting
the IRQ to both the internal combiner and the external GIC with the
IRQ line of the internal combiner.  (That is, these IRQ lines go to
just one device, not multiple.)

This bug didn't have any visible guest effects because the only
implemented device that was affected was the HDMI I2C controller,
and we never connect any I2C devices to that bus.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-14-peter.maydell@linaro.org
---
 hw/arm/exynos4210.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
             qdev_connect_gpio_out(splitter, 1,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
+        } else {
+            s->irq_table[n] = is->int_combiner_irq[n];
         }
     }
     /*
-- 
2.25.1

Currently for the interrupts MCT_G0 and MCT_G1 which are
the only ones in the input range of the external combiner
and which are also wired to the external GIC, we connect
them only to the internal combiner and the external GIC.
This seems likely to be a bug, as all other interrupts
which are in the input range of both combiners are
connected to both combiners. (The fact that the code in
exynos4210_combiner_get_gpioin() is also trying to wire
up these inputs on both combiners also suggests this.)

Wire these interrupts up to both combiners, like the rest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-15-peter.maydell@linaro.org
---
 hw/arm/exynos4210.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
         splitter = DEVICE(&s->splitter[splitcount]);
-        qdev_prop_set_uint16(splitter, "num-lines", 2);
+        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
         qdev_realize(splitter, NULL, &error_abort);
         splitcount++;
         s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
         qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         if (irq_id) {
-            qdev_connect_gpio_out(splitter, 1,
+            qdev_connect_gpio_out(splitter, 2,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
-        } else {
-            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
-- 
2.25.1

The combiner_grp_to_gic_id[] array includes the EXT_GIC_ID_MCT_G0
and EXT_GIC_ID_MCT_G1 multiple times. This means that we will
connect multiple IRQs up to the same external GIC input, which
is not permitted. We do the same thing in the code in
exynos4210_init_board_irqs() because the conditionals selecting
an irq_id in the first loop match multiple interrupt IDs.

Overall we do this for interrupt IDs
(1, 4), (12, 4), (35, 4), (51, 4), (53, 4) for EXT_GIC_ID_MCT_G0
and
(1, 5), (12, 5), (35, 5), (51, 5), (53, 5) for EXT_GIC_ID_MCT_G1

These correspond to the cases for the multi-core timer that we are
wiring up to multiple inputs on the combiner in
exynos4210_combiner_get_gpioin().  That code already deals with all
these interrupt IDs being the same input source, so we don't need to
connect the external GIC interrupt for any of them except the first
(1, 4) and (1, 5). Remove the array entries and conditionals which
were incorrectly causing us to wire up extra lines.

This bug didn't cause any visible effects, because we only connect
up a device to the "primary" ID values (1, 4) and (1, 5), so the
extra lines would never be set to a level.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-16-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  2 +-
 hw/arm/exynos4210.c         | 12 +++++-------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
  * one for every non-zero entry in combiner_grp_to_gic_id[].
  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
  */
-#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
 
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     /* int combiner group 34 */
     { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
     /* int combiner group 35 */
-    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { 0, 0, 0, EXT_GIC_ID_MCT_L1 },
     /* int combiner group 36 */
     { EXT_GIC_ID_MIXER },
     /* int combiner group 37 */
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     /* groups 38-50 */
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
     /* int combiner group 51 */
-    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { EXT_GIC_ID_MCT_L0 },
     /* group 52 */
     { },
     /* int combiner group 53 */
-    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { EXT_GIC_ID_WDT },
     /* groups 54-63 */
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 };
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4)) {
             /* MCT_G0 is passed to External GIC */
             irq_id = EXT_GIC_ID_MCT_G0;
         }
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5)) {
             /* MCT_G1 is passed to External and GIC */
             irq_id = EXT_GIC_ID_MCT_G1;
         }
-- 
2.25.1

At this point, the function exynos4210_init_board_irqs() splits input
IRQ lines to connect them to the input combiner, output combiner and
external GIC.  The function exynos4210_combiner_get_gpioin() splits
some of the combiner input lines further to connect them to multiple
different inputs on the combiner.

Because (unlike qemu_irq_split()) the TYPE_SPLIT_IRQ device has a
configurable number of outputs, we can do all this in one place, by
making exynos4210_init_board_irqs() add extra outputs to the splitter
device when it must be connected to more than one input on each
combiner.

We do this with a new data structure, the combinermap, which is an
array each of whose elements is a list of the interrupt IDs on the
combiner which must be tied together.  As we loop through each
interrupt ID, if we find that it is the first one in one of these
lists, we configure the splitter device with eonugh extra outputs and
wire them up to the other interrupt IDs in the list.

Conveniently, for all the cases where this is necessary, the
lowest-numbered interrupt ID in each group is in the range of the
external combiner, so we only need to code for this in the first of
the two loops in exynos4210_init_board_irqs().

The old code in exynos4210_combiner_get_gpioin() which is being
deleted here had several problems which don't exist in the new code
in its handling of the multi-core timer interrupts:
 (1) the case labels specified bits 4 ... 8, but bit '8' doesn't
     exist; these should have been 4 ... 7
 (2) it used the input irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]
     multiple times as the input of several different splitters,
     which isn't allowed
 (3) in an apparent cut-and-paste error, the cases for all the
     multi-core timer inputs used "bit + 4" even though the
     bit range for the case was (intended to be) 4 ... 7, which
     meant it was looking at non-existent bits 8 ... 11.
None of these exist in the new code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-17-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |   6 +-
 hw/arm/exynos4210.c         | 178 +++++++++++++++++++++++-------------
 2 files changed, 119 insertions(+), 65 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 
 /*
  * We need one splitter for every external combiner input, plus
- * one for every non-zero entry in combiner_grp_to_gic_id[].
+ * one for every non-zero entry in combiner_grp_to_gic_id[],
+ * minus one for every external combiner ID in second or later
+ * places in a combinermap[] line.
  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
  */
-#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
 
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
     ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 
+/*
+ * Some interrupt lines go to multiple combiner inputs.
+ * This data structure defines those: each array element is
+ * a list of combiner inputs which are connected together;
+ * the one with the smallest interrupt ID value must be first.
+ * As with combiner_grp_to_gic_id[], we rely on (0, 0) not being
+ * wired to anything so we can use 0 as a terminator.
+ */
+#define IRQNO(G, B) EXYNOS4210_COMBINER_GET_IRQ_NUM(G, B)
+#define IRQNONE 0
+
+#define COMBINERMAP_SIZE 16
+
+static const int combinermap[COMBINERMAP_SIZE][6] = {
+    /* MDNIE_LCD1 */
+    { IRQNO(0, 4), IRQNO(1, 0), IRQNONE },
+    { IRQNO(0, 5), IRQNO(1, 1), IRQNONE },
+    { IRQNO(0, 6), IRQNO(1, 2), IRQNONE },
+    { IRQNO(0, 7), IRQNO(1, 3), IRQNONE },
+    /* TMU */
+    { IRQNO(2, 4), IRQNO(3, 4), IRQNONE },
+    { IRQNO(2, 5), IRQNO(3, 5), IRQNONE },
+    { IRQNO(2, 6), IRQNO(3, 6), IRQNONE },
+    { IRQNO(2, 7), IRQNO(3, 7), IRQNONE },
+    /* LCD1 */
+    { IRQNO(11, 4), IRQNO(12, 0), IRQNONE },
+    { IRQNO(11, 5), IRQNO(12, 1), IRQNONE },
+    { IRQNO(11, 6), IRQNO(12, 2), IRQNONE },
+    { IRQNO(11, 7), IRQNO(12, 3), IRQNONE },
+    /* Multi-core timer */
+    { IRQNO(1, 4), IRQNO(12, 4), IRQNO(35, 4), IRQNO(51, 4), IRQNO(53, 4), IRQNONE },
+    { IRQNO(1, 5), IRQNO(12, 5), IRQNO(35, 5), IRQNO(51, 5), IRQNO(53, 5), IRQNONE },
+    { IRQNO(1, 6), IRQNO(12, 6), IRQNO(35, 6), IRQNO(51, 6), IRQNO(53, 6), IRQNONE },
+    { IRQNO(1, 7), IRQNO(12, 7), IRQNO(35, 7), IRQNO(51, 7), IRQNO(53, 7), IRQNONE },
+};
+
+#undef IRQNO
+
+static const int *combinermap_entry(int irq)
+{
+    /*
+     * If the interrupt number passed in is the first entry in some
+     * line of the combinermap, return a pointer to that line;
+     * otherwise return NULL.
+     */
+    int i;
+    for (i = 0; i < COMBINERMAP_SIZE; i++) {
+        if (combinermap[i][0] == irq) {
+            return combinermap[i];
+        }
+    }
+    return NULL;
+}
+
+static int mapline_size(const int *mapline)
+{
+    /* Return number of entries in this mapline in total */
+    int i = 0;
+
+    if (!mapline) {
+        /* Not in the map? IRQ goes to exactly one combiner input */
+        return 1;
+    }
+    while (*mapline != IRQNONE) {
+        mapline++;
+        i++;
+    }
+    return i;
+}
+
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
     int splitcount = 0;
     DeviceState *splitter;
+    const int *mapline;
+    int numlines, splitin, in;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             irq_id = EXT_GIC_ID_MCT_G1;
         }
 
+        if (s->irq_table[n]) {
+            /*
+             * This must be some non-first entry in a combinermap line,
+             * and we've already filled it in.
+             */
+            continue;
+        }
+        mapline = combinermap_entry(n);
+        /*
+         * We need to connect the IRQ to multiple inputs on both combiners
+         * and possibly also to the external GIC.
+         */
+        numlines = 2 * mapline_size(mapline);
+        if (irq_id) {
+            numlines++;
+        }
         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
         splitter = DEVICE(&s->splitter[splitcount]);
-        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
+        qdev_prop_set_uint16(splitter, "num-lines", numlines);
         qdev_realize(splitter, NULL, &error_abort);
         splitcount++;
-        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
-        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
-        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
+
+        in = n;
+        splitin = 0;
+        for (;;) {
+            s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
+            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
+            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
+            splitin += 2;
+            if (!mapline) {
+                break;
+            }
+            mapline++;
+            in = *mapline;
+            if (in == IRQNONE) {
+                break;
+            }
+        }
         if (irq_id) {
-            qdev_connect_gpio_out(splitter, 2,
+            qdev_connect_gpio_out(splitter, splitin,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
         }
     }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         irq_id = combiner_grp_to_gic_id[grp -
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
+        if (s->irq_table[n]) {
+            /*
+             * This must be some non-first entry in a combinermap line,
+             * and we've already filled it in.
+             */
+            continue;
+        }
+
         if (irq_id) {
             assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
             splitter = DEVICE(&s->splitter[splitcount]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
                                            DeviceState *dev, int ext)
 {
     int n;
-    int bit;
     int max;
     qemu_irq *irq;
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
         EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
     irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 
-    /*
-     * Some IRQs of Int/External Combiner are going to two Combiners groups,
-     * so let split them.
-     */
     for (n = 0; n < max; n++) {
-
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-
-        switch (n) {
-        /* MDNIE_LCD1 INTG1 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
-            continue;
-
-        /* TMU INTG3 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
-            continue;
-
-        /* LCD1 INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
-               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG35 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG51 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG53 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-        }
-
         irq[n] = qdev_get_gpio_in(dev, n);
     }
 }
-- 
2.25.1

Switch the creation of the combiner devices to the new-style
"embedded in state struct" approach, so we can easily refer
to the object elsewhere during realize.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-18-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h           |  3 ++
 include/hw/intc/exynos4210_combiner.h | 57 +++++++++++++++++++++++++++
 hw/arm/exynos4210.c                   | 20 +++++-----
 hw/intc/exynos4210_combiner.c         | 31 +--------------
 4 files changed, 72 insertions(+), 39 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_combiner.h

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/intc/exynos4210_gic.h"
+#include "hw/intc/exynos4210_combiner.h"
 #include "hw/core/split-irq.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
     Exynos4210GicState ext_gic;
+    Exynos4210CombinerState int_combiner;
+    Exynos4210CombinerState ext_combiner;
     SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
 };
 
diff --git a/include/hw/intc/exynos4210_combiner.h b/include/hw/intc/exynos4210_combiner.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/intc/exynos4210_combiner.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Samsung exynos4210 Interrupt Combiner
+ *
+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
+ * All rights reserved.
+ *
+ * Evgeny Voevodin <e.voevodin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_INTC_EXYNOS4210_COMBINER
+#define HW_INTC_EXYNOS4210_COMBINER
+
+#include "hw/sysbus.h"
+
+/*
+ * State for each output signal of internal combiner
+ */
+typedef struct CombinerGroupState {
+    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
+    uint8_t src_pending;        /* Pending source interrupts before masking */
+} CombinerGroupState;
+
+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
+
+/* Number of groups and total number of interrupts for the internal combiner */
+#define IIC_NGRP 64
+#define IIC_NIRQ (IIC_NGRP * 8)
+#define IIC_REGSET_SIZE 0x41
+
+struct Exynos4210CombinerState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+
+    struct CombinerGroupState group[IIC_NGRP];
+    uint32_t reg_set[IIC_REGSET_SIZE];
+    uint32_t icipsr[2];
+    uint32_t external;          /* 1 means that this combiner is external */
+
+    qemu_irq output_irq[IIC_NGRP];
+};
+
+#endif
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     }
 
     /* Internal Interrupt Combiner */
-    dev = qdev_new("exynos4210.combiner");
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    busdev = SYS_BUS_DEVICE(&s->int_combiner);
+    sysbus_realize(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
+    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
 
     /* External Interrupt Combiner */
-    dev = qdev_new("exynos4210.combiner");
-    qdev_prop_set_uint32(dev, "external", 1);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->ext_combiner), "external", 1);
+    busdev = SYS_BUS_DEVICE(&s->ext_combiner);
+    sysbus_realize(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
+    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
 
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
+    object_initialize_child(obj, "int-combiner", &s->int_combiner,
+                            TYPE_EXYNOS4210_COMBINER);
+    object_initialize_child(obj, "ext-combiner", &s->ext_combiner,
+                            TYPE_EXYNOS4210_COMBINER);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
-
+#include "hw/intc/exynos4210_combiner.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
 #define DPRINTF(fmt, ...) do {} while (0)
 #endif
 
-#define    IIC_NGRP        64            /* Internal Interrupt Combiner
-                                            Groups number */
-#define    IIC_NIRQ        (IIC_NGRP * 8)/* Internal Interrupt Combiner
-                                            Interrupts number */
 #define IIC_REGION_SIZE    0x108         /* Size of memory mapped region */
-#define IIC_REGSET_SIZE    0x41
-
-/*
- * State for each output signal of internal combiner
- */
-typedef struct CombinerGroupState {
-    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
-    uint8_t src_pending;        /* Pending source interrupts before masking */
-} CombinerGroupState;
-
-#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
-
-struct Exynos4210CombinerState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion iomem;
-
-    struct CombinerGroupState group[IIC_NGRP];
-    uint32_t reg_set[IIC_REGSET_SIZE];
-    uint32_t icipsr[2];
-    uint32_t external;          /* 1 means that this combiner is external */
-
-    qemu_irq output_irq[IIC_NGRP];
-};
 
 static const VMStateDescription vmstate_exynos4210_combiner_group_state = {
     .name = "exynos4210.combiner.groupstate",
-- 
2.25.1

The only time we use the int_combiner_irq[] and ext_combiner_irq[]
arrays in the Exynos4210Irq struct is during realize of the SoC -- we
initialize them with the input IRQs of the combiner devices, and then
connect those to outputs of other devices in
exynos4210_init_board_irqs().  Now that the combiner objects are
easily accessible as s->int_combiner and s->ext_combiner we can make
the connections directly from one device to the other without going
via these arrays.

Since these are the only two remaining elements of Exynos4210Irq,
we can remove that struct entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-19-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  6 ------
 hw/arm/exynos4210.c         | 34 ++++++++--------------------------
 2 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
  */
 #define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
 
-typedef struct Exynos4210Irq {
-    qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
-    qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-} Exynos4210Irq;
-
 struct Exynos4210State {
     /*< private >*/
     SysBusDevice parent_obj;
     /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
-    Exynos4210Irq irqs;
     qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 
     MemoryRegion chipid_mem;
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static int mapline_size(const int *mapline)
 static void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
-    Exynos4210Irq *is = &s->irqs;
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
+    DeviceState *intcdev = DEVICE(&s->int_combiner);
+    DeviceState *extcdev = DEVICE(&s->ext_combiner);
     int splitcount = 0;
     DeviceState *splitter;
     const int *mapline;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         splitin = 0;
         for (;;) {
             s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
-            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
-            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
+            qdev_connect_gpio_out(splitter, splitin,
+                                  qdev_get_gpio_in(intcdev, in));
+            qdev_connect_gpio_out(splitter, splitin + 1,
+                                  qdev_get_gpio_in(extcdev, in));
             splitin += 2;
             if (!mapline) {
                 break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             qdev_realize(splitter, NULL, &error_abort);
             splitcount++;
             s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
-            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 0, qdev_get_gpio_in(intcdev, n));
             qdev_connect_gpio_out(splitter, 1,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
         } else {
-            s->irq_table[n] = is->int_combiner_irq[n];
+            s->irq_table[n] = qdev_get_gpio_in(intcdev, n);
         }
     }
     /*
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
     return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 }
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
-                                           DeviceState *dev, int ext)
-{
-    int n;
-    int max;
-    qemu_irq *irq;
-
-    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
-        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
-    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
-
-    for (n = 0; n < max; n++) {
-        irq[n] = qdev_get_gpio_in(dev, n);
-    }
-}
-
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
 
     /* External Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-2-zongyuan.li@smartx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/realview.c | 33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
+#include "hw/core/split-irq.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
 #include "hw/pci/pci.h"
+#include "hw/qdev-core.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static const int realview_board_id[] = {
     0x76d
 };
 
+static void split_irq_from_named(DeviceState *src, const char* outname,
+                                 qemu_irq out1, qemu_irq out2) {
+    DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
+
+    qdev_prop_set_uint32(splitter, "num-lines", 2);
+
+    qdev_realize_and_unref(splitter, NULL, &error_fatal);
+
+    qdev_connect_gpio_out(splitter, 0, out1);
+    qdev_connect_gpio_out(splitter, 1, out2);
+    qdev_connect_gpio_out_named(src, outname, 0,
+                                qdev_get_gpio_in(splitter, 0));
+}
+
 static void realview_init(MachineState *machine,
                           enum realview_board_type board_type)
 {
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
     DeviceState *dev, *sysctl, *gpio2, *pl041;
     SysBusDevice *busdev;
     qemu_irq pic[64];
-    qemu_irq mmc_irq[2];
     PCIBus *pci_bus = NULL;
     NICInfo *nd;
     DriveInfo *dinfo;
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
      * and the PL061 has them the other way about. Also the card
      * detect line is inverted.
      */
-    mmc_irq[0] = qemu_irq_split(
-        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
-        qdev_get_gpio_in(gpio2, 1));
-    mmc_irq[1] = qemu_irq_split(
-        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
-        qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
-    qdev_connect_gpio_out_named(dev, "card-read-only", 0, mmc_irq[0]);
-    qdev_connect_gpio_out_named(dev, "card-inserted", 0, mmc_irq[1]);
+    split_irq_from_named(dev, "card-read-only",
+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
+                   qdev_get_gpio_in(gpio2, 1));
+
+    split_irq_from_named(dev, "card-inserted",
+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
+                   qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
+
     dinfo = drive_get(IF_SD, 0, 0);
     if (dinfo) {
         DeviceState *card;
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-3-zongyuan.li@smartx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "hw/core/split-irq.h"
 #include "hw/sysbus.h"
 #include "hw/sd/sd.h"
 #include "hw/ssi/ssi.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             DeviceState *ssddev;
             DriveInfo *dinfo;
             DeviceState *carddev;
+            DeviceState *gpio_d_splitter;
             BlockBackend *blk;
 
             /*
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
                                    &error_fatal);
 
             ssddev = ssi_create_peripheral(bus, "ssd0323");
-            gpio_out[GPIO_D][0] = qemu_irq_split(
-                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
+
+            gpio_d_splitter = qdev_new(TYPE_SPLIT_IRQ);
+            qdev_prop_set_uint32(gpio_d_splitter, "num-lines", 2);
+            qdev_realize_and_unref(gpio_d_splitter, NULL, &error_fatal);
+            qdev_connect_gpio_out(
+                    gpio_d_splitter, 0,
+                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0));
+            qdev_connect_gpio_out(
+                    gpio_d_splitter, 1,
                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
+            gpio_out[GPIO_D][0] = qdev_get_gpio_in(gpio_d_splitter, 0);
+
             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
 
             /* Make sure the select pin is high.  */
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-5-zongyuan.li@smartx.com
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/811
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/irq.h |  5 -----
 hw/core/irq.c    | 15 ---------------
 2 files changed, 20 deletions(-)

diff --git a/include/hw/irq.h b/include/hw/irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
 /* Returns a new IRQ with opposite polarity.  */
 qemu_irq qemu_irq_invert(qemu_irq irq);
 
-/* Returns a new IRQ which feeds into both the passed IRQs.
- * It's probably better to use the TYPE_SPLIT_IRQ device instead.
- */
-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
-
 /* For internal use in qtest.  Similar to qemu_irq_split, but operating
    on an existing vector of qemu_irq.  */
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
diff --git a/hw/core/irq.c b/hw/core/irq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_invert(qemu_irq irq)
     return qemu_allocate_irq(qemu_notirq, irq, 0);
 }
 
-static void qemu_splitirq(void *opaque, int line, int level)
-{
-    struct IRQState **irq = opaque;
-    irq[0]->handler(irq[0]->opaque, irq[0]->n, level);
-    irq[1]->handler(irq[1]->opaque, irq[1]->n, level);
-}
-
-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
-{
-    qemu_irq *s = g_new0(qemu_irq, 2);
-    s[0] = irq1;
-    s[1] = irq2;
-    return qemu_allocate_irq(qemu_splitirq, s, 0);
-}
-
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
 {
     int i;
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

Similar to the Aspeed code in include/misc/aspeed_scu.h, we define
the PWRON STRAP fields in their corresponding module for NPCM7XX.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20220411165842.3912945-2-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/npcm7xx_gcr.h | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/include/hw/misc/npcm7xx_gcr.h b/include/hw/misc/npcm7xx_gcr.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/npcm7xx_gcr.h
+++ b/include/hw/misc/npcm7xx_gcr.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 
+/*
+ * NPCM7XX PWRON STRAP bit fields
+ * 12: SPI0 powered by VSBV3 at 1.8V
+ * 11: System flash attached to BMC
+ * 10: BSP alternative pins.
+ * 9:8: Flash UART command route enabled.
+ * 7: Security enabled.
+ * 6: HI-Z state control.
+ * 5: ECC disabled.
+ * 4: Reserved
+ * 3: JTAG2 enabled.
+ * 2:0: CPU and DRAM clock frequency.
+ */
+#define NPCM7XX_PWRON_STRAP_SPI0F18                 BIT(12)
+#define NPCM7XX_PWRON_STRAP_SFAB                    BIT(11)
+#define NPCM7XX_PWRON_STRAP_BSPA                    BIT(10)
+#define NPCM7XX_PWRON_STRAP_FUP(x)                  ((x) << 8)
+#define     FUP_NORM_UART2      3
+#define     FUP_PROG_UART3      2
+#define     FUP_PROG_UART2      1
+#define     FUP_NORM_UART3      0
+#define NPCM7XX_PWRON_STRAP_SECEN                   BIT(7)
+#define NPCM7XX_PWRON_STRAP_HIZ                     BIT(6)
+#define NPCM7XX_PWRON_STRAP_ECC                     BIT(5)
+#define NPCM7XX_PWRON_STRAP_RESERVE1                BIT(4)
+#define NPCM7XX_PWRON_STRAP_J2EN                    BIT(3)
+#define NPCM7XX_PWRON_STRAP_CKFRQ(x)                (x)
+#define     CKFRQ_SKIPINIT      0x000
+#define     CKFRQ_DEFAULT       0x111
+
 /*
  * Number of registers in our device state structure. Don't change this without
  * incrementing the version_id in the vmstate.
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

This patch uses the defined fields to describe PWRON STRAPs for
better readability.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20220411165842.3912945-3-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm7xx_boards.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "sysemu/block-backend.h"
 
-#define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
-#define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
-#define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
-#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
-#define MORI_BMC_POWER_ON_STRAPS 0x00001fff
+#define NPCM7XX_POWER_ON_STRAPS_DEFAULT (           \
+        NPCM7XX_PWRON_STRAP_SPI0F18 |               \
+        NPCM7XX_PWRON_STRAP_SFAB |                  \
+        NPCM7XX_PWRON_STRAP_BSPA |                  \
+        NPCM7XX_PWRON_STRAP_FUP(FUP_NORM_UART2) |   \
+        NPCM7XX_PWRON_STRAP_SECEN |                 \
+        NPCM7XX_PWRON_STRAP_HIZ |                   \
+        NPCM7XX_PWRON_STRAP_ECC |                   \
+        NPCM7XX_PWRON_STRAP_RESERVE1 |              \
+        NPCM7XX_PWRON_STRAP_J2EN |                  \
+        NPCM7XX_PWRON_STRAP_CKFRQ(CKFRQ_DEFAULT))
+
+#define NPCM750_EVB_POWER_ON_STRAPS ( \
+        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_J2EN)
+#define QUANTA_GSJ_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
+#define QUANTA_GBS_POWER_ON_STRAPS ( \
+        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_SFAB)
+#define KUDO_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
+#define MORI_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 
 static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 
-- 
2.25.1