diff --git a/default-configs/devices/arm-softmmu.mak b/default-configs/devices/arm-softmmu.mak

index XXXXXXX..XXXXXXX 100644

--- a/default-configs/devices/arm-softmmu.mak

+++ b/default-configs/devices/arm-softmmu.mak

@@ -XXX,XX +XXX,XX @@ CONFIG_CHEETAH=y

CONFIG_SX1=y

CONFIG_NSERIES=y

CONFIG_STELLARIS=y

+CONFIG_STM32VLDISCOVERY=y

CONFIG_REALVIEW=y

CONFIG_VERSATILE=y

CONFIG_VEXPRESS=y

diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/arm/stm32vldiscovery.c

@@ -XXX,XX +XXX,XX @@

+/*

+ * ST STM32VLDISCOVERY machine

+ *

+ * Copyright (c) 2021 Alexandre Iooss <erdnaxe@crans.org>

+ * Copyright (c) 2014 Alistair Francis <alistair@alistair23.me>

+ *

+ * Permission is hereby granted, free of charge, to any person obtaining a copy

+ * of this software and associated documentation files (the "Software"), to deal

+ * in the Software without restriction, including without limitation the rights

+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

+ * copies of the Software, and to permit persons to whom the Software is

+ * furnished to do so, subject to the following conditions:

+ *

+ * The above copyright notice and this permission notice shall be included in

+ * all copies or substantial portions of the Software.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

+ * THE SOFTWARE.

+ */

+

+#include "qemu/osdep.h"

+#include "qapi/error.h"

+#include "hw/boards.h"

+#include "hw/qdev-properties.h"

+#include "qemu/error-report.h"

+#include "hw/arm/stm32f100_soc.h"

+#include "hw/arm/boot.h"

+

+/* stm32vldiscovery implementation is derived from netduinoplus2 */

+

+/* Main SYSCLK frequency in Hz (24MHz) */

+#define SYSCLK_FRQ 24000000ULL

+

+static void stm32vldiscovery_init(MachineState *machine)

+{

+ DeviceState *dev;

+

+ /*

+ * TODO: ideally we would model the SoC RCC and let it handle

+ * system_clock_scale, including its ability to define different

+ * possible SYSCLK sources.

+ */

+ system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;

+

+ dev = qdev_new(TYPE_STM32F100_SOC);

+ qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));

+ sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);

+

+ armv7m_load_kernel(ARM_CPU(first_cpu),

+ machine->kernel_filename,

+ FLASH_SIZE);

+}

+

+static void stm32vldiscovery_machine_init(MachineClass *mc)

+{

+ mc->desc = "ST STM32VLDISCOVERY (Cortex-M3)";

+ mc->init = stm32vldiscovery_init;

+}

+

+DEFINE_MACHINE("stm32vldiscovery", stm32vldiscovery_machine_init)

+

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: hw/*/stellaris*

F: include/hw/input/gamepad.h

F: docs/system/arm/stellaris.rst

+STM32VLDISCOVERY

+M: Alexandre Iooss <erdnaxe@crans.org>

+L: qemu-arm@nongnu.org

+S: Maintained

+F: hw/arm/stm32vldiscovery.c

+

Versatile Express

M: Peter Maydell <peter.maydell@linaro.org>

L: qemu-arm@nongnu.org

From: Alexandre Iooss <erdnaxe@crans.org>

This adds the target guide for Netduino 2, Netduino Plus 2 and STM32VLDISCOVERY.

Signed-off-by: Alexandre Iooss <erdnaxe@crans.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20210617165647.2575955-4-erdnaxe@crans.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/stm32.rst | 66 ++++++++++++++++++++++++++++++++++++++

docs/system/target-arm.rst | 1 +

MAINTAINERS | 1 +

3 files changed, 68 insertions(+)

create mode 100644 docs/system/arm/stm32.rst

diff --git a/docs/system/arm/stm32.rst b/docs/system/arm/stm32.rst

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/docs/system/arm/stm32.rst

@@ -XXX,XX +XXX,XX @@

+STMicroelectronics STM32 boards (``netduino2``, ``netduinoplus2``, ``stm32vldiscovery``)

+========================================================================================

+

+The `STM32`_ chips are a family of 32-bit ARM-based microcontroller by

+STMicroelectronics.

+

+.. _STM32: https://www.st.com/en/microcontrollers-microprocessors/stm32-32-bit-arm-cortex-mcus.html

+

+The STM32F1 series is based on ARM Cortex-M3 core. The following machines are

+based on this chip :

+

+- ``stm32vldiscovery`` STM32VLDISCOVERY board with STM32F100RBT6 microcontroller

+

+The STM32F2 series is based on ARM Cortex-M3 core. The following machines are

+based on this chip :

+

+- ``netduino2`` Netduino 2 board with STM32F205RFT6 microcontroller

+

+The STM32F4 series is based on ARM Cortex-M4F core. This series is pin-to-pin

+compatible with STM32F2 series. The following machines are based on this chip :

+

+- ``netduinoplus2`` Netduino Plus 2 board with STM32F405RGT6 microcontroller

+

+There are many other STM32 series that are currently not supported by QEMU.

+

+Supported devices

+-----------------

+

+ * ARM Cortex-M3, Cortex M4F

+ * Analog to Digital Converter (ADC)

+ * EXTI interrupt

+ * Serial ports (USART)

+ * SPI controller

+ * System configuration (SYSCFG)

+ * Timer controller (TIMER)

+

+Missing devices

+---------------

+

+ * Camera interface (DCMI)

+ * Controller Area Network (CAN)

+ * Cycle Redundancy Check (CRC) calculation unit

+ * Digital to Analog Converter (DAC)

+ * DMA controller

+ * Ethernet controller

+ * Flash Interface Unit

+ * GPIO controller

+ * I2C controller

+ * Inter-Integrated Sound (I2S) controller

+ * Power supply configuration (PWR)

+ * Random Number Generator (RNG)

+ * Real-Time Clock (RTC) controller

+ * Reset and Clock Controller (RCC)

+ * Secure Digital Input/Output (SDIO) interface

+ * USB OTG

+ * Watchdog controller (IWDG, WWDG)

+

+Boot options

+------------

+

+The STM32 machines can be started using the ``-kernel`` option to load a

+firmware. Example:

+

+.. code-block:: bash

+

+ $ qemu-system-arm -M stm32vldiscovery -kernel firmware.bin

diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/target-arm.rst

+++ b/docs/system/target-arm.rst

@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running

arm/collie

arm/sx1

arm/stellaris

+ arm/stm32

arm/virt

arm/xlnx-versal-virt

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ M: Alexandre Iooss <erdnaxe@crans.org>

L: qemu-arm@nongnu.org

S: Maintained

F: hw/arm/stm32vldiscovery.c

+F: docs/system/arm/stm32.rst

Versatile Express

M: Peter Maydell <peter.maydell@linaro.org>

--

2.20.1

From: Alexandre Iooss <erdnaxe@crans.org>

New mini-kernel test for STM32VLDISCOVERY USART1.

Signed-off-by: Alexandre Iooss <erdnaxe@crans.org>

Acked-by: Thomas Huth <thuth@redhat.com>

Acked-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20210617165647.2575955-5-erdnaxe@crans.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

tests/qtest/boot-serial-test.c | 37 ++++++++++++++++++++++++++++++++++

1 file changed, 37 insertions(+)

diff --git a/tests/qtest/boot-serial-test.c b/tests/qtest/boot-serial-test.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/qtest/boot-serial-test.c

+++ b/tests/qtest/boot-serial-test.c

@@ -XXX,XX +XXX,XX @@ static const uint8_t kernel_nrf51[] = {

0x1c, 0x25, 0x00, 0x40 /* 0x4000251c = UART TXD */

};

+static const uint8_t kernel_stm32vldiscovery[] = {

+ 0x00, 0x00, 0x00, 0x00, /* Stack top address */

+ 0x1d, 0x00, 0x00, 0x00, /* Reset handler address */

+ 0x00, 0x00, 0x00, 0x00, /* NMI */

+ 0x00, 0x00, 0x00, 0x00, /* Hard fault */

+ 0x00, 0x00, 0x00, 0x00, /* Memory management fault */

+ 0x00, 0x00, 0x00, 0x00, /* Bus fault */

+ 0x00, 0x00, 0x00, 0x00, /* Usage fault */

+ 0x0b, 0x4b, /* ldr r3, [pc, #44] Get RCC */

+ 0x44, 0xf2, 0x04, 0x02, /* movw r2, #16388 */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0x0a, 0x4b, /* ldr r3, [pc, #40] Get GPIOA */

+ 0x1a, 0x68, /* ldr r2, [r3] */

+ 0x22, 0xf0, 0xf0, 0x02, /* bic r2, r2, #240 */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0x1a, 0x68, /* ldr r2, [r3] */

+ 0x42, 0xf0, 0xb0, 0x02, /* orr r2, r2, #176 */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0x07, 0x4b, /* ldr r3, [pc, #26] Get BAUD */

+ 0x45, 0x22, /* movs r2, #69 */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0x06, 0x4b, /* ldr r3, [pc, #24] Get ENABLE */

+ 0x42, 0xf2, 0x08, 0x02, /* movw r2, #8200 */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0x05, 0x4b, /* ldr r3, [pc, #20] Get TXD */

+ 0x54, 0x22, /* movs r2, 'T' */

+ 0x1a, 0x60, /* str r2, [r3] */

+ 0xfe, 0xe7, /* b . */

+ 0x18, 0x10, 0x02, 0x40, /* 0x40021018 = RCC */

+ 0x04, 0x08, 0x01, 0x40, /* 0x40010804 = GPIOA */

+ 0x08, 0x38, 0x01, 0x40, /* 0x40013808 = USART1 BAUD */

+ 0x0c, 0x38, 0x01, 0x40, /* 0x4001380c = USART1 ENABLE */

+ 0x04, 0x38, 0x01, 0x40 /* 0x40013804 = USART1 TXD */

+};

+

typedef struct testdef {

const char *arch; /* Target architecture */

const char *machine; /* Name of the machine */

@@ -XXX,XX +XXX,XX @@ static testdef_t tests[] = {

{ "aarch64", "virt", "-cpu max", "TT", sizeof(kernel_aarch64),

kernel_aarch64 },

{ "arm", "microbit", "", "T", sizeof(kernel_nrf51), kernel_nrf51 },

+ { "arm", "stm32vldiscovery", "", "T",

+ sizeof(kernel_stm32vldiscovery), kernel_stm32vldiscovery },

{ NULL }

};

--

2.20.1

From: Ricardo Koller <ricarkol@google.com>

icv_eoir_write() and icv_dir_write() ignore invalid virtual IRQ numbers

(like LPIs). The issue is that these functions check against the number

of implemented IRQs (QEMU's default is num_irq=288) which can be lower

than the maximum virtual IRQ number (1020 - 1). The consequence is that

if a hypervisor creates an LR for an IRQ between 288 and 1020, then the

guest is unable to deactivate the resulting IRQ. Note that other

functions that deal with large IRQ numbers, like icv_iar_read, check

against 1020 and not against num_irq.

Fix the checks by using GICV3_MAXIRQ (1020) instead of the number of

implemented IRQs.

Signed-off-by: Ricardo Koller <ricarkol@google.com>

Message-id: 20210702233701.3369-1-ricarkol@google.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/arm_gicv3_cpuif.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/arm_gicv3_cpuif.c

+++ b/hw/intc/arm_gicv3_cpuif.c

@@ -XXX,XX +XXX,XX @@ static void icv_dir_write(CPUARMState *env, const ARMCPRegInfo *ri,

trace_gicv3_icv_dir_write(gicv3_redist_affid(cs), value);

- if (irq >= cs->gic->num_irq) {

+ if (irq >= GICV3_MAXIRQ) {

/* Also catches special interrupt numbers and LPIs */

return;

}

@@ -XXX,XX +XXX,XX @@ static void icv_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,

trace_gicv3_icv_eoir_write(ri->crm == 8 ? 0 : 1,

gicv3_redist_affid(cs), value);

- if (irq >= cs->gic->num_irq) {

+ if (irq >= GICV3_MAXIRQ) {

/* Also catches special interrupt numbers and LPIs */

return;

}

--

2.20.1

Convert the use of the DPRINTF debug macro in the PL061 model to

use tracepoints.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

hw/gpio/pl061.c | 27 +++++++++------------------

hw/gpio/trace-events | 6 ++++++

2 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/gpio/pl061.c

+++ b/hw/gpio/pl061.c

@@ -XXX,XX +XXX,XX @@

#include "qemu/log.h"

#include "qemu/module.h"

#include "qom/object.h"

-

-//#define DEBUG_PL061 1

-

-#ifdef DEBUG_PL061

-#define DPRINTF(fmt, ...) \

-do { printf("pl061: " fmt , ## __VA_ARGS__); } while (0)

-#define BADF(fmt, ...) \

-do { fprintf(stderr, "pl061: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)

-#else

-#define DPRINTF(fmt, ...) do {} while(0)

-#define BADF(fmt, ...) \

-do { fprintf(stderr, "pl061: error: " fmt , ## __VA_ARGS__);} while (0)

-#endif

+#include "trace.h"

static const uint8_t pl061_id[12] =

{ 0x00, 0x00, 0x00, 0x00, 0x61, 0x10, 0x04, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };

@@ -XXX,XX +XXX,XX @@ static void pl061_update(PL061State *s)

uint8_t out;

int i;

- DPRINTF("dir = %d, data = %d\n", s->dir, s->data);

+ trace_pl061_update(DEVICE(s)->canonical_path, s->dir, s->data);

/* Outputs float high. */

/* FIXME: This is board dependent. */

@@ -XXX,XX +XXX,XX @@ static void pl061_update(PL061State *s)

for (i = 0; i < N_GPIOS; i++) {

mask = 1 << i;

if (changed & mask) {

- DPRINTF("Set output %d = %d\n", i, (out & mask) != 0);

- qemu_set_irq(s->out[i], (out & mask) != 0);

+ int level = (out & mask) != 0;

+ trace_pl061_set_output(DEVICE(s)->canonical_path, i, level);

+ qemu_set_irq(s->out[i], level);

}

}

}

@@ -XXX,XX +XXX,XX @@ static void pl061_update(PL061State *s)

for (i = 0; i < N_GPIOS; i++) {

mask = 1 << i;

if (changed & mask) {

- DPRINTF("Changed input %d = %d\n", i, (s->data & mask) != 0);

+ trace_pl061_input_change(DEVICE(s)->canonical_path, i,

+ (s->data & mask) != 0);

if (!(s->isense & mask)) {

/* Edge interrupt */

@@ -XXX,XX +XXX,XX @@ static void pl061_update(PL061State *s)

/* Level interrupt */

s->istate |= ~(s->data ^ s->iev) & s->isense;

- DPRINTF("istate = %02X\n", s->istate);

+ trace_pl061_update_istate(DEVICE(s)->canonical_path,

+ s->istate, s->im, (s->istate & s->im) != 0);

qemu_set_irq(s->irq, (s->istate & s->im) != 0);

}

diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/gpio/trace-events

+++ b/hw/gpio/trace-events

@@ -XXX,XX +XXX,XX @@ nrf51_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x

nrf51_gpio_set(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64

nrf51_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " value %" PRIi64

+# pl061.c

+pl061_update(const char *id, uint32_t dir, uint32_t data) "%s GPIODIR 0x%x GPIODATA 0x%x"

+pl061_set_output(const char *id, int gpio, int level) "%s setting output %d to %d"

+pl061_input_change(const char *id, int gpio, int level) "%s input %d changed to %d"

+pl061_update_istate(const char *id, uint32_t istate, uint32_t im, int level) "%s GPIORIS 0x%x GPIOIE 0x%x interrupt level %d"

+

# sifive_gpio.c

sifive_gpio_read(uint64_t offset, uint64_t r) "offset 0x%" PRIx64 " value 0x%" PRIx64

sifive_gpio_write(uint64_t offset, uint64_t value) "offset 0x%" PRIx64 " value 0x%" PRIx64

--

2.20.1

Add tracepoints for reads and writes to the PL061 registers. This requires

restructuring pl061_read() to only return after the tracepoint, rather

than having lots of early-returns.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

hw/gpio/pl061.c | 70 ++++++++++++++++++++++++++++++--------------

hw/gpio/trace-events | 2 ++

2 files changed, 50 insertions(+), 22 deletions(-)

diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/gpio/pl061.c

+++ b/hw/gpio/pl061.c

@@ -XXX,XX +XXX,XX @@ static uint64_t pl061_read(void *opaque, hwaddr offset,

unsigned size)

{

PL061State *s = (PL061State *)opaque;

+ uint64_t r = 0;

switch (offset) {

case 0x0 ... 0x3ff: /* Data */

- return s->data & (offset >> 2);

+ r = s->data & (offset >> 2);

+ break;

case 0x400: /* Direction */

- return s->dir;

+ r = s->dir;

+ break;

case 0x404: /* Interrupt sense */

- return s->isense;

+ r = s->isense;

+ break;

case 0x408: /* Interrupt both edges */

- return s->ibe;

+ r = s->ibe;

+ break;

case 0x40c: /* Interrupt event */

- return s->iev;

+ r = s->iev;

+ break;

case 0x410: /* Interrupt mask */

- return s->im;

+ r = s->im;

+ break;

case 0x414: /* Raw interrupt status */

- return s->istate;

+ r = s->istate;

+ break;

case 0x418: /* Masked interrupt status */

- return s->istate & s->im;

+ r = s->istate & s->im;

+ break;

case 0x420: /* Alternate function select */

- return s->afsel;

+ r = s->afsel;

+ break;

case 0x500: /* 2mA drive */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->dr2r;

+ r = s->dr2r;

+ break;

case 0x504: /* 4mA drive */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->dr4r;

+ r = s->dr4r;

+ break;

case 0x508: /* 8mA drive */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->dr8r;

+ r = s->dr8r;

+ break;

case 0x50c: /* Open drain */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->odr;

+ r = s->odr;

+ break;

case 0x510: /* Pull-up */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->pur;

+ r = s->pur;

+ break;

case 0x514: /* Pull-down */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->pdr;

+ r = s->pdr;

+ break;

case 0x518: /* Slew rate control */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->slr;

+ r = s->slr;

+ break;

case 0x51c: /* Digital enable */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->den;

+ r = s->den;

+ break;

case 0x520: /* Lock */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->locked;

+ r = s->locked;

+ break;

case 0x524: /* Commit */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->cr;

+ r = s->cr;

+ break;

case 0x528: /* Analog mode select */

if (s->id != pl061_id_luminary) {

goto bad_offset;

}

- return s->amsel;

+ r = s->amsel;

+ break;

case 0xfd0 ... 0xfff: /* ID registers */

- return s->id[(offset - 0xfd0) >> 2];

+ r = s->id[(offset - 0xfd0) >> 2];

+ break;

default:

bad_offset:

qemu_log_mask(LOG_GUEST_ERROR,

"pl061_read: Bad offset %x\n", (int)offset);

break;

}

- return 0;

+

+ trace_pl061_read(DEVICE(s)->canonical_path, offset, r);

+ return r;

}

static void pl061_write(void *opaque, hwaddr offset,

@@ -XXX,XX +XXX,XX @@ static void pl061_write(void *opaque, hwaddr offset,

PL061State *s = (PL061State *)opaque;

uint8_t mask;

+ trace_pl061_write(DEVICE(s)->canonical_path, offset, value);

+

switch (offset) {

case 0 ... 0x3ff: