Series comparison

-[PULL 00/18] target-arm queue
+[PULL 00/14] target-arm queue
-Nothing very exciting this time around...
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
--- PMM
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 The following changes since commit 37a712a0f969ca2df7f01182409a6c4825cebfb5:
   Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2020-10-01 12:23:19 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201001
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-for you to fetch changes up to cdfaa57dcb53ba012439765a1462247dfda8595d:
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-  hw/arm/raspi: Remove use of the 'version' value in the board code (2020-10-01 15:31:01 +0100)
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Make isar_feature_aa32_fp16_arith() handle M-profile
+ * Implement FEAT_ECV
- * Fix SVE splice
+ * STM32L4x5: Implement GPIO device
- * Fix SVE LDR/STR
+ * Fix 32-bit SMOPA
- * Remove ignore_memory_transaction_failures on the raspi2
+ * Refactor v7m related code from cpu32.c into its own file
- * raspi: Various cleanup/refactoring
+ * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
 ----------------------------------------------------------------
-Peter Maydell (5):
+Inès Varhol (3):
-      target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
+      hw/gpio: Implement STM32L4x5 GPIO
-      target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
+      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-      hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
+      tests/qtest: Add STM32L4x5 GPIO QTest testcase
       target/arm: Add ID register values for Cortex-M0
       target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile
-Philippe Mathieu-Daudé (11):
+Peter Maydell (9):
-      hw/arm/raspi: Define various blocks base addresses
+      target/arm: Move some register related defines to internals.h
-      hw/arm/bcm2835: Add more unimplemented peripherals
+      target/arm: Timer _EL02 registers UNDEF for E2H == 0
-      hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
+      target/arm: use FIELD macro for CNTHCTL bit definitions
-      hw/arm/raspi: Display the board revision in the machine description
+      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-      hw/arm/raspi: Load the firmware on the first core
+      target/arm: Implement new FEAT_ECV trap bits
-      hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
+      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-      hw/arm/raspi: Avoid using TypeInfo::class_data pointer
+      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-      hw/arm/raspi: Use more specific machine names
+      target/arm: Enable FEAT_ECV for 'max' CPU
-      hw/arm/raspi: Introduce RaspiProcessorId enum
+      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
       hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
       hw/arm/raspi: Remove use of the 'version' value in the board code
-Richard Henderson (2):
+Richard Henderson (1):
-      target/arm: Fix sve ldr/str
+      target/arm: Fix 32-bit SMOPA
       target/arm: Fix SVE splice
- include/hw/arm/bcm2835_peripherals.h |   2 +
+Thomas Huth (1):
- include/hw/arm/raspi_platform.h      |  51 ++++++++++--
+      target/arm: Move v7m-related code from cpu32.c into a separate file
  target/arm/cpu.h                     |  50 +++++++++--
  hw/arm/bcm2835_peripherals.c         |   2 +
  hw/arm/raspi.c                       | 155 +++++++++++++++++++----------------
  hw/intc/armv7m_nvic.c                |  46 ++++++++++-
  target/arm/cpu.c                     |  21 +++--
  target/arm/cpu64.c                   |  12 +--
  target/arm/cpu_tcg.c                 |  60 ++++++++++----
  target/arm/helper.c                  |   9 +-
  target/arm/kvm64.c                   |   4 +
  target/arm/translate-sve.c           |   6 +-
 files changed, 286 insertions(+), 132 deletions(-)
+ MAINTAINERS                        |   1 +
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
+ docs/system/arm/emulation.rst      |   1 +
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
+ include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
+ include/hw/misc/stm32l4x5_syscfg.h |   3 +-
+ include/hw/rtc/sun4v-rtc.h         |   2 +-
+ target/arm/cpu-features.h          |  10 +
+ target/arm/cpu.h                   | 129 +--------
+ target/arm/internals.h             | 151 ++++++++++
+ hw/arm/stm32l4x5_soc.c             |  71 ++++-
+ hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
+ hw/misc/stm32l4x5_syscfg.c         |   1 +
+ hw/rtc/sun4v-rtc.c                 |   2 +-
+ target/arm/helper.c                | 189 ++++++++++++-
+ target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
+ target/arm/tcg/cpu32.c             | 261 ------------------
+ target/arm/tcg/cpu64.c             |   1 +
+ target/arm/tcg/sme_helper.c        |  77 +++---
+ tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
+ tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
+ hw/arm/Kconfig                     |   3 +-
+ hw/gpio/Kconfig                    |   3 +
+ hw/gpio/meson.build                |   1 +
+ hw/gpio/trace-events               |   6 +
+ target/arm/meson.build             |   3 +
+ target/arm/tcg/meson.build         |   3 +
+ target/arm/trace-events            |   1 +
+ tests/qtest/meson.build            |   3 +-
+ tests/tcg/aarch64/Makefile.target  |   2 +-
+files changed, 1962 insertions(+), 456 deletions(-)
+ create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
+ create mode 100644 hw/gpio/stm32l4x5_gpio.c
+ create mode 100644 target/arm/tcg/cpu-v7m.c
+ create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
+ create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
+ create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

-[PULL 05/18] target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile
+[PULL 01/14] target/arm: Move some register related defines to internals.h
-The M-profile definition of the MVFR1 ID register differs slightly
+cpu.h has a lot of #defines relating to CPU register fields.
-from the A-profile one, and in particular the check for "does the CPU
+Most of these aren't actually used outside target/arm code,
-support fp16 arithmetic" is not the same.
+so there's no point in cluttering up the cpu.h file with them.
+Move some easy ones to internals.h.
 We don't currently implement any M-profile CPUs with fp16 arithmetic,
 so this is not yet a visible bug, but correcting the logic now
 disarms this beartrap for when we eventually do.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200910173855.4068-6-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 31 ++++++++++++++++++++++++++-----
+ target/arm/cpu.h       | 128 -----------------------------------------
-file changed, 26 insertions(+), 5 deletions(-)
+ target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 files changed, 128 insertions(+), 128 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
- FIELD(ID_MMFR4, CCIDX, 24, 4)
+     uint64_t ctl; /* Timer Control register */
- FIELD(ID_MMFR4, EVT, 28, 4)
+ } ARMGenericTimer;
-+FIELD(ID_PFR1, PROGMOD, 0, 4)
+-#define VTCR_NSW (1u << 29)
-+FIELD(ID_PFR1, SECURITY, 4, 4)
+-#define VTCR_NSA (1u << 30)
-+FIELD(ID_PFR1, MPROGMOD, 8, 4)
+-#define VSTCR_SW VTCR_NSW
-+FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
+-#define VSTCR_SA VTCR_NSA
-+FIELD(ID_PFR1, GENTIMER, 16, 4)
+-
-+FIELD(ID_PFR1, SEC_FRAC, 20, 4)
+ /* Define a maximum sized vector register.
-+FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
+  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
-+FIELD(ID_PFR1, GIC, 28, 4)
+  * For 64-bit, this is a 2048-bit SVE register.
-+
+@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
- FIELD(ID_AA64ISAR0, AES, 4, 4)
+ #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
- FIELD(ID_AA64ISAR0, SHA1, 8, 4)
+ #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
- FIELD(ID_AA64ISAR0, SHA2, 12, 4)
-@@ -XXX,XX +XXX,XX @@ FIELD(MVFR0, FPROUND, 28, 4)
+-/* Bit definitions for CPACR (AArch32 only) */
+-FIELD(CPACR, CP10, 20, 2)
- FIELD(MVFR1, FPFTZ, 0, 4)
+-FIELD(CPACR, CP11, 22, 2)
- FIELD(MVFR1, FPDNAN, 4, 4)
+-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
--FIELD(MVFR1, SIMDLS, 8, 4)
+-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
--FIELD(MVFR1, SIMDINT, 12, 4)
+-FIELD(CPACR, ASEDIS, 31, 1)
--FIELD(MVFR1, SIMDSP, 16, 4)
+-
--FIELD(MVFR1, SIMDHP, 20, 4)
+-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-+FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
+-FIELD(CPACR_EL1, ZEN, 16, 2)
-+FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
+-FIELD(CPACR_EL1, FPEN, 20, 2)
-+FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
+-FIELD(CPACR_EL1, SMEN, 24, 2)
-+FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
+-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-+FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
+-
-+FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
+-/* Bit definitions for HCPTR (AArch32 only) */
- FIELD(MVFR1, FPHP, 24, 4)
+-FIELD(HCPTR, TCP10, 10, 1)
- FIELD(MVFR1, SIMDFMAC, 28, 4)
+-FIELD(HCPTR, TCP11, 11, 1)
+-FIELD(HCPTR, TASE, 15, 1)
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
+-FIELD(HCPTR, TTA, 20, 1)
-     return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
+-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
- }
+-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+-
-+static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
+-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-+{
+-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-+    return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-+}
+-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-+
+-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
- static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
+-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
- {
+-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
--    return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+-FIELD(CPTR_EL2, TTA, 28, 1)
-+    /* Sadly this is encoded differently for A-profile and M-profile */
+-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-+    if (isar_feature_aa32_mprofile(id)) {
+-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-+        return FIELD_EX32(id->mvfr1, MVFR1, FP16) > 0;
+-
-+    } else {
+-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-+        return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+-FIELD(CPTR_EL3, EZ, 8, 1)
-+    }
+-FIELD(CPTR_EL3, TFP, 10, 1)
- }
+-FIELD(CPTR_EL3, ESM, 12, 1)
+-FIELD(CPTR_EL3, TTA, 20, 1)
- static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
+-FIELD(CPTR_EL3, TAM, 30, 1)
 -FIELD(CPTR_EL3, TCPAC, 31, 1)
 -
 -#define MDCR_MTPME    (1U << 28)
 -#define MDCR_TDCC     (1U << 27)
 -#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 -#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 -#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 -#define MDCR_EPMAD    (1U << 21)
 -#define MDCR_EDAD     (1U << 20)
 -#define MDCR_TTRF     (1U << 19)
 -#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 -#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 -#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 -#define MDCR_SDD      (1U << 16)
 -#define MDCR_SPD      (3U << 14)
 -#define MDCR_TDRA     (1U << 11)
 -#define MDCR_TDOSA    (1U << 10)
 -#define MDCR_TDA      (1U << 9)
 -#define MDCR_TDE      (1U << 8)
 -#define MDCR_HPME     (1U << 7)
 -#define MDCR_TPM      (1U << 6)
 -#define MDCR_TPMCR    (1U << 5)
 -#define MDCR_HPMN     (0x1fU)
 -
 -/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 -#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 -                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 -                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 -
  #define CPSR_M (0x1fU)
  #define CPSR_T (1U << 5)
  #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define XPSR_NZCV CPSR_NZCV
  #define XPSR_IT CPSR_IT
 -#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 -#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 -#define TTBCR_PD0    (1U << 4)
 -#define TTBCR_PD1    (1U << 5)
 -#define TTBCR_EPD0   (1U << 7)
 -#define TTBCR_IRGN0  (3U << 8)
 -#define TTBCR_ORGN0  (3U << 10)
 -#define TTBCR_SH0    (3U << 12)
 -#define TTBCR_T1SZ   (3U << 16)
 -#define TTBCR_A1     (1U << 22)
 -#define TTBCR_EPD1   (1U << 23)
 -#define TTBCR_IRGN1  (3U << 24)
 -#define TTBCR_ORGN1  (3U << 26)
 -#define TTBCR_SH1    (1U << 28)
 -#define TTBCR_EAE    (1U << 31)
 -
 -FIELD(VTCR, T0SZ, 0, 6)
 -FIELD(VTCR, SL0, 6, 2)
 -FIELD(VTCR, IRGN0, 8, 2)
 -FIELD(VTCR, ORGN0, 10, 2)
 -FIELD(VTCR, SH0, 12, 2)
 -FIELD(VTCR, TG0, 14, 2)
 -FIELD(VTCR, PS, 16, 3)
 -FIELD(VTCR, VS, 19, 1)
 -FIELD(VTCR, HA, 21, 1)
 -FIELD(VTCR, HD, 22, 1)
 -FIELD(VTCR, HWU59, 25, 1)
 -FIELD(VTCR, HWU60, 26, 1)
 -FIELD(VTCR, HWU61, 27, 1)
 -FIELD(VTCR, HWU62, 28, 1)
 -FIELD(VTCR, NSW, 29, 1)
 -FIELD(VTCR, NSA, 30, 1)
 -FIELD(VTCR, DS, 32, 1)
 -FIELD(VTCR, SL2, 33, 1)
 -
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_TWEDEN    (1ULL << 59)
  #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 -#define HCRX_ENAS0    (1ULL << 0)
 -#define HCRX_ENALS    (1ULL << 1)
 -#define HCRX_ENASR    (1ULL << 2)
 -#define HCRX_FNXS     (1ULL << 3)
 -#define HCRX_FGTNXS   (1ULL << 4)
 -#define HCRX_SMPME    (1ULL << 5)
 -#define HCRX_TALLINT  (1ULL << 6)
 -#define HCRX_VINMI    (1ULL << 7)
 -#define HCRX_VFNMI    (1ULL << 8)
 -#define HCRX_CMOW     (1ULL << 9)
 -#define HCRX_MCE2     (1ULL << 10)
 -#define HCRX_MSCEN    (1ULL << 11)
 -
 -#define HPFAR_NS      (1ULL << 63)
 -
  #define SCR_NS                (1ULL << 0)
  #define SCR_IRQ               (1ULL << 1)
  #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_GPF               (1ULL << 48)
  #define SCR_NSE               (1ULL << 62)
 -#define HSTR_TTEE (1 << 16)
 -#define HSTR_TJDBX (1 << 17)
 -
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 -
  /* Return the current FPSCR value.  */
  uint32_t vfp_get_fpscr(CPUARMState *env);
  void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
  FIELD(DBGWCR, MASK, 24, 5)
  FIELD(DBGWCR, SSCE, 29, 1)
 +#define VTCR_NSW (1u << 29)
 +#define VTCR_NSA (1u << 30)
 +#define VSTCR_SW VTCR_NSW
 +#define VSTCR_SA VTCR_NSA
 +
 +/* Bit definitions for CPACR (AArch32 only) */
 +FIELD(CPACR, CP10, 20, 2)
 +FIELD(CPACR, CP11, 22, 2)
 +FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
 +FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
 +FIELD(CPACR, ASEDIS, 31, 1)
 +
 +/* Bit definitions for CPACR_EL1 (AArch64 only) */
 +FIELD(CPACR_EL1, ZEN, 16, 2)
 +FIELD(CPACR_EL1, FPEN, 20, 2)
 +FIELD(CPACR_EL1, SMEN, 24, 2)
 +FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
 +
 +/* Bit definitions for HCPTR (AArch32 only) */
 +FIELD(HCPTR, TCP10, 10, 1)
 +FIELD(HCPTR, TCP11, 11, 1)
 +FIELD(HCPTR, TASE, 15, 1)
 +FIELD(HCPTR, TTA, 20, 1)
 +FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
 +FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
 +
 +/* Bit definitions for CPTR_EL2 (AArch64 only) */
 +FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
 +FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 +FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 +FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 +FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 +FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 +FIELD(CPTR_EL2, TTA, 28, 1)
 +FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 +FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 +
 +/* Bit definitions for CPTR_EL3 (AArch64 only) */
 +FIELD(CPTR_EL3, EZ, 8, 1)
 +FIELD(CPTR_EL3, TFP, 10, 1)
 +FIELD(CPTR_EL3, ESM, 12, 1)
 +FIELD(CPTR_EL3, TTA, 20, 1)
 +FIELD(CPTR_EL3, TAM, 30, 1)
 +FIELD(CPTR_EL3, TCPAC, 31, 1)
 +
 +#define MDCR_MTPME    (1U << 28)
 +#define MDCR_TDCC     (1U << 27)
 +#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 +#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 +#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 +#define MDCR_EPMAD    (1U << 21)
 +#define MDCR_EDAD     (1U << 20)
 +#define MDCR_TTRF     (1U << 19)
 +#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 +#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 +#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 +#define MDCR_SDD      (1U << 16)
 +#define MDCR_SPD      (3U << 14)
 +#define MDCR_TDRA     (1U << 11)
 +#define MDCR_TDOSA    (1U << 10)
 +#define MDCR_TDA      (1U << 9)
 +#define MDCR_TDE      (1U << 8)
 +#define MDCR_HPME     (1U << 7)
 +#define MDCR_TPM      (1U << 6)
 +#define MDCR_TPMCR    (1U << 5)
 +#define MDCR_HPMN     (0x1fU)
 +
 +/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 +#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 +                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 +                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 +
 +#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 +#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 +#define TTBCR_PD0    (1U << 4)
 +#define TTBCR_PD1    (1U << 5)
 +#define TTBCR_EPD0   (1U << 7)
 +#define TTBCR_IRGN0  (3U << 8)
 +#define TTBCR_ORGN0  (3U << 10)
 +#define TTBCR_SH0    (3U << 12)
 +#define TTBCR_T1SZ   (3U << 16)
 +#define TTBCR_A1     (1U << 22)
 +#define TTBCR_EPD1   (1U << 23)
 +#define TTBCR_IRGN1  (3U << 24)
 +#define TTBCR_ORGN1  (3U << 26)
 +#define TTBCR_SH1    (1U << 28)
 +#define TTBCR_EAE    (1U << 31)
 +
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
 +#define HCRX_ENAS0    (1ULL << 0)
 +#define HCRX_ENALS    (1ULL << 1)
 +#define HCRX_ENASR    (1ULL << 2)
 +#define HCRX_FNXS     (1ULL << 3)
 +#define HCRX_FGTNXS   (1ULL << 4)
 +#define HCRX_SMPME    (1ULL << 5)
 +#define HCRX_TALLINT  (1ULL << 6)
 +#define HCRX_VINMI    (1ULL << 7)
 +#define HCRX_VFNMI    (1ULL << 8)
 +#define HCRX_CMOW     (1ULL << 9)
 +#define HCRX_MCE2     (1ULL << 10)
 +#define HCRX_MSCEN    (1ULL << 11)
 +
 +#define HPFAR_NS      (1ULL << 63)
 +
 +#define HSTR_TTEE (1 << 16)
 +#define HSTR_TJDBX (1 << 17)
 +
 +#define CNTHCTL_CNTVMASK      (1 << 18)
 +#define CNTHCTL_CNTPMASK      (1 << 19)
 +
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
   * get_phys_addr() code assumes A/R profile and reports failures via
 --
-.20.1
+.34.1

-[PULL 07/18] target/arm: Fix SVE splice
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
-From: Richard Henderson <richard.henderson@linaro.org>
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
 or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
 delivering the exception to EL2 with the wrong syndrome.
-While converting to gen_gvec_ool_zzzp, we lost passing
-a->esz as the data argument to the function.
-Fixes: 36cbb7a8e71
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200918000500.2690937-1-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
 ---
- target/arm/translate-sve.c | 2 +-
+ target/arm/helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/target/arm/helper.c
-+++ b/target/arm/translate-sve.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_SPLICE(DisasContext *s, arg_rprr_esz *a)
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
- {
+         return CP_ACCESS_OK;
      if (sve_access_check(s)) {
          gen_gvec_ool_zzzp(s, gen_helper_sve_splice,
 -                          a->rd, a->rn, a->rm, a->pg, 0);
 +                          a->rd, a->rn, a->rm, a->pg, a->esz);
      }
-     return true;
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
 -        return CP_ACCESS_TRAP;
 +        return CP_ACCESS_TRAP_UNCATEGORIZED;
      }
      return CP_ACCESS_OK;
  }
 --
-.20.1
+.34.1

-[PULL 17/18] hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We prefer the FIELD macro over ad-hoc #defines for register bits;
 switch CNTHCTL to that style before we add any more bits.
-The firmware load address depends on the SoC ("processor id") used,
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-not on the version of the board.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
 ---
  target/arm/internals.h | 27 +++++++++++++++++++++++++--
  target/arm/helper.c    |  9 ++++-----
 files changed, 29 insertions(+), 7 deletions(-)
-Suggested-by: Luc Michel <luc.michel@greensocs.com>
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-8-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/raspi.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/internals.h
-+++ b/hw/arm/raspi.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
-      * the normal Linux boot process
+ #define HSTR_TTEE (1 << 16)
  #define HSTR_TJDBX (1 << 17)
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 +/*
 + * Depending on the value of HCR_EL2.E2H, bits 0 and 1
 + * have different bit definitions, and EL1PCTEN might be
 + * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
 + * disambiguate if necessary.
 + */
 +FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
 +FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
 +FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
 +FIELD(CNTHCTL, EVNTEN, 2, 1)
 +FIELD(CNTHCTL, EVNTDIR, 3, 1)
 +FIELD(CNTHCTL, EVNTI, 4, 4)
 +FIELD(CNTHCTL, EL0VTEN, 8, 1)
 +FIELD(CNTHCTL, EL0PTEN, 9, 1)
 +FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
 +FIELD(CNTHCTL, EL1PTEN, 11, 1)
 +FIELD(CNTHCTL, ECV, 12, 1)
 +FIELD(CNTHCTL, EL1TVT, 13, 1)
 +FIELD(CNTHCTL, EL1TVCT, 14, 1)
 +FIELD(CNTHCTL, EL1NVPCT, 15, 1)
 +FIELD(CNTHCTL, EL1NVVCT, 16, 1)
 +FIELD(CNTHCTL, EVNTIS, 17, 1)
 +FIELD(CNTHCTL, CNTVMASK, 18, 1)
 +FIELD(CNTHCTL, CNTPMASK, 19, 1)
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
       * It is RES0 in Secure and NonSecure state.
       */
-     if (machine->firmware) {
+     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
--        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
+-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-+        hwaddr firmware_addr = processor_id <= PROCESSOR_ID_BCM2836
+-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
-+                             ? FIRMWARE_ADDR_2 : FIRMWARE_ADDR_3;
++        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
-         /* load the firmware image (typically kernel.img) */
++         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
-         r = load_image_targphys(machine->firmware, firmware_addr,
+         irqstate = 0;
-                                 ram_size - firmware_addr);
+     }
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      ARMCPU *cpu = env_archcpu(env);
      uint32_t oldval = env->cp15.cnthctl_el2;
 -
      raw_write(env, ri, value);
 -    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
 +    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
          gt_update_irq(cpu, GTIMER_VIRT);
 -    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
 +    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
          gt_update_irq(cpu, GTIMER_PHYS);
      }
  }
 --
-.20.1
+.34.1

-[PULL 03/18] hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-M-profile CPUs only implement the ID registers as guest-visible if
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
-the CPU implements the Main Extension (all our current CPUs except
+This is not strictly architecturally required, but it is how we've
-the Cortex-M0 do).
+tended to implement registers more recently.
-Currently we handle this by having the Cortex-M0 leave the ID
+In particular, bits [19:18] are only present with FEAT_RME,
-register values in the ARMCPU struct as zero, but this conflicts with
+and bits [17:12] will only be present with FEAT_ECV.
 our design decision to make QEMU behaviour be keyed off ID register
 fields wherever possible.
 Explicitly code the ID registers in the NVIC to return 0 if the Main
 Extension is not implemented, so we can make the M0 model set the
 ARMCPU struct fields to obtain the correct behaviour without those
 values becoming guest-visible.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200910173855.4068-4-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 18 ++++++++++++++++++
-file changed, 42 insertions(+)
+file changed, 18 insertions(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/helper.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                       "Aux Fault status registers unimplemented\n");
+ {
-         return 0;
+     ARMCPU *cpu = env_archcpu(env);
-     case 0xd40: /* PFR0.  */
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
++    uint32_t valid_mask =
-+            goto bad_offset;
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
-+        }
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
-         return cpu->isar.id_pfr0;
++        R_CNTHCTL_EVNTEN_MASK |
-     case 0xd44: /* PFR1.  */
++        R_CNTHCTL_EVNTDIR_MASK |
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
++        R_CNTHCTL_EVNTI_MASK |
-+            goto bad_offset;
++        R_CNTHCTL_EL0VTEN_MASK |
-+        }
++        R_CNTHCTL_EL0PTEN_MASK |
-         return cpu->isar.id_pfr1;
++        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
-     case 0xd48: /* DFR0.  */
++        R_CNTHCTL_EL1PTEN_MASK;
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
++
-+            goto bad_offset;
++    if (cpu_isar_feature(aa64_rme, cpu)) {
-+        }
++        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
-         return cpu->isar.id_dfr0;
++    }
-     case 0xd4c: /* AFR0.  */
++
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
++    /* Clear RES0 bits */
-+            goto bad_offset;
++    value &= valid_mask;
-+        }
++
-         return cpu->id_afr0;
+     raw_write(env, ri, value);
-     case 0xd50: /* MMFR0.  */
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_mmfr0;
      case 0xd54: /* MMFR1.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_mmfr1;
      case 0xd58: /* MMFR2.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_mmfr2;
      case 0xd5c: /* MMFR3.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_mmfr3;
      case 0xd60: /* ISAR0.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar0;
      case 0xd64: /* ISAR1.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar1;
      case 0xd68: /* ISAR2.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar2;
      case 0xd6c: /* ISAR3.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar3;
      case 0xd70: /* ISAR4.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar4;
      case 0xd74: /* ISAR5.  */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
 +            goto bad_offset;
 +        }
          return cpu->isar.id_isar5;
      case 0xd78: /* CLIDR */
          return cpu->clidr;
 --
-.20.1
+.34.1

-[PULL 01/18] target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
-The ARM_FEATURE_PXN bit indicates whether the CPU supports the PXN
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
-bit in short-descriptor translation table format descriptors.  This
+ * four new trap bits for various counter and timer registers
-is indicated by ID_MMFR0.VMSA being at least 0b0100.  Replace the
+ * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
-feature bit with an ID register check, in line with our preference
+   scaling of the event stream. This is a no-op for us, because we don't
-for ID register checks over feature bits.
+   implement the event stream (our WFE is a NOP): all we need to do is
    allow CNTHCTL_EL2.ENVTIS to be read and written.
  * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
    TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
    FEAT_SPE or FEAT_TRF.
  * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
    "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
    that no barriers are needed around their accesses. For us these
    are just the same as the normal views, because all our sysregs are
    inherently self-sychronizing.
 In this commit we implement the trap handling and permit the new
 CNTHCTL_EL2 bits to be written.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200910173855.4068-2-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    | 15 ++++++++++++++-
+ target/arm/cpu-features.h |  5 ++++
- target/arm/cpu.c    |  1 -
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
- target/arm/helper.c |  5 +++--
+files changed, 51 insertions(+), 5 deletions(-)
 files changed, 17 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/cpu-features.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, FHM, 8, 4)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
- FIELD(ID_ISAR6, SB, 12, 4)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
  FIELD(ID_ISAR6, SPECRES, 16, 4)
 +FIELD(ID_MMFR0, VMSA, 0, 4)
 +FIELD(ID_MMFR0, PMSA, 4, 4)
 +FIELD(ID_MMFR0, OUTERSHR, 8, 4)
 +FIELD(ID_MMFR0, SHARELVL, 12, 4)
 +FIELD(ID_MMFR0, TCM, 16, 4)
 +FIELD(ID_MMFR0, AUXREG, 20, 4)
 +FIELD(ID_MMFR0, FCSE, 24, 4)
 +FIELD(ID_MMFR0, INNERSHR, 28, 4)
 +
  FIELD(ID_MMFR3, CMAINTVA, 0, 4)
  FIELD(ID_MMFR3, CMAINTSW, 4, 4)
  FIELD(ID_MMFR3, BPMAINT, 8, 4)
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */
      ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */
      ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
 -    ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
      ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
      ARM_FEATURE_V8,
      ARM_FEATURE_AARCH64, /* supports 64 bit mode */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
      return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 4;
  }
-+static inline bool isar_feature_aa32_pxn(const ARMISARegisters *id)
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
 +{
-+    return FIELD_EX32(id->id_mmfr0, ID_MMFR0, VMSA) >= 4;
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 +}
 +
- static inline bool isar_feature_aa32_pan(const ARMISARegisters *id)
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
  {
-     return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) != 0;
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
 -        set_feature(env, ARM_FEATURE_PXN);
      }
      if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
          set_feature(env, ARM_FEATURE_CBAR);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
-                              target_ulong *page_size, ARMMMUFaultInfo *fi)
+              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
              return CP_ACCESS_TRAP_EL2;
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                  }
              }
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (cpu_isar_feature(aa64_rme, cpu)) {
          valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        valid_mask |=
 +            R_CNTHCTL_EL1TVT_MASK |
 +            R_CNTHCTL_EL1TVCT_MASK |
 +            R_CNTHCTL_EL1NVPCT_MASK |
 +            R_CNTHCTL_EL1NVVCT_MASK |
 +            R_CNTHCTL_EVNTIS_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
  {
-     CPUState *cs = env_cpu(env);
+     if (arm_current_el(env) == 1) {
-+    ARMCPU *cpu = env_archcpu(env);
+         /* This must be a FEAT_NV access */
-     int level = 1;
+-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
-     uint32_t table;
+         return CP_ACCESS_OK;
      uint32_t desc;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
          goto do_fault;
      }
-     type = (desc & 3);
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
--    if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-+    if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
+     return CP_ACCESS_OK;
-         /* Section translation fault, or attempt to use the encoding
+ }
-          * which is Reserved on implementations without PXN.
-          */
++static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
++                                      bool isread)
-         pxn = desc & 1;
++{
-         ns = extract32(desc, 19, 1);
++    if (arm_current_el(env) == 1) {
-     } else {
++        /* This must be a FEAT_NV access with NVx == 101 */
--        if (arm_feature(env, ARM_FEATURE_PXN)) {
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
-+        if (cpu_isar_feature(aa32_pxn, cpu)) {
++            return CP_ACCESS_TRAP_EL2;
-             pxn = (desc >> 2) & 1;
++        }
-         }
++    }
-         ns = extract32(desc, 3, 1);
++    return e2h_access(env, ri, isread);
 +}
 +
 +static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                      bool isread)
 +{
 +    if (arm_current_el(env) == 1) {
 +        /* This must be a FEAT_NV access with NVx == 101 */
 +        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
 +    }
 +    return e2h_access(env, ri, isread);
 +}
 +
  /* Test if system register redirection is to occur in the current state.  */
  static bool redirect_for_e2h(CPUARMState *env)
  {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
      { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvpct,
        .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
        .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
      { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvvct,
        .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
        .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
        .type = ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvpct,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
      { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
        .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvvct,
        .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
  #endif
  };
 --
-.20.1
+.34.1

-[PULL 14/18] hw/arm/raspi: Avoid using TypeInfo::class_data pointer
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
 defined, which are "self-synchronized" views of the physical and
 virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
 (meaning that no barriers are needed around accesses to them to
 ensure that reads of them do not occur speculatively and out-of-order
 with other instructions).
-Using class_data pointer to create a MachineClass is not
+For QEMU, all our system registers are self-synchronized, so we can
-the recommended way anymore. The correct way is to open-code
+simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
-the MachineClass::fields in the class_init() method.
+to the new register encodings.
-We can not use TYPE_RASPI_MACHINE::class_base_init() because
+This means we now implement all the functionality required for
-it is called *before* each machine class_init(), therefore the
+ID_AA64MMFR0_EL1.ECV == 0b0001.
 board_rev field is not populated. We have to manually call
 raspi_machine_class_common_init() for each machine.
-This partly reverts commit a03bde3674e.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
 ---
  target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 file changed, 43 insertions(+)
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-5-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/raspi.c | 34 ++++++++++++++++++++++++----------
 file changed, 24 insertions(+), 10 deletions(-)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-     setup_boot(machine, version, machine->ram_size - vcram_size);
+     },
  }
 -static void raspi_machine_class_init(ObjectClass *oc, void *data)
 +static void raspi_machine_class_common_init(MachineClass *mc,
 +                                            uint32_t board_rev)
  {
 -    MachineClass *mc = MACHINE_CLASS(oc);
 -    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 -    uint32_t board_rev = (uint32_t)(uintptr_t)data;
 -
 -    rmc->board_rev = board_rev;
      mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
                                 board_type(board_rev),
                                 FIELD_EX32(board_rev, REV_CODE, REVISION));
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
      mc->default_ram_id = "ram";
  };
-+static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
++/*
-+{
++ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
-+    MachineClass *mc = MACHINE_CLASS(oc);
++ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
-+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
++ * so our implementations here are identical to the normal registers.
-+
++ */
-+    rmc->board_rev = 0xa21041;
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
-+    raspi_machine_class_common_init(mc, rmc->board_rev);
++    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access,
 +      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
 +    },
 +    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access,
 +      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
 +    },
 +};
 +
-+#ifdef TARGET_AARCH64
+ #else
-+static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
-+{
+ /*
-+    MachineClass *mc = MACHINE_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+     },
  };
 +/*
 + * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
 + * is exposed to userspace by Linux.
 + */
 +static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .readfn = gt_virt_cnt_read,
 +    },
 +};
 +
-+    rmc->board_rev = 0xa02082;
-+    raspi_machine_class_common_init(mc, rmc->board_rev);
-+};
-+#endif /* TARGET_AARCH64 */
-+
- static const TypeInfo raspi_machine_types[] = {
-     {
-         .name           = MACHINE_TYPE_NAME("raspi2"),
-         .parent         = TYPE_RASPI_MACHINE,
--        .class_init     = raspi_machine_class_init,
--        .class_data     = (void *)0xa21041,
-+        .class_init     = raspi2b_machine_class_init,
- #ifdef TARGET_AARCH64
-     }, {
-         .name           = MACHINE_TYPE_NAME("raspi3"),
-         .parent         = TYPE_RASPI_MACHINE,
--        .class_init     = raspi_machine_class_init,
--        .class_data     = (void *)0xa02082,
-+        .class_init     = raspi3b_machine_class_init,
  #endif
-     }, {
-         .name           = TYPE_RASPI_MACHINE,
+ static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
          define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
 +    }
      if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 --
-.20.1
+.34.1

-[PULL 02/18] target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-Move the id_pfr0 and id_pfr1 fields into the ARMISARegisters
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
-sub-struct. We're going to want id_pfr1 for an isar_features
+implemented.  This is similar to the existing CNTVOFF_EL2, except
-check, and moving both at the same time avoids an odd
+that it controls a hypervisor-adjustable offset made to the physical
-inconsistency.
+counter and timer.
-Changes other than the ones to cpu.h and kvm64.c made
+Implement the handling for this register, which includes control/trap
-automatically with:
+bits in SCR_EL3 and CNTHCTL_EL2.
   perl -p -i -e 's/cpu->id_pfr/cpu->isar.id_pfr/' target/arm/*.c hw/intc/armv7m_nvic.c
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200910173855.4068-3-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  4 ++--
+ target/arm/cpu-features.h |  5 +++
- hw/intc/armv7m_nvic.c |  4 ++--
+ target/arm/cpu.h          |  1 +
- target/arm/cpu.c      | 20 ++++++++++----------
+ target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
- target/arm/cpu64.c    | 12 ++++++------
+ target/arm/trace-events   |  1 +
- target/arm/cpu_tcg.c  | 36 ++++++++++++++++++------------------
+files changed, 73 insertions(+), 2 deletions(-)
  target/arm/helper.c   |  4 ++--
  target/arm/kvm64.c    |  4 ++++
 files changed, 44 insertions(+), 40 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+ }
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
++}
++
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-         uint32_t id_mmfr2;
+         uint64_t c14_cntkctl; /* Timer Control register */
-         uint32_t id_mmfr3;
+         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
-         uint32_t id_mmfr4;
+         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
-+        uint32_t id_pfr0;
++        uint64_t cntpoff_el2; /* Counter Physical Offset register */
-+        uint32_t id_pfr1;
+         ARMGenericTimer c14_timer[NUM_GTIMERS];
-         uint32_t mvfr0;
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
-         uint32_t mvfr1;
+         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
          uint32_t mvfr2;
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      uint32_t reset_fpsid;
      uint32_t ctr;
      uint32_t reset_sctlr;
 -    uint32_t id_pfr0;
 -    uint32_t id_pfr1;
      uint64_t pmceid0;
      uint64_t pmceid1;
      uint32_t id_afr0;
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                        "Aux Fault status registers unimplemented\n");
          return 0;
      case 0xd40: /* PFR0.  */
 -        return cpu->id_pfr0;
 +        return cpu->isar.id_pfr0;
      case 0xd44: /* PFR1.  */
 -        return cpu->id_pfr1;
 +        return cpu->isar.id_pfr1;
      case 0xd48: /* DFR0.  */
          return cpu->isar.id_dfr0;
      case 0xd4c: /* AFR0.  */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          /* Disable the security extension feature bits in the processor feature
           * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
           */
 -        cpu->id_pfr1 &= ~0xf0;
 +        cpu->isar.id_pfr1 &= ~0xf0;
          cpu->isar.id_aa64pfr0 &= ~0xf000;
      }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
           * id_aa64pfr0_el1[11:8].
           */
          cpu->isar.id_aa64pfr0 &= ~0xf00;
 -        cpu->id_pfr1 &= ~0xf000;
 +        cpu->isar.id_pfr1 &= ~0xf000;
      }
  #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00011111;
      cpu->ctr = 0x82048004;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x1031;
 -    cpu->id_pfr1 = 0x11;
 +    cpu->isar.id_pfr0 = 0x1031;
 +    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x400;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x31100003;
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x01111111;
      cpu->ctr = 0x80038003;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x1031;
 -    cpu->id_pfr1 = 0x11;
 +    cpu->isar.id_pfr0 = 0x1031;
 +    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x000;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x00100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x11111111;
      cpu->ctr = 0x84448003;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x00001131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00001131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x02010555;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x11111111;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50078;
 -    cpu->id_pfr0 = 0x00001131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00001131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x02010555;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10201105;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x84448004; /* L1Ip = VIPT */
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      cpu->isar.mvfr2 = 0x00000043;
      cpu->ctr = 0x8444c004;
      cpu->reset_sctlr = 0x00c50838;
 -    cpu->id_pfr0 = 0x00000131;
 -    cpu->id_pfr1 = 0x00011011;
 +    cpu->isar.id_pfr0 = 0x00000131;
 +    cpu->isar.id_pfr1 = 0x00011011;
      cpu->isar.id_dfr0 = 0x03010066;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x10201105;
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0x2;
      cpu->id_afr0 = 0x3;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0x2;
      cpu->id_afr0 = 0x3;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1dd20d2;
      cpu->reset_sctlr = 0x00050078;
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x11;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x11;
      cpu->isar.id_dfr0 = 0x33;
      cpu->id_afr0 = 0;
      cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x11111111;
      cpu->isar.mvfr1 = 0x00000000;
      cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
 -    cpu->id_pfr0 = 0x111;
 -    cpu->id_pfr1 = 0x1;
 +    cpu->isar.id_pfr0 = 0x111;
 +    cpu->isar.id_pfr1 = 0x1;
      cpu->isar.id_dfr0 = 0;
      cpu->id_afr0 = 0x2;
      cpu->isar.id_mmfr0 = 0x01100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
      cpu->midr = 0x410fc231;
      cpu->pmsav7_dregion = 8;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110021;
      cpu->isar.mvfr1 = 0x11000011;
      cpu->isar.mvfr2 = 0x00000000;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110221;
      cpu->isar.mvfr1 = 0x12000011;
      cpu->isar.mvfr2 = 0x00000040;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000200;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
      cpu->isar.id_dfr0 = 0x00100000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00100030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
      cpu->isar.mvfr0 = 0x10110021;
      cpu->isar.mvfr1 = 0x11000011;
      cpu->isar.mvfr2 = 0x00000040;
 -    cpu->id_pfr0 = 0x00000030;
 -    cpu->id_pfr1 = 0x00000210;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
      cpu->isar.id_dfr0 = 0x00200000;
      cpu->id_afr0 = 0x00000000;
      cpu->isar.id_mmfr0 = 0x00101F40;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_PMSA);
      set_feature(&cpu->env, ARM_FEATURE_PMU);
      cpu->midr = 0x411fc153; /* r1p3 */
 -    cpu->id_pfr0 = 0x0131;
 -    cpu->id_pfr1 = 0x001;
 +    cpu->isar.id_pfr0 = 0x0131;
 +    cpu->isar.id_pfr1 = 0x001;
      cpu->isar.id_dfr0 = 0x010400;
      cpu->id_afr0 = 0x0;
      cpu->isar.id_mmfr0 = 0x0210030;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
- static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
+         if (cpu_isar_feature(aa64_rme, cpu)) {
              valid_mask |= SCR_NSE | SCR_GPF;
          }
 +        if (cpu_isar_feature(aa64_ecv, cpu)) {
 +            valid_mask |= SCR_ECVEN;
 +        }
      } else {
          valid_mask &= ~(SCR_RW | SCR_ST);
          if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
      gt_update_irq(cpu, GTIMER_PHYS);
  }
 +static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
 +{
 +    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
 +        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
 +        arm_is_el2_enabled(env) &&
 +        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 +        return env->cp15.cntpoff_el2;
 +    }
 +    return 0;
 +}
 +
 +static uint64_t gt_phys_cnt_offset(CPUARMState *env)
 +{
 +    if (arm_current_el(env) >= 2) {
 +        return 0;
 +    }
 +    return gt_phys_raw_cnt_offset(env);
 +}
 +
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
  {
-     ARMCPU *cpu = env_archcpu(env);
+     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
--    uint64_t pfr1 = cpu->id_pfr1;
+@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
-+    uint64_t pfr1 = cpu->isar.id_pfr1;
+          * reset timer to when ISTATUS next has to change
+          */
-     if (env->gicv3state) {
+         uint64_t offset = timeridx == GTIMER_VIRT ?
-         pfr1 |= 1 << 28;
+-                                      cpu->env.cp15.cntvoff_el2 : 0;
 +            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
          uint64_t count = gt_get_countervalue(&cpu->env);
          /* Note that this must be unsigned 64 bit arithmetic: */
          int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
  static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
 -    return gt_get_countervalue(env);
 +    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
  }
  static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
      return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
      trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
              R_CNTHCTL_EL1NVVCT_MASK |
              R_CNTHCTL_EVNTIS_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        valid_mask |= R_CNTHCTL_ECV_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
      },
  };
 +static CPAccessResult gt_cntpoff_access(CPUARMState *env,
 +                                        const ARMCPRegInfo *ri,
 +                                        bool isread)
 +{
 +    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                              uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    trace_arm_gt_cntpoff_write(value);
 +    raw_write(env, ri, value);
 +    gt_recalc_timer(cpu, GTIMER_PHYS);
 +}
 +
 +static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
 +    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
 +    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
 +    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
 +    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
 +    .nv2_redirect_offset = 0x1a8,
 +    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
 +};
  #else
  /*
 @@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
+     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
-               .access = PL1_R, .type = ARM_CP_CONST,
+         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
-               .accessfn = access_aa32_tid3,
+     }
--              .resetvalue = cpu->id_pfr0 },
++#ifndef CONFIG_USER_ONLY
-+              .resetvalue = cpu->isar.id_pfr0 },
++    if (cpu_isar_feature(aa64_ecv, cpu)) {
-             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
++        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
-              * the value of the GIC field until after we define these regs.
++    }
-              */
++#endif
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 diff --git a/target/arm/trace-events b/target/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
+--- a/target/arm/trace-events
-+++ b/target/arm/kvm64.c
++++ b/target/arm/trace-events
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
-          * than skipping the reads and leaving 0, as we must avoid
+ arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
-          * considering the values in every case.
+ arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
-          */
+ arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
++arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
-+                              ARM64_SYS_REG(3, 0, 0, 1, 0));
+ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
-+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
-+                              ARM64_SYS_REG(3, 0, 0, 1, 1));
+ # kvm.c
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                                ARM64_SYS_REG(3, 0, 0, 1, 2));
          err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
 --
-.20.1
+.34.1

-[PULL 15/18] hw/arm/raspi: Use more specific machine names
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Enable all FEAT_ECV features on the 'max' CPU.
-Now that we can instantiate different machines based on their
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-board_rev register value, we can have various raspi2 and raspi3.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
 ---
  docs/system/arm/emulation.rst | 1 +
  target/arm/tcg/cpu64.c        | 1 +
 files changed, 2 insertions(+)
-In commit fc78a990ec103 we corrected the machine description.
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 Correct the machine names too. For backward compatibility, add
 an alias to the previous generic name.
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-6-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/raspi.c | 6 ++++--
 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/arm/raspi.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-     MachineClass *mc = MACHINE_CLASS(oc);
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
-     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+ - FEAT_DoubleFault (Double Fault Extension)
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
-+    mc->alias = "raspi2";
++- FEAT_ECV (Enhanced Counter Virtualization)
-     rmc->board_rev = 0xa21041;
+ - FEAT_EPAC (Enhanced pointer authentication)
-     raspi_machine_class_common_init(mc, rmc->board_rev);
+ - FEAT_ETS (Enhanced Translation Synchronization)
- };
+ - FEAT_EVT (Enhanced Virtualization Traps)
-@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
-     MachineClass *mc = MACHINE_CLASS(oc);
+index XXXXXXX..XXXXXXX 100644
-     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+--- a/target/arm/tcg/cpu64.c
++++ b/target/arm/tcg/cpu64.c
-+    mc->alias = "raspi3";
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
-     rmc->board_rev = 0xa02082;
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
-     raspi_machine_class_common_init(mc, rmc->board_rev);
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
- };
+     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
-@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
++    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
+     cpu->isar.id_aa64mmfr0 = t;
- static const TypeInfo raspi_machine_types[] = {
-     {
+     t = cpu->isar.id_aa64mmfr1;
 -        .name           = MACHINE_TYPE_NAME("raspi2"),
 +        .name           = MACHINE_TYPE_NAME("raspi2b"),
          .parent         = TYPE_RASPI_MACHINE,
          .class_init     = raspi2b_machine_class_init,
  #ifdef TARGET_AARCH64
      }, {
 -        .name           = MACHINE_TYPE_NAME("raspi3"),
 +        .name           = MACHINE_TYPE_NAME("raspi3b"),
          .parent         = TYPE_RASPI_MACHINE,
          .class_init     = raspi3b_machine_class_init,
  #endif
 --
-.20.1
+.34.1

-[PULL 13/18] hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-The arm_boot_info structure belong to the machine,
+Features supported :
-move it to RaspiMachineState.
+- the 8 STM32L4x5 GPIOs are initialized with their reset values
     (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Difference with the real GPIOs :
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+- Alternate Function and Analog mode aren't implemented :
-Message-id: 20200924111808.77168-4-f4bug@amsat.org
+    pins in AF/Analog behave like pins in input mode
 - floating pins stay at their last value
 - register IDR reset values differ from the real one :
     values are coherent with the other registers reset values
     and the fact that AF/Analog modes aren't implemented
 - setting I/O output speed isn't supported
 - locking port bits isn't supported
 - ADC function isn't supported
 - GPIOH has 16 pins instead of 2 pins
 - writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
 Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
 Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 30 +++++++++++++++---------------
+ MAINTAINERS                        |   1 +
-file changed, 15 insertions(+), 15 deletions(-)
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
  include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
  hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/MAINTAINERS
-+++ b/hw/arm/raspi.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ struct RaspiMachineState {
+@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
-     MachineState parent_obj;
+ F: hw/misc/stm32l4x5_exti.c
-     /*< public >*/
+ F: hw/misc/stm32l4x5_syscfg.c
-     BCM283XState soc;
+ F: hw/misc/stm32l4x5_rcc.c
-+    struct arm_boot_info binfo;
++F: hw/gpio/stm32l4x5_gpio.c
- };
+ F: include/hw/*/stm32l4x5_*.h
- typedef struct RaspiMachineState RaspiMachineState;
+ B-L475E-IOT01A IoT Node
-@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
+diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
- static void setup_boot(MachineState *machine, int version, size_t ram_size)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/docs/system/arm/b-l475e-iot01a.rst
-     RaspiMachineState *s = RASPI_MACHINE(machine);
++++ b/docs/system/arm/b-l475e-iot01a.rst
--    static struct arm_boot_info binfo;
+@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
-     int r;
+ - STM32L4x5 EXTI (Extended interrupts and events controller)
+ - STM32L4x5 SYSCFG (System configuration controller)
--    binfo.board_id = MACH_TYPE_BCM2708;
+ - STM32L4x5 RCC (Reset and clock control)
--    binfo.ram_size = ram_size;
++- STM32L4x5 GPIOs (General-purpose I/Os)
--    binfo.nb_cpus = machine->smp.cpus;
-+    s->binfo.board_id = MACH_TYPE_BCM2708;
+ Missing devices
-+    s->binfo.ram_size = ram_size;
+ """""""""""""""
-+    s->binfo.nb_cpus = machine->smp.cpus;
+@@ -XXX,XX +XXX,XX @@ Missing devices
+ The B-L475E-IOT01A does *not* support the following devices:
-     if (version <= 2) {
-         /* The rpi1 and 2 require some custom setup code to run in Secure
+ - Serial ports (UART)
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+-- General-purpose I/Os (GPIO)
-          * firmware for some cache maintenance operations.
+ - Analog to Digital Converter (ADC)
-          * The rpi3 doesn't need this.
+ - SPI controller
-          */
+ - Timer controller (TIMER)
--        binfo.board_setup_addr = BOARDSETUP_ADDR;
+diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
--        binfo.write_board_setup = write_board_setup;
+new file mode 100644
--        binfo.secure_board_setup = true;
+index XXXXXXX..XXXXXXX
--        binfo.secure_boot = true;
+--- /dev/null
-+        s->binfo.board_setup_addr = BOARDSETUP_ADDR;
++++ b/include/hw/gpio/stm32l4x5_gpio.h
-+        s->binfo.write_board_setup = write_board_setup;
+@@ -XXX,XX +XXX,XX @@
-+        s->binfo.secure_board_setup = true;
++/*
-+        s->binfo.secure_boot = true;
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
-     }
++ *
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
-     /* Pi2 and Pi3 requires SMP setup */
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
-     if (version >= 2) {
++ *
--        binfo.smp_loader_start = SMPBOOT_ADDR;
++ * SPDX-License-Identifier: GPL-2.0-or-later
-+        s->binfo.smp_loader_start = SMPBOOT_ADDR;
++ *
-         if (version == 2) {
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
--            binfo.write_secondary_boot = write_smpboot;
++ * See the COPYING file in the top-level directory.
-+            s->binfo.write_secondary_boot = write_smpboot;
++ */
-         } else {
++
--            binfo.write_secondary_boot = write_smpboot64;
++/*
-+            s->binfo.write_secondary_boot = write_smpboot64;
++ * The reference used is the STMicroElectronics RM0351 Reference manual
-         }
++ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
--        binfo.secondary_cpu_reset_hook = reset_secondary;
++ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
-+        s->binfo.secondary_cpu_reset_hook = reset_secondary;
++ */
-     }
++
++#ifndef HW_STM32L4X5_GPIO_H
-     /* If the user specified a "firmware" image (e.g. UEFI), we bypass
++#define HW_STM32L4X5_GPIO_H
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
++
-             exit(1);
++#include "hw/sysbus.h"
-         }
++#include "qom/object.h"
++
--        binfo.entry = firmware_addr;
++#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
--        binfo.firmware_loaded = true;
++OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
-+        s->binfo.entry = firmware_addr;
++
-+        s->binfo.firmware_loaded = true;
++#define GPIO_NUM_PINS 16
-     }
++
++struct Stm32l4x5GpioState {
--    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
++    SysBusDevice parent_obj;
-+    arm_load_kernel(&s->soc.cpu[0].core, machine, &s->binfo);
++
- }
++    MemoryRegion mmio;
++
- static void raspi_machine_init(MachineState *machine)
++    /* GPIO registers */
 +    uint32_t moder;
 +    uint32_t otyper;
 +    uint32_t ospeedr;
 +    uint32_t pupdr;
 +    uint32_t idr;
 +    uint32_t odr;
 +    uint32_t lckr;
 +    uint32_t afrl;
 +    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
 +
 +#endif
 diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
 +#include "migration/vmstate.h"
 +#include "trace.h"
 +
 +#define GPIO_MODER 0x00
 +#define GPIO_OTYPER 0x04
 +#define GPIO_OSPEEDR 0x08
 +#define GPIO_PUPDR 0x0C
 +#define GPIO_IDR 0x10
 +#define GPIO_ODR 0x14
 +#define GPIO_BSRR 0x18
 +#define GPIO_LCKR 0x1C
 +#define GPIO_AFRL 0x20
 +#define GPIO_AFRH 0x24
 +#define GPIO_BRR 0x28
 +#define GPIO_ASCR 0x2C
 +
 +/* 0b11111111_11111111_00000000_00000000 */
 +#define RESERVED_BITS_MASK 0xFFFF0000
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s);
 +
 +static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 2;
 +}
 +
 +static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 1;
 +}
 +
 +static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
 +static void stm32l4x5_gpio_reset_hold(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    s->moder = s->moder_reset;
 +    s->otyper = 0x00000000;
 +    s->ospeedr = s->ospeedr_reset;
 +    s->pupdr = s->pupdr_reset;
 +    s->idr = 0x00000000;
 +    s->odr = 0x00000000;
 +    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
 +        s->pins_connected_high &= ~(1 << line);
 +    }
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s)
 +{
 +    uint32_t new_idr_mask = 0;
 +    uint32_t new_idr = s->odr;
 +    uint32_t old_idr = s->idr;
 +    int new_pin_state, old_pin_state;
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (is_output(s, i)) {
 +            if (is_push_pull(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (!(s->odr & (1 << i))) {
 +                /* open-drain ODR 0 */
 +                new_idr_mask |= (1 << i);
 +            /* open-drain ODR 1 */
 +            } else if (!(s->disconnected_pins & (1 << i)) &&
 +                       !(s->pins_connected_high & (1 << i))) {
 +                /* open-drain ODR 1 with pin connected low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            /* open-drain ODR 1 with unactive pin */
 +            } else if (is_pull_up(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for open-drain ODR 1
 +             * with unactive pin without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        /* input or analog mode with connected pin */
 +        } else if (!(s->disconnected_pins & (1 << i))) {
 +            if (s->pins_connected_high & (1 << i)) {
 +                /* pin high */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else {
 +                /* pin low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +        /* input or analog mode with disconnected pin */
 +        } else {
 +            if (is_pull_up(s, i)) {
 +                /* pull-up */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                /* pull-down */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for a disconnected pin
 +             * without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        }
 +    }
 +
 +    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
 +    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (new_idr_mask & (1 << i)) {
 +            new_pin_state = (new_idr & (1 << i)) > 0;
 +            old_pin_state = (old_idr & (1 << i)) > 0;
 +            if (new_pin_state > old_pin_state) {
 +                qemu_irq_raise(s->pin[i]);
 +            } else if (new_pin_state < old_pin_state) {
 +                qemu_irq_lower(s->pin[i]);
 +            }
 +        }
 +    }
 +}
 +
 +/*
 + * Return mask of pins that are both configured in output
 + * mode and externally driven (except pins in open-drain
 + * mode externally set to 0).
 + */
 +static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
 +{
 +    uint32_t pins_to_disconnect = 0;
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        /* for each connected pin in output mode */
 +        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
 +            /* if either push-pull or high level */
 +            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
 +                pins_to_disconnect |= (1 << i);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Line %d can't be driven externally\n",
 +                              i);
 +            }
 +        }
 +    }
 +    return pins_to_disconnect;
 +}
 +
 +/*
 + * Set field `disconnected_pins` and call `update_gpio_idr()`
 + */
 +static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
 +{
 +    s->disconnected_pins |= lines;
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +static void disconnected_pins_set(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint16_t value;
 +    if (!visit_type_uint16(v, name, &value, errp)) {
 +        return;
 +    }
 +    disconnect_gpio_pins(s, value);
 +}
 +
 +static void disconnected_pins_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
 +}
 +
 +static void clock_freq_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint32_t clock_freq_hz = clock_get_hz(s->clk);
 +    visit_type_uint32(v, name, &clock_freq_hz, errp);
 +}
 +
 +static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
 +                                 uint64_t val64, unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    uint32_t value = val64;
 +    trace_stm32l4x5_gpio_write(s->name, addr, val64);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        s->moder = value;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Analog and AF modes aren't supported\n\
 +                       Analog and AF mode behave like input mode\n",
 +                      __func__);
 +        return;
 +    case GPIO_OTYPER:
 +        s->otyper = value & ~RESERVED_BITS_MASK;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        return;
 +    case GPIO_OSPEEDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing I/O output speed isn't supported\n\
 +                       I/O speed is already maximal\n",
 +                      __func__);
 +        s->ospeedr = value;
 +        return;
 +    case GPIO_PUPDR:
 +        s->pupdr = value;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_IDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: GPIO->IDR is read-only\n",
 +                      __func__);
 +        return;
 +    case GPIO_ODR:
 +        s->odr = value & ~RESERVED_BITS_MASK;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_BSRR: {
 +        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
 +        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
 +        /* If both BSx and BRx are set, BSx has priority.*/
 +        s->odr &= ~bits_to_reset;
 +        s->odr |= bits_to_set;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_LCKR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Locking port bits configuration isn't supported\n",
 +                      __func__);
 +        s->lckr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    case GPIO_AFRL:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrl = value;
 +        return;
 +    case GPIO_AFRH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrh = value;
 +        return;
 +    case GPIO_BRR: {
 +        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
 +        s->odr &= ~bits_to_reset;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_ASCR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: ADC function isn't supported\n",
 +                      __func__);
 +        s->ascr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +    }
 +}
 +
 +static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
 +                                    unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    trace_stm32l4x5_gpio_read(s->name, addr);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        return s->moder;
 +    case GPIO_OTYPER:
 +        return s->otyper;
 +    case GPIO_OSPEEDR:
 +        return s->ospeedr;
 +    case GPIO_PUPDR:
 +        return s->pupdr;
 +    case GPIO_IDR:
 +        return s->idr;
 +    case GPIO_ODR:
 +        return s->odr;
 +    case GPIO_BSRR:
 +        return 0;
 +    case GPIO_LCKR:
 +        return s->lckr;
 +    case GPIO_AFRL:
 +        return s->afrl;
 +    case GPIO_AFRH:
 +        return s->afrh;
 +    case GPIO_BRR:
 +        return 0;
 +    case GPIO_ASCR:
 +        return s->ascr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +        return 0;
 +    }
 +}
 +
 +static const MemoryRegionOps stm32l4x5_gpio_ops = {
 +    .read = stm32l4x5_gpio_read,
 +    .write = stm32l4x5_gpio_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +};
 +
 +static void stm32l4x5_gpio_init(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
 +                          TYPE_STM32L4X5_GPIO, 0x400);
 +
 +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 +
 +    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
 +    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
 +
 +    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
 +
 +    object_property_add(obj, "disconnected-pins", "uint16",
 +                        disconnected_pins_get, disconnected_pins_set,
 +                        NULL, &s->disconnected_pins);
 +    object_property_add(obj, "clock-freq-hz", "uint32",
 +                        clock_freq_get, NULL, NULL, NULL);
 +}
 +
 +static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
 +    if (!clock_has_source(s->clk)) {
 +        error_setg(errp, "GPIO: clk input must be connected");
 +        return;
 +    }
 +}
 +
 +static const VMStateDescription vmstate_stm32l4x5_gpio = {
 +    .name = TYPE_STM32L4X5_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]){
 +        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property stm32l4x5_gpio_properties[] = {
 +    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
 +    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
 +    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
 +    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    device_class_set_props(dc, stm32l4x5_gpio_properties);
 +    dc->vmsd = &vmstate_stm32l4x5_gpio;
 +    dc->realize = stm32l4x5_gpio_realize;
 +    rc->phases.hold = stm32l4x5_gpio_reset_hold;
 +}
 +
 +static const TypeInfo stm32l4x5_gpio_types[] = {
 +    {
 +        .name = TYPE_STM32L4X5_GPIO,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(Stm32l4x5GpioState),
 +        .instance_init = stm32l4x5_gpio_init,
 +        .class_init = stm32l4x5_gpio_class_init,
 +    },
 +};
 +
 +DEFINE_TYPES(stm32l4x5_gpio_types)
 diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/Kconfig
 +++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
  config SIFIVE_GPIO
      bool
 +
 +config STM32L4X5_GPIO
 +    bool
 diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
      'bcm2835_gpio.c',
      'bcm2838_gpio.c'
  ))
 +system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
  system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
 diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/trace-events
 +++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
  # aspeed_gpio.c
  aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
  aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 +
 +# stm32l4x5_gpio.c
 +stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
 +stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
 +stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
 --
-.20.1
+.34.1

-[PULL 16/18] hw/arm/raspi: Introduce RaspiProcessorId enum
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-As we only support a reduced set of the REV_CODE_PROCESSOR id
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-encoded in the board revision, define the PROCESSOR_ID values
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-as an enum. We can simplify the board_soc_type and cores_count
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-methods.
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-7-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 45 +++++++++++++++++++++------------------------
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
-file changed, 21 insertions(+), 24 deletions(-)
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
-index XXXXXXX..XXXXXXX 100644
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
---- a/hw/arm/raspi.c
+ hw/arm/Kconfig                     |  3 +-
-+++ b/hw/arm/raspi.c
+files changed, 63 insertions(+), 18 deletions(-)
-@@ -XXX,XX +XXX,XX @@ FIELD(REV_CODE, MANUFACTURER,      16, 4);
- FIELD(REV_CODE, MEMORY_SIZE,       20, 3);
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
- FIELD(REV_CODE, STYLE,             23, 1);
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/stm32l4x5_soc.h
-+typedef enum RaspiProcessorId {
++++ b/include/hw/arm/stm32l4x5_soc.h
-+    PROCESSOR_ID_BCM2836 = 1,
+@@ -XXX,XX +XXX,XX @@
-+    PROCESSOR_ID_BCM2837 = 2,
+ #include "hw/misc/stm32l4x5_syscfg.h"
-+} RaspiProcessorId;
+ #include "hw/misc/stm32l4x5_exti.h"
-+
+ #include "hw/misc/stm32l4x5_rcc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "qom/object.h"
  #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
      OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
      Stm32l4x5SyscfgState syscfg;
      Stm32l4x5RccState rcc;
 +    Stm32l4x5GpioState gpio[NUM_GPIOS];
      MemoryRegion sram1;
      MemoryRegion sram2;
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/gpio/stm32l4x5_gpio.h
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
  #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +#define NUM_GPIOS 8
  #define GPIO_NUM_PINS 16
  struct Stm32l4x5GpioState {
 diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
 +static const struct {
-+    const char *type;
++    uint32_t addr;
-+    int cores_count;
++    uint32_t moder_reset;
-+} soc_property[] = {
++    uint32_t ospeedr_reset;
-+    [PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
++    uint32_t pupdr_reset;
-+    [PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
++} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
 +    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
- static uint64_t board_ram_size(uint32_t board_rev)
+ static void stm32l4x5_soc_initfn(Object *obj)
  {
-     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
+     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
-     return 256 * MiB << FIELD_EX32(board_rev, REV_CODE, MEMORY_SIZE);
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
      }
      object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
      object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
 +        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
 +    }
  }
--static int board_processor_id(uint32_t board_rev)
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+static RaspiProcessorId board_processor_id(uint32_t board_rev)
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
- {
+     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
-+    int proc_id = FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
-+
+     MemoryRegion *system_memory = get_system_memory();
-     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
+-    DeviceState *armv7m;
--    return FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
++    DeviceState *armv7m, *dev;
-+    assert(proc_id < ARRAY_SIZE(soc_property) && soc_property[proc_id].type);
+     SysBusDevice *busdev;
-+
++    uint32_t pin_index;
-+    return proc_id;
- }
+     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
+                                 sc->flash_size, errp)) {
- static int board_version(uint32_t board_rev)
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static int board_version(uint32_t board_rev)
+         return;
+     }
- static const char *board_soc_type(uint32_t board_rev)
- {
++    /* GPIOs */
--    static const char *soc_types[] = {
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
--        NULL, TYPE_BCM2836, TYPE_BCM2837,
++        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
--    };
++        dev = DEVICE(&s->gpio[i]);
--    int proc_id = board_processor_id(board_rev);
++        qdev_prop_set_string(dev, "name", name);
--
++        qdev_prop_set_uint32(dev, "mode-reset",
--    if (proc_id >= ARRAY_SIZE(soc_types) || !soc_types[proc_id]) {
++                             stm32l4x5_gpio_cfg[i].moder_reset);
--        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
++        qdev_prop_set_uint32(dev, "ospeed-reset",
--                     proc_id, board_rev);
++                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
--        exit(1);
++        qdev_prop_set_uint32(dev, "pupd-reset",
--    }
++                            stm32l4x5_gpio_cfg[i].pupdr_reset);
--    return soc_types[proc_id];
++        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
-+    return soc_property[board_processor_id(board_rev)].type;
++        g_free(name);
- }
++        name = g_strdup_printf("gpio%c-out", 'a' + i);
++        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
- static int cores_count(uint32_t board_rev)
++            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
- {
++        if (!sysbus_realize(busdev, errp)) {
--    static const int soc_cores_count[] = {
++            return;
--        0, BCM283X_NCPUS, BCM283X_NCPUS,
++        }
--    };
++        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
--    int proc_id = board_processor_id(board_rev);
++    }
--
++
--    if (proc_id >= ARRAY_SIZE(soc_cores_count) || !soc_cores_count[proc_id]) {
+     /* System configuration controller */
--        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
+     busdev = SYS_BUS_DEVICE(&s->syscfg);
--                     proc_id, board_rev);
+     if (!sysbus_realize(busdev, errp)) {
--        exit(1);
+         return;
--    }
+     }
--    return soc_cores_count[proc_id];
+     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-+    return soc_property[board_processor_id(board_rev)].cores_count;
+-    /*
- }
+-     * TODO: when the GPIO device is implemented, connect it
+-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
- static const char *board_type(uint32_t board_rev)
+-     * GPIO_NUM_PINS.
 -     */
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
 +            pin_index = GPIO_NUM_PINS * i + j;
 +            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
 +                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
 +                                  pin_index));
 +        }
 +    }
      /* EXTI device */
      busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          }
      }
 -    for (unsigned i = 0; i < 16; i++) {
 +    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
          qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                                qdev_get_gpio_in(DEVICE(&s->exti), i));
      }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      /* RESERVED:    0x40024400, 0x7FDBC00 */
      /* AHB2 BUS */
 -    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
 -    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
 -    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
 -    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
 -    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
 -    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
 -    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
 -    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
      /* RESERVED:    0x48002000, 0x7FDBC00 */
      create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
      create_unimplemented_device("ADC",       0x50040000, 0x400);
 diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32l4x5_syscfg.c
 +++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "migration/vmstate.h"
  #include "hw/misc/stm32l4x5_syscfg.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
-.20.1
+.34.1

-[PULL 12/18] hw/arm/raspi: Load the firmware on the first core
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-The 'first_cpu' is more a QEMU accelerator-related concept
+The testcase contains :
-than a variable the machine requires to use.
+- `test_idr_reset_value()` :
-Since the machine is aware of its CPUs, directly use the
+Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
-first one to load the firmware.
+- `test_gpio_output_mode()` :
 Checks that writing a bit in register ODR results in the corresponding
 pin rising or lowering, if this pin is configured in output mode.
 - `test_gpio_input_mode()` :
 Checks that a input pin set high or low externally results
 in the pin rising and lowering.
 - `test_pull_up_pull_down()` :
 Checks that a floating pin in pull-up/down mode is actually high/down.
 - `test_push_pull()` :
 Checks that a pin set externally is disconnected when configured in
 push-pull output mode, and can't be set externally while in this mode.
 - `test_open_drain()` :
 Checks that a pin set externally high is disconnected when configured
 in open-drain output mode, and can't be set high while in this mode.
 - `test_bsrr_brr()` :
 Checks that writing to BSRR and BRR has the desired result in ODR.
 - `test_clock_enable()` :
 Checks that GPIO clock is at the right frequency after enabling it.
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-Message-id: 20200924111808.77168-3-f4bug@amsat.org
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
 Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 3 ++-
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
-file changed, 2 insertions(+), 1 deletion(-)
+ tests/qtest/meson.build           |   3 +-
 files changed, 553 insertions(+), 1 deletion(-)
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for STM32L4x5_GPIO
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "libqtest-single.h"
 +
 +#define GPIO_BASE_ADDR 0x48000000
 +#define GPIO_SIZE      0x400
 +#define NUM_GPIOS      8
 +#define NUM_GPIO_PINS  16
 +
 +#define GPIO_A 0x48000000
 +#define GPIO_B 0x48000400
 +#define GPIO_C 0x48000800
 +#define GPIO_D 0x48000C00
 +#define GPIO_E 0x48001000
 +#define GPIO_F 0x48001400
 +#define GPIO_G 0x48001800
 +#define GPIO_H 0x48001C00
 +
 +#define MODER 0x00
 +#define OTYPER 0x04
 +#define PUPDR 0x0C
 +#define IDR 0x10
 +#define ODR 0x14
 +#define BSRR 0x18
 +#define BRR 0x28
 +
 +#define MODER_INPUT 0
 +#define MODER_OUTPUT 1
 +
 +#define PUPDR_NONE 0
 +#define PUPDR_PULLUP 1
 +#define PUPDR_PULLDOWN 2
 +
 +#define OTYPER_PUSH_PULL 0
 +#define OTYPER_OPEN_DRAIN 1
 +
 +const uint32_t moder_reset[NUM_GPIOS] = {
 +    0xABFFFFFF,
 +    0xFFFFFEBF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0x0000000F
 +};
 +
 +const uint32_t pupdr_reset[NUM_GPIOS] = {
 +    0x64000000,
 +    0x00000100,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +const uint32_t idr_reset[NUM_GPIOS] = {
 +    0x0000A000,
 +    0x00000010,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
 +{
 +    return readl(gpio + offset);
 +}
 +
 +static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
 +{
 +    writel(gpio + offset, value);
 +}
 +
 +static void gpio_set_bit(unsigned int gpio, unsigned int reg,
 +                         unsigned int pin, uint32_t value)
 +{
 +    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
 +}
 +
 +static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
 +                           unsigned int pin, uint32_t value)
 +{
 +    uint32_t offset = 2 * pin;
 +    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
 +}
 +
 +static unsigned int get_gpio_id(uint32_t gpio_addr)
 +{
 +    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
 +}
 +
 +static void gpio_set_irq(unsigned int gpio, int num, int level)
 +{
 +    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    qtest_set_irq_in(global_qtest, name, NULL, num, level);
 +}
 +
 +static void disconnect_all_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
 +        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
 +        path, 0xFFFF);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static uint32_t get_disconnected_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    uint32_t disconnected_pins = 0;
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
 +        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    disconnected_pins = qdict_get_int(r, "return");
 +    qobject_unref(r);
 +    return disconnected_pins;
 +}
 +
 +static uint32_t reset(uint32_t gpio, unsigned int offset)
 +{
 +    switch (offset) {
 +    case MODER:
 +        return moder_reset[get_gpio_id(gpio)];
 +    case PUPDR:
 +        return pupdr_reset[get_gpio_id(gpio)];
 +    case IDR:
 +        return idr_reset[get_gpio_id(gpio)];
 +    }
 +    return 0x0;
 +}
 +
 +static void system_reset(void)
 +{
 +    QDict *r;
 +    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static void test_idr_reset_value(void)
 +{
 +    /*
 +     * Checks that the values in MODER, OTYPER, PUPDR and ODR
 +     * after reset are correct, and that the value in IDR is
 +     * coherent.
 +     * Since AF and analog modes aren't implemented, IDR reset
 +     * values aren't the same as with a real board.
 +     *
 +     * Register IDR contains the actual values of all GPIO pins.
 +     * Its value depends on the pins' configuration
 +     * (intput/output/analog : register MODER, push-pull/open-drain :
 +     * register OTYPER, pull-up/pull-down/none : register PUPDR)
 +     * and on the values stored in register ODR
 +     * (in case the pin is in output mode).
 +     */
 +
 +    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
 +
 +    system_reset();
 +
 +    uint32_t moder = gpio_readl(GPIO_A, MODER);
 +    uint32_t odr = gpio_readl(GPIO_A, ODR);
 +    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
 +    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
 +    uint32_t idr = gpio_readl(GPIO_A, IDR);
 +    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
 +    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
 +    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
 +
 +    moder = gpio_readl(GPIO_B, MODER);
 +    odr = gpio_readl(GPIO_B, ODR);
 +    otyper = gpio_readl(GPIO_B, OTYPER);
 +    pupdr = gpio_readl(GPIO_B, PUPDR);
 +    idr = gpio_readl(GPIO_B, IDR);
 +    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
 +    /* ... 5: neither, 4: pull-up, 3: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
 +    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
 +
 +    moder = gpio_readl(GPIO_C, MODER);
 +    odr = gpio_readl(GPIO_C, ODR);
 +    otyper = gpio_readl(GPIO_C, OTYPER);
 +    pupdr = gpio_readl(GPIO_C, PUPDR);
 +    idr = gpio_readl(GPIO_C, IDR);
 +    /* Analog, same as Input mode*/
 +    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
 +
 +    moder = gpio_readl(GPIO_H, MODER);
 +    odr = gpio_readl(GPIO_H, ODR);
 +    otyper = gpio_readl(GPIO_H, OTYPER);
 +    pupdr = gpio_readl(GPIO_H, PUPDR);
 +    idr = gpio_readl(GPIO_H, IDR);
 +    /* Analog, same as Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
 +}
 +
 +static void test_gpio_output_mode(const void *data)
 +{
 +    /*
 +     * Checks that setting a bit in ODR sets the corresponding
 +     * GPIO line high : it should set the right bit in IDR
 +     * and send an irq to syscfg.
 +     * Additionally, it checks that values written to ODR
 +     * when not in output mode are stored and not discarded.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Set a bit in ODR and check nothing happens */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the relevant line as output and check the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Reset the bit in ODR and check the pin is low */
 +    gpio_set_bit(gpio, ODR, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +}
 +
 +static void test_gpio_input_mode(const void *data)
 +{
 +    /*
 +     * Test that setting a line high/low externally sets the
 +     * corresponding GPIO line high/low : it should set the
 +     * right bit in IDR and send an irq to syscfg.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input, raise it, and check that the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Lower the line and check that the pin is low */
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    disconnect_all_pins(gpio);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_pull_up_pull_down(const void *data)
 +{
 +    /*
 +     * Test that a floating pin with pull-up sets the pin
 +     * high and vice-versa.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input with pull-up, check the line is set high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the line with pull-down, check the line is low */
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_push_pull(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in push-pull output mode
 +     * disconnects the pin, that the pin can't be set or reset
 +     * externally afterwards.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Trying to set a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio2, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +}
 +
 +static void test_open_drain(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in open-drain output mode
 +     * disconnects a pin set high externally and that the pin
 +     * can't be set high externally while configured in open-drain.
 +     *
 +     * However a pin set low externally shouldn't be disconnected,
 +     * and it can be set low externally when in open-drain mode.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in open-drain output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in open-drain output */
 +    /* And checking the pin wasn't disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Trying to set a open-drain output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a open-drain output pin, checking it works */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Clean the test */
 +    disconnect_all_pins(gpio2);
 +    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
 +    disconnect_all_pins(gpio);
 +    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_bsrr_brr(const void *data)
 +{
 +    /*
 +     * Test that writing a '1' in BSS and BSRR
 +     * has the desired effect on ODR.
 +     * In BSRR, BSx has priority over BRx.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    /* BSx should have priority over BRx */
 +    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int ret;
 +
 +    g_test_init(&argc, &argv, NULL);
 +    g_test_set_nonfatal_assertions();
 +    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
 +                   test_idr_reset_value);
 +    /*
 +     * The inputs for the tests (gpio and pin) can be changed,
 +     * but the tests don't work for pins that are high at reset
 +     * (GPIOA15, GPIO13 and GPIOB5).
 +     * Specifically, rising the pin then checking `get_irq()`
 +     * is problematic since the pin was already high.
 +     */
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
 +                        (void *)((uint64_t)GPIO_C << 32 | 5),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
 +                        (void *)((uint64_t)GPIO_D << 32 | 6),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
 +                        (void *)((uint64_t)GPIO_C << 32 | 10),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
 +                        (void *)((uint64_t)GPIO_B << 32 | 5),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
 +                        (void *)((uint64_t)GPIO_F << 32 | 1),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
 +                        (void *)((uint64_t)GPIO_G << 32 | 6),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
 +                        (void *)((uint64_t)GPIO_C << 32 | 4),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
 +                        (void *)((uint64_t)GPIO_E << 32 | 11),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
 +                        (void *)((uint64_t)GPIO_A << 32 | 12),
 +                        test_bsrr_brr);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
 +                        (void *)((uint64_t)GPIO_D << 32 | 0),
 +                        test_bsrr_brr);
 +
 +    qtest_start("-machine b-l475e-iot01a");
 +    ret = g_test_run();
 +    qtest_end();
 +
 +    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/tests/qtest/meson.build
-+++ b/hw/arm/raspi.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
+ qtests_stm32l4x5 = \
- static void setup_boot(MachineState *machine, int version, size_t ram_size)
+   ['stm32l4x5_exti-test',
- {
+    'stm32l4x5_syscfg-test',
-+    RaspiMachineState *s = RASPI_MACHINE(machine);
+-   'stm32l4x5_rcc-test']
-     static struct arm_boot_info binfo;
++   'stm32l4x5_rcc-test',
-     int r;
++   'stm32l4x5_gpio-test']
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+ qtests_arm = \
-         binfo.firmware_loaded = true;
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
      }
 -    arm_load_kernel(ARM_CPU(first_cpu), machine, &binfo);
 +    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
  }
  static void raspi_machine_init(MachineState *machine)
 --
-.20.1
+.34.1

-[PULL 18/18] hw/arm/raspi: Remove use of the 'version' value in the board code
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We expected the 'version' ID to match the board processor ID,
+While the 8-bit input elements are sequential in the input vector,
-but this is not always true (for example boards with revision
+the 32-bit output elements are not sequential in the output matrix.
-id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
+Do not attempt to compute 2 32-bit outputs at the same time.
-This was not important because we were not modelling them, but
-since the recent refactor now allow to model these boards, it
+Cc: qemu-stable@nongnu.org
-is safer to check the processor id directly. Remove the version
+Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
-check.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200924111808.77168-9-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 29 +++++++++++++----------------
+ target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
-file changed, 13 insertions(+), 16 deletions(-)
+ tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+ tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 147 insertions(+), 33 deletions(-)
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/tcg/sme_helper.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/tcg/sme_helper.c
-@@ -XXX,XX +XXX,XX @@ static RaspiProcessorId board_processor_id(uint32_t board_rev)
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
-     return proc_id;
+     }
  }
--static int board_version(uint32_t board_rev)
+-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
--{
++typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
--    return board_processor_id(board_rev) + 1;
++static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
--}
++                              uint8_t *pn, uint8_t *pm,
--
++                              uint32_t desc, IMOPFn32 *fn)
- static const char *board_soc_type(uint32_t board_rev)
++{
 +    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
 +    bool neg = simd_data(desc);
 -static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 -                            uint8_t *pn, uint8_t *pm,
 -                            uint32_t desc, IMOPFn *fn)
 +    for (row = 0; row < oprsz; ++row) {
 +        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
 +        uint32_t *za_row = &za[tile_vslice_index(row)];
 +        uint32_t n = zn[H4(row)];
 +
 +        for (col = 0; col < oprsz; ++col) {
 +            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
 +            uint32_t *a = &za_row[H4(col)];
 +
 +            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
 +        }
 +    }
 +}
 +
 +typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn64 *fn)
  {
-     return soc_property[board_processor_id(board_rev)].type;
+     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
-@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
+     bool neg = simd_data(desc);
-     cpu_set_pc(cs, info->smp_loader_start);
+@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
  }
--static void setup_boot(MachineState *machine, int version, size_t ram_size)
+ #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-+static void setup_boot(MachineState *machine, RaspiProcessorId processor_id,
+-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
-+                       size_t ram_size)
++static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
- {
+ {                                                                           \
-     RaspiMachineState *s = RASPI_MACHINE(machine);
+-    uint32_t sum0 = 0, sum1 = 0;                                            \
-     int r;
++    uint32_t sum = 0;                                                       \
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+     /* Apply P to N as a mask, making the inactive elements 0. */           \
-     s->binfo.ram_size = ram_size;
+     n &= expand_pred_b(p);                                                  \
-     s->binfo.nb_cpus = machine->smp.cpus;
+-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
+-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
--    if (version <= 2) {
+-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
--        /* The rpi1 and 2 require some custom setup code to run in Secure
+-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
--         * mode before booting a kernel (to set up the SMC vectors so
+-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
--         * that we get a no-op SMC; this is used by Linux to call the
+-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-+    if (processor_id <= PROCESSOR_ID_BCM2836) {
+-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-+        /*
+-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-+         * The BCM2835 and BCM2836 require some custom setup code to run
+-    if (neg) {                                                              \
-+         * in Secure mode before booting a kernel (to set up the SMC vectors
+-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-+         * so that we get a no-op SMC; this is used by Linux to call the
+-    } else {                                                                \
-          * firmware for some cache maintenance operations.
+-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
--         * The rpi3 doesn't need this.
+-    }                                                                       \
-+         * The BCM2837 doesn't need this.
+-    return ((uint64_t)sum1 << 32) | sum0;                                   \
-          */
++    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
-         s->binfo.board_setup_addr = BOARDSETUP_ADDR;
++    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
-         s->binfo.write_board_setup = write_board_setup;
++    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
++    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
-         s->binfo.secure_boot = true;
++    return neg ? a - sum : a + sum;                                         \
      }
 -    /* Pi2 and Pi3 requires SMP setup */
 -    if (version >= 2) {
 +    /* BCM2836 and BCM2837 requires SMP setup */
 +    if (processor_id >= PROCESSOR_ID_BCM2836) {
          s->binfo.smp_loader_start = SMPBOOT_ADDR;
 -        if (version == 2) {
 +        if (processor_id == PROCESSOR_ID_BCM2836) {
              s->binfo.write_secondary_boot = write_smpboot;
          } else {
              s->binfo.write_secondary_boot = write_smpboot64;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
      RaspiMachineClass *mc = RASPI_MACHINE_GET_CLASS(machine);
      RaspiMachineState *s = RASPI_MACHINE(machine);
      uint32_t board_rev = mc->board_rev;
 -    int version = board_version(board_rev);
      uint64_t ram_size = board_ram_size(board_rev);
      uint32_t vcram_size;
      DriveInfo *di;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
      vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
                                            &error_abort);
 -    setup_boot(machine, version, machine->ram_size - vcram_size);
 +    setup_boot(machine, board_processor_id(mc->board_rev),
 +               machine->ram_size - vcram_size);
  }
- static void raspi_machine_class_common_init(MachineClass *mc,
+ #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
  DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
  DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 -#define DEF_IMOPH(NAME) \
 -    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
 -                            void *vpm, uint32_t desc)                        \
 -    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
 +#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  # SME Tests
  ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
 -AARCH64_TESTS += sme-outprod1
 +AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
  endif
  # System Registers Tests
 --
-.20.1
+.34.1

-[PULL 09/18] hw/arm/bcm2835: Add more unimplemented peripherals
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
 was unfortunately added with a license of GPL-v3-or-later, which is
 not compatible with other QEMU code which has a GPL-v2-only license.
-The bcm2835-v3d is used since Linux 4.7, see commit
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-ac67e0c39c ("ARM: bcm2835: Add VC4 to the device tree"),
+to make it compatible with the rest of QEMU.
 and the bcm2835-txp since Linux 4.19, see commit
 b7dd29b401f5 ("ARM: dts: bcm283x: Add Transposer block").
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200921034729.432931-3-f4bug@amsat.org
+Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
 Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2835_peripherals.h | 2 ++
+ include/hw/rtc/sun4v-rtc.h | 2 +-
- hw/arm/bcm2835_peripherals.c         | 2 ++
+ hw/rtc/sun4v-rtc.c         | 2 +-
-files changed, 4 insertions(+)
+files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2835_peripherals.h
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/include/hw/arm/bcm2835_peripherals.h
++++ b/include/hw/rtc/sun4v-rtc.h
-@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
+@@ -XXX,XX +XXX,XX @@
+  *
-     BCM2835SystemTimerState systmr;
+  * Copyright (c) 2016 Artyom Tarasenko
-     BCM2835MphiState mphi;
+  *
-+    UnimplementedDeviceState txp;
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-     UnimplementedDeviceState armtmr;
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-     UnimplementedDeviceState cprman;
+  * version.
-     UnimplementedDeviceState a2w;
+  */
-@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
-     UnimplementedDeviceState otp;
+diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
      UnimplementedDeviceState dbus;
      UnimplementedDeviceState ave0;
 +    UnimplementedDeviceState v3d;
      UnimplementedDeviceState bscsl;
      UnimplementedDeviceState smi;
      DWC2State dwc2;
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2835_peripherals.c
+--- a/hw/rtc/sun4v-rtc.c
-+++ b/hw/arm/bcm2835_peripherals.c
++++ b/hw/rtc/sun4v-rtc.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
+  *
-                                INTERRUPT_USB));
+  * Copyright (c) 2016 Artyom Tarasenko
+  *
-+    create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-     create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
+  * version.
-     create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
+  */
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
      create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
      create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
      create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
 +    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x1000);
      create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
  }
 --
-.20.1
+.34.1

-[PULL 04/18] target/arm: Add ID register values for Cortex-M0
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
-Give the Cortex-M0 ID register values corresponding to its
+From: Thomas Huth <thuth@redhat.com>
 implemented behaviour.  These will not be guest-visible but will be
 used to govern the behaviour of QEMU's emulation.  We use the same
 values that the Cortex-M3 does.
+Move the code to a separate file so that we do not have to compile
+it anymore if CONFIG_ARM_V7M is not set.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240308141051.536599-2-thuth@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200910173855.4068-5-peter.maydell@linaro.org
 ---
- target/arm/cpu_tcg.c | 24 ++++++++++++++++++++++++
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
-file changed, 24 insertions(+)
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
  target/arm/meson.build     |   3 +
  target/arm/tcg/meson.build |   3 +
 files changed, 296 insertions(+), 261 deletions(-)
  create mode 100644 target/arm/tcg/cpu-v7m.c
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/target/arm/cpu_tcg.c
+index XXXXXXX..XXXXXXX
-+++ b/target/arm/cpu_tcg.c
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ static void cortex_m0_initfn(Object *obj)
++++ b/target/arm/tcg/cpu-v7m.c
-     set_feature(&cpu->env, ARM_FEATURE_M);
+@@ -XXX,XX +XXX,XX @@
++/*
-     cpu->midr = 0x410cc200;
++ * QEMU ARMv7-M TCG-only CPUs.
 + *
 + * Copyright (c) 2012 SUSE LINUX Products GmbH
 + *
 + * This code is licensed under the GNU GPL v2 or later.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
 +#include "internals.h"
 +
 +#if !defined(CONFIG_USER_ONLY)
 +
 +#include "hw/intc/armv7m_nvic.h"
 +
 +static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cs);
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    bool ret = false;
 +
 +    /*
 +     * ARMv7-M interrupt masking works differently than -A or -R.
 +     * There is no FIQ/IRQ distinction. Instead of I and F bits
 +     * masking FIQ and IRQ interrupts, an exception is taken only
 +     * if it is higher priority than the current execution priority
 +     * (which depends on state like BASEPRI, FAULTMASK and the
 +     * currently active exception).
 +     */
 +    if (interrupt_request & CPU_INTERRUPT_HARD
 +        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 +        cs->exception_index = EXCP_IRQ;
 +        cc->tcg_ops->do_interrupt(cs);
 +        ret = true;
 +    }
 +    return ret;
 +}
 +
 +#endif /* !CONFIG_USER_ONLY */
 +
 +static void cortex_m0_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V6);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +
 +    cpu->midr = 0x410cc200;
 +
 +    /*
 +     * These ID register values are not guest visible, because
 +     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 ...
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m3_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    cpu->midr = 0x410fc231;
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00000030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x00000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01141110;
++    cpu->isar.id_isar1 = 0x02111000;
++    cpu->isar.id_isar2 = 0x21112231;
++    cpu->isar.id_isar3 = 0x01111110;
++    cpu->isar.id_isar4 = 0x01310102;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m4_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fc240; /* r0p0 */
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.mvfr0 = 0x10110021;
++    cpu->isar.mvfr1 = 0x11000011;
++    cpu->isar.mvfr2 = 0x00000000;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00000030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x00000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01141110;
++    cpu->isar.id_isar1 = 0x02111000;
++    cpu->isar.id_isar2 = 0x21112231;
++    cpu->isar.id_isar3 = 0x01111110;
++    cpu->isar.id_isar4 = 0x01310102;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m7_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V7);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x411fc272; /* r1p2 */
++    cpu->pmsav7_dregion = 8;
++    cpu->isar.mvfr0 = 0x10110221;
++    cpu->isar.mvfr1 = 0x12000011;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000200;
++    cpu->isar.id_dfr0 = 0x00100000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00100030;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01101110;
++    cpu->isar.id_isar1 = 0x02112000;
++    cpu->isar.id_isar2 = 0x20232231;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++}
++
++static void cortex_m33_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V8);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fd213; /* r0p3 */
++    cpu->pmsav7_dregion = 16;
++    cpu->sau_sregion = 8;
++    cpu->isar.mvfr0 = 0x10110021;
++    cpu->isar.mvfr1 = 0x11000011;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x00000030;
++    cpu->isar.id_pfr1 = 0x00000210;
++    cpu->isar.id_dfr0 = 0x00200000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00101F40;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000000;
++    cpu->isar.id_isar0 = 0x01101110;
++    cpu->isar.id_isar1 = 0x02212000;
++    cpu->isar.id_isar2 = 0x20232232;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++    cpu->clidr = 0x00000000;
++    cpu->ctr = 0x8000c000;
++}
++
++static void cortex_m55_initfn(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++
++    set_feature(&cpu->env, ARM_FEATURE_V8);
++    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
++    set_feature(&cpu->env, ARM_FEATURE_M);
++    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
++    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
++    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
++    cpu->midr = 0x410fd221; /* r0p1 */
++    cpu->revidr = 0;
++    cpu->pmsav7_dregion = 16;
++    cpu->sau_sregion = 8;
++    /* These are the MVFR* values for the FPU + full MVE configuration */
++    cpu->isar.mvfr0 = 0x10110221;
++    cpu->isar.mvfr1 = 0x12100211;
++    cpu->isar.mvfr2 = 0x00000040;
++    cpu->isar.id_pfr0 = 0x20000030;
++    cpu->isar.id_pfr1 = 0x00000230;
++    cpu->isar.id_dfr0 = 0x10200000;
++    cpu->id_afr0 = 0x00000000;
++    cpu->isar.id_mmfr0 = 0x00111040;
++    cpu->isar.id_mmfr1 = 0x00000000;
++    cpu->isar.id_mmfr2 = 0x01000000;
++    cpu->isar.id_mmfr3 = 0x00000011;
++    cpu->isar.id_isar0 = 0x01103110;
++    cpu->isar.id_isar1 = 0x02212000;
++    cpu->isar.id_isar2 = 0x20232232;
++    cpu->isar.id_isar3 = 0x01111131;
++    cpu->isar.id_isar4 = 0x01310132;
++    cpu->isar.id_isar5 = 0x00000000;
++    cpu->isar.id_isar6 = 0x00000000;
++    cpu->clidr = 0x00000000; /* caches not implemented */
++    cpu->ctr = 0x8303c003;
++}
++
++static const TCGCPUOps arm_v7m_tcg_ops = {
++    .initialize = arm_translate_init,
++    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
++    .debug_excp_handler = arm_debug_excp_handler,
++    .restore_state_to_opc = arm_restore_state_to_opc,
++
++#ifdef CONFIG_USER_ONLY
++    .record_sigsegv = arm_cpu_record_sigsegv,
++    .record_sigbus = arm_cpu_record_sigbus,
++#else
++    .tlb_fill = arm_cpu_tlb_fill,
++    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
++    .do_interrupt = arm_v7m_cpu_do_interrupt,
++    .do_transaction_failed = arm_cpu_do_transaction_failed,
++    .do_unaligned_access = arm_cpu_do_unaligned_access,
++    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
++    .debug_check_watchpoint = arm_debug_check_watchpoint,
++    .debug_check_breakpoint = arm_debug_check_breakpoint,
++#endif /* !CONFIG_USER_ONLY */
++};
++
++static void arm_v7m_class_init(ObjectClass *oc, void *data)
++{
++    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
++    CPUClass *cc = CPU_CLASS(oc);
++
++    acc->info = data;
++    cc->tcg_ops = &arm_v7m_tcg_ops;
++    cc->gdb_core_xml_file = "arm-m-profile.xml";
++}
++
++static const ARMCPUInfo arm_v7m_cpus[] = {
++    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
++                             .class_init = arm_v7m_class_init },
++    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
++                             .class_init = arm_v7m_class_init },
++};
++
++static void arm_v7m_cpu_register_types(void)
++{
++    size_t i;
++
++    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
++        arm_cpu_register(&arm_v7m_cpus[i]);
++    }
++}
++
++type_init(arm_v7m_cpu_register_types)
+diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/cpu32.c
++++ b/target/arm/tcg/cpu32.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #endif
+ #include "cpregs.h"
+-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+-#include "hw/intc/armv7m_nvic.h"
+-#endif
+ /* Share AArch32 -cpu max features with AArch64. */
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
+ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
+-#if !defined(CONFIG_USER_ONLY)
+-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+-{
+-    CPUClass *cc = CPU_GET_CLASS(cs);
+-    ARMCPU *cpu = ARM_CPU(cs);
+-    CPUARMState *env = &cpu->env;
+-    bool ret = false;
+-
+-    /*
+-     * ARMv7-M interrupt masking works differently than -A or -R.
+-     * There is no FIQ/IRQ distinction. Instead of I and F bits
+-     * masking FIQ and IRQ interrupts, an exception is taken only
+-     * if it is higher priority than the current execution priority
+-     * (which depends on state like BASEPRI, FAULTMASK and the
+-     * currently active exception).
+-     */
+-    if (interrupt_request & CPU_INTERRUPT_HARD
+-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+-        cs->exception_index = EXCP_IRQ;
+-        cc->tcg_ops->do_interrupt(cs);
+-        ret = true;
+-    }
+-    return ret;
+-}
+-#endif /* !CONFIG_USER_ONLY */
+-
+ static void arm926_initfn(Object *obj)
+ {
+     ARMCPU *cpu = ARM_CPU(obj);
+@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
+     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
- static void cortex_m3_initfn(Object *obj)
+-static void cortex_m0_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_V6);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -
 -    cpu->midr = 0x410cc200;
 -
 -    /*
 -     * These ID register values are not guest visible, because
 -     * we do not implement the Main Extension. They must be set
 -     * to values corresponding to the Cortex-M0's implemented
 -     * features, because QEMU generally controls its emulation
 -     * by looking at ID register fields. We use the same values as
 -     * for the M3.
 -     */
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m3_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    cpu->midr = 0x410fc231;
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m4_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fc240; /* r0p0 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000000;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m7_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x411fc272; /* r1p2 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00100030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02112000;
 -    cpu->isar.id_isar2 = 0x20232231;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m33_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd213; /* r0p3 */
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000210;
 -    cpu->isar.id_dfr0 = 0x00200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00101F40;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000;
 -    cpu->ctr = 0x8000c000;
 -}
 -
 -static void cortex_m55_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd221; /* r0p1 */
 -    cpu->revidr = 0;
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    /* These are the MVFR* values for the FPU + full MVE configuration */
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12100211;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x20000030;
 -    cpu->isar.id_pfr1 = 0x00000230;
 -    cpu->isar.id_dfr0 = 0x10200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00111040;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000011;
 -    cpu->isar.id_isar0 = 0x01103110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000; /* caches not implemented */
 -    cpu->ctr = 0x8303c003;
 -}
 -
  static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
      /* Dummy the TCM region regs for the moment */
      { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
 -static const TCGCPUOps arm_v7m_tcg_ops = {
 -    .initialize = arm_translate_init,
 -    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 -    .debug_excp_handler = arm_debug_excp_handler,
 -    .restore_state_to_opc = arm_restore_state_to_opc,
 -
 -#ifdef CONFIG_USER_ONLY
 -    .record_sigsegv = arm_cpu_record_sigsegv,
 -    .record_sigbus = arm_cpu_record_sigbus,
 -#else
 -    .tlb_fill = arm_cpu_tlb_fill,
 -    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 -    .do_interrupt = arm_v7m_cpu_do_interrupt,
 -    .do_transaction_failed = arm_cpu_do_transaction_failed,
 -    .do_unaligned_access = arm_cpu_do_unaligned_access,
 -    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 -    .debug_check_watchpoint = arm_debug_check_watchpoint,
 -    .debug_check_breakpoint = arm_debug_check_breakpoint,
 -#endif /* !CONFIG_USER_ONLY */
 -};
 -
 -static void arm_v7m_class_init(ObjectClass *oc, void *data)
 -{
 -    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 -    CPUClass *cc = CPU_CLASS(oc);
 -
 -    acc->info = data;
 -    cc->tcg_ops = &arm_v7m_tcg_ops;
 -    cc->gdb_core_xml_file = "arm-m-profile.xml";
 -}
 -
  #ifndef TARGET_AARCH64
  /*
   * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
      { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
      { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
      { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 -    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 -                             .class_init = arm_v7m_class_init },
      { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
      { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
      { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
    'ptw.c',
  ))
 +arm_user_ss = ss.source_set()
 +
  subdir('hvf')
  if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
  target_arch += {'arm': arm_ss}
  target_system_arch += {'arm': arm_system_ss}
 +target_user_arch += {'arm': arm_user_ss}
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
  arm_system_ss.add(files(
    'psci.c',
  ))
 +
 +arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 --
-.20.1
+.34.1

-[PULL 06/18] target/arm: Fix sve ldr/str
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The mte update missed a bit when producing clean addresses.
-Fixes: b2aa8879b88
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200916014102.2446323-1-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-sve.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
-         for (i = 0; i < len_align; i += 8) {
-             tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEQ);
-             tcg_gen_st_i64(t0, cpu_env, vofs + i);
--            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
-+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
-         }
-         tcg_temp_free_i64(t0);
-     } else {
-@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
-         for (i = 0; i < len_align; i += 8) {
-             tcg_gen_ld_i64(t0, cpu_env, vofs + i);
-             tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEQ);
--            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
-+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
-         }
-         tcg_temp_free_i64(t0);
-     } else {
---
-.20.1

-[PULL 08/18] hw/arm/raspi: Define various blocks base addresses
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The Raspberry firmware is closed-source. While running it, it
-accesses various I/O registers. Logging these accesses as UNIMP
-(unimplemented) help to understand what the firmware is doing
-(ideally we want it able to boot a Linux kernel).
-Document various blocks we might use later.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20200921034729.432931-2-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/raspi_platform.h | 51 +++++++++++++++++++++++++++------
-file changed, 43 insertions(+), 8 deletions(-)
-diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/raspi_platform.h
-+++ b/include/hw/arm/raspi_platform.h
-@@ -XXX,XX +XXX,XX @@
-  * You should have received a copy of the GNU General Public License
-  * along with this program; if not, write to the Free Software
-  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-+ *
-+ * Various undocumented addresses and names come from Herman Hermitage's VC4
-+ * documentation:
-+ * https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
-  */
- #ifndef HW_ARM_RASPI_PLATFORM_H
- #define HW_ARM_RASPI_PLATFORM_H
- #define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
--#define IC0_OFFSET              0x2000
-+#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
-+#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
- #define ST_OFFSET               0x3000   /* System Timer */
-+#define TXP_OFFSET              0x4000   /* Transposer */
-+#define JPEG_OFFSET             0x5000
- #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
- #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
--#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
-+#define ARBA_OFFSET             0x9000
-+#define BRDG_OFFSET             0xa000
-+#define ARM_OFFSET              0xB000   /* ARM control block */
- #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
- #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
--#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
-+#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
- #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
-                                                       * Doorbells & Mailboxes */
- #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
-@@ -XXX,XX +XXX,XX @@
- #define AVS_OFFSET              0x103000 /* Audio Video Standard */
- #define RNG_OFFSET              0x104000
- #define GPIO_OFFSET             0x200000
--#define UART0_OFFSET            0x201000
--#define MMCI0_OFFSET            0x202000
--#define I2S_OFFSET              0x203000
--#define SPI0_OFFSET             0x204000
-+#define UART0_OFFSET            0x201000 /* PL011 */
-+#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
-+#define I2S_OFFSET              0x203000 /* PCM */
-+#define SPI0_OFFSET             0x204000 /* SPI master */
- #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
-+#define PIXV0_OFFSET            0x206000
-+#define PIXV1_OFFSET            0x207000
-+#define DPI_OFFSET              0x208000
-+#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
-+#define PWM_OFFSET              0x20c000
-+#define PERM_OFFSET             0x20d000
-+#define TEC_OFFSET              0x20e000
- #define OTP_OFFSET              0x20f000
-+#define SLIM_OFFSET             0x210000 /* SLIMbus */
-+#define CPG_OFFSET              0x211000
- #define THERMAL_OFFSET          0x212000
--#define BSC_SL_OFFSET           0x214000 /* SPI slave */
-+#define AVSP_OFFSET             0x213000
-+#define BSC_SL_OFFSET           0x214000 /* SPI slave (bootrom) */
- #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
- #define EMMC1_OFFSET            0x300000
-+#define EMMC2_OFFSET            0x340000
-+#define HVS_OFFSET              0x400000
- #define SMI_OFFSET              0x600000
-+#define DSI1_OFFSET             0x700000
-+#define UCAM_OFFSET             0x800000
-+#define CMI_OFFSET              0x802000
- #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
- #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
-+#define VECA_OFFSET             0x806000
-+#define PIXV2_OFFSET            0x807000
-+#define HDMI_OFFSET             0x808000
-+#define HDCP_OFFSET             0x809000
-+#define ARBR0_OFFSET            0x80a000
- #define DBUS_OFFSET             0x900000
- #define AVE0_OFFSET             0x910000
- #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
-+#define V3D_OFFSET              0xc00000
- #define SDRAMC_OFFSET           0xe00000
-+#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
-+#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
-+#define ARBR1_OFFSET            0xe04000
- #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
-+#define DCRC_OFFSET             0xe07000
-+#define AXIP_OFFSET             0xe08000
- /* GPU interrupts */
- #define INTERRUPT_TIMER0               0
---
-.20.1

-[PULL 10/18] hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Commit 1c3db49d39 added the raspi3, which uses the same peripherals
-than the raspi2 (but with different ARM cores). The raspi3 was
-introduced without the ignore_memory_transaction_failures flag.
-Almost 2 years later, the machine is usable running U-Boot and
-Linux.
-In commit 00cbd5bd74 we mapped a lot of unimplemented devices,
-commit d442d95f added thermal block and commit 0e5bbd7406 the
-system timer.
-As we are happy with the raspi3, let's remove this flag on the
-raspi2.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200921034729.432931-4-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/raspi.c | 3 ---
-file changed, 3 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
-+++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
-     mc->default_cpus = mc->min_cpus = mc->max_cpus = cores_count(board_rev);
-     mc->default_ram_size = board_ram_size(board_rev);
-     mc->default_ram_id = "ram";
--    if (board_version(board_rev) == 2) {
--        mc->ignore_memory_transaction_failures = true;
--    }
- };
- static const TypeInfo raspi_machine_types[] = {
---
-.20.1

-[PULL 11/18] hw/arm/raspi: Display the board revision in the machine description
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Display the board revision in the machine description.
-Before:
-  $ qemu-system-aarch64 -M help | fgrep raspi
-  raspi2               Raspberry Pi 2B
-  raspi3               Raspberry Pi 3B
-After:
-  raspi2               Raspberry Pi 2B (revision 1.1)
-  raspi3               Raspberry Pi 3B (revision 1.2)
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200924111808.77168-2-f4bug@amsat.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/raspi.c | 4 +++-
-file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
-+++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
-     uint32_t board_rev = (uint32_t)(uintptr_t)data;
-     rmc->board_rev = board_rev;
--    mc->desc = g_strdup_printf("Raspberry Pi %s", board_type(board_rev));
-+    mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
-+                               board_type(board_rev),
-+                               FIELD_EX32(board_rev, REV_CODE, REVISION));
-     mc->init = raspi_machine_init;
-     mc->block_default_type = IF_SD;
-     mc->no_parallel = 1;
---
-.20.1

Nothing very exciting this time around...

-- PMM

The following changes since commit 37a712a0f969ca2df7f01182409a6c4825cebfb5:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2020-10-01 12:23:19 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201001

for you to fetch changes up to cdfaa57dcb53ba012439765a1462247dfda8595d:

hw/arm/raspi: Remove use of the 'version' value in the board code (2020-10-01 15:31:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * Make isar_feature_aa32_fp16_arith() handle M-profile
 * Fix SVE splice
 * Fix SVE LDR/STR
 * Remove ignore_memory_transaction_failures on the raspi2
 * raspi: Various cleanup/refactoring

----------------------------------------------------------------
Peter Maydell (5):
      target/arm: Replace ARM_FEATURE_PXN with ID_MMFR0.VMSA check
      target/arm: Move id_pfr0, id_pfr1 into ARMISARegisters
      hw/intc/armv7m_nvic: Only show ID register values for Main Extension CPUs
      target/arm: Add ID register values for Cortex-M0
      target/arm: Make isar_feature_aa32_fp16_arith() handle M-profile

Philippe Mathieu-Daudé (11):
      hw/arm/raspi: Define various blocks base addresses
      hw/arm/bcm2835: Add more unimplemented peripherals
      hw/arm/raspi: Remove ignore_memory_transaction_failures on the raspi2
      hw/arm/raspi: Display the board revision in the machine description
      hw/arm/raspi: Load the firmware on the first core
      hw/arm/raspi: Move arm_boot_info structure to RaspiMachineState
      hw/arm/raspi: Avoid using TypeInfo::class_data pointer
      hw/arm/raspi: Use more specific machine names
      hw/arm/raspi: Introduce RaspiProcessorId enum
      hw/arm/raspi: Use RaspiProcessorId to set the firmware load address
      hw/arm/raspi: Remove use of the 'version' value in the board code

Richard Henderson (2):
      target/arm: Fix sve ldr/str
      target/arm: Fix SVE splice

The ARM_FEATURE_PXN bit indicates whether the CPU supports the PXN
bit in short-descriptor translation table format descriptors.  This
is indicated by ID_MMFR0.VMSA being at least 0b0100.  Replace the
feature bit with an ID register check, in line with our preference
for ID register checks over feature bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-2-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 15 ++++++++++++++-
 target/arm/cpu.c    |  1 -
 target/arm/helper.c |  5 +++--
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, FHM, 8, 4)
 FIELD(ID_ISAR6, SB, 12, 4)
 FIELD(ID_ISAR6, SPECRES, 16, 4)
 
+FIELD(ID_MMFR0, VMSA, 0, 4)
+FIELD(ID_MMFR0, PMSA, 4, 4)
+FIELD(ID_MMFR0, OUTERSHR, 8, 4)
+FIELD(ID_MMFR0, SHARELVL, 12, 4)
+FIELD(ID_MMFR0, TCM, 16, 4)
+FIELD(ID_MMFR0, AUXREG, 20, 4)
+FIELD(ID_MMFR0, FCSE, 24, 4)
+FIELD(ID_MMFR0, INNERSHR, 28, 4)
+
 FIELD(ID_MMFR3, CMAINTVA, 0, 4)
 FIELD(ID_MMFR3, CMAINTSW, 4, 4)
 FIELD(ID_MMFR3, BPMAINT, 8, 4)
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_CACHE_DIRTY_REG, /* 1136/1176 cache dirty status register */
     ARM_FEATURE_CACHE_BLOCK_OPS, /* v6 optional cache block operations */
     ARM_FEATURE_MPIDR, /* has cp15 MPIDR */
-    ARM_FEATURE_PXN, /* has Privileged Execute Never bit */
     ARM_FEATURE_LPAE, /* has Large Physical Address Extension */
     ARM_FEATURE_V8,
     ARM_FEATURE_AARCH64, /* supports 64 bit mode */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 4;
 }
 
+static inline bool isar_feature_aa32_pxn(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_mmfr0, ID_MMFR0, VMSA) >= 4;
+}
+
 static inline bool isar_feature_aa32_pan(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->id_mmfr3, ID_MMFR3, PAN) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
-        set_feature(env, ARM_FEATURE_PXN);
     }
     if (arm_feature(env, ARM_FEATURE_CBAR_RO)) {
         set_feature(env, ARM_FEATURE_CBAR);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
                              target_ulong *page_size, ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    ARMCPU *cpu = env_archcpu(env);
     int level = 1;
     uint32_t table;
     uint32_t desc;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         goto do_fault;
     }
     type = (desc & 3);
-    if (type == 0 || (type == 3 && !arm_feature(env, ARM_FEATURE_PXN))) {
+    if (type == 0 || (type == 3 && !cpu_isar_feature(aa32_pxn, cpu))) {
         /* Section translation fault, or attempt to use the encoding
          * which is Reserved on implementations without PXN.
          */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address,
         pxn = desc & 1;
         ns = extract32(desc, 19, 1);
     } else {
-        if (arm_feature(env, ARM_FEATURE_PXN)) {
+        if (cpu_isar_feature(aa32_pxn, cpu)) {
             pxn = (desc >> 2) & 1;
         }
         ns = extract32(desc, 3, 1);
-- 
2.20.1

Move the id_pfr0 and id_pfr1 fields into the ARMISARegisters
sub-struct. We're going to want id_pfr1 for an isar_features
check, and moving both at the same time avoids an odd
inconsistency.

Changes other than the ones to cpu.h and kvm64.c made
automatically with:
  perl -p -i -e 's/cpu->id_pfr/cpu->isar.id_pfr/' target/arm/*.c hw/intc/armv7m_nvic.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-3-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  4 ++--
 hw/intc/armv7m_nvic.c |  4 ++--
 target/arm/cpu.c      | 20 ++++++++++----------
 target/arm/cpu64.c    | 12 ++++++------
 target/arm/cpu_tcg.c  | 36 ++++++++++++++++++------------------
 target/arm/helper.c   |  4 ++--
 target/arm/kvm64.c    |  4 ++++
 7 files changed, 44 insertions(+), 40 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint32_t id_mmfr2;
         uint32_t id_mmfr3;
         uint32_t id_mmfr4;
+        uint32_t id_pfr0;
+        uint32_t id_pfr1;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     uint32_t reset_fpsid;
     uint32_t ctr;
     uint32_t reset_sctlr;
-    uint32_t id_pfr0;
-    uint32_t id_pfr1;
     uint64_t pmceid0;
     uint64_t pmceid1;
     uint32_t id_afr0;
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                       "Aux Fault status registers unimplemented\n");
         return 0;
     case 0xd40: /* PFR0.  */
-        return cpu->id_pfr0;
+        return cpu->isar.id_pfr0;
     case 0xd44: /* PFR1.  */
-        return cpu->id_pfr1;
+        return cpu->isar.id_pfr1;
     case 0xd48: /* DFR0.  */
         return cpu->isar.id_dfr0;
     case 0xd4c: /* AFR0.  */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         /* Disable the security extension feature bits in the processor feature
          * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
          */
-        cpu->id_pfr1 &= ~0xf0;
+        cpu->isar.id_pfr1 &= ~0xf0;
         cpu->isar.id_aa64pfr0 &= ~0xf000;
     }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          * id_aa64pfr0_el1[11:8].
          */
         cpu->isar.id_aa64pfr0 &= ~0xf00;
-        cpu->id_pfr1 &= ~0xf000;
+        cpu->isar.id_pfr1 &= ~0xf000;
     }
 
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00011111;
     cpu->ctr = 0x82048004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x1031;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x1031;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x400;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x31100003;
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x01111111;
     cpu->ctr = 0x80038003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x1031;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x1031;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x000;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x00100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x84448003;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x00001131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00001131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x11111111;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50078;
-    cpu->id_pfr0 = 0x00001131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00001131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x02010555;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x84448004; /* L1Ip = VIPT */
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10101105;
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
     cpu->ctr = 0x8444c004;
     cpu->reset_sctlr = 0x00c50838;
-    cpu->id_pfr0 = 0x00000131;
-    cpu->id_pfr1 = 0x00011011;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
     cpu->isar.id_dfr0 = 0x03010066;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x10201105;
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0x2;
     cpu->id_afr0 = 0x3;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1dd20d2;
     cpu->reset_sctlr = 0x00050078;
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x11;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x11;
     cpu->isar.id_dfr0 = 0x33;
     cpu->id_afr0 = 0;
     cpu->isar.id_mmfr0 = 0x01130003;
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x11111111;
     cpu->isar.mvfr1 = 0x00000000;
     cpu->ctr = 0x1d192992; /* 32K icache 32K dcache */
-    cpu->id_pfr0 = 0x111;
-    cpu->id_pfr1 = 0x1;
+    cpu->isar.id_pfr0 = 0x111;
+    cpu->isar.id_pfr1 = 0x1;
     cpu->isar.id_dfr0 = 0;
     cpu->id_afr0 = 0x2;
     cpu->isar.id_mmfr0 = 0x01100103;
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     cpu->midr = 0x410fc231;
     cpu->pmsav7_dregion = 8;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000000;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00000030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x12000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000200;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
     cpu->isar.id_dfr0 = 0x00100000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00100030;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
     cpu->isar.mvfr0 = 0x10110021;
     cpu->isar.mvfr1 = 0x11000011;
     cpu->isar.mvfr2 = 0x00000040;
-    cpu->id_pfr0 = 0x00000030;
-    cpu->id_pfr1 = 0x00000210;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
     cpu->isar.id_dfr0 = 0x00200000;
     cpu->id_afr0 = 0x00000000;
     cpu->isar.id_mmfr0 = 0x00101F40;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_PMSA);
     set_feature(&cpu->env, ARM_FEATURE_PMU);
     cpu->midr = 0x411fc153; /* r1p3 */
-    cpu->id_pfr0 = 0x0131;
-    cpu->id_pfr1 = 0x001;
+    cpu->isar.id_pfr0 = 0x0131;
+    cpu->isar.id_pfr1 = 0x001;
     cpu->isar.id_dfr0 = 0x010400;
     cpu->id_afr0 = 0x0;
     cpu->isar.id_mmfr0 = 0x0210030;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
 static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint64_t pfr1 = cpu->id_pfr1;
+    uint64_t pfr1 = cpu->isar.id_pfr1;
 
     if (env->gicv3state) {
         pfr1 |= 1 << 28;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa32_tid3,
-              .resetvalue = cpu->id_pfr0 },
+              .resetvalue = cpu->isar.id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
              */
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          * than skipping the reads and leaving 0, as we must avoid
          * considering the values in every case.
          */
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr0,
+                              ARM64_SYS_REG(3, 0, 0, 1, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
+                              ARM64_SYS_REG(3, 0, 0, 1, 1));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 2));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
-- 
2.20.1

M-profile CPUs only implement the ID registers as guest-visible if
the CPU implements the Main Extension (all our current CPUs except
the Cortex-M0 do).

Currently we handle this by having the Cortex-M0 leave the ID
register values in the ARMCPU struct as zero, but this conflicts with
our design decision to make QEMU behaviour be keyed off ID register
fields wherever possible.

Explicitly code the ID registers in the NVIC to return 0 if the Main
Extension is not implemented, so we can make the M0 model set the
ARMCPU struct fields to obtain the correct behaviour without those
values becoming guest-visible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-4-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                       "Aux Fault status registers unimplemented\n");
         return 0;
     case 0xd40: /* PFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_pfr0;
     case 0xd44: /* PFR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_pfr1;
     case 0xd48: /* DFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_dfr0;
     case 0xd4c: /* AFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->id_afr0;
     case 0xd50: /* MMFR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr0;
     case 0xd54: /* MMFR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr1;
     case 0xd58: /* MMFR2.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr2;
     case 0xd5c: /* MMFR3.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_mmfr3;
     case 0xd60: /* ISAR0.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar0;
     case 0xd64: /* ISAR1.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar1;
     case 0xd68: /* ISAR2.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar2;
     case 0xd6c: /* ISAR3.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar3;
     case 0xd70: /* ISAR4.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar4;
     case 0xd74: /* ISAR5.  */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+            goto bad_offset;
+        }
         return cpu->isar.id_isar5;
     case 0xd78: /* CLIDR */
         return cpu->clidr;
-- 
2.20.1

Give the Cortex-M0 ID register values corresponding to its
implemented behaviour.  These will not be guest-visible but will be
used to govern the behaviour of QEMU's emulation.  We use the same
values that the Cortex-M3 does.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-5-peter.maydell@linaro.org
---
 target/arm/cpu_tcg.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void cortex_m0_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
 
     cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
 }
 
 static void cortex_m3_initfn(Object *obj)
-- 
2.20.1

The M-profile definition of the MVFR1 ID register differs slightly
from the A-profile one, and in particular the check for "does the CPU
support fp16 arithmetic" is not the same.

We don't currently implement any M-profile CPUs with fp16 arithmetic,
so this is not yet a visible bug, but correcting the logic now
disarms this beartrap for when we eventually do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200910173855.4068-6-peter.maydell@linaro.org
---
 target/arm/cpu.h | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
 FIELD(ID_MMFR4, CCIDX, 24, 4)
 FIELD(ID_MMFR4, EVT, 28, 4)
 
+FIELD(ID_PFR1, PROGMOD, 0, 4)
+FIELD(ID_PFR1, SECURITY, 4, 4)
+FIELD(ID_PFR1, MPROGMOD, 8, 4)
+FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
+FIELD(ID_PFR1, GENTIMER, 16, 4)
+FIELD(ID_PFR1, SEC_FRAC, 20, 4)
+FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
+FIELD(ID_PFR1, GIC, 28, 4)
+
 FIELD(ID_AA64ISAR0, AES, 4, 4)
 FIELD(ID_AA64ISAR0, SHA1, 8, 4)
 FIELD(ID_AA64ISAR0, SHA2, 12, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(MVFR0, FPROUND, 28, 4)
 
 FIELD(MVFR1, FPFTZ, 0, 4)
 FIELD(MVFR1, FPDNAN, 4, 4)
-FIELD(MVFR1, SIMDLS, 8, 4)
-FIELD(MVFR1, SIMDINT, 12, 4)
-FIELD(MVFR1, SIMDSP, 16, 4)
-FIELD(MVFR1, SIMDHP, 20, 4)
+FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
+FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
+FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
+FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
+FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
+FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
 FIELD(MVFR1, FPHP, 24, 4)
 FIELD(MVFR1, SIMDFMAC, 28, 4)
 
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
     return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
 }
 
+static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+}
+
 static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+    /* Sadly this is encoded differently for A-profile and M-profile */
+    if (isar_feature_aa32_mprofile(id)) {
+        return FIELD_EX32(id->mvfr1, MVFR1, FP16) > 0;
+    } else {
+        return FIELD_EX32(id->mvfr1, MVFR1, FPHP) >= 3;
+    }
 }
 
 static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mte update missed a bit when producing clean addresses.

Fixes: b2aa8879b88
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200916014102.2446323-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_ldr(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         for (i = 0; i < len_align; i += 8) {
             tcg_gen_qemu_ld_i64(t0, clean_addr, midx, MO_LEQ);
             tcg_gen_st_i64(t0, cpu_env, vofs + i);
-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
         }
         tcg_temp_free_i64(t0);
     } else {
@@ -XXX,XX +XXX,XX @@ static void do_str(DisasContext *s, uint32_t vofs, int len, int rn, int imm)
         for (i = 0; i < len_align; i += 8) {
             tcg_gen_ld_i64(t0, cpu_env, vofs + i);
             tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEQ);
-            tcg_gen_addi_i64(clean_addr, cpu_reg_sp(s, rn), 8);
+            tcg_gen_addi_i64(clean_addr, clean_addr, 8);
         }
         tcg_temp_free_i64(t0);
     } else {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

While converting to gen_gvec_ool_zzzp, we lost passing
a->esz as the data argument to the function.

Fixes: 36cbb7a8e71
Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200918000500.2690937-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_SPLICE(DisasContext *s, arg_rprr_esz *a)
 {
     if (sve_access_check(s)) {
         gen_gvec_ool_zzzp(s, gen_helper_sve_splice,
-                          a->rd, a->rn, a->rm, a->pg, 0);
+                          a->rd, a->rn, a->rm, a->pg, a->esz);
     }
     return true;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The Raspberry firmware is closed-source. While running it, it
accesses various I/O registers. Logging these accesses as UNIMP
(unimplemented) help to understand what the firmware is doing
(ideally we want it able to boot a Linux kernel).

Document various blocks we might use later.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200921034729.432931-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/raspi_platform.h | 51 +++++++++++++++++++++++++++------
 1 file changed, 43 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -XXX,XX +XXX,XX @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Various undocumented addresses and names come from Herman Hermitage's VC4
+ * documentation:
+ * https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
  */
 
 #ifndef HW_ARM_RASPI_PLATFORM_H
 #define HW_ARM_RASPI_PLATFORM_H
 
 #define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
-#define IC0_OFFSET              0x2000
+#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
+#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
 #define ST_OFFSET               0x3000   /* System Timer */
+#define TXP_OFFSET              0x4000   /* Transposer */
+#define JPEG_OFFSET             0x5000
 #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
 #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
-#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
+#define ARBA_OFFSET             0x9000
+#define BRDG_OFFSET             0xa000
+#define ARM_OFFSET              0xB000   /* ARM control block */
 #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
 #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
-#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
+#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
 #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
                                                       * Doorbells & Mailboxes */
 #define CPRMAN_OFFSET           0x100000 /* Power Management, Watchdog */
@@ -XXX,XX +XXX,XX @@
 #define AVS_OFFSET              0x103000 /* Audio Video Standard */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
-#define UART0_OFFSET            0x201000
-#define MMCI0_OFFSET            0x202000
-#define I2S_OFFSET              0x203000
-#define SPI0_OFFSET             0x204000
+#define UART0_OFFSET            0x201000 /* PL011 */
+#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
+#define I2S_OFFSET              0x203000 /* PCM */
+#define SPI0_OFFSET             0x204000 /* SPI master */
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define PIXV0_OFFSET            0x206000
+#define PIXV1_OFFSET            0x207000
+#define DPI_OFFSET              0x208000
+#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
+#define PWM_OFFSET              0x20c000
+#define PERM_OFFSET             0x20d000
+#define TEC_OFFSET              0x20e000
 #define OTP_OFFSET              0x20f000
+#define SLIM_OFFSET             0x210000 /* SLIMbus */
+#define CPG_OFFSET              0x211000
 #define THERMAL_OFFSET          0x212000
-#define BSC_SL_OFFSET           0x214000 /* SPI slave */
+#define AVSP_OFFSET             0x213000
+#define BSC_SL_OFFSET           0x214000 /* SPI slave (bootrom) */
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
+#define EMMC2_OFFSET            0x340000
+#define HVS_OFFSET              0x400000
 #define SMI_OFFSET              0x600000
+#define DSI1_OFFSET             0x700000
+#define UCAM_OFFSET             0x800000
+#define CMI_OFFSET              0x802000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
 #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
+#define VECA_OFFSET             0x806000
+#define PIXV2_OFFSET            0x807000
+#define HDMI_OFFSET             0x808000
+#define HDCP_OFFSET             0x809000
+#define ARBR0_OFFSET            0x80a000
 #define DBUS_OFFSET             0x900000
 #define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define V3D_OFFSET              0xc00000
 #define SDRAMC_OFFSET           0xe00000
+#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
+#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
+#define ARBR1_OFFSET            0xe04000
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
+#define DCRC_OFFSET             0xe07000
+#define AXIP_OFFSET             0xe08000
 
 /* GPU interrupts */
 #define INTERRUPT_TIMER0               0
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The bcm2835-v3d is used since Linux 4.7, see commit
49ac67e0c39c ("ARM: bcm2835: Add VC4 to the device tree"),
and the bcm2835-txp since Linux 4.19, see commit
b7dd29b401f5 ("ARM: dts: bcm283x: Add Transposer block").

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200921034729.432931-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h | 2 ++
 hw/arm/bcm2835_peripherals.c         | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
 
     BCM2835SystemTimerState systmr;
     BCM2835MphiState mphi;
+    UnimplementedDeviceState txp;
     UnimplementedDeviceState armtmr;
     UnimplementedDeviceState cprman;
     UnimplementedDeviceState a2w;
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
     UnimplementedDeviceState otp;
     UnimplementedDeviceState dbus;
     UnimplementedDeviceState ave0;
+    UnimplementedDeviceState v3d;
     UnimplementedDeviceState bscsl;
     UnimplementedDeviceState smi;
     DWC2State dwc2;
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
                                INTERRUPT_USB));
 
+    create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
     create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
     create_unimp(s, &s->a2w, "bcm2835-a2w", A2W_OFFSET, 0x1000);
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
     create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
     create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
+    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x1000);
     create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Commit 1c3db49d39 added the raspi3, which uses the same peripherals
than the raspi2 (but with different ARM cores). The raspi3 was
introduced without the ignore_memory_transaction_failures flag.
Almost 2 years later, the machine is usable running U-Boot and
Linux.
In commit 00cbd5bd74 we mapped a lot of unimplemented devices,
commit d442d95f added thermal block and commit 0e5bbd7406 the
system timer.
As we are happy with the raspi3, let's remove this flag on the
raspi2.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200921034729.432931-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     mc->default_cpus = mc->min_cpus = mc->max_cpus = cores_count(board_rev);
     mc->default_ram_size = board_ram_size(board_rev);
     mc->default_ram_id = "ram";
-    if (board_version(board_rev) == 2) {
-        mc->ignore_memory_transaction_failures = true;
-    }
 };
 
 static const TypeInfo raspi_machine_types[] = {
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Display the board revision in the machine description.

Before:

$ qemu-system-aarch64 -M help | fgrep raspi
  raspi2               Raspberry Pi 2B
  raspi3               Raspberry Pi 3B

After:

raspi2               Raspberry Pi 2B (revision 1.1)
  raspi3               Raspberry Pi 3B (revision 1.2)

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     uint32_t board_rev = (uint32_t)(uintptr_t)data;
 
     rmc->board_rev = board_rev;
-    mc->desc = g_strdup_printf("Raspberry Pi %s", board_type(board_rev));
+    mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
+                               board_type(board_rev),
+                               FIELD_EX32(board_rev, REV_CODE, REVISION));
     mc->init = raspi_machine_init;
     mc->block_default_type = IF_SD;
     mc->no_parallel = 1;
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The 'first_cpu' is more a QEMU accelerator-related concept
than a variable the machine requires to use.
Since the machine is aware of its CPUs, directly use the
first one to load the firmware.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
 
 static void setup_boot(MachineState *machine, int version, size_t ram_size)
 {
+    RaspiMachineState *s = RASPI_MACHINE(machine);
     static struct arm_boot_info binfo;
     int r;
 
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
         binfo.firmware_loaded = true;
     }
 
-    arm_load_kernel(ARM_CPU(first_cpu), machine, &binfo);
+    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
 }
 
 static void raspi_machine_init(MachineState *machine)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The arm_boot_info structure belong to the machine,
move it to RaspiMachineState.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-4-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ struct RaspiMachineState {
     MachineState parent_obj;
     /*< public >*/
     BCM283XState soc;
+    struct arm_boot_info binfo;
 };
 typedef struct RaspiMachineState RaspiMachineState;
 
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
 static void setup_boot(MachineState *machine, int version, size_t ram_size)
 {
     RaspiMachineState *s = RASPI_MACHINE(machine);
-    static struct arm_boot_info binfo;
     int r;
 
-    binfo.board_id = MACH_TYPE_BCM2708;
-    binfo.ram_size = ram_size;
-    binfo.nb_cpus = machine->smp.cpus;
+    s->binfo.board_id = MACH_TYPE_BCM2708;
+    s->binfo.ram_size = ram_size;
+    s->binfo.nb_cpus = machine->smp.cpus;
 
     if (version <= 2) {
         /* The rpi1 and 2 require some custom setup code to run in Secure
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
          * firmware for some cache maintenance operations.
          * The rpi3 doesn't need this.
          */
-        binfo.board_setup_addr = BOARDSETUP_ADDR;
-        binfo.write_board_setup = write_board_setup;
-        binfo.secure_board_setup = true;
-        binfo.secure_boot = true;
+        s->binfo.board_setup_addr = BOARDSETUP_ADDR;
+        s->binfo.write_board_setup = write_board_setup;
+        s->binfo.secure_board_setup = true;
+        s->binfo.secure_boot = true;
     }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-        binfo.smp_loader_start = SMPBOOT_ADDR;
+        s->binfo.smp_loader_start = SMPBOOT_ADDR;
         if (version == 2) {
-            binfo.write_secondary_boot = write_smpboot;
+            s->binfo.write_secondary_boot = write_smpboot;
         } else {
-            binfo.write_secondary_boot = write_smpboot64;
+            s->binfo.write_secondary_boot = write_smpboot64;
         }
-        binfo.secondary_cpu_reset_hook = reset_secondary;
+        s->binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
     /* If the user specified a "firmware" image (e.g. UEFI), we bypass
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
             exit(1);
         }
 
-        binfo.entry = firmware_addr;
-        binfo.firmware_loaded = true;
+        s->binfo.entry = firmware_addr;
+        s->binfo.firmware_loaded = true;
     }
 
-    arm_load_kernel(&s->soc.cpu[0].core, machine, &binfo);
+    arm_load_kernel(&s->soc.cpu[0].core, machine, &s->binfo);
 }
 
 static void raspi_machine_init(MachineState *machine)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Using class_data pointer to create a MachineClass is not
the recommended way anymore. The correct way is to open-code
the MachineClass::fields in the class_init() method.

We can not use TYPE_RASPI_MACHINE::class_base_init() because
it is called *before* each machine class_init(), therefore the
board_rev field is not populated. We have to manually call
raspi_machine_class_common_init() for each machine.

This partly reverts commit a03bde3674e.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-5-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 34 ++++++++++++++++++++++++----------
 1 file changed, 24 insertions(+), 10 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
     setup_boot(machine, version, machine->ram_size - vcram_size);
 }
 
-static void raspi_machine_class_init(ObjectClass *oc, void *data)
+static void raspi_machine_class_common_init(MachineClass *mc,
+                                            uint32_t board_rev)
 {
-    MachineClass *mc = MACHINE_CLASS(oc);
-    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
-    uint32_t board_rev = (uint32_t)(uintptr_t)data;
-
-    rmc->board_rev = board_rev;
     mc->desc = g_strdup_printf("Raspberry Pi %s (revision 1.%u)",
                                board_type(board_rev),
                                FIELD_EX32(board_rev, REV_CODE, REVISION));
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_id = "ram";
 };
 
+static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+    rmc->board_rev = 0xa21041;
+    raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+
+#ifdef TARGET_AARCH64
+static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
+
+    rmc->board_rev = 0xa02082;
+    raspi_machine_class_common_init(mc, rmc->board_rev);
+};
+#endif /* TARGET_AARCH64 */
+
 static const TypeInfo raspi_machine_types[] = {
     {
         .name           = MACHINE_TYPE_NAME("raspi2"),
         .parent         = TYPE_RASPI_MACHINE,
-        .class_init     = raspi_machine_class_init,
-        .class_data     = (void *)0xa21041,
+        .class_init     = raspi2b_machine_class_init,
 #ifdef TARGET_AARCH64
     }, {
         .name           = MACHINE_TYPE_NAME("raspi3"),
         .parent         = TYPE_RASPI_MACHINE,
-        .class_init     = raspi_machine_class_init,
-        .class_data     = (void *)0xa02082,
+        .class_init     = raspi3b_machine_class_init,
 #endif
     }, {
         .name           = TYPE_RASPI_MACHINE,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Now that we can instantiate different machines based on their
board_rev register value, we can have various raspi2 and raspi3.

In commit fc78a990ec103 we corrected the machine description.
Correct the machine names too. For backward compatibility, add
an alias to the previous generic name.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-6-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2b_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 
+    mc->alias = "raspi2";
     rmc->board_rev = 0xa21041;
     raspi_machine_class_common_init(mc, rmc->board_rev);
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiMachineClass *rmc = RASPI_MACHINE_CLASS(oc);
 
+    mc->alias = "raspi3";
     rmc->board_rev = 0xa02082;
     raspi_machine_class_common_init(mc, rmc->board_rev);
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3b_machine_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo raspi_machine_types[] = {
     {
-        .name           = MACHINE_TYPE_NAME("raspi2"),
+        .name           = MACHINE_TYPE_NAME("raspi2b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi2b_machine_class_init,
 #ifdef TARGET_AARCH64
     }, {
-        .name           = MACHINE_TYPE_NAME("raspi3"),
+        .name           = MACHINE_TYPE_NAME("raspi3b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi3b_machine_class_init,
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As we only support a reduced set of the REV_CODE_PROCESSOR id
encoded in the board revision, define the PROCESSOR_ID values
as an enum. We can simplify the board_soc_type and cores_count
methods.

Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-7-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 45 +++++++++++++++++++++------------------------
 1 file changed, 21 insertions(+), 24 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ FIELD(REV_CODE, MANUFACTURER,      16, 4);
 FIELD(REV_CODE, MEMORY_SIZE,       20, 3);
 FIELD(REV_CODE, STYLE,             23, 1);
 
+typedef enum RaspiProcessorId {
+    PROCESSOR_ID_BCM2836 = 1,
+    PROCESSOR_ID_BCM2837 = 2,
+} RaspiProcessorId;
+
+static const struct {
+    const char *type;
+    int cores_count;
+} soc_property[] = {
+    [PROCESSOR_ID_BCM2836] = {TYPE_BCM2836, BCM283X_NCPUS},
+    [PROCESSOR_ID_BCM2837] = {TYPE_BCM2837, BCM283X_NCPUS},
+};
+
 static uint64_t board_ram_size(uint32_t board_rev)
 {
     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
     return 256 * MiB << FIELD_EX32(board_rev, REV_CODE, MEMORY_SIZE);
 }
 
-static int board_processor_id(uint32_t board_rev)
+static RaspiProcessorId board_processor_id(uint32_t board_rev)
 {
+    int proc_id = FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+
     assert(FIELD_EX32(board_rev, REV_CODE, STYLE)); /* Only new style */
-    return FIELD_EX32(board_rev, REV_CODE, PROCESSOR);
+    assert(proc_id < ARRAY_SIZE(soc_property) && soc_property[proc_id].type);
+
+    return proc_id;
 }
 
 static int board_version(uint32_t board_rev)
@@ -XXX,XX +XXX,XX @@ static int board_version(uint32_t board_rev)
 
 static const char *board_soc_type(uint32_t board_rev)
 {
-    static const char *soc_types[] = {
-        NULL, TYPE_BCM2836, TYPE_BCM2837,
-    };
-    int proc_id = board_processor_id(board_rev);
-
-    if (proc_id >= ARRAY_SIZE(soc_types) || !soc_types[proc_id]) {
-        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
-                     proc_id, board_rev);
-        exit(1);
-    }
-    return soc_types[proc_id];
+    return soc_property[board_processor_id(board_rev)].type;
 }
 
 static int cores_count(uint32_t board_rev)
 {
-    static const int soc_cores_count[] = {
-        0, BCM283X_NCPUS, BCM283X_NCPUS,
-    };
-    int proc_id = board_processor_id(board_rev);
-
-    if (proc_id >= ARRAY_SIZE(soc_cores_count) || !soc_cores_count[proc_id]) {
-        error_report("Unsupported processor id '%d' (board revision: 0x%x)",
-                     proc_id, board_rev);
-        exit(1);
-    }
-    return soc_cores_count[proc_id];
+    return soc_property[board_processor_id(board_rev)].cores_count;
 }
 
 static const char *board_type(uint32_t board_rev)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The firmware load address depends on the SoC ("processor id") used,
not on the version of the board.

Suggested-by: Luc Michel <luc.michel@greensocs.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-8-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      * the normal Linux boot process
      */
     if (machine->firmware) {
-        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
+        hwaddr firmware_addr = processor_id <= PROCESSOR_ID_BCM2836
+                             ? FIRMWARE_ADDR_2 : FIRMWARE_ADDR_3;
         /* load the firmware image (typically kernel.img) */
         r = load_image_targphys(machine->firmware, firmware_addr,
                                 ram_size - firmware_addr);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We expected the 'version' ID to match the board processor ID,
but this is not always true (for example boards with revision
id 0xa02042/0xa22042 are Raspberry Pi 2 with a BCM2837 SoC).
This was not important because we were not modelling them, but
since the recent refactor now allow to model these boards, it
is safer to check the processor id directly. Remove the version
check.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200924111808.77168-9-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static RaspiProcessorId board_processor_id(uint32_t board_rev)
     return proc_id;
 }
 
-static int board_version(uint32_t board_rev)
-{
-    return board_processor_id(board_rev) + 1;
-}
-
 static const char *board_soc_type(uint32_t board_rev)
 {
     return soc_property[board_processor_id(board_rev)].type;
@@ -XXX,XX +XXX,XX @@ static void reset_secondary(ARMCPU *cpu, const struct arm_boot_info *info)
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-static void setup_boot(MachineState *machine, int version, size_t ram_size)
+static void setup_boot(MachineState *machine, RaspiProcessorId processor_id,
+                       size_t ram_size)
 {
     RaspiMachineState *s = RASPI_MACHINE(machine);
     int r;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     s->binfo.ram_size = ram_size;
     s->binfo.nb_cpus = machine->smp.cpus;
 
-    if (version <= 2) {
-        /* The rpi1 and 2 require some custom setup code to run in Secure
-         * mode before booting a kernel (to set up the SMC vectors so
-         * that we get a no-op SMC; this is used by Linux to call the
+    if (processor_id <= PROCESSOR_ID_BCM2836) {
+        /*
+         * The BCM2835 and BCM2836 require some custom setup code to run
+         * in Secure mode before booting a kernel (to set up the SMC vectors
+         * so that we get a no-op SMC; this is used by Linux to call the
          * firmware for some cache maintenance operations.
-         * The rpi3 doesn't need this.
+         * The BCM2837 doesn't need this.
          */
         s->binfo.board_setup_addr = BOARDSETUP_ADDR;
         s->binfo.write_board_setup = write_board_setup;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
         s->binfo.secure_boot = true;
     }
 
-    /* Pi2 and Pi3 requires SMP setup */
-    if (version >= 2) {
+    /* BCM2836 and BCM2837 requires SMP setup */
+    if (processor_id >= PROCESSOR_ID_BCM2836) {
         s->binfo.smp_loader_start = SMPBOOT_ADDR;
-        if (version == 2) {
+        if (processor_id == PROCESSOR_ID_BCM2836) {
             s->binfo.write_secondary_boot = write_smpboot;
         } else {
             s->binfo.write_secondary_boot = write_smpboot64;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
     RaspiMachineClass *mc = RASPI_MACHINE_GET_CLASS(machine);
     RaspiMachineState *s = RASPI_MACHINE(machine);
     uint32_t board_rev = mc->board_rev;
-    int version = board_version(board_rev);
     uint64_t ram_size = board_ram_size(board_rev);
     uint32_t vcram_size;
     DriveInfo *di;
@@ -XXX,XX +XXX,XX @@ static void raspi_machine_init(MachineState *machine)
 
     vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
                                           &error_abort);
-    setup_boot(machine, version, machine->ram_size - vcram_size);
+    setup_boot(machine, board_processor_id(mc->board_rev),
+               machine->ram_size - vcram_size);
 }
 
 static void raspi_machine_class_common_init(MachineClass *mc,
-- 
2.20.1

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1