Series comparison

-[PULL 00/36] target-arm queue
+[PULL 00/46] target-arm queue
-First pullreq for 6.0: mostly my v8.1M work, plus some other
+The following changes since commit 7e7eb9f852a46b51a71ae9d82590b2e4d28827ee:
 bits and pieces. (I still have a lot of stuff in my to-review
 folder, which I may or may not get to before the Christmas break...)
-thanks
+  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-01-28' into staging (2021-01-28 22:43:18 +0000)
 -- PMM
 The following changes since commit 5e7b204dbfae9a562fc73684986f936b97f63877:
   Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2020-12-09 20:08:54 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201210
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210129
-for you to fetch changes up to 71f916be1c7e9ede0e37d9cabc781b5a9e8638ff:
+for you to fetch changes up to 11749122e1a86866591306d43603d2795a3dea1a:
-  hw/arm/armv7m: Correct typo in QOM object name (2020-12-10 11:44:56 +0000)
+  hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS (2021-01-29 10:47:29 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/smmuv3: Fix up L1STD_SPAN decoding
+ * Implement ID_PFR2
- * xlnx-zynqmp: Support Xilinx ZynqMP CAN controllers
+ * Conditionalize DBGDIDR
- * sbsa-ref: allow to use Cortex-A53/57/72 cpus
+ * rename xlnx-zcu102.canbusN properties
- * Various minor code cleanups
+ * provide powerdown/reset mechanism for secure firmware on 'virt' board
- * hw/intc/armv7m_nvic: Make all of system PPB range be RAZWI/BusFault
+ * hw/misc: Fix arith overflow in NPCM7XX PWM module
- * Implement more pieces of ARMv8.1M support
+ * target/arm: Replace magic value by MMU_DATA_LOAD definition
  * configure: fix preadv errors on Catalina macOS with new XCode
  * Various configure and other cleanups in preparation for iOS support
  * hvf: Add hypervisor entitlement to output binaries (needed for Big Sur)
  * Implement pvpanic-pci device
  * Convert the CMSDK timer devices to the Clock framework
 ----------------------------------------------------------------
-Alex Chen (4):
+Alexander Graf (1):
-      i.MX25: Fix bad printf format specifiers
+      hvf: Add hypervisor entitlement to output binaries
       i.MX31: Fix bad printf format specifiers
       i.MX6: Fix bad printf format specifiers
       i.MX6ul: Fix bad printf format specifiers
-Havard Skinnemoen (1):
+Hao Wu (1):
-      tests/qtest/npcm7xx_rng-test: dump random data on failure
+      hw/misc: Fix arith overflow in NPCM7XX PWM module
-Kunkun Jiang (1):
+Joelle van Dyne (7):
-      hw/arm/smmuv3: Fix up L1STD_SPAN decoding
+      configure: cross-compiling with empty cross_prefix
       osdep: build with non-working system() function
       darwin: remove redundant dependency declaration
       darwin: fix cross-compiling for Darwin
       configure: cross compile should use x86_64 cpu_family
       darwin: detect CoreAudio for build
       darwin: remove 64-bit build detection on 32-bit OS
-Marcin Juszkiewicz (1):
+Maxim Uvarov (3):
-      sbsa-ref: allow to use Cortex-A53/57/72 cpus
+      hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
       arm-virt: refactor gpios creation
       arm-virt: add secure pl061 for reset/power down
-Peter Maydell (25):
+Mihai Carabas (4):
-      hw/intc/armv7m_nvic: Make all of system PPB range be RAZWI/BusFault
+      hw/misc/pvpanic: split-out generic and bus dependent code
-      target/arm: Implement v8.1M PXN extension
+      hw/misc/pvpanic: add PCI interface support
-      target/arm: Don't clobber ID_PFR1.Security on M-profile cores
+      pvpanic : update pvpanic spec document
-      target/arm: Implement VSCCLRM insn
+      tests/qtest: add a test case for pvpanic-pci
       target/arm: Implement CLRM instruction
       target/arm: Enforce M-profile VMRS/VMSR register restrictions
       target/arm: Refactor M-profile VMSR/VMRS handling
       target/arm: Move general-use constant expanders up in translate.c
       target/arm: Implement VLDR/VSTR system register
       target/arm: Implement M-profile FPSCR_nzcvqc
       target/arm: Use new FPCR_NZCV_MASK constant
       target/arm: Factor out preserve-fp-state from full_vfp_access_check()
       target/arm: Implement FPCXT_S fp system register
       hw/intc/armv7m_nvic: Update FPDSCR masking for v8.1M
       target/arm: For v8.1M, always clear R0-R3, R12, APSR, EPSR on exception entry
       target/arm: In v8.1M, don't set HFSR.FORCED on vector table fetch failures
       target/arm: Implement v8.1M REVIDR register
       target/arm: Implement new v8.1M NOCP check for exception return
       target/arm: Implement new v8.1M VLLDM and VLSTM encodings
       hw/intc/armv7m_nvic: Support v8.1M CCR.TRD bit
       target/arm: Implement CCR_S.TRD behaviour for SG insns
       hw/intc/armv7m_nvic: Fix "return from inactive handler" check
       target/arm: Implement M-profile "minimal RAS implementation"
       hw/intc/armv7m_nvic: Implement read/write for RAS register block
       hw/arm/armv7m: Correct typo in QOM object name
-Vikram Garhwal (4):
+Paolo Bonzini (1):
-      hw/net/can: Introduce Xilinx ZynqMP CAN controller
+      arm: rename xlnx-zcu102.canbusN properties
       xlnx-zynqmp: Connect Xilinx ZynqMP CAN controllers
       tests/qtest: Introduce tests for Xilinx ZynqMP CAN controller
       MAINTAINERS: Add maintainer entry for Xilinx ZynqMP CAN controller
- meson.build                      |    1 +
+Peter Maydell (26):
- hw/arm/smmuv3-internal.h         |    2 +-
+      configure: Move preadv check to meson.build
- hw/net/can/trace.h               |    1 +
+      ptimer: Add new ptimer_set_period_from_clock() function
- include/hw/arm/xlnx-zynqmp.h     |    8 +
+      clock: Add new clock_has_source() function
- include/hw/intc/armv7m_nvic.h    |    2 +
+      tests: Add a simple test of the CMSDK APB timer
- include/hw/net/xlnx-zynqmp-can.h |   78 +++
+      tests: Add a simple test of the CMSDK APB watchdog
- target/arm/cpu.h                 |   46 ++
+      tests: Add a simple test of the CMSDK APB dual timer
- target/arm/m-nocp.decode         |   10 +-
+      hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
- target/arm/t32.decode            |   10 +-
+      hw/timer/cmsdk-apb-timer: Add Clock input
- target/arm/vfp.decode            |   14 +
+      hw/timer/cmsdk-apb-dualtimer: Add Clock input
- hw/arm/armv7m.c                  |    4 +-
+      hw/watchdog/cmsdk-apb-watchdog: Add Clock input
- hw/arm/sbsa-ref.c                |   23 +-
+      hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
- hw/arm/xlnx-zcu102.c             |   20 +
+      hw/arm/armsse: Wire up clocks
- hw/arm/xlnx-zynqmp.c             |   34 ++
+      hw/arm/mps2: Inline CMSDK_APB_TIMER creation
- hw/intc/armv7m_nvic.c            |  246 ++++++--
+      hw/arm/mps2: Create and connect SYSCLK Clock
- hw/misc/imx25_ccm.c              |   12 +-
+      hw/arm/mps2-tz: Create and connect ARMSSE Clocks
- hw/misc/imx31_ccm.c              |   14 +-
+      hw/arm/musca: Create and connect ARMSSE Clocks
- hw/misc/imx6_ccm.c               |   20 +-
+      hw/arm/stellaris: Convert SSYS to QOM device
- hw/misc/imx6_src.c               |    2 +-
+      hw/arm/stellaris: Create Clock input for watchdog
- hw/misc/imx6ul_ccm.c             |    4 +-
+      hw/timer/cmsdk-apb-timer: Convert to use Clock input
- hw/misc/imx_ccm.c                |    4 +-
+      hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
- hw/net/can/xlnx-zynqmp-can.c     | 1161 ++++++++++++++++++++++++++++++++++++++
+      hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
- target/arm/cpu.c                 |    5 +-
+      tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
- target/arm/helper.c              |    7 +-
+      hw/arm/armsse: Use Clock to set system_clock_scale
- target/arm/m_helper.c            |  130 ++++-
+      arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
- target/arm/translate.c           |  105 +++-
+      arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
- tests/qtest/npcm7xx_rng-test.c   |   12 +
+      hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS
  tests/qtest/xlnx-can-test.c      |  360 ++++++++++++
  MAINTAINERS                      |    8 +
  hw/Kconfig                       |    1 +
  hw/net/can/meson.build           |    1 +
  hw/net/can/trace-events          |    9 +
  target/arm/translate-vfp.c.inc   |  511 ++++++++++++++++-
  tests/qtest/meson.build          |    1 +
 files changed, 2713 insertions(+), 153 deletions(-)
  create mode 100644 hw/net/can/trace.h
  create mode 100644 include/hw/net/xlnx-zynqmp-can.h
  create mode 100644 hw/net/can/xlnx-zynqmp-can.c
  create mode 100644 tests/qtest/xlnx-can-test.c
  create mode 100644 hw/net/can/trace-events
+Philippe Mathieu-Daudé (1):
+      target/arm: Replace magic value by MMU_DATA_LOAD definition
+Richard Henderson (2):
+      target/arm: Implement ID_PFR2
+      target/arm: Conditionalize DBGDIDR
+ docs/devel/clocks.rst                    |  16 +++
+ docs/specs/pci-ids.txt                   |   1 +
+ docs/specs/pvpanic.txt                   |  13 ++-
+ docs/system/arm/virt.rst                 |   2 +
+ configure                                |  78 ++++++++------
+ meson.build                              |  34 ++++++-
+ include/hw/arm/armsse.h                  |  14 ++-
+ include/hw/arm/virt.h                    |   2 +
+ include/hw/clock.h                       |  15 +++
+ include/hw/misc/pvpanic.h                |  24 ++++-
+ include/hw/pci/pci.h                     |   1 +
+ include/hw/ptimer.h                      |  22 ++++
+ include/hw/timer/cmsdk-apb-dualtimer.h   |   5 +-
+ include/hw/timer/cmsdk-apb-timer.h       |  34 ++-----
+ include/hw/watchdog/cmsdk-apb-watchdog.h |   5 +-
+ include/qemu/osdep.h                     |  12 +++
+ include/qemu/typedefs.h                  |   1 +
+ target/arm/cpu.h                         |   1 +
+ hw/arm/armsse.c                          |  48 ++++++---
+ hw/arm/mps2-tz.c                         |  14 ++-
+ hw/arm/mps2.c                            |  28 ++++-
+ hw/arm/musca.c                           |  13 ++-
+ hw/arm/stellaris.c                       | 170 +++++++++++++++++++++++--------
+ hw/arm/virt.c                            | 111 ++++++++++++++++----
+ hw/arm/xlnx-zcu102.c                     |   4 +-
+ hw/core/ptimer.c                         |  34 +++++++
+ hw/gpio/gpio_pwr.c                       |  70 +++++++++++++
+ hw/misc/npcm7xx_pwm.c                    |  23 ++++-
+ hw/misc/pvpanic-isa.c                    |  94 +++++++++++++++++
+ hw/misc/pvpanic-pci.c                    |  94 +++++++++++++++++
+ hw/misc/pvpanic.c                        |  85 ++--------------
+ hw/timer/cmsdk-apb-dualtimer.c           |  53 +++++++---
+ hw/timer/cmsdk-apb-timer.c               |  55 +++++-----
+ hw/watchdog/cmsdk-apb-watchdog.c         |  29 ++++--
+ target/arm/helper.c                      |  27 +++--
+ target/arm/kvm64.c                       |   2 +
+ tests/qtest/cmsdk-apb-dualtimer-test.c   | 130 +++++++++++++++++++++++
+ tests/qtest/cmsdk-apb-timer-test.c       |  75 ++++++++++++++
+ tests/qtest/cmsdk-apb-watchdog-test.c    | 131 ++++++++++++++++++++++++
+ tests/qtest/npcm7xx_pwm-test.c           |   4 +-
+ tests/qtest/pvpanic-pci-test.c           |  94 +++++++++++++++++
+ tests/qtest/xlnx-can-test.c              |  30 +++---
+ MAINTAINERS                              |   3 +
+ accel/hvf/entitlements.plist             |   8 ++
+ hw/arm/Kconfig                           |   1 +
+ hw/gpio/Kconfig                          |   3 +
+ hw/gpio/meson.build                      |   1 +
+ hw/i386/Kconfig                          |   2 +-
+ hw/misc/Kconfig                          |  12 ++-
+ hw/misc/meson.build                      |   4 +-
+ scripts/entitlement.sh                   |  13 +++
+ tests/qtest/meson.build                  |   6 +-
+files changed, 1432 insertions(+), 319 deletions(-)
+ create mode 100644 hw/gpio/gpio_pwr.c
+ create mode 100644 hw/misc/pvpanic-isa.c
+ create mode 100644 hw/misc/pvpanic-pci.c
+ create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
+ create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
+ create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
+ create mode 100644 tests/qtest/pvpanic-pci-test.c
+ create mode 100644 accel/hvf/entitlements.plist
+ create mode 100755 scripts/entitlement.sh

-[PULL 31/36] hw/intc/armv7m_nvic: Support v8.1M CCR.TRD bit
+[PULL 01/46] target/arm: Implement ID_PFR2
-v8.1M introduces a new TRD flag in the CCR register, which enables
+From: Richard Henderson <richard.henderson@linaro.org>
 checking for stack frame integrity signatures on SG instructions.
 This bit is not banked, and is always RAZ/WI to Non-secure code.
 Adjust the code for handling CCR reads and writes to handle this.
+This was defined at some point before ARMv8.4, and will
+shortly be used by new processor descriptions.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210120204400.1056582-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201119215617.29887-23-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  2 ++
+ target/arm/cpu.h    | 1 +
- hw/intc/armv7m_nvic.c | 26 ++++++++++++++++++--------
+ target/arm/helper.c | 4 ++--
-files changed, 20 insertions(+), 8 deletions(-)
+ target/arm/kvm64.c  | 2 ++
 files changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKOFHFNMIGN, 10, 1)
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- FIELD(V7M_CCR, DC, 16, 1)
+         uint32_t id_mmfr4;
- FIELD(V7M_CCR, IC, 17, 1)
+         uint32_t id_pfr0;
- FIELD(V7M_CCR, BP, 18, 1)
+         uint32_t id_pfr1;
-+FIELD(V7M_CCR, LOB, 19, 1)
++        uint32_t id_pfr2;
-+FIELD(V7M_CCR, TRD, 20, 1)
+         uint32_t mvfr0;
+         uint32_t mvfr1;
- /* V7M SCR bits */
+         uint32_t mvfr2;
- FIELD(V7M_SCR, SLEEPONEXIT, 1, 1)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/helper.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         }
+               .access = PL1_R, .type = ARM_CP_CONST,
-         return cpu->env.v7m.scr[attrs.secure];
+               .accessfn = access_aa64_tid3,
-     case 0xd14: /* Configuration Control.  */
+               .resetvalue = 0 },
--        /* The BFHFNMIGN bit is the only non-banked bit; we
+-            { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
--         * keep it in the non-secure copy of the register.
++            { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
-+        /*
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
-+         * Non-banked bits: BFHFNMIGN (stored in the NS copy of the register)
+               .access = PL1_R, .type = ARM_CP_CONST,
-+         * and TRD (stored in the S copy of the register)
+               .accessfn = access_aa64_tid3,
-          */
+-              .resetvalue = 0 },
-         val = cpu->env.v7m.ccr[attrs.secure];
++              .resetvalue = cpu->isar.id_pfr2 },
-         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
+             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
-         cpu->env.v7m.scr[attrs.secure] = value;
+               .access = PL1_R, .type = ARM_CP_CONST,
-         break;
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-     case 0xd14: /* Configuration Control.  */
+index XXXXXXX..XXXXXXX 100644
-+    {
+--- a/target/arm/kvm64.c
-+        uint32_t mask;
++++ b/target/arm/kvm64.c
-+
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
+                               ARM64_SYS_REG(3, 0, 0, 1, 0));
-             goto bad_offset;
+         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
-         }
+                               ARM64_SYS_REG(3, 0, 0, 1, 1));
++        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
-         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
++                              ARM64_SYS_REG(3, 0, 0, 3, 4));
--        value &= (R_V7M_CCR_STKALIGN_MASK |
+         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
--                  R_V7M_CCR_BFHFNMIGN_MASK |
+                               ARM64_SYS_REG(3, 0, 0, 1, 2));
--                  R_V7M_CCR_DIV_0_TRP_MASK |
+         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
 -                  R_V7M_CCR_UNALIGN_TRP_MASK |
 -                  R_V7M_CCR_USERSETMPEND_MASK |
 -                  R_V7M_CCR_NONBASETHRDENA_MASK);
 +        mask = R_V7M_CCR_STKALIGN_MASK |
 +            R_V7M_CCR_BFHFNMIGN_MASK |
 +            R_V7M_CCR_DIV_0_TRP_MASK |
 +            R_V7M_CCR_UNALIGN_TRP_MASK |
 +            R_V7M_CCR_USERSETMPEND_MASK |
 +            R_V7M_CCR_NONBASETHRDENA_MASK;
 +        if (arm_feature(&cpu->env, ARM_FEATURE_V8_1M) && attrs.secure) {
 +            /* TRD is always RAZ/WI from NS */
 +            mask |= R_V7M_CCR_TRD_MASK;
 +        }
 +        value &= mask;
          if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
              /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          cpu->env.v7m.ccr[attrs.secure] = value;
          break;
 +    }
      case 0xd24: /* System Handler Control and State (SHCSR) */
          if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
              goto bad_offset;
 --
 .20.1

-[PULL 13/36] target/arm: Implement v8.1M PXN extension
+[PULL 02/46] target/arm: Conditionalize DBGDIDR
-In v8.1M the PXN architecture extension adds a new PXN bit to the
+From: Richard Henderson <richard.henderson@linaro.org>
 MPU_RLAR registers, which forbids execution of code in the region
 from a privileged mode.
-This is another feature which is just in the generic "in v8.1M" set
+Only define the register if it exists for the cpu.
 and has no ID register field indicating its presence.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210120031656.737646-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201119215617.29887-3-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 7 ++++++-
+ target/arm/helper.c | 21 +++++++++++++++------
-file changed, 6 insertions(+), 1 deletion(-)
+file changed, 15 insertions(+), 6 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
-     } else {
+      */
-         uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
+     int i;
-         uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
+     int wrps, brps, ctx_cmps;
-+        bool pxn = false;
+-    ARMCPRegInfo dbgdidr = {
 -        .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
 -        .access = PL0_R, .accessfn = access_tda,
 -        .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
 -    };
 +
-+        if (arm_feature(env, ARM_FEATURE_V8_1M)) {
++    /*
-+            pxn = extract32(env->pmsav8.rlar[secure][matchregion], 4, 1);
++     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
-+        }
++     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
++     * the register must not exist for this cpu.
-         if (m_is_system_region(env, address)) {
++     */
-             /* System space is always execute never */
++    if (cpu->isar.dbgdidr != 0) {
-@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
++        ARMCPRegInfo dbgdidr = {
-         }
++            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
++            .opc1 = 0, .opc2 = 0,
-         *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
++            .access = PL0_R, .accessfn = access_tda,
--        if (*prot && !xn) {
++            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
-+        if (*prot && !xn && !(pxn && !is_user)) {
++        };
-             *prot |= PAGE_EXEC;
++        define_one_arm_cp_reg(cpu, &dbgdidr);
-         }
++    }
-         /* We don't need to look the attribute up in the MAIR0/MAIR1
      /* Note that all these register fields hold "number of Xs minus 1". */
      brps = arm_num_brps(cpu);
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
      assert(ctx_cmps <= brps);
 -    define_one_arm_cp_reg(cpu, &dbgdidr);
      define_arm_cp_regs(cpu, debug_cp_reginfo);
      if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 --
 .20.1

-[PULL 03/36] xlnx-zynqmp: Connect Xilinx ZynqMP CAN controllers
+[PULL 03/46] arm: rename xlnx-zcu102.canbusN properties
-From: Vikram Garhwal <fnu.vikram@xilinx.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-Connect CAN0 and CAN1 on the ZynqMP.
+The properties to attach a CANBUS object to the xlnx-zcu102 machine have
 a period in them.  We want to use periods in properties for compound QAPI types,
 and besides the "xlnx-zcu102." prefix is both unnecessary and different
 from any other machine property name.  Remove it.
-Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20210118162537.779542-1-pbonzini@redhat.com
-Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
+Reviewed-by: Vikram Garhwal <fnu.vikram@xilinx.com>
 Message-id: 1605728926-352690-3-git-send-email-fnu.vikram@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-zynqmp.h |  8 ++++++++
+ hw/arm/xlnx-zcu102.c        |  4 ++--
- hw/arm/xlnx-zcu102.c         | 20 ++++++++++++++++++++
+ tests/qtest/xlnx-can-test.c | 30 +++++++++++++++---------------
- hw/arm/xlnx-zynqmp.c         | 34 ++++++++++++++++++++++++++++++++++
+files changed, 17 insertions(+), 17 deletions(-)
 files changed, 62 insertions(+)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/intc/arm_gic.h"
- #include "hw/net/cadence_gem.h"
- #include "hw/char/cadence_uart.h"
-+#include "hw/net/xlnx-zynqmp-can.h"
- #include "hw/ide/ahci.h"
- #include "hw/sd/sdhci.h"
- #include "hw/ssi/xilinx_spips.h"
-@@ -XXX,XX +XXX,XX @@
- #include "hw/cpu/cluster.h"
- #include "target/arm/cpu.h"
- #include "qom/object.h"
-+#include "net/can_emu.h"
- #define TYPE_XLNX_ZYNQMP "xlnx,zynqmp"
- OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
-@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
- #define XLNX_ZYNQMP_NUM_RPU_CPUS 2
- #define XLNX_ZYNQMP_NUM_GEMS 4
- #define XLNX_ZYNQMP_NUM_UARTS 2
-+#define XLNX_ZYNQMP_NUM_CAN 2
-+#define XLNX_ZYNQMP_CAN_REF_CLK (24 * 1000 * 1000)
- #define XLNX_ZYNQMP_NUM_SDHCI 2
- #define XLNX_ZYNQMP_NUM_SPIS 2
- #define XLNX_ZYNQMP_NUM_GDMA_CH 8
-@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
-     CadenceGEMState gem[XLNX_ZYNQMP_NUM_GEMS];
-     CadenceUARTState uart[XLNX_ZYNQMP_NUM_UARTS];
-+    XlnxZynqMPCANState can[XLNX_ZYNQMP_NUM_CAN];
-     SysbusAHCIState sata;
-     SDHCIState sdhci[XLNX_ZYNQMP_NUM_SDHCI];
-     XilinxSPIPS spi[XLNX_ZYNQMP_NUM_SPIS];
-@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
-     bool virt;
-     /* Has the RPU subsystem?  */
-     bool has_rpu;
-+
-+    /* CAN bus. */
-+    CanBusState *canbus[XLNX_ZYNQMP_NUM_CAN];
- };
- #endif
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
-@@ -XXX,XX +XXX,XX @@
- #include "sysemu/qtest.h"
- #include "sysemu/device_tree.h"
- #include "qom/object.h"
-+#include "net/can_emu.h"
- struct XlnxZCU102 {
-     MachineState parent_obj;
-@@ -XXX,XX +XXX,XX @@ struct XlnxZCU102 {
-     bool secure;
-     bool virt;
-+    CanBusState *canbus[XLNX_ZYNQMP_NUM_CAN];
-+
-     struct arm_boot_info binfo;
- };
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
-     object_property_set_bool(OBJECT(&s->soc), "virtualization", s->virt,
-                              &error_fatal);
-+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
-+        gchar *bus_name = g_strdup_printf("canbus%d", i);
-+
-+        object_property_set_link(OBJECT(&s->soc), bus_name,
-+                                 OBJECT(s->canbus[i]), &error_fatal);
-+        g_free(bus_name);
-+    }
-+
-     qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
-     /* Create and plug in the SD cards */
 @@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
      s->secure = false;
      /* Default to virt (EL2) being disabled */
      s->virt = false;
-+    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
+-    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
-+                             (Object **)&s->canbus[0],
++    object_property_add_link(obj, "canbus0", TYPE_CAN_BUS,
-+                             object_property_allow_set_link,
+                              (Object **)&s->canbus[0],
-+                             0);
+                              object_property_allow_set_link,
-+
+);
-+    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
-+                             (Object **)&s->canbus[1],
+-    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
-+                             object_property_allow_set_link,
++    object_property_add_link(obj, "canbus1", TYPE_CAN_BUS,
-+                             0);
+                              (Object **)&s->canbus[1],
- }
+                              object_property_allow_set_link,
+);
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
+--- a/tests/qtest/xlnx-can-test.c
-+++ b/hw/arm/xlnx-zynqmp.c
++++ b/tests/qtest/xlnx-can-test.c
-@@ -XXX,XX +XXX,XX @@ static const int uart_intr[XLNX_ZYNQMP_NUM_UARTS] = {
+@@ -XXX,XX +XXX,XX @@ static void test_can_bus(void)
-, 22,
+     uint8_t can_timestamp = 1;
- };
+     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-+static const uint64_t can_addr[XLNX_ZYNQMP_NUM_CAN] = {
+-                " -object can-bus,id=canbus0"
-+    0xFF060000, 0xFF070000,
+-                " -machine xlnx-zcu102.canbus0=canbus0"
-+};
+-                " -machine xlnx-zcu102.canbus1=canbus0"
-+
++                " -object can-bus,id=canbus"
-+static const int can_intr[XLNX_ZYNQMP_NUM_CAN] = {
++                " -machine canbus0=canbus"
-+    23, 24,
++                " -machine canbus1=canbus"
-+};
+                 );
-+
- static const uint64_t sdhci_addr[XLNX_ZYNQMP_NUM_SDHCI] = {
+     /* Configure the CAN0 and CAN1. */
-xFF160000, 0xFF170000,
+@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
- };
+     uint32_t status = 0;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
-                                 TYPE_CADENCE_UART);
+     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-     }
+-                " -object can-bus,id=canbus0"
+-                " -machine xlnx-zcu102.canbus0=canbus0"
-+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
+-                " -machine xlnx-zcu102.canbus1=canbus0"
-+        object_initialize_child(obj, "can[*]", &s->can[i],
++                " -object can-bus,id=canbus"
-+                                TYPE_XLNX_ZYNQMP_CAN);
++                " -machine canbus0=canbus"
-+    }
++                " -machine canbus1=canbus"
-+
+                 );
-     object_initialize_child(obj, "sata", &s->sata, TYPE_SYSBUS_AHCI);
+     /* Configure the CAN0 in loopback mode. */
-     for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) {
+@@ -XXX,XX +XXX,XX @@ static void test_can_filter(void)
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+     uint8_t can_timestamp = 1;
-                            gic_spi[uart_intr[i]]);
-     }
+     QTestState *qts = qtest_init("-machine xlnx-zcu102"
+-                " -object can-bus,id=canbus0"
-+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
+-                " -machine xlnx-zcu102.canbus0=canbus0"
-+        object_property_set_int(OBJECT(&s->can[i]), "ext_clk_freq",
+-                " -machine xlnx-zcu102.canbus1=canbus0"
-+                                XLNX_ZYNQMP_CAN_REF_CLK, &error_abort);
++                " -object can-bus,id=canbus"
-+
++                " -machine canbus0=canbus"
-+        object_property_set_link(OBJECT(&s->can[i]), "canbus",
++                " -machine canbus1=canbus"
-+                                 OBJECT(s->canbus[i]), &error_fatal);
+                 );
-+
-+        sysbus_realize(SYS_BUS_DEVICE(&s->can[i]), &err);
+     /* Configure the CAN0 and CAN1. */
-+        if (err) {
+@@ -XXX,XX +XXX,XX @@ static void test_can_sleepmode(void)
-+            error_propagate(errp, err);
+     uint8_t can_timestamp = 1;
-+            return;
-+        }
+     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->can[i]), 0, can_addr[i]);
+-                " -object can-bus,id=canbus0"
-+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->can[i]), 0,
+-                " -machine xlnx-zcu102.canbus0=canbus0"
-+                           gic_spi[can_intr[i]]);
+-                " -machine xlnx-zcu102.canbus1=canbus0"
-+    }
++                " -object can-bus,id=canbus"
-+
++                " -machine canbus0=canbus"
-     object_property_set_int(OBJECT(&s->sata), "num-ports", SATA_NUM_PORTS,
++                " -machine canbus1=canbus"
-                             &error_abort);
+                 );
-     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sata), errp)) {
-@@ -XXX,XX +XXX,XX @@ static Property xlnx_zynqmp_props[] = {
+     /* Configure the CAN0. */
-     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
+@@ -XXX,XX +XXX,XX @@ static void test_can_snoopmode(void)
-     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
+     uint8_t can_timestamp = 1;
-                      MemoryRegion *),
-+    DEFINE_PROP_LINK("canbus0", XlnxZynqMPState, canbus[0], TYPE_CAN_BUS,
+     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-+                     CanBusState *),
+-                " -object can-bus,id=canbus0"
-+    DEFINE_PROP_LINK("canbus1", XlnxZynqMPState, canbus[1], TYPE_CAN_BUS,
+-                " -machine xlnx-zcu102.canbus0=canbus0"
-+                     CanBusState *),
+-                " -machine xlnx-zcu102.canbus1=canbus0"
-     DEFINE_PROP_END_OF_LIST()
++                " -object can-bus,id=canbus"
- };
++                " -machine canbus0=canbus"
++                " -machine canbus1=canbus"
                  );
      /* Configure the CAN0. */
 --
 .20.1

-[PULL 20/36] target/arm: Implement VLDR/VSTR system register
+[PULL 04/46] hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
-Implement the new-in-v8.1M VLDR/VSTR variants which directly
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
 read or write FP system registers to memory.
+Implement gpio-pwr driver to allow reboot and poweroff machine.
+This is simple driver with just 2 gpios lines. Current use case
+is to reboot and poweroff virt machine in secure mode. Secure
+pl066 gpio chip is needed for that.
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201119215617.29887-10-peter.maydell@linaro.org
 ---
- target/arm/vfp.decode          | 14 ++++++
+ hw/gpio/gpio_pwr.c  | 70 +++++++++++++++++++++++++++++++++++++++++++++
- target/arm/translate-vfp.c.inc | 91 ++++++++++++++++++++++++++++++++++
+ hw/gpio/Kconfig     |  3 ++
-files changed, 105 insertions(+)
+ hw/gpio/meson.build |  1 +
 files changed, 74 insertions(+)
  create mode 100644 hw/gpio/gpio_pwr.c
-diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
+diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/target/arm/vfp.decode
+index XXXXXXX..XXXXXXX
-+++ b/target/arm/vfp.decode
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ VLDR_VSTR_hp ---- 1101 u:1 .0 l:1 rn:4 .... 1001 imm:8      vd=%vd_sp
++++ b/hw/gpio/gpio_pwr.c
- VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
+@@ -XXX,XX +XXX,XX @@
- VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
++/*
++ * GPIO qemu power controller
-+# M-profile VLDR/VSTR to sysreg
++ *
-+%vldr_sysreg 22:1 13:3
++ * Copyright (c) 2020 Linaro Limited
-+%imm7_0x4 0:7 !function=times_4
++ *
 + * Author: Maxim Uvarov <maxim.uvarov@linaro.org>
 + *
 + * Virtual gpio driver which can be used on top of pl061
 + * to reboot and shutdown qemu virtual machine. One of use
 + * case is gpio driver for secure world application (ARM
 + * Trusted Firmware.).
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
-+&vldr_sysreg rn reg imm a w p
++/*
-+@vldr_sysreg .... ... . a:1 . . . rn:4 ... . ... .. ....... \
++ * QEMU interface:
-+             reg=%vldr_sysreg imm=%imm7_0x4 &vldr_sysreg
++ * two named input GPIO lines:
 + *   'reset' : when asserted, trigger system reset
 + *   'shutdown' : when asserted, trigger system shutdown
 + */
 +
-+# P=0 W=0 is SEE "Related encodings", so split into two patterns
++#include "qemu/osdep.h"
-+VLDR_sysreg  ---- 110 1 . . w:1 1 .... ... 0 111 11 ....... @vldr_sysreg p=1
++#include "hw/sysbus.h"
-+VLDR_sysreg  ---- 110 0 . . 1   1 .... ... 0 111 11 ....... @vldr_sysreg p=0 w=1
++#include "sysemu/runstate.h"
 +VSTR_sysreg  ---- 110 1 . . w:1 0 .... ... 0 111 11 ....... @vldr_sysreg p=1
 +VSTR_sysreg  ---- 110 0 . . 1   0 .... ... 0 111 11 ....... @vldr_sysreg p=0 w=1
 +
- # We split the load/store multiple up into two patterns to avoid
++#define TYPE_GPIOPWR "gpio-pwr"
- # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
++OBJECT_DECLARE_SIMPLE_TYPE(GPIO_PWR_State, GPIOPWR)
- # grouping:
++
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
++struct GPIO_PWR_State {
-index XXXXXXX..XXXXXXX 100644
++    SysBusDevice parent_obj;
---- a/target/arm/translate-vfp.c.inc
++};
-+++ b/target/arm/translate-vfp.c.inc
++
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
++static void gpio_pwr_reset(void *opaque, int n, int level)
      return true;
  }
 +static void fp_sysreg_to_memory(DisasContext *s, void *opaque, TCGv_i32 value)
 +{
-+    arg_vldr_sysreg *a = opaque;
++    if (level) {
-+    uint32_t offset = a->imm;
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +    TCGv_i32 addr;
 +
 +    if (!a->a) {
 +        offset = - offset;
 +    }
 +
 +    addr = load_reg(s, a->rn);
 +    if (a->p) {
 +        tcg_gen_addi_i32(addr, addr, offset);
 +    }
 +
 +    if (s->v8m_stackcheck && a->rn == 13 && a->w) {
 +        gen_helper_v8m_stackcheck(cpu_env, addr);
 +    }
 +
 +    gen_aa32_st_i32(s, value, addr, get_mem_index(s),
 +                    MO_UL | MO_ALIGN | s->be_data);
 +    tcg_temp_free_i32(value);
 +
 +    if (a->w) {
 +        /* writeback */
 +        if (!a->p) {
 +            tcg_gen_addi_i32(addr, addr, offset);
 +        }
 +        store_reg(s, a->rn, addr);
 +    } else {
 +        tcg_temp_free_i32(addr);
 +    }
 +}
 +
-+static TCGv_i32 memory_to_fp_sysreg(DisasContext *s, void *opaque)
++static void gpio_pwr_shutdown(void *opaque, int n, int level)
 +{
-+    arg_vldr_sysreg *a = opaque;
++    if (level) {
-+    uint32_t offset = a->imm;
++        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +    TCGv_i32 addr;
 +    TCGv_i32 value = tcg_temp_new_i32();
 +
 +    if (!a->a) {
 +        offset = - offset;
 +    }
-+
-+    addr = load_reg(s, a->rn);
-+    if (a->p) {
-+        tcg_gen_addi_i32(addr, addr, offset);
-+    }
-+
-+    if (s->v8m_stackcheck && a->rn == 13 && a->w) {
-+        gen_helper_v8m_stackcheck(cpu_env, addr);
-+    }
-+
-+    gen_aa32_ld_i32(s, value, addr, get_mem_index(s),
-+                    MO_UL | MO_ALIGN | s->be_data);
-+
-+    if (a->w) {
-+        /* writeback */
-+        if (!a->p) {
-+            tcg_gen_addi_i32(addr, addr, offset);
-+        }
-+        store_reg(s, a->rn, addr);
-+    } else {
-+        tcg_temp_free_i32(addr);
-+    }
-+    return value;
 +}
 +
-+static bool trans_VLDR_sysreg(DisasContext *s, arg_vldr_sysreg *a)
++static void gpio_pwr_init(Object *obj)
 +{
-+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++    DeviceState *dev = DEVICE(obj);
-+        return false;
++
-+    }
++    qdev_init_gpio_in_named(dev, gpio_pwr_reset, "reset", 1);
-+    if (a->rn == 15) {
++    qdev_init_gpio_in_named(dev, gpio_pwr_shutdown, "shutdown", 1);
 +        return false;
 +    }
 +    return gen_M_fp_sysreg_write(s, a->reg, memory_to_fp_sysreg, a);
 +}
 +
-+static bool trans_VSTR_sysreg(DisasContext *s, arg_vldr_sysreg *a)
++static const TypeInfo gpio_pwr_info = {
 +    .name          = TYPE_GPIOPWR,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(GPIO_PWR_State),
 +    .instance_init = gpio_pwr_init,
 +};
 +
 +static void gpio_pwr_register_types(void)
 +{
-+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++    type_register_static(&gpio_pwr_info);
 +        return false;
 +    }
 +    if (a->rn == 15) {
 +        return false;
 +    }
 +    return gen_M_fp_sysreg_read(s, a->reg, fp_sysreg_to_memory, a);
 +}
 +
- static bool trans_VMOV_half(DisasContext *s, arg_VMOV_single *a)
++type_init(gpio_pwr_register_types)
- {
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
-     TCGv_i32 tmp;
+index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/Kconfig
 +++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config PL061
  config GPIO_KEY
      bool
 +config GPIO_PWR
 +    bool
 +
  config SIFIVE_GPIO
      bool
 diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@
  softmmu_ss.add(when: 'CONFIG_E500', if_true: files('mpc8xxx.c'))
  softmmu_ss.add(when: 'CONFIG_GPIO_KEY', if_true: files('gpio_key.c'))
 +softmmu_ss.add(when: 'CONFIG_GPIO_PWR', if_true: files('gpio_pwr.c'))
  softmmu_ss.add(when: 'CONFIG_MAX7310', if_true: files('max7310.c'))
  softmmu_ss.add(when: 'CONFIG_PL061', if_true: files('pl061.c'))
  softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_gpio.c'))
 --
 .20.1

-[PULL 09/36] i.MX31: Fix bad printf format specifiers
+[PULL 05/46] arm-virt: refactor gpios creation
-From: Alex Chen <alex.chen@huawei.com>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-We should use printf format specifier "%u" instead of "%d" for
+No functional change. Just refactor code to better
-argument of type "unsigned int".
+support secure and normal world gpios.
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20201126111109.112238-3-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/imx31_ccm.c | 14 +++++++-------
+ hw/arm/virt.c | 57 ++++++++++++++++++++++++++++++++-------------------
- hw/misc/imx_ccm.c   |  4 ++--
+file changed, 36 insertions(+), 21 deletions(-)
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/hw/misc/imx31_ccm.c b/hw/misc/imx31_ccm.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/imx31_ccm.c
+--- a/hw/arm/virt.c
-+++ b/hw/misc/imx31_ccm.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx31_ccm_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
      case IMX31_CCM_PDR2_REG:
          return "PDR2";
      default:
 -        sprintf(unknown, "[%d ?]", reg);
 +        sprintf(unknown, "[%u ?]", reg);
          return unknown;
      }
  }
-@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_pll_ref_clk(IMXCCMState *dev)
-         freq = CKIH_FREQ;
+-static void create_gpio(const VirtMachineState *vms)
 +static void create_gpio_keys(const VirtMachineState *vms,
 +                             DeviceState *pl061_dev,
 +                             uint32_t phandle)
 +{
 +    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
 +                                        qdev_get_gpio_in(pl061_dev, 3));
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
 +    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
 +    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
 +                            "label", "GPIO Key Poweroff");
 +    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
 +                          KEY_POWER);
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
 +                           "gpios", phandle, 3, 0);
 +}
 +
 +static void create_gpio_devices(const VirtMachineState *vms, int gpio,
 +                                MemoryRegion *mem)
  {
      char *nodename;
      DeviceState *pl061_dev;
 -    hwaddr base = vms->memmap[VIRT_GPIO].base;
 -    hwaddr size = vms->memmap[VIRT_GPIO].size;
 -    int irq = vms->irqmap[VIRT_GPIO];
 +    hwaddr base = vms->memmap[gpio].base;
 +    hwaddr size = vms->memmap[gpio].size;
 +    int irq = vms->irqmap[gpio];
      const char compat[] = "arm,pl061\0arm,primecell";
 +    SysBusDevice *s;
 -    pl061_dev = sysbus_create_simple("pl061", base,
 -                                     qdev_get_gpio_in(vms->gic, irq));
 +    pl061_dev = qdev_new("pl061");
 +    s = SYS_BUS_DEVICE(pl061_dev);
 +    sysbus_realize_and_unref(s, &error_fatal);
 +    memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(vms->gic, irq));
      uint32_t phandle = qemu_fdt_alloc_phandle(vms->fdt);
      nodename = g_strdup_printf("/pl061@%" PRIx64, base);
@@ -XXX,XX +XXX,XX @@ static void create_gpio(const VirtMachineState *vms)
      qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
      qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 -    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
 -                                        qdev_get_gpio_in(pl061_dev, 3));
 -    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
 -    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
 -
 -    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
 -    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
 -                            "label", "GPIO Key Poweroff");
 -    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
 -                          KEY_POWER);
 -    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
 -                           "gpios", phandle, 3, 0);
      g_free(nodename);
 +
 +    /* Child gpio devices */
 +    create_gpio_keys(vms, pl061_dev, phandle);
  }
  static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
          vms->acpi_dev = create_acpi_ged(vms);
      } else {
 -        create_gpio(vms);
 +        create_gpio_devices(vms, VIRT_GPIO, sysmem);
      }
--    DPRINTF("freq = %d\n", freq);
+      /* connect powerdown request */
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_mpll_clk(IMXCCMState *dev)
      freq = imx_ccm_calc_pll(s->reg[IMX31_CCM_MPCTL_REG],
                              imx31_ccm_get_pll_ref_clk(dev));
 -    DPRINTF("freq = %d\n", freq);
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_mcu_main_clk(IMXCCMState *dev)
          freq = imx31_ccm_get_mpll_clk(dev);
      }
 -    DPRINTF("freq = %d\n", freq);
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_hclk_clk(IMXCCMState *dev)
      freq = imx31_ccm_get_mcu_main_clk(dev)
             / (1 + EXTRACT(s->reg[IMX31_CCM_PDR0_REG], MAX));
 -    DPRINTF("freq = %d\n", freq);
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_ipg_clk(IMXCCMState *dev)
      freq = imx31_ccm_get_hclk_clk(dev)
             / (1 + EXTRACT(s->reg[IMX31_CCM_PDR0_REG], IPG));
 -    DPRINTF("freq = %d\n", freq);
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
          break;
      }
 -    DPRINTF("Clock = %d) = %d\n", clock, freq);
 +    DPRINTF("Clock = %d) = %u\n", clock, freq);
      return freq;
  }
 diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/imx_ccm.c
 +++ b/hw/misc/imx_ccm.c
@@ -XXX,XX +XXX,XX @@ uint32_t imx_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
          freq = klass->get_clock_frequency(dev, clock);
      }
 -    DPRINTF("(clock = %d) = %d\n", clock, freq);
 +    DPRINTF("(clock = %d) = %u\n", clock, freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ uint32_t imx_ccm_calc_pll(uint32_t pllreg, uint32_t base_freq)
      freq = ((2 * (base_freq >> 10) * (mfi * mfd + mfn)) /
              (mfd * pd)) << 10;
 -    DPRINTF("(pllreg = 0x%08x, base_freq = %d) = %d\n", pllreg, base_freq,
 +    DPRINTF("(pllreg = 0x%08x, base_freq = %u) = %d\n", pllreg, base_freq,
              freq);
      return freq;
 --
 .20.1

-[PULL 06/36] sbsa-ref: allow to use Cortex-A53/57/72 cpus
+[PULL 06/46] arm-virt: add secure pl061 for reset/power down
-From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-Trusted Firmware now supports A72 on sbsa-ref by default [1] so enable
+Add secure pl061 for reset/power down machine from
-it for QEMU as well. A53 was already enabled there.
+the secure world (Arm Trusted Firmware). Connect it
 with gpio-pwr driver.
-. https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/7117
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
+[PMM: Added mention of the new device to the documentation]
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20201120141705.246690-1-marcin.juszkiewicz@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/sbsa-ref.c | 23 ++++++++++++++++++++---
+ docs/system/arm/virt.rst |  2 ++
-file changed, 20 insertions(+), 3 deletions(-)
+ include/hw/arm/virt.h    |  2 ++
  hw/arm/virt.c            | 56 +++++++++++++++++++++++++++++++++++++++-
  hw/arm/Kconfig           |  1 +
 files changed, 60 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
+--- a/docs/system/arm/virt.rst
-+++ b/hw/arm/sbsa-ref.c
++++ b/docs/system/arm/virt.rst
-@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
+@@ -XXX,XX +XXX,XX @@ The virt board supports:
-     [SBSA_GWDT] = 16,
+ - Secure-World-only devices if the CPU has TrustZone:
    - A second PL011 UART
 +  - A second PL061 GPIO controller, with GPIO lines for triggering
 +    a system reset or system poweroff
    - A secure flash memory
    - 16MB of secure RAM
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
      VIRT_GPIO,
      VIRT_SECURE_UART,
      VIRT_SECURE_MEM,
 +    VIRT_SECURE_GPIO,
      VIRT_PCDIMM_ACPI,
      VIRT_ACPI_GED,
      VIRT_NVDIMM_ACPI,
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
      bool kvm_no_adjvtime;
      bool no_kvm_steal_time;
      bool acpi_expose_flash;
 +    bool no_secure_gpio;
  };
-+static const char * const valid_cpus[] = {
+ struct VirtMachineState {
-+    ARM_CPU_TYPE_NAME("cortex-a53"),
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-+    ARM_CPU_TYPE_NAME("cortex-a57"),
+index XXXXXXX..XXXXXXX 100644
-+    ARM_CPU_TYPE_NAME("cortex-a72"),
+--- a/hw/arm/virt.c
-+};
++++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
      [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
      [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
      [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
 +    [VIRT_SECURE_GPIO] =        { 0x090b0000, 0x00001000 },
      [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
      /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
      [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(const VirtMachineState *vms,
                             "gpios", phandle, 3, 0);
  }
 +#define SECURE_GPIO_POWEROFF 0
 +#define SECURE_GPIO_RESET    1
 +
-+static bool cpu_type_valid(const char *cpu)
++static void create_secure_gpio_pwr(const VirtMachineState *vms,
 +                                   DeviceState *pl061_dev,
 +                                   uint32_t phandle)
 +{
-+    int i;
++    DeviceState *gpio_pwr_dev;
 +
-+    for (i = 0; i < ARRAY_SIZE(valid_cpus); i++) {
++    /* gpio-pwr */
-+        if (strcmp(cpu, valid_cpus[i]) == 0) {
++    gpio_pwr_dev = sysbus_create_simple("gpio-pwr", -1, NULL);
-+            return true;
++
-+        }
++    /* connect secure pl061 to gpio-pwr */
-+    }
++    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_RESET,
-+    return false;
++                          qdev_get_gpio_in_named(gpio_pwr_dev, "reset", 0));
 +    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_POWEROFF,
 +                          qdev_get_gpio_in_named(gpio_pwr_dev, "shutdown", 0));
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-poweroff");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "compatible",
 +                            "gpio-poweroff");
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-poweroff",
 +                           "gpios", phandle, SECURE_GPIO_POWEROFF, 0);
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "status", "disabled");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "secure-status",
 +                            "okay");
 +
 +    qemu_fdt_add_subnode(vms->fdt, "/gpio-restart");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "compatible",
 +                            "gpio-restart");
 +    qemu_fdt_setprop_cells(vms->fdt, "/gpio-restart",
 +                           "gpios", phandle, SECURE_GPIO_RESET, 0);
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "status", "disabled");
 +    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "secure-status",
 +                            "okay");
 +}
 +
- static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
+ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
                                  MemoryRegion *mem)
  {
-     uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
+@@ -XXX,XX +XXX,XX @@ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
-@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
+     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
-     const CPUArchIdList *possible_cpus;
+     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
-     int n, sbsa_max_cpus;
++    if (gpio != VIRT_GPIO) {
--    if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a57"))) {
++        /* Mark as not usable by the normal world */
--        error_report("sbsa-ref: CPU type other than the built-in "
++        qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
--                     "cortex-a57 not supported");
++        qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
-+    if (!cpu_type_valid(machine->cpu_type)) {
++    }
-+        error_report("mach-virt: CPU type %s not supported", machine->cpu_type);
+     g_free(nodename);
-         exit(1);
      /* Child gpio devices */
 -    create_gpio_keys(vms, pl061_dev, phandle);
 +    if (gpio == VIRT_GPIO) {
 +        create_gpio_keys(vms, pl061_dev, phandle);
 +    } else {
 +        create_secure_gpio_pwr(vms, pl061_dev, phandle);
 +    }
  }
  static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
          create_gpio_devices(vms, VIRT_GPIO, sysmem);
      }
++    if (vms->secure && !vmc->no_secure_gpio) {
++        create_gpio_devices(vms, VIRT_SECURE_GPIO, secure_sysmem);
++    }
++
+      /* connect powerdown request */
+      vms->powerdown_notifier.notify = virt_powerdown_req;
+      qemu_register_powerdown_notifier(&vms->powerdown_notifier);
+@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 0)
+ static void virt_machine_5_2_options(MachineClass *mc)
+ {
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
++
+     virt_machine_6_0_options(mc);
+     compat_props_add(mc->compat_props, hw_compat_5_2, hw_compat_5_2_len);
++    vmc->no_secure_gpio = true;
+ }
+ DEFINE_VIRT_MACHINE(5, 2)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+     select PL011 # UART
+     select PL031 # RTC
+     select PL061 # GPIO
++    select GPIO_PWR
+     select PLATFORM_BUS
+     select SMBIOS
+     select VIRTIO_MMIO
 --
 .20.1

-[PULL 11/36] i.MX6ul: Fix bad printf format specifiers
+[PULL 07/46] hw/misc: Fix arith overflow in NPCM7XX PWM module
-From: Alex Chen <alex.chen@huawei.com>
+From: Hao Wu <wuhaotsh@google.com>
-We should use printf format specifier "%u" instead of "%d" for
+Fix potential overflow problem when calculating pwm_duty.
-argument of type "unsigned int".
+. Ensure p->cmr and p->cnr to be from [0,65535], according to the
    hardware specification.
 . Changed duty to uint32_t. However, since MAX_DUTY * (p->cmr+1)
    can excceed UINT32_MAX, we convert them to uint64_t in computation
    and converted them back to uint32_t.
    (duty is guaranteed to be <= MAX_DUTY so it won't overflow.)
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Fixes: CID 1442342
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20201126111109.112238-5-alex.chen@huawei.com
+Reviewed-by: Doug Evans <dje@google.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210127011142.2122790-1-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/imx6ul_ccm.c | 4 ++--
+ hw/misc/npcm7xx_pwm.c          | 23 +++++++++++++++++++----
-file changed, 2 insertions(+), 2 deletions(-)
+ tests/qtest/npcm7xx_pwm-test.c |  4 ++--
 files changed, 21 insertions(+), 6 deletions(-)
-diff --git a/hw/misc/imx6ul_ccm.c b/hw/misc/imx6ul_ccm.c
+diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/imx6ul_ccm.c
+--- a/hw/misc/npcm7xx_pwm.c
-+++ b/hw/misc/imx6ul_ccm.c
++++ b/hw/misc/npcm7xx_pwm.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx6ul_ccm_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_PWM_PWDR3, 0x50);
-     case CCM_CMEOR:
+ #define NPCM7XX_CH_INV              BIT(2)
-         return "CMEOR";
+ #define NPCM7XX_CH_MOD              BIT(3)
-     default:
--        sprintf(unknown, "%d ?", reg);
++#define NPCM7XX_MAX_CMR             65535
-+        sprintf(unknown, "%u ?", reg);
++#define NPCM7XX_MAX_CNR             65535
-         return unknown;
++
  /* Offset of each PWM channel's prescaler in the PPR register. */
  static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
  /* Offset of each PWM channel's clock selector in the CSR register. */
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
  static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
  {
 -    uint64_t duty;
 +    uint32_t duty;
      if (p->running) {
          if (p->cnr == 0) {
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
          } else if (p->cmr >= p->cnr) {
              duty = NPCM7XX_PWM_MAX_DUTY;
          } else {
 -            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
 +            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
          }
      } else {
          duty = 0;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
      case A_NPCM7XX_PWM_CNR2:
      case A_NPCM7XX_PWM_CNR3:
          p = &s->pwm[npcm7xx_cnr_index(offset)];
 -        p->cnr = value;
 +        if (value > NPCM7XX_MAX_CNR) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid cnr value: %u", __func__, value);
 +            p->cnr = NPCM7XX_MAX_CNR;
 +        } else {
 +            p->cnr = value;
 +        }
          npcm7xx_pwm_update_output(p);
          break;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
      case A_NPCM7XX_PWM_CMR2:
      case A_NPCM7XX_PWM_CMR3:
          p = &s->pwm[npcm7xx_cmr_index(offset)];
 -        p->cmr = value;
 +        if (value > NPCM7XX_MAX_CMR) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid cmr value: %u", __func__, value);
 +            p->cmr = NPCM7XX_MAX_CMR;
 +        } else {
 +            p->cmr = value;
 +        }
          npcm7xx_pwm_update_output(p);
          break;
 diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/npcm7xx_pwm-test.c
 +++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
  static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
  {
 -    uint64_t duty;
 +    uint32_t duty;
      if (cnr == 0) {
          /* PWM is stopped. */
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
      } else if (cmr >= cnr) {
          duty = MAX_DUTY;
      } else {
 -        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
 +        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
      }
- }
-@@ -XXX,XX +XXX,XX @@ static const char *imx6ul_analog_reg_name(uint32_t reg)
+     if (inverted) {
      case USB_ANALOG_DIGPROG:
          return "USB_ANALOG_DIGPROG";
      default:
 -        sprintf(unknown, "%d ?", reg);
 +        sprintf(unknown, "%u ?", reg);
          return unknown;
      }
  }
 --
 .20.1

-[PULL 10/36] i.MX6: Fix bad printf format specifiers
+[PULL 08/46] target/arm: Replace magic value by MMU_DATA_LOAD definition
-From: Alex Chen <alex.chen@huawei.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We should use printf format specifier "%u" instead of "%d" for
+cpu_get_phys_page_debug() uses 'DATA LOAD' MMU access type.
 argument of type "unsigned int".
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Message-id: 20210127232822.3530782-1-f4bug@amsat.org
 Message-id: 20201126111109.112238-4-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/imx6_ccm.c | 20 ++++++++++----------
+ target/arm/helper.c | 2 +-
- hw/misc/imx6_src.c |  2 +-
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 11 insertions(+), 11 deletions(-)
-diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/imx6_ccm.c
+--- a/target/arm/helper.c
-+++ b/hw/misc/imx6_ccm.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx6_ccm_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-     case CCM_CMEOR:
-         return "CMEOR";
+     *attrs = (MemTxAttrs) {};
-     default:
--        sprintf(unknown, "%d ?", reg);
+-    ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-+        sprintf(unknown, "%u ?", reg);
++    ret = get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &phys_addr,
-         return unknown;
+                         attrs, &prot, &page_size, &fi, &cacheattrs);
-     }
- }
+     if (ret) {
@@ -XXX,XX +XXX,XX @@ static const char *imx6_analog_reg_name(uint32_t reg)
      case USB_ANALOG_DIGPROG:
          return "USB_ANALOG_DIGPROG";
      default:
 -        sprintf(unknown, "%d ?", reg);
 +        sprintf(unknown, "%u ?", reg);
          return unknown;
      }
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_clk(IMX6CCMState *dev)
          freq *= 20;
      }
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_pfd0_clk(IMX6CCMState *dev)
      freq = imx6_analog_get_pll2_clk(dev) * 18
             / EXTRACT(dev->analog[CCM_ANALOG_PFD_528], PFD0_FRAC);
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_pfd2_clk(IMX6CCMState *dev)
      freq = imx6_analog_get_pll2_clk(dev) * 18
             / EXTRACT(dev->analog[CCM_ANALOG_PFD_528], PFD2_FRAC);
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_periph_clk(IMX6CCMState *dev)
          break;
      }
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_ahb_clk(IMX6CCMState *dev)
      freq = imx6_analog_get_periph_clk(dev)
             / (1 + EXTRACT(dev->ccm[CCM_CBCDR], AHB_PODF));
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_ipg_clk(IMX6CCMState *dev)
      freq = imx6_ccm_get_ahb_clk(dev)
             / (1 + EXTRACT(dev->ccm[CCM_CBCDR], IPG_PODF));
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_per_clk(IMX6CCMState *dev)
      freq = imx6_ccm_get_ipg_clk(dev)
             / (1 + EXTRACT(dev->ccm[CCM_CSCMR1], PERCLK_PODF));
 -    DPRINTF("freq = %d\n", (uint32_t)freq);
 +    DPRINTF("freq = %u\n", (uint32_t)freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx6_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
          break;
      }
 -    DPRINTF("Clock = %d) = %d\n", clock, freq);
 +    DPRINTF("Clock = %d) = %u\n", clock, freq);
      return freq;
  }
 diff --git a/hw/misc/imx6_src.c b/hw/misc/imx6_src.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/imx6_src.c
 +++ b/hw/misc/imx6_src.c
@@ -XXX,XX +XXX,XX @@ static const char *imx6_src_reg_name(uint32_t reg)
      case SRC_GPR10:
          return "SRC_GPR10";
      default:
 -        sprintf(unknown, "%d ?", reg);
 +        sprintf(unknown, "%u ?", reg);
          return unknown;
      }
  }
 --
 .20.1

-New patch
+[PULL 09/46] configure: Move preadv check to meson.build
+Move the preadv availability check to meson.build.  This is what we
+want to be doing for host-OS-feature-checks anyway, but it also fixes
+a problem with building for macOS with the most recent XCode SDK on a
+Catalina host.
+On that configuration, 'preadv()' is provided as a weak symbol, so
+that programs can be built with optional support for it and make a
+runtime availability check to see whether the preadv() they have is a
+working one or one which they must not call because it will
+runtime-assert.  QEMU's configure test passes (unless you're building
+with --enable-werror) because the test program using preadv()
+compiles, but then QEMU crashes at runtime when preadv() is called,
+with errors like:
+  dyld: lazy symbol binding failed: Symbol not found: _preadv
+    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
+    Expected in: /usr/lib/libSystem.B.dylib
+  dyld: Symbol not found: _preadv
+    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
+    Expected in: /usr/lib/libSystem.B.dylib
+Meson's own function availability check has a special case for macOS
+which adds '-Wl,-no_weak_imports' to the compiler flags, which forces
+the test to require the real function, not the macOS-version-too-old
+stub.
+So this commit fixes the bug where macOS builds on Catalina currently
+require --disable-werror.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20210126155846.17109-1-peter.maydell@linaro.org
+---
+ configure   | 16 ----------------
+ meson.build |  4 +++-
+files changed, 3 insertions(+), 17 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ if compile_prog "" "" ; then
+   iovec=yes
+ fi
+-##########################################
+-# preadv probe
+-cat > $TMPC <<EOF
+-#include <sys/types.h>
+-#include <sys/uio.h>
+-#include <unistd.h>
+-int main(void) { return preadv(0, 0, 0, 0); }
+-EOF
+-preadv=no
+-if compile_prog "" "" ; then
+-  preadv=yes
+-fi
+-
+ ##########################################
+ # fdt probe
+@@ -XXX,XX +XXX,XX @@ fi
+ if test "$iovec" = "yes" ; then
+   echo "CONFIG_IOVEC=y" >> $config_host_mak
+ fi
+-if test "$preadv" = "yes" ; then
+-  echo "CONFIG_PREADV=y" >> $config_host_mak
+-fi
+ if test "$membarrier" = "yes" ; then
+   echo "CONFIG_MEMBARRIER=y" >> $config_host_mak
+ fi
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
+ config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
+ config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
++config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
++
+ ignored = ['CONFIG_QEMU_INTERP_PREFIX'] # actually per-target
+ arrays = ['CONFIG_AUDIO_DRIVERS', 'CONFIG_BDRV_RW_WHITELIST', 'CONFIG_BDRV_RO_WHITELIST']
+ strings = ['HOST_DSOSUF', 'CONFIG_IASL']
+@@ -XXX,XX +XXX,XX @@ summary_info += {'PIE':               get_option('b_pie')}
+ summary_info += {'static build':      config_host.has_key('CONFIG_STATIC')}
+ summary_info += {'malloc trim support': has_malloc_trim}
+ summary_info += {'membarrier':        config_host.has_key('CONFIG_MEMBARRIER')}
+-summary_info += {'preadv support':    config_host.has_key('CONFIG_PREADV')}
++summary_info += {'preadv support':    config_host_data.get('CONFIG_PREADV')}
+ summary_info += {'fdatasync':         config_host.has_key('CONFIG_FDATASYNC')}
+ summary_info += {'madvise':           config_host.has_key('CONFIG_MADVISE')}
+ summary_info += {'posix_madvise':     config_host.has_key('CONFIG_POSIX_MADVISE')}
+--
+.20.1

-New patch
+[PULL 10/46] configure: cross-compiling with empty cross_prefix
+From: Joelle van Dyne <j@getutm.app>
+The iOS toolchain does not use the host prefix naming convention. So we
+need to enable cross-compile options while allowing the PREFIX to be
+blank.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-3-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ cpu=""
+ iasl="iasl"
+ interp_prefix="/usr/gnemul/qemu-%M"
+ static="no"
++cross_compile="no"
+ cross_prefix=""
+ audio_drv_list=""
+ block_drv_rw_whitelist=""
+@@ -XXX,XX +XXX,XX @@ for opt do
+   optarg=$(expr "x$opt" : 'x[^=]*=\(.*\)')
+   case "$opt" in
+   --cross-prefix=*) cross_prefix="$optarg"
++                    cross_compile="yes"
+   ;;
+   --cc=*) CC="$optarg"
+   ;;
+@@ -XXX,XX +XXX,XX @@ $(echo Deprecated targets: $deprecated_targets_list | \
+   --target-list-exclude=LIST exclude a set of targets from the default target-list
+ Advanced options (experts only):
+-  --cross-prefix=PREFIX    use PREFIX for compile tools [$cross_prefix]
++  --cross-prefix=PREFIX    use PREFIX for compile tools, PREFIX can be blank [$cross_prefix]
+   --cc=CC                  use C compiler CC [$cc]
+   --iasl=IASL              use ACPI compiler IASL [$iasl]
+   --host-cc=CC             use C compiler CC [$host_cc] for code run at
+@@ -XXX,XX +XXX,XX @@ if has $sdl2_config; then
+ fi
+ echo "strip = [$(meson_quote $strip)]" >> $cross
+ echo "windres = [$(meson_quote $windres)]" >> $cross
+-if test -n "$cross_prefix"; then
++if test "$cross_compile" = "yes"; then
+     cross_arg="--cross-file config-meson.cross"
+     echo "[host_machine]" >> $cross
+     if test "$mingw32" = "yes" ; then
+--
+.20.1

-[PULL 01/36] hw/arm/smmuv3: Fix up L1STD_SPAN decoding
+[PULL 11/46] osdep: build with non-working system() function
-From: Kunkun Jiang <jiangkunkun@huawei.com>
+From: Joelle van Dyne <j@getutm.app>
-Accroding to the SMMUv3 spec, the SPAN field of Level1 Stream Table
+Build without error on hosts without a working system(). If system()
-Descriptor is 5 bits([4:0]).
+is called, return -1 with ENOSYS.
-Fixes: 9bde7f0674f(hw/arm/smmuv3: Implement translate callback)
+Signed-off-by: Joelle van Dyne <j@getutm.app>
-Signed-off-by: Kunkun Jiang <jiangkunkun@huawei.com>
+Message-id: 20210126012457.39046-6-j@getutm.app
 Message-id: 20201124023711.1184-1-jiangkunkun@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 2 +-
+ meson.build          |  1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ include/qemu/osdep.h | 12 ++++++++++++
 files changed, 13 insertions(+)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/meson.build
-+++ b/hw/arm/smmuv3-internal.h
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t l1std_l2ptr(STEDesc *desc)
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
-     return hi << 32 | lo;
+ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
- }
+ config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
+ config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
--#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))
++config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
-+#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 5))
+ config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ static inline void qemu_thread_jit_write(void) {}
  static inline void qemu_thread_jit_execute(void) {}
  #endif
 +/**
 + * Platforms which do not support system() return ENOSYS
 + */
 +#ifndef HAVE_SYSTEM_FUNCTION
 +#define system platform_does_not_support_system
 +static inline int platform_does_not_support_system(const char *command)
 +{
 +    errno = ENOSYS;
 +    return -1;
 +}
 +#endif /* !HAVE_SYSTEM_FUNCTION */
 +
  #endif
 --
 .20.1

-New patch
+[PULL 12/46] darwin: remove redundant dependency declaration
+From: Joelle van Dyne <j@getutm.app>
+Meson will find CoreFoundation, IOKit, and Cocoa as needed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-7-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 1 -
+file changed, 1 deletion(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ Darwin)
+   fi
+   audio_drv_list="coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+-  QEMU_LDFLAGS="-framework CoreFoundation -framework IOKit $QEMU_LDFLAGS"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+   # won't work when we're compiling with gcc as a C compiler.
+   QEMU_CFLAGS="-DOS_OBJECT_USE_OBJC=0 $QEMU_CFLAGS"
+--
+.20.1

-New patch
+[PULL 13/46] darwin: fix cross-compiling for Darwin
+From: Joelle van Dyne <j@getutm.app>
+Add objc to the Meson cross file as well as detection of Darwin.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210126012457.39046-8-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ echo "cpp_link_args = [${LDFLAGS:+$(meson_quote $LDFLAGS)}]" >> $cross
+ echo "[binaries]" >> $cross
+ echo "c = [$(meson_quote $cc)]" >> $cross
+ test -n "$cxx" && echo "cpp = [$(meson_quote $cxx)]" >> $cross
++test -n "$objcc" && echo "objc = [$(meson_quote $objcc)]" >> $cross
+ echo "ar = [$(meson_quote $ar)]" >> $cross
+ echo "nm = [$(meson_quote $nm)]" >> $cross
+ echo "pkgconfig = [$(meson_quote $pkg_config_exe)]" >> $cross
+@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
+     if test "$linux" = "yes" ; then
+         echo "system = 'linux'" >> $cross
+     fi
++    if test "$darwin" = "yes" ; then
++        echo "system = 'darwin'" >> $cross
++    fi
+     case "$ARCH" in
+         i386|x86_64)
+             echo "cpu_family = 'x86'" >> $cross
+--
+.20.1

-New patch
+[PULL 14/46] configure: cross compile should use x86_64 cpu_family
+From: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-9-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 5 ++++-
+file changed, 4 insertions(+), 1 deletion(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
+         echo "system = 'darwin'" >> $cross
+     fi
+     case "$ARCH" in
+-        i386|x86_64)
++        i386)
+             echo "cpu_family = 'x86'" >> $cross
+             ;;
++        x86_64)
++            echo "cpu_family = 'x86_64'" >> $cross
++            ;;
+         ppc64le)
+             echo "cpu_family = 'ppc64'" >> $cross
+             ;;
+--
+.20.1

-New patch
+[PULL 15/46] darwin: detect CoreAudio for build
+From: Joelle van Dyne <j@getutm.app>
+On iOS there is no CoreAudio, so we should not assume Darwin always
+has it.
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210126012457.39046-11-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 35 +++++++++++++++++++++++++++++++++--
+file changed, 33 insertions(+), 2 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fdt="auto"
+ netmap="no"
+ sdl="auto"
+ sdl_image="auto"
++coreaudio="auto"
+ virtiofsd="auto"
+ virtfs="auto"
+ libudev="auto"
+@@ -XXX,XX +XXX,XX @@ Darwin)
+     QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
+     QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
+   fi
+-  audio_drv_list="coreaudio try-sdl"
++  audio_drv_list="try-coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+   # won't work when we're compiling with gcc as a C compiler.
+@@ -XXX,XX +XXX,XX @@ EOF
+   fi
+ fi
++##########################################
++# detect CoreAudio
++if test "$coreaudio" != "no" ; then
++  coreaudio_libs="-framework CoreAudio"
++  cat > $TMPC << EOF
++#include <CoreAudio/CoreAudio.h>
++int main(void)
++{
++  return (int)AudioGetCurrentHostTime();
++}
++EOF
++  if compile_prog "" "$coreaudio_libs" ; then
++    coreaudio=yes
++  else
++    coreaudio=no
++  fi
++fi
++
+ ##########################################
+ # Sound support libraries probe
+@@ -XXX,XX +XXX,XX @@ for drv in $audio_drv_list; do
+     fi
+     ;;
+-    coreaudio)
++    coreaudio | try-coreaudio)
++    if test "$coreaudio" = "no"; then
++      if test "$drv" = "try-coreaudio"; then
++        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio//')
++      else
++        error_exit "$drv check failed" \
++                "Make sure to have the $drv is available."
++      fi
++    else
+       coreaudio_libs="-framework CoreAudio"
++      if test "$drv" = "try-coreaudio"; then
++        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio/coreaudio/')
++      fi
++    fi
+     ;;
+     dsound)
+--
+.20.1

-New patch
+[PULL 16/46] darwin: remove 64-bit build detection on 32-bit OS
+From: Joelle van Dyne <j@getutm.app>
+A workaround added in early days of 64-bit OSX forced x86_64 if the
+host machine had 64-bit support. This creates issues when cross-
+compiling for ARM64. Additionally, the user can always use --cpu=* to
+manually set the host CPU and therefore this workaround should be
+removed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Message-id: 20210126012457.39046-12-j@getutm.app
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure | 11 -----------
+file changed, 11 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fi
+ # the correct CPU with the --cpu option.
+ case $targetos in
+ Darwin)
+-  # on Leopard most of the system is 32-bit, so we have to ask the kernel if we can
+-  # run 64-bit userspace code.
+-  # If the user didn't specify a CPU explicitly and the kernel says this is
+-  # 64 bit hw, then assume x86_64. Otherwise fall through to the usual detection code.
+-  if test -z "$cpu" && test "$(sysctl -n hw.optional.x86_64)" = "1"; then
+-    cpu="x86_64"
+-  fi
+   HOST_DSOSUF=".dylib"
+   ;;
+ SunOS)
+@@ -XXX,XX +XXX,XX @@ OpenBSD)
+ Darwin)
+   bsd="yes"
+   darwin="yes"
+-  if [ "$cpu" = "x86_64" ] ; then
+-    QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
+-    QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
+-  fi
+   audio_drv_list="try-coreaudio try-sdl"
+   audio_possible_drivers="coreaudio sdl"
+   # Disable attempts to use ObjectiveC features in os/object.h since they
+--
+.20.1

-New patch
+[PULL 17/46] hvf: Add hypervisor entitlement to output binaries
+From: Alexander Graf <agraf@csgraf.de>
+In macOS 11, QEMU only gets access to Hypervisor.framework if it has the
+respective entitlement. Add an entitlement template and automatically self
+sign and apply the entitlement in the build.
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Tested-by: Roman Bolshakov <r.bolshakov@yadro.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ meson.build                  | 29 +++++++++++++++++++++++++----
+ accel/hvf/entitlements.plist |  8 ++++++++
+ scripts/entitlement.sh       | 13 +++++++++++++
+files changed, 46 insertions(+), 4 deletions(-)
+ create mode 100644 accel/hvf/entitlements.plist
+ create mode 100755 scripts/entitlement.sh
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
+     }]
+   endif
+   foreach exe: execs
+-    emulators += {exe['name']:
+-         executable(exe['name'], exe['sources'],
+-               install: true,
++    exe_name = exe['name']
++    exe_sign = 'CONFIG_HVF' in config_target
++    if exe_sign
++      exe_name += '-unsigned'
++    endif
++
++    emulator = executable(exe_name, exe['sources'],
++               install: not exe_sign,
+                c_args: c_args,
+                dependencies: arch_deps + deps + exe['dependencies'],
+                objects: lib.extract_all_objects(recursive: true),
+@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
+                link_depends: [block_syms, qemu_syms] + exe.get('link_depends', []),
+                link_args: link_args,
+                gui_app: exe['gui'])
+-    }
++
++    if exe_sign
++      emulators += {exe['name'] : custom_target(exe['name'],
++                   install: true,
++                   install_dir: get_option('bindir'),
++                   depends: emulator,
++                   output: exe['name'],
++                   command: [
++                     meson.current_source_dir() / 'scripts/entitlement.sh',
++                     meson.current_build_dir() / exe_name,
++                     meson.current_build_dir() / exe['name'],
++                     meson.current_source_dir() / 'accel/hvf/entitlements.plist'
++                   ])
++      }
++    else
++      emulators += {exe['name']: emulator}
++    endif
+     if 'CONFIG_TRACE_SYSTEMTAP' in config_host
+       foreach stp: [
+diff --git a/accel/hvf/entitlements.plist b/accel/hvf/entitlements.plist
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/accel/hvf/entitlements.plist
+@@ -XXX,XX +XXX,XX @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
++<plist version="1.0">
++<dict>
++    <key>com.apple.security.hypervisor</key>
++    <true/>
++</dict>
++</plist>
+diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh
+new file mode 100755
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/scripts/entitlement.sh
+@@ -XXX,XX +XXX,XX @@
++#!/bin/sh -e
++#
++# Helper script for the build process to apply entitlements
++
++SRC="$1"
++DST="$2"
++ENTITLEMENT="$3"
++
++trap 'rm "$DST.tmp"' exit
++cp -af "$SRC" "$DST.tmp"
++codesign --entitlements "$ENTITLEMENT" --force -s - "$DST.tmp"
++mv "$DST.tmp" "$DST"
++trap '' exit
+--
+.20.1

-[PULL 07/36] tests/qtest/npcm7xx_rng-test: dump random data on failure
+[PULL 18/46] hw/misc/pvpanic: split-out generic and bus dependent code
-From: Havard Skinnemoen <hskinnemoen@google.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-Dump the collected random data after a randomness test failure.
+To ease the PCI device addition in next patches, split the code as follows:
+- generic code (read/write/setup) is being kept in pvpanic.c
-Note that this relies on the test having called
+- ISA dependent code moved to pvpanic-isa.c
-g_test_set_nonfatal_assertions() so we don't abort immediately on the
-assertion failure.
+Also, rename:
+- ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
-Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
+- TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
 - MemoryRegion io -> mr.
 - pvpanic_ioport_* in pvpanic_*.
 Update the build system with the new files and config structure.
 Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: minor commit message tweak]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/npcm7xx_rng-test.c | 12 ++++++++++++
+ include/hw/misc/pvpanic.h | 23 +++++++++-
-file changed, 12 insertions(+)
+ hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
+ hw/misc/pvpanic.c         | 85 +++--------------------------------
-diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
+ hw/i386/Kconfig           |  2 +-
-index XXXXXXX..XXXXXXX 100644
+ hw/misc/Kconfig           |  6 ++-
---- a/tests/qtest/npcm7xx_rng-test.c
+ hw/misc/meson.build       |  3 +-
-+++ b/tests/qtest/npcm7xx_rng-test.c
+ tests/qtest/meson.build   |  2 +-
 files changed, 130 insertions(+), 85 deletions(-)
  create mode 100644 hw/misc/pvpanic-isa.c
 diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/pvpanic.h
 +++ b/include/hw/misc/pvpanic.h
 @@ -XXX,XX +XXX,XX @@
- #include "libqtest-single.h"
+ #include "qom/object.h"
- #include "qemu/bitops.h"
-+#include "qemu-common.h"
+-#define TYPE_PVPANIC "pvpanic"
++#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
- #define RNG_BASE_ADDR   0xf000b000
+ #define PVPANIC_IOPORT_PROP "ioport"
 +/* The bit of supported pv event, TODO: include uapi header and remove this */
 +#define PVPANIC_F_PANICKED      0
 +#define PVPANIC_F_CRASHLOADED   1
 +
 +/* The pv event value */
 +#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
 +#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
 +
 +/*
 + * PVPanicState for any device type
 + */
 +typedef struct PVPanicState PVPanicState;
 +struct PVPanicState {
 +    MemoryRegion mr;
 +    uint8_t events;
 +};
 +
 +void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
 +
  static inline uint16_t pvpanic_port(void)
  {
 -    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
 +    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
      if (!o) {
          return 0;
      }
 diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/pvpanic-isa.c
 @@ -XXX,XX +XXX,XX @@
- /* Number of bits to collect for randomness tests. */
++/*
- #define TEST_INPUT_BITS  (128)
++ * QEMU simulated pvpanic device.
++ *
-+static void dump_buf_if_failed(const uint8_t *buf, size_t size)
++ * Copyright Fujitsu, Corp. 2013
 + *
 + * Authors:
 + *     Wen Congyang <wency@cn.fujitsu.com>
 + *     Hu Tao <hutao@cn.fujitsu.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "sysemu/runstate.h"
 +
 +#include "hw/nvram/fw_cfg.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/misc/pvpanic.h"
 +#include "qom/object.h"
 +#include "hw/isa/isa.h"
 +
 +OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
 +
 +/*
 + * PVPanicISAState for ISA device and
 + * use ioport.
 + */
 +struct PVPanicISAState {
 +    ISADevice parent_obj;
 +
 +    uint16_t ioport;
 +    PVPanicState pvpanic;
 +};
 +
 +static void pvpanic_isa_initfn(Object *obj)
 +{
-+    if (g_test_failed()) {
++    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
-+        qemu_hexdump(stderr, "", buf, size);
++
 +    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
 +}
 +
 +static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
 +{
 +    ISADevice *d = ISA_DEVICE(dev);
 +    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
 +    PVPanicState *ps = &s->pvpanic;
 +    FWCfgState *fw_cfg = fw_cfg_find();
 +    uint16_t *pvpanic_port;
 +
 +    if (!fw_cfg) {
 +        return;
 +    }
++
++    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
++    *pvpanic_port = cpu_to_le16(s->ioport);
++    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
++                    sizeof(*pvpanic_port));
++
++    isa_register_ioport(d, &ps->mr, s->ioport);
 +}
 +
- static void rng_writeb(unsigned int offset, uint8_t value)
++static Property pvpanic_isa_properties[] = {
- {
++    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
-     writeb(RNG_BASE_ADDR + offset, value);
++    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-@@ -XXX,XX +XXX,XX @@ static void test_continuous_monobit(void)
++    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = pvpanic_isa_realizefn;
 +    device_class_set_props(dc, pvpanic_isa_properties);
 +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 +}
 +
 +static TypeInfo pvpanic_isa_info = {
 +    .name          = TYPE_PVPANIC_ISA_DEVICE,
 +    .parent        = TYPE_ISA_DEVICE,
 +    .instance_size = sizeof(PVPanicISAState),
 +    .instance_init = pvpanic_isa_initfn,
 +    .class_init    = pvpanic_isa_class_init,
 +};
 +
 +static void pvpanic_register_types(void)
 +{
 +    type_register_static(&pvpanic_isa_info);
 +}
 +
 +type_init(pvpanic_register_types)
 diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/pvpanic.c
 +++ b/hw/misc/pvpanic.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/misc/pvpanic.h"
  #include "qom/object.h"
 -/* The bit of supported pv event, TODO: include uapi header and remove this */
 -#define PVPANIC_F_PANICKED      0
 -#define PVPANIC_F_CRASHLOADED   1
 -
 -/* The pv event value */
 -#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
 -#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
 -
 -typedef struct PVPanicState PVPanicState;
 -DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
 -                         TYPE_PVPANIC)
 -
  static void handle_event(int event)
  {
      static bool logged;
@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
      }
-     g_assert_cmpfloat(calc_monobit_p(buf, sizeof(buf)), >, 0.01);
-+    dump_buf_if_failed(buf, sizeof(buf));
  }
- /*
+-#include "hw/isa/isa.h"
-@@ -XXX,XX +XXX,XX @@ static void test_continuous_runs(void)
+-
-     }
+-struct PVPanicState {
+-    ISADevice parent_obj;
-     g_assert_cmpfloat(calc_runs_p(buf.l, sizeof(buf) * BITS_PER_BYTE), >, 0.01);
+-
-+    dump_buf_if_failed(buf.c, sizeof(buf));
+-    MemoryRegion io;
 -    uint16_t ioport;
 -    uint8_t events;
 -};
 -
  /* return supported events on read */
 -static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
 +static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
  {
      PVPanicState *pvp = opaque;
      return pvp->events;
  }
- /*
+-static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
-@@ -XXX,XX +XXX,XX @@ static void test_first_byte_monobit(void)
++static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
-     }
+                                  unsigned size)
+ {
-     g_assert_cmpfloat(calc_monobit_p(buf, sizeof(buf)), >, 0.01);
+     handle_event(val);
 +    dump_buf_if_failed(buf, sizeof(buf));
  }
- /*
+ static const MemoryRegionOps pvpanic_ops = {
-@@ -XXX,XX +XXX,XX @@ static void test_first_byte_runs(void)
+-    .read = pvpanic_ioport_read,
-     }
+-    .write = pvpanic_ioport_write,
++    .read = pvpanic_read,
-     g_assert_cmpfloat(calc_runs_p(buf.l, sizeof(buf) * BITS_PER_BYTE), >, 0.01);
++    .write = pvpanic_write,
-+    dump_buf_if_failed(buf.c, sizeof(buf));
+     .impl = {
          .min_access_size = 1,
          .max_access_size = 1,
      },
  };
 -static void pvpanic_isa_initfn(Object *obj)
 +void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
  {
 -    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
 -
 -    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
 +    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
  }
+-
- int main(int argc, char **argv)
+-static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
 -{
 -    ISADevice *d = ISA_DEVICE(dev);
 -    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
 -    FWCfgState *fw_cfg = fw_cfg_find();
 -    uint16_t *pvpanic_port;
 -
 -    if (!fw_cfg) {
 -        return;
 -    }
 -
 -    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
 -    *pvpanic_port = cpu_to_le16(s->ioport);
 -    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
 -                    sizeof(*pvpanic_port));
 -
 -    isa_register_ioport(d, &s->io, s->ioport);
 -}
 -
 -static Property pvpanic_isa_properties[] = {
 -    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
 -    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
 -    DEFINE_PROP_END_OF_LIST(),
 -};
 -
 -static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
 -{
 -    DeviceClass *dc = DEVICE_CLASS(klass);
 -
 -    dc->realize = pvpanic_isa_realizefn;
 -    device_class_set_props(dc, pvpanic_isa_properties);
 -    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 -}
 -
 -static TypeInfo pvpanic_isa_info = {
 -    .name          = TYPE_PVPANIC,
 -    .parent        = TYPE_ISA_DEVICE,
 -    .instance_size = sizeof(PVPanicState),
 -    .instance_init = pvpanic_isa_initfn,
 -    .class_init    = pvpanic_isa_class_init,
 -};
 -
 -static void pvpanic_register_types(void)
 -{
 -    type_register_static(&pvpanic_isa_info);
 -}
 -
 -type_init(pvpanic_register_types)
 diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i386/Kconfig
 +++ b/hw/i386/Kconfig
@@ -XXX,XX +XXX,XX @@ config PC
      imply ISA_DEBUG
      imply PARALLEL
      imply PCI_DEVICES
 -    imply PVPANIC
 +    imply PVPANIC_ISA
      imply QXL
      imply SEV
      imply SGA
 diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/Kconfig
 +++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
  config IOTKIT_SYSINFO
      bool
 -config PVPANIC
 +config PVPANIC_COMMON
 +    bool
 +
 +config PVPANIC_ISA
      bool
      depends on ISA_BUS
 +    select PVPANIC_COMMON
  config AUX
      bool
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
  softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
  softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
  softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
 +softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
  # ARM devices
  softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
  softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
  softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 -softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
 +softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
  softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
  softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
  softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
    (config_host.has_key('CONFIG_LINUX') and                                                  \
     config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
    (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
 -  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
 +  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
    (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
    (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
    (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
 --
 .20.1

-[PULL 02/36] hw/net/can: Introduce Xilinx ZynqMP CAN controller
+[PULL 19/46] hw/misc/pvpanic: add PCI interface support
-From: Vikram Garhwal <fnu.vikram@xilinx.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-The Xilinx ZynqMP CAN controller is developed based on SocketCAN, QEMU CAN bus
+Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
-implementation. Bus connection and socketCAN connection for each CAN module
+where the PCI specific routines reside and update the build system with the new
-can be set through command lines.
+files and config structure.
-Example for using single CAN:
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-    -object can-bus,id=canbus0 \
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
     -machine xlnx-zcu102.canbus0=canbus0 \
     -object can-host-socketcan,id=socketcan0,if=vcan0,canbus=canbus0
 Example for connecting both CAN to same virtual CAN on host machine:
     -object can-bus,id=canbus0 -object can-bus,id=canbus1 \
     -machine xlnx-zcu102.canbus0=canbus0 \
     -machine xlnx-zcu102.canbus1=canbus1 \
     -object can-host-socketcan,id=socketcan0,if=vcan0,canbus=canbus0 \
     -object can-host-socketcan,id=socketcan1,if=vcan0,canbus=canbus1
 To create virtual CAN on the host machine, please check the QEMU CAN docs:
 https://github.com/qemu/qemu/blob/master/docs/can.txt
 Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
 Message-id: 1605728926-352690-2-git-send-email-fnu.vikram@xilinx.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- meson.build                      |    1 +
+ docs/specs/pci-ids.txt    |  1 +
- hw/net/can/trace.h               |    1 +
+ include/hw/misc/pvpanic.h |  1 +
- include/hw/net/xlnx-zynqmp-can.h |   78 ++
+ include/hw/pci/pci.h      |  1 +
- hw/net/can/xlnx-zynqmp-can.c     | 1161 ++++++++++++++++++++++++++++++
+ hw/misc/pvpanic-pci.c     | 94 +++++++++++++++++++++++++++++++++++++++
- hw/Kconfig                       |    1 +
+ hw/misc/Kconfig           |  6 +++
- hw/net/can/meson.build           |    1 +
+ hw/misc/meson.build       |  1 +
- hw/net/can/trace-events          |    9 +
+files changed, 104 insertions(+)
-files changed, 1252 insertions(+)
+ create mode 100644 hw/misc/pvpanic-pci.c
  create mode 100644 hw/net/can/trace.h
  create mode 100644 include/hw/net/xlnx-zynqmp-can.h
  create mode 100644 hw/net/can/xlnx-zynqmp-can.c
  create mode 100644 hw/net/can/trace-events
-diff --git a/meson.build b/meson.build
+diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/docs/specs/pci-ids.txt
-+++ b/meson.build
++++ b/docs/specs/pci-ids.txt
-@@ -XXX,XX +XXX,XX @@ if have_system
+@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
-     'hw/misc',
+b36:000d  PCI xhci usb host adapter
-     'hw/misc/macio',
+b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
-     'hw/net',
+b36:0010  PCIe NVMe device (-device nvme)
-+    'hw/net/can',
++1b36:0011  PCI PVPanic device (-device pvpanic-pci)
-     'hw/nvram',
-     'hw/pci',
+ All these devices are documented in docs/specs.
-     'hw/pci-host',
-diff --git a/hw/net/can/trace.h b/hw/net/can/trace.h
+diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/pvpanic.h
 +++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
  #include "qom/object.h"
  #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
 +#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
  #define PVPANIC_IOPORT_PROP "ioport"
 diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/pci/pci.h
 +++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
  #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
  #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
  #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
 +#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
  #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
  #define FMT_PCIBUS                      PRIx64
 diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/net/can/trace.h
++++ b/hw/misc/pvpanic-pci.c
@@ -0,0 +1 @@
 +#include "trace/trace-hw_net_can.h"
 diff --git a/include/hw/net/xlnx-zynqmp-can.h b/include/hw/net/xlnx-zynqmp-can.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/net/xlnx-zynqmp-can.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU model of the Xilinx ZynqMP CAN controller.
++ * QEMU simulated PCI pvpanic device.
 + *
-+ * Copyright (c) 2020 Xilinx Inc.
++ * Copyright (C) 2020 Oracle
 + *
-+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
++ * Authors:
 + *     Mihai Carabas <mihai.carabas@oracle.com>
 + *
-+ * Based on QEMU CAN Device emulation implemented by Jin Yang, Deniz Eren and
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * Pavel Pisa.
++ * See the COPYING file in the top-level directory.
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#ifndef XLNX_ZYNQMP_CAN_H
-+#define XLNX_ZYNQMP_CAN_H
-+
-+#include "hw/register.h"
-+#include "net/can_emu.h"
-+#include "net/can_host.h"
-+#include "qemu/fifo32.h"
-+#include "hw/ptimer.h"
-+#include "hw/qdev-clock.h"
-+
-+#define TYPE_XLNX_ZYNQMP_CAN "xlnx.zynqmp-can"
-+
-+#define XLNX_ZYNQMP_CAN(obj) \
-+     OBJECT_CHECK(XlnxZynqMPCANState, (obj), TYPE_XLNX_ZYNQMP_CAN)
-+
-+#define MAX_CAN_CTRLS      2
-+#define XLNX_ZYNQMP_CAN_R_MAX     (0x84 / 4)
-+#define MAILBOX_CAPACITY   64
-+#define CAN_TIMER_MAX  0XFFFFUL
-+#define CAN_DEFAULT_CLOCK (24 * 1000 * 1000)
-+
-+/* Each CAN_FRAME will have 4 * 32bit size. */
-+#define CAN_FRAME_SIZE     4
-+#define RXFIFO_SIZE        (MAILBOX_CAPACITY * CAN_FRAME_SIZE)
-+
-+typedef struct XlnxZynqMPCANState {
-+    SysBusDevice        parent_obj;
-+    MemoryRegion        iomem;
-+
-+    qemu_irq            irq;
-+
-+    CanBusClientState   bus_client;
-+    CanBusState         *canbus;
-+
-+    struct {
-+        uint32_t        ext_clk_freq;
-+    } cfg;
-+
-+    RegisterInfo        reg_info[XLNX_ZYNQMP_CAN_R_MAX];
-+    uint32_t            regs[XLNX_ZYNQMP_CAN_R_MAX];
-+
-+    Fifo32              rx_fifo;
-+    Fifo32              tx_fifo;
-+    Fifo32              txhpb_fifo;
-+
-+    ptimer_state        *can_timer;
-+} XlnxZynqMPCANState;
-+
-+#endif
-diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/net/can/xlnx-zynqmp-can.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU model of the Xilinx ZynqMP CAN controller.
-+ * This implementation is based on the following datasheet:
-+ * https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
-+ *
-+ * Copyright (c) 2020 Xilinx Inc.
-+ *
-+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
-+ *
-+ * Based on QEMU CAN Device emulation implemented by Jin Yang, Deniz Eren and
-+ * Pavel Pisa
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "hw/sysbus.h"
-+#include "hw/register.h"
-+#include "hw/irq.h"
-+#include "qapi/error.h"
-+#include "qemu/bitops.h"
 +#include "qemu/log.h"
-+#include "qemu/cutils.h"
++#include "qemu/module.h"
-+#include "sysemu/sysemu.h"
++#include "sysemu/runstate.h"
 +
 +#include "hw/nvram/fw_cfg.h"
 +#include "hw/qdev-properties.h"
 +#include "migration/vmstate.h"
-+#include "hw/qdev-properties.h"
++#include "hw/misc/pvpanic.h"
-+#include "net/can_emu.h"
++#include "qom/object.h"
-+#include "net/can_host.h"
++#include "hw/pci/pci.h"
 +#include "qemu/event_notifier.h"
 +#include "qom/object_interfaces.h"
 +#include "hw/net/xlnx-zynqmp-can.h"
 +#include "trace.h"
 +
-+#ifndef XLNX_ZYNQMP_CAN_ERR_DEBUG
++OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
 +#define XLNX_ZYNQMP_CAN_ERR_DEBUG 0
 +#endif
 +
-+#define MAX_DLC            8
++/*
-+#undef ERROR
++ * PVPanicPCIState for PCI device
 + */
 +typedef struct PVPanicPCIState {
 +    PCIDevice dev;
 +    PVPanicState pvpanic;
 +} PVPanicPCIState;
 +
-+REG32(SOFTWARE_RESET_REGISTER, 0x0)
++static const VMStateDescription vmstate_pvpanic_pci = {
-+    FIELD(SOFTWARE_RESET_REGISTER, CEN, 1, 1)
++    .name = "pvpanic-pci",
-+    FIELD(SOFTWARE_RESET_REGISTER, SRST, 0, 1)
++    .version_id = 1,
-+REG32(MODE_SELECT_REGISTER, 0x4)
++    .minimum_version_id = 1,
-+    FIELD(MODE_SELECT_REGISTER, SNOOP, 2, 1)
++    .fields = (VMStateField[]) {
-+    FIELD(MODE_SELECT_REGISTER, LBACK, 1, 1)
++        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
-+    FIELD(MODE_SELECT_REGISTER, SLEEP, 0, 1)
++        VMSTATE_END_OF_LIST()
 +REG32(ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER, 0x8)
 +    FIELD(ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER, BRP, 0, 8)
 +REG32(ARBITRATION_PHASE_BIT_TIMING_REGISTER, 0xc)
 +    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, SJW, 7, 2)
 +    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, TS2, 4, 3)
 +    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, TS1, 0, 4)
 +REG32(ERROR_COUNTER_REGISTER, 0x10)
 +    FIELD(ERROR_COUNTER_REGISTER, REC, 8, 8)
 +    FIELD(ERROR_COUNTER_REGISTER, TEC, 0, 8)
 +REG32(ERROR_STATUS_REGISTER, 0x14)
 +    FIELD(ERROR_STATUS_REGISTER, ACKER, 4, 1)
 +    FIELD(ERROR_STATUS_REGISTER, BERR, 3, 1)
 +    FIELD(ERROR_STATUS_REGISTER, STER, 2, 1)
 +    FIELD(ERROR_STATUS_REGISTER, FMER, 1, 1)
 +    FIELD(ERROR_STATUS_REGISTER, CRCER, 0, 1)
 +REG32(STATUS_REGISTER, 0x18)
 +    FIELD(STATUS_REGISTER, SNOOP, 12, 1)
 +    FIELD(STATUS_REGISTER, ACFBSY, 11, 1)
 +    FIELD(STATUS_REGISTER, TXFLL, 10, 1)
 +    FIELD(STATUS_REGISTER, TXBFLL, 9, 1)
 +    FIELD(STATUS_REGISTER, ESTAT, 7, 2)
 +    FIELD(STATUS_REGISTER, ERRWRN, 6, 1)
 +    FIELD(STATUS_REGISTER, BBSY, 5, 1)
 +    FIELD(STATUS_REGISTER, BIDLE, 4, 1)
 +    FIELD(STATUS_REGISTER, NORMAL, 3, 1)
 +    FIELD(STATUS_REGISTER, SLEEP, 2, 1)
 +    FIELD(STATUS_REGISTER, LBACK, 1, 1)
 +    FIELD(STATUS_REGISTER, CONFIG, 0, 1)
 +REG32(INTERRUPT_STATUS_REGISTER, 0x1c)
 +    FIELD(INTERRUPT_STATUS_REGISTER, TXFEMP, 14, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, TXFWMEMP, 13, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, RXFWMFLL, 12, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, WKUP, 11, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, SLP, 10, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, BSOFF, 9, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, ERROR, 8, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, RXNEMP, 7, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, RXOFLW, 6, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, RXUFLW, 5, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, RXOK, 4, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, TXBFLL, 3, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, TXFLL, 2, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, TXOK, 1, 1)
 +    FIELD(INTERRUPT_STATUS_REGISTER, ARBLST, 0, 1)
 +REG32(INTERRUPT_ENABLE_REGISTER, 0x20)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFEMP, 14, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFWMEMP, 13, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ERXFWMFLL, 12, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, EWKUP, 11, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ESLP, 10, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, EBSOFF, 9, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, EERROR, 8, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ERXNEMP, 7, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ERXOFLW, 6, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ERXUFLW, 5, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ERXOK, 4, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ETXBFLL, 3, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFLL, 2, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, ETXOK, 1, 1)
 +    FIELD(INTERRUPT_ENABLE_REGISTER, EARBLST, 0, 1)
 +REG32(INTERRUPT_CLEAR_REGISTER, 0x24)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFEMP, 14, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFWMEMP, 13, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CRXFWMFLL, 12, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CWKUP, 11, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CSLP, 10, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CBSOFF, 9, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CERROR, 8, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CRXNEMP, 7, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CRXOFLW, 6, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CRXUFLW, 5, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CRXOK, 4, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CTXBFLL, 3, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFLL, 2, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CTXOK, 1, 1)
 +    FIELD(INTERRUPT_CLEAR_REGISTER, CARBLST, 0, 1)
 +REG32(TIMESTAMP_REGISTER, 0x28)
 +    FIELD(TIMESTAMP_REGISTER, CTS, 0, 1)
 +REG32(WIR, 0x2c)
 +    FIELD(WIR, EW, 8, 8)
 +    FIELD(WIR, FW, 0, 8)
 +REG32(TXFIFO_ID, 0x30)
 +    FIELD(TXFIFO_ID, IDH, 21, 11)
 +    FIELD(TXFIFO_ID, SRRRTR, 20, 1)
 +    FIELD(TXFIFO_ID, IDE, 19, 1)
 +    FIELD(TXFIFO_ID, IDL, 1, 18)
 +    FIELD(TXFIFO_ID, RTR, 0, 1)
 +REG32(TXFIFO_DLC, 0x34)
 +    FIELD(TXFIFO_DLC, DLC, 28, 4)
 +REG32(TXFIFO_DATA1, 0x38)
 +    FIELD(TXFIFO_DATA1, DB0, 24, 8)
 +    FIELD(TXFIFO_DATA1, DB1, 16, 8)
 +    FIELD(TXFIFO_DATA1, DB2, 8, 8)
 +    FIELD(TXFIFO_DATA1, DB3, 0, 8)
 +REG32(TXFIFO_DATA2, 0x3c)
 +    FIELD(TXFIFO_DATA2, DB4, 24, 8)
 +    FIELD(TXFIFO_DATA2, DB5, 16, 8)
 +    FIELD(TXFIFO_DATA2, DB6, 8, 8)
 +    FIELD(TXFIFO_DATA2, DB7, 0, 8)
 +REG32(TXHPB_ID, 0x40)
 +    FIELD(TXHPB_ID, IDH, 21, 11)
 +    FIELD(TXHPB_ID, SRRRTR, 20, 1)
 +    FIELD(TXHPB_ID, IDE, 19, 1)
 +    FIELD(TXHPB_ID, IDL, 1, 18)
 +    FIELD(TXHPB_ID, RTR, 0, 1)
 +REG32(TXHPB_DLC, 0x44)
 +    FIELD(TXHPB_DLC, DLC, 28, 4)
 +REG32(TXHPB_DATA1, 0x48)
 +    FIELD(TXHPB_DATA1, DB0, 24, 8)
 +    FIELD(TXHPB_DATA1, DB1, 16, 8)
 +    FIELD(TXHPB_DATA1, DB2, 8, 8)
 +    FIELD(TXHPB_DATA1, DB3, 0, 8)
 +REG32(TXHPB_DATA2, 0x4c)
 +    FIELD(TXHPB_DATA2, DB4, 24, 8)
 +    FIELD(TXHPB_DATA2, DB5, 16, 8)
 +    FIELD(TXHPB_DATA2, DB6, 8, 8)
 +    FIELD(TXHPB_DATA2, DB7, 0, 8)
 +REG32(RXFIFO_ID, 0x50)
 +    FIELD(RXFIFO_ID, IDH, 21, 11)
 +    FIELD(RXFIFO_ID, SRRRTR, 20, 1)
 +    FIELD(RXFIFO_ID, IDE, 19, 1)
 +    FIELD(RXFIFO_ID, IDL, 1, 18)
 +    FIELD(RXFIFO_ID, RTR, 0, 1)
 +REG32(RXFIFO_DLC, 0x54)
 +    FIELD(RXFIFO_DLC, DLC, 28, 4)
 +    FIELD(RXFIFO_DLC, RXT, 0, 16)
 +REG32(RXFIFO_DATA1, 0x58)
 +    FIELD(RXFIFO_DATA1, DB0, 24, 8)
 +    FIELD(RXFIFO_DATA1, DB1, 16, 8)
 +    FIELD(RXFIFO_DATA1, DB2, 8, 8)
 +    FIELD(RXFIFO_DATA1, DB3, 0, 8)
 +REG32(RXFIFO_DATA2, 0x5c)
 +    FIELD(RXFIFO_DATA2, DB4, 24, 8)
 +    FIELD(RXFIFO_DATA2, DB5, 16, 8)
 +    FIELD(RXFIFO_DATA2, DB6, 8, 8)
 +    FIELD(RXFIFO_DATA2, DB7, 0, 8)
 +REG32(AFR, 0x60)
 +    FIELD(AFR, UAF4, 3, 1)
 +    FIELD(AFR, UAF3, 2, 1)
 +    FIELD(AFR, UAF2, 1, 1)
 +    FIELD(AFR, UAF1, 0, 1)
 +REG32(AFMR1, 0x64)
 +    FIELD(AFMR1, AMIDH, 21, 11)
 +    FIELD(AFMR1, AMSRR, 20, 1)
 +    FIELD(AFMR1, AMIDE, 19, 1)
 +    FIELD(AFMR1, AMIDL, 1, 18)
 +    FIELD(AFMR1, AMRTR, 0, 1)
 +REG32(AFIR1, 0x68)
 +    FIELD(AFIR1, AIIDH, 21, 11)
 +    FIELD(AFIR1, AISRR, 20, 1)
 +    FIELD(AFIR1, AIIDE, 19, 1)
 +    FIELD(AFIR1, AIIDL, 1, 18)
 +    FIELD(AFIR1, AIRTR, 0, 1)
 +REG32(AFMR2, 0x6c)
 +    FIELD(AFMR2, AMIDH, 21, 11)
 +    FIELD(AFMR2, AMSRR, 20, 1)
 +    FIELD(AFMR2, AMIDE, 19, 1)
 +    FIELD(AFMR2, AMIDL, 1, 18)
 +    FIELD(AFMR2, AMRTR, 0, 1)
 +REG32(AFIR2, 0x70)
 +    FIELD(AFIR2, AIIDH, 21, 11)
 +    FIELD(AFIR2, AISRR, 20, 1)
 +    FIELD(AFIR2, AIIDE, 19, 1)
 +    FIELD(AFIR2, AIIDL, 1, 18)
 +    FIELD(AFIR2, AIRTR, 0, 1)
 +REG32(AFMR3, 0x74)
 +    FIELD(AFMR3, AMIDH, 21, 11)
 +    FIELD(AFMR3, AMSRR, 20, 1)
 +    FIELD(AFMR3, AMIDE, 19, 1)
 +    FIELD(AFMR3, AMIDL, 1, 18)
 +    FIELD(AFMR3, AMRTR, 0, 1)
 +REG32(AFIR3, 0x78)
 +    FIELD(AFIR3, AIIDH, 21, 11)
 +    FIELD(AFIR3, AISRR, 20, 1)
 +    FIELD(AFIR3, AIIDE, 19, 1)
 +    FIELD(AFIR3, AIIDL, 1, 18)
 +    FIELD(AFIR3, AIRTR, 0, 1)
 +REG32(AFMR4, 0x7c)
 +    FIELD(AFMR4, AMIDH, 21, 11)
 +    FIELD(AFMR4, AMSRR, 20, 1)
 +    FIELD(AFMR4, AMIDE, 19, 1)
 +    FIELD(AFMR4, AMIDL, 1, 18)
 +    FIELD(AFMR4, AMRTR, 0, 1)
 +REG32(AFIR4, 0x80)
 +    FIELD(AFIR4, AIIDH, 21, 11)
 +    FIELD(AFIR4, AISRR, 20, 1)
 +    FIELD(AFIR4, AIIDE, 19, 1)
 +    FIELD(AFIR4, AIIDL, 1, 18)
 +    FIELD(AFIR4, AIRTR, 0, 1)
 +
 +static void can_update_irq(XlnxZynqMPCANState *s)
 +{
 +    uint32_t irq;
 +
 +    /* Watermark register interrupts. */
 +    if ((fifo32_num_free(&s->tx_fifo) / CAN_FRAME_SIZE) >
 +            ARRAY_FIELD_EX32(s->regs, WIR, EW)) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFWMEMP, 1);
 +    }
 +
 +    if ((fifo32_num_used(&s->rx_fifo) / CAN_FRAME_SIZE) >
 +            ARRAY_FIELD_EX32(s->regs, WIR, FW)) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXFWMFLL, 1);
 +    }
 +
 +    /* RX Interrupts. */
 +    if (fifo32_num_used(&s->rx_fifo) >= CAN_FRAME_SIZE) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXNEMP, 1);
 +    }
 +
 +    /* TX interrupts. */
 +    if (fifo32_is_empty(&s->tx_fifo)) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFEMP, 1);
 +    }
 +
 +    if (fifo32_is_full(&s->tx_fifo)) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFLL, 1);
 +    }
 +
 +    if (fifo32_is_full(&s->txhpb_fifo)) {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXBFLL, 1);
 +    }
 +
 +    irq = s->regs[R_INTERRUPT_STATUS_REGISTER];
 +    irq &= s->regs[R_INTERRUPT_ENABLE_REGISTER];
 +
 +    trace_xlnx_can_update_irq(s->regs[R_INTERRUPT_STATUS_REGISTER],
 +                              s->regs[R_INTERRUPT_ENABLE_REGISTER], irq);
 +    qemu_set_irq(s->irq, irq);
 +}
 +
 +static void can_ier_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    can_update_irq(s);
 +}
 +
 +static uint64_t can_icr_pre_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    s->regs[R_INTERRUPT_STATUS_REGISTER] &= ~val;
 +    can_update_irq(s);
 +
 +    return 0;
 +}
 +
 +static void can_config_reset(XlnxZynqMPCANState *s)
 +{
 +    /* Reset all the configuration registers. */
 +    register_reset(&s->reg_info[R_SOFTWARE_RESET_REGISTER]);
 +    register_reset(&s->reg_info[R_MODE_SELECT_REGISTER]);
 +    register_reset(
 +              &s->reg_info[R_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER]);
 +    register_reset(&s->reg_info[R_ARBITRATION_PHASE_BIT_TIMING_REGISTER]);
 +    register_reset(&s->reg_info[R_STATUS_REGISTER]);
 +    register_reset(&s->reg_info[R_INTERRUPT_STATUS_REGISTER]);
 +    register_reset(&s->reg_info[R_INTERRUPT_ENABLE_REGISTER]);
 +    register_reset(&s->reg_info[R_INTERRUPT_CLEAR_REGISTER]);
 +    register_reset(&s->reg_info[R_WIR]);
 +}
 +
 +static void can_config_mode(XlnxZynqMPCANState *s)
 +{
 +    register_reset(&s->reg_info[R_ERROR_COUNTER_REGISTER]);
 +    register_reset(&s->reg_info[R_ERROR_STATUS_REGISTER]);
 +
 +    /* Put XlnxZynqMPCAN in configuration mode. */
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, CONFIG, 1);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, WKUP, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, SLP, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, BSOFF, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, ERROR, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXOK, 0);
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, ARBLST, 0);
 +
 +    can_update_irq(s);
 +}
 +
 +static void update_status_register_mode_bits(XlnxZynqMPCANState *s)
 +{
 +    bool sleep_status = ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP);
 +    bool sleep_mode = ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SLEEP);
 +    /* Wake up interrupt bit. */
 +    bool wakeup_irq_val = sleep_status && (sleep_mode == 0);
 +    /* Sleep interrupt bit. */
 +    bool sleep_irq_val = sleep_mode && (sleep_status == 0);
 +
 +    /* Clear previous core mode status bits. */
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, LBACK, 0);
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SLEEP, 0);
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SNOOP, 0);
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, NORMAL, 0);
 +
 +    /* set current mode bit and generate irqs accordingly. */
 +    if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, LBACK)) {
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, LBACK, 1);
 +    } else if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SLEEP)) {
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SLEEP, 1);
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, SLP,
 +                         sleep_irq_val);
 +    } else if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SNOOP)) {
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SNOOP, 1);
 +    } else {
 +        /*
 +         * If all bits are zero then XlnxZynqMPCAN is set in normal mode.
 +         */
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, NORMAL, 1);
 +        /* Set wakeup interrupt bit. */
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, WKUP,
 +                         wakeup_irq_val);
 +    }
 +
 +    can_update_irq(s);
 +}
 +
 +static void can_exit_sleep_mode(XlnxZynqMPCANState *s)
 +{
 +    ARRAY_FIELD_DP32(s->regs, MODE_SELECT_REGISTER, SLEEP, 0);
 +    update_status_register_mode_bits(s);
 +}
 +
 +static void generate_frame(qemu_can_frame *frame, uint32_t *data)
 +{
 +    frame->can_id = data[0];
 +    frame->can_dlc = FIELD_EX32(data[1], TXFIFO_DLC, DLC);
 +
 +    frame->data[0] = FIELD_EX32(data[2], TXFIFO_DATA1, DB3);
 +    frame->data[1] = FIELD_EX32(data[2], TXFIFO_DATA1, DB2);
 +    frame->data[2] = FIELD_EX32(data[2], TXFIFO_DATA1, DB1);
 +    frame->data[3] = FIELD_EX32(data[2], TXFIFO_DATA1, DB0);
 +
 +    frame->data[4] = FIELD_EX32(data[3], TXFIFO_DATA2, DB7);
 +    frame->data[5] = FIELD_EX32(data[3], TXFIFO_DATA2, DB6);
 +    frame->data[6] = FIELD_EX32(data[3], TXFIFO_DATA2, DB5);
 +    frame->data[7] = FIELD_EX32(data[3], TXFIFO_DATA2, DB4);
 +}
 +
 +static bool tx_ready_check(XlnxZynqMPCANState *s)
 +{
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, SRST)) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer data while"
 +                      " data while controller is in reset mode.\n",
 +                      path);
 +        return false;
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer"
 +                      " data while controller is in configuration mode. Reset"
 +                      " the core so operations can start fresh.\n",
 +                      path);
 +        return false;
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SNOOP)) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer"
 +                      " data while controller is in SNOOP MODE.\n",
 +                      path);
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
 +{
 +    qemu_can_frame frame;
 +    uint32_t data[CAN_FRAME_SIZE];
 +    int i;
 +    bool can_tx = tx_ready_check(s);
 +
 +    if (!can_tx) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is not enabled for data"
 +                      " transfer.\n", path);
 +        can_update_irq(s);
 +        return;
 +    }
 +
 +    while (!fifo32_is_empty(fifo)) {
 +        for (i = 0; i < CAN_FRAME_SIZE; i++) {
 +            data[i] = fifo32_pop(fifo);
 +        }
 +
 +        if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, LBACK)) {
 +            /*
 +             * Controller is in loopback. In Loopback mode, the CAN core
 +             * transmits a recessive bitstream on to the XlnxZynqMPCAN Bus.
 +             * Any message transmitted is looped back to the RX line and
 +             * acknowledged. The XlnxZynqMPCAN core receives any message
 +             * that it transmits.
 +             */
 +            if (fifo32_is_full(&s->rx_fifo)) {
 +                ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
 +            } else {
 +                for (i = 0; i < CAN_FRAME_SIZE; i++) {
 +                    fifo32_push(&s->rx_fifo, data[i]);
 +                }
 +
 +                ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 1);
 +            }
 +        } else {
 +            /* Normal mode Tx. */
 +            generate_frame(&frame, data);
 +
 +            trace_xlnx_can_tx_data(frame.can_id, frame.can_dlc,
 +                                   frame.data[0], frame.data[1],
 +                                   frame.data[2], frame.data[3],
 +                                   frame.data[4], frame.data[5],
 +                                   frame.data[6], frame.data[7]);
 +            can_bus_client_send(&s->bus_client, &frame, 1);
 +        }
 +    }
 +
 +    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXOK, 1);
 +    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, TXBFLL, 0);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP)) {
 +        can_exit_sleep_mode(s);
 +    }
 +
 +    can_update_irq(s);
 +}
 +
 +static uint64_t can_srr_pre_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    ARRAY_FIELD_DP32(s->regs, SOFTWARE_RESET_REGISTER, CEN,
 +                     FIELD_EX32(val, SOFTWARE_RESET_REGISTER, CEN));
 +
 +    if (FIELD_EX32(val, SOFTWARE_RESET_REGISTER, SRST)) {
 +        trace_xlnx_can_reset(val);
 +
 +        /* First, core will do software reset then will enter in config mode. */
 +        can_config_reset(s);
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
 +        can_config_mode(s);
 +    } else {
 +        /*
 +         * Leave config mode. Now XlnxZynqMPCAN core will enter normal,
 +         * sleep, snoop or loopback mode depending upon LBACK, SLEEP, SNOOP
 +         * register states.
 +         */
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, CONFIG, 0);
 +
 +        ptimer_transaction_begin(s->can_timer);
 +        ptimer_set_count(s->can_timer, 0);
 +        ptimer_transaction_commit(s->can_timer);
 +
 +        /* XlnxZynqMPCAN is out of config mode. It will send pending data. */
 +        transfer_fifo(s, &s->txhpb_fifo);
 +        transfer_fifo(s, &s->tx_fifo);
 +    }
 +
 +    update_status_register_mode_bits(s);
 +
 +    return s->regs[R_SOFTWARE_RESET_REGISTER];
 +}
 +
 +static uint64_t can_msr_pre_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +    uint8_t multi_mode;
 +
 +    /*
 +     * Multiple mode set check. This is done to make sure user doesn't set
 +     * multiple modes.
 +     */
 +    multi_mode = FIELD_EX32(val, MODE_SELECT_REGISTER, LBACK) +
 +                 FIELD_EX32(val, MODE_SELECT_REGISTER, SLEEP) +
 +                 FIELD_EX32(val, MODE_SELECT_REGISTER, SNOOP);
 +
 +    if (multi_mode > 1) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to config"
 +                      " several modes simultaneously. One mode will be selected"
 +                      " according to their priority: LBACK > SLEEP > SNOOP.\n",
 +                      path);
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
 +        /* We are in configuration mode, any mode can be selected. */
 +        s->regs[R_MODE_SELECT_REGISTER] = val;
 +    } else {
 +        bool sleep_mode_bit = FIELD_EX32(val, MODE_SELECT_REGISTER, SLEEP);
 +
 +        ARRAY_FIELD_DP32(s->regs, MODE_SELECT_REGISTER, SLEEP, sleep_mode_bit);
 +
 +        if (FIELD_EX32(val, MODE_SELECT_REGISTER, LBACK)) {
 +            g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to set"
 +                          " LBACK mode without setting CEN bit as 0.\n",
 +                          path);
 +        } else if (FIELD_EX32(val, MODE_SELECT_REGISTER, SNOOP)) {
 +            g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to set"
 +                          " SNOOP mode without setting CEN bit as 0.\n",
 +                          path);
 +        }
 +
 +        update_status_register_mode_bits(s);
 +    }
 +
 +    return s->regs[R_MODE_SELECT_REGISTER];
 +}
 +
 +static uint64_t can_brpr_pre_write(RegisterInfo  *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    /* Only allow writes when in config mode. */
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
 +        return s->regs[R_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER];
 +    }
 +
 +    return val;
 +}
 +
 +static uint64_t can_btr_pre_write(RegisterInfo  *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    /* Only allow writes when in config mode. */
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
 +        return s->regs[R_ARBITRATION_PHASE_BIT_TIMING_REGISTER];
 +    }
 +
 +    return val;
 +}
 +
 +static uint64_t can_tcr_pre_write(RegisterInfo  *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    if (FIELD_EX32(val, TIMESTAMP_REGISTER, CTS)) {
 +        ptimer_transaction_begin(s->can_timer);
 +        ptimer_set_count(s->can_timer, 0);
 +        ptimer_transaction_commit(s->can_timer);
 +    }
 +
 +    return 0;
 +}
 +
 +static void update_rx_fifo(XlnxZynqMPCANState *s, const qemu_can_frame *frame)
 +{
 +    bool filter_pass = false;
 +    uint16_t timestamp = 0;
 +
 +    /* If no filter is enabled. Message will be stored in FIFO. */
 +    if (!((ARRAY_FIELD_EX32(s->regs, AFR, UAF1)) |
 +       (ARRAY_FIELD_EX32(s->regs, AFR, UAF2)) |
 +       (ARRAY_FIELD_EX32(s->regs, AFR, UAF3)) |
 +       (ARRAY_FIELD_EX32(s->regs, AFR, UAF4)))) {
 +        filter_pass = true;
 +    }
 +
 +    /*
 +     * Messages that pass any of the acceptance filters will be stored in
 +     * the RX FIFO.
 +     */
 +    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF1)) {
 +        uint32_t id_masked = s->regs[R_AFMR1] & frame->can_id;
 +        uint32_t filter_id_masked = s->regs[R_AFMR1] & s->regs[R_AFIR1];
 +
 +        if (filter_id_masked == id_masked) {
 +            filter_pass = true;
 +        }
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF2)) {
 +        uint32_t id_masked = s->regs[R_AFMR2] & frame->can_id;
 +        uint32_t filter_id_masked = s->regs[R_AFMR2] & s->regs[R_AFIR2];
 +
 +        if (filter_id_masked == id_masked) {
 +            filter_pass = true;
 +        }
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF3)) {
 +        uint32_t id_masked = s->regs[R_AFMR3] & frame->can_id;
 +        uint32_t filter_id_masked = s->regs[R_AFMR3] & s->regs[R_AFIR3];
 +
 +        if (filter_id_masked == id_masked) {
 +            filter_pass = true;
 +        }
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF4)) {
 +        uint32_t id_masked = s->regs[R_AFMR4] & frame->can_id;
 +        uint32_t filter_id_masked = s->regs[R_AFMR4] & s->regs[R_AFIR4];
 +
 +        if (filter_id_masked == id_masked) {
 +            filter_pass = true;
 +        }
 +    }
 +
 +    if (!filter_pass) {
 +        trace_xlnx_can_rx_fifo_filter_reject(frame->can_id, frame->can_dlc);
 +        return;
 +    }
 +
 +    /* Store the message in fifo if it passed through any of the filters. */
 +    if (filter_pass && frame->can_dlc <= MAX_DLC) {
 +
 +        if (fifo32_is_full(&s->rx_fifo)) {
 +            ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
 +        } else {
 +            timestamp = CAN_TIMER_MAX - ptimer_get_count(s->can_timer);
 +
 +            fifo32_push(&s->rx_fifo, frame->can_id);
 +
 +            fifo32_push(&s->rx_fifo, deposit32(0, R_RXFIFO_DLC_DLC_SHIFT,
 +                                               R_RXFIFO_DLC_DLC_LENGTH,
 +                                               frame->can_dlc) |
 +                                     deposit32(0, R_RXFIFO_DLC_RXT_SHIFT,
 +                                               R_RXFIFO_DLC_RXT_LENGTH,
 +                                               timestamp));
 +
 +            /* First 32 bit of the data. */
 +            fifo32_push(&s->rx_fifo, deposit32(0, R_TXFIFO_DATA1_DB3_SHIFT,
 +                                               R_TXFIFO_DATA1_DB3_LENGTH,
 +                                               frame->data[0]) |
 +                                     deposit32(0, R_TXFIFO_DATA1_DB2_SHIFT,
 +                                               R_TXFIFO_DATA1_DB2_LENGTH,
 +                                               frame->data[1]) |
 +                                     deposit32(0, R_TXFIFO_DATA1_DB1_SHIFT,
 +                                               R_TXFIFO_DATA1_DB1_LENGTH,
 +                                               frame->data[2]) |
 +                                     deposit32(0, R_TXFIFO_DATA1_DB0_SHIFT,
 +                                               R_TXFIFO_DATA1_DB0_LENGTH,
 +                                               frame->data[3]));
 +            /* Last 32 bit of the data. */
 +            fifo32_push(&s->rx_fifo, deposit32(0, R_TXFIFO_DATA2_DB7_SHIFT,
 +                                               R_TXFIFO_DATA2_DB7_LENGTH,
 +                                               frame->data[4]) |
 +                                     deposit32(0, R_TXFIFO_DATA2_DB6_SHIFT,
 +                                               R_TXFIFO_DATA2_DB6_LENGTH,
 +                                               frame->data[5]) |
 +                                     deposit32(0, R_TXFIFO_DATA2_DB5_SHIFT,
 +                                               R_TXFIFO_DATA2_DB5_LENGTH,
 +                                               frame->data[6]) |
 +                                     deposit32(0, R_TXFIFO_DATA2_DB4_SHIFT,
 +                                               R_TXFIFO_DATA2_DB4_LENGTH,
 +                                               frame->data[7]));
 +
 +            ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 1);
 +            trace_xlnx_can_rx_data(frame->can_id, frame->can_dlc,
 +                                   frame->data[0], frame->data[1],
 +                                   frame->data[2], frame->data[3],
 +                                   frame->data[4], frame->data[5],
 +                                   frame->data[6], frame->data[7]);
 +        }
 +
 +        can_update_irq(s);
 +    }
 +}
 +
 +static uint64_t can_rxfifo_pre_read(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    if (!fifo32_is_empty(&s->rx_fifo)) {
 +        val = fifo32_pop(&s->rx_fifo);
 +    } else {
 +        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXUFLW, 1);
 +    }
 +
 +    can_update_irq(s);
 +    return val;
 +}
 +
 +static void can_filter_enable_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF1) &&
 +        ARRAY_FIELD_EX32(s->regs, AFR, UAF2) &&
 +        ARRAY_FIELD_EX32(s->regs, AFR, UAF3) &&
 +        ARRAY_FIELD_EX32(s->regs, AFR, UAF4)) {
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, ACFBSY, 1);
 +    } else {
 +        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, ACFBSY, 0);
 +    }
 +}
 +
 +static uint64_t can_filter_mask_pre_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +    uint32_t reg_idx = (reg->access->addr) / 4;
 +    uint32_t filter_number = (reg_idx - R_AFMR1) / 2;
 +
 +    /* modify an acceptance filter, the corresponding UAF bit should be '0'. */
 +    if (!(s->regs[R_AFR] & (1 << filter_number))) {
 +        s->regs[reg_idx] = val;
 +
 +        trace_xlnx_can_filter_mask_pre_write(filter_number, s->regs[reg_idx]);
 +    } else {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d"
 +                      " mask is not set as corresponding UAF bit is not 0.\n",
 +                      path, filter_number + 1);
 +    }
 +
 +    return s->regs[reg_idx];
 +}
 +
 +static uint64_t can_filter_id_pre_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +    uint32_t reg_idx = (reg->access->addr) / 4;
 +    uint32_t filter_number = (reg_idx - R_AFIR1) / 2;
 +
 +    if (!(s->regs[R_AFR] & (1 << filter_number))) {
 +        s->regs[reg_idx] = val;
 +
 +        trace_xlnx_can_filter_id_pre_write(filter_number, s->regs[reg_idx]);
 +    } else {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d"
 +                      " id is not set as corresponding UAF bit is not 0.\n",
 +                      path, filter_number + 1);
 +    }
 +
 +    return s->regs[reg_idx];
 +}
 +
 +static void can_tx_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
 +
 +    bool is_txhpb = reg->access->addr > A_TXFIFO_DATA2;
 +
 +    bool initiate_transfer = (reg->access->addr == A_TXFIFO_DATA2) ||
 +                             (reg->access->addr == A_TXHPB_DATA2);
 +
 +    Fifo32 *f = is_txhpb ? &s->txhpb_fifo : &s->tx_fifo;
 +
 +    if (!fifo32_is_full(f)) {
 +        fifo32_push(f, val);
 +    } else {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: TX FIFO is full.\n", path);
 +    }
 +
 +    /* Initiate the message send if TX register is written. */
 +    if (initiate_transfer &&
 +        ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
 +        transfer_fifo(s, f);
 +    }
 +
 +    can_update_irq(s);
 +}
 +
 +static const RegisterAccessInfo can_regs_info[] = {
 +    {   .name = "SOFTWARE_RESET_REGISTER",
 +        .addr = A_SOFTWARE_RESET_REGISTER,
 +        .rsvd = 0xfffffffc,
 +        .pre_write = can_srr_pre_write,
 +    },{ .name = "MODE_SELECT_REGISTER",
 +        .addr = A_MODE_SELECT_REGISTER,
 +        .rsvd = 0xfffffff8,
 +        .pre_write = can_msr_pre_write,
 +    },{ .name = "ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER",
 +        .addr = A_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER,
 +        .rsvd = 0xffffff00,
 +        .pre_write = can_brpr_pre_write,
 +    },{ .name = "ARBITRATION_PHASE_BIT_TIMING_REGISTER",
 +        .addr = A_ARBITRATION_PHASE_BIT_TIMING_REGISTER,
 +        .rsvd = 0xfffffe00,
 +        .pre_write = can_btr_pre_write,
 +    },{ .name = "ERROR_COUNTER_REGISTER",
 +        .addr = A_ERROR_COUNTER_REGISTER,
 +        .rsvd = 0xffff0000,
 +        .ro = 0xffffffff,
 +    },{ .name = "ERROR_STATUS_REGISTER",
 +        .addr = A_ERROR_STATUS_REGISTER,
 +        .rsvd = 0xffffffe0,
 +        .w1c = 0x1f,
 +    },{ .name = "STATUS_REGISTER",  .addr = A_STATUS_REGISTER,
 +        .reset = 0x1,
 +        .rsvd = 0xffffe000,
 +        .ro = 0x1fff,
 +    },{ .name = "INTERRUPT_STATUS_REGISTER",
 +        .addr = A_INTERRUPT_STATUS_REGISTER,
 +        .reset = 0x6000,
 +        .rsvd = 0xffff8000,
 +        .ro = 0x7fff,
 +    },{ .name = "INTERRUPT_ENABLE_REGISTER",
 +        .addr = A_INTERRUPT_ENABLE_REGISTER,
 +        .rsvd = 0xffff8000,
 +        .post_write = can_ier_post_write,
 +    },{ .name = "INTERRUPT_CLEAR_REGISTER",
 +        .addr = A_INTERRUPT_CLEAR_REGISTER,
 +        .rsvd = 0xffff8000,
 +        .pre_write = can_icr_pre_write,
 +    },{ .name = "TIMESTAMP_REGISTER",
 +        .addr = A_TIMESTAMP_REGISTER,
 +        .rsvd = 0xfffffffe,
 +        .pre_write = can_tcr_pre_write,
 +    },{ .name = "WIR",  .addr = A_WIR,
 +        .reset = 0x3f3f,
 +        .rsvd = 0xffff0000,
 +    },{ .name = "TXFIFO_ID",  .addr = A_TXFIFO_ID,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXFIFO_DLC",  .addr = A_TXFIFO_DLC,
 +        .rsvd = 0xfffffff,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXFIFO_DATA1",  .addr = A_TXFIFO_DATA1,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXFIFO_DATA2",  .addr = A_TXFIFO_DATA2,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXHPB_ID",  .addr = A_TXHPB_ID,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXHPB_DLC",  .addr = A_TXHPB_DLC,
 +        .rsvd = 0xfffffff,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXHPB_DATA1",  .addr = A_TXHPB_DATA1,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "TXHPB_DATA2",  .addr = A_TXHPB_DATA2,
 +        .post_write = can_tx_post_write,
 +    },{ .name = "RXFIFO_ID",  .addr = A_RXFIFO_ID,
 +        .ro = 0xffffffff,
 +        .post_read = can_rxfifo_pre_read,
 +    },{ .name = "RXFIFO_DLC",  .addr = A_RXFIFO_DLC,
 +        .rsvd = 0xfff0000,
 +        .post_read = can_rxfifo_pre_read,
 +    },{ .name = "RXFIFO_DATA1",  .addr = A_RXFIFO_DATA1,
 +        .post_read = can_rxfifo_pre_read,
 +    },{ .name = "RXFIFO_DATA2",  .addr = A_RXFIFO_DATA2,
 +        .post_read = can_rxfifo_pre_read,
 +    },{ .name = "AFR",  .addr = A_AFR,
 +        .rsvd = 0xfffffff0,
 +        .post_write = can_filter_enable_post_write,
 +    },{ .name = "AFMR1",  .addr = A_AFMR1,
 +        .pre_write = can_filter_mask_pre_write,
 +    },{ .name = "AFIR1",  .addr = A_AFIR1,
 +        .pre_write = can_filter_id_pre_write,
 +    },{ .name = "AFMR2",  .addr = A_AFMR2,
 +        .pre_write = can_filter_mask_pre_write,
 +    },{ .name = "AFIR2",  .addr = A_AFIR2,
 +        .pre_write = can_filter_id_pre_write,
 +    },{ .name = "AFMR3",  .addr = A_AFMR3,
 +        .pre_write = can_filter_mask_pre_write,
 +    },{ .name = "AFIR3",  .addr = A_AFIR3,
 +        .pre_write = can_filter_id_pre_write,
 +    },{ .name = "AFMR4",  .addr = A_AFMR4,
 +        .pre_write = can_filter_mask_pre_write,
 +    },{ .name = "AFIR4",  .addr = A_AFIR4,
 +        .pre_write = can_filter_id_pre_write,
 +    }
 +};
 +
-+static void xlnx_zynqmp_can_ptimer_cb(void *opaque)
++static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
 +{
-+    /* No action required on the timer rollover. */
++    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
 +    PVPanicState *ps = &s->pvpanic;
 +
 +    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
 +
 +    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
 +}
 +
-+static const MemoryRegionOps can_ops = {
++static Property pvpanic_pci_properties[] = {
-+    .read = register_read_memory,
++    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-+    .write = register_write_memory,
++    DEFINE_PROP_END_OF_LIST(),
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
-+static void xlnx_zynqmp_can_reset_init(Object *obj, ResetType type)
++static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
 +{
-+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+    unsigned int i;
++    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
 +
-+    for (i = R_RXFIFO_ID; i < ARRAY_SIZE(s->reg_info); ++i) {
++    device_class_set_props(dc, pvpanic_pci_properties);
 +        register_reset(&s->reg_info[i]);
 +    }
 +
-+    ptimer_transaction_begin(s->can_timer);
++    pc->realize = pvpanic_pci_realizefn;
-+    ptimer_set_count(s->can_timer, 0);
++    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
-+    ptimer_transaction_commit(s->can_timer);
++    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
 +    pc->revision = 1;
 +    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
 +    dc->vmsd = &vmstate_pvpanic_pci;
 +
 +    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 +}
 +
-+static void xlnx_zynqmp_can_reset_hold(Object *obj)
++static TypeInfo pvpanic_pci_info = {
-+{
++    .name          = TYPE_PVPANIC_PCI_DEVICE,
-+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
++    .parent        = TYPE_PCI_DEVICE,
-+    unsigned int i;
++    .instance_size = sizeof(PVPanicPCIState),
-+
++    .class_init    = pvpanic_pci_class_init,
-+    for (i = 0; i < R_RXFIFO_ID; ++i) {
++    .interfaces = (InterfaceInfo[]) {
-+        register_reset(&s->reg_info[i]);
++        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-+    }
++        { }
 +
 +    /*
 +     * Reset FIFOs when CAN model is reset. This will clear the fifo writes
 +     * done by post_write which gets called from register_reset function,
 +     * post_write handle will not be able to trigger tx because CAN will be
 +     * disabled when software_reset_register is cleared first.
 +     */
 +    fifo32_reset(&s->rx_fifo);
 +    fifo32_reset(&s->tx_fifo);
 +    fifo32_reset(&s->txhpb_fifo);
 +}
 +
 +static bool xlnx_zynqmp_can_can_receive(CanBusClientState *client)
 +{
 +    XlnxZynqMPCANState *s = container_of(client, XlnxZynqMPCANState,
 +                                         bus_client);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, SRST)) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is in reset state.\n",
 +                      path);
 +        return false;
 +    }
 +
 +    if ((ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) == 0) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is disabled. Incoming"
 +                      " messages will be discarded.\n", path);
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +static ssize_t xlnx_zynqmp_can_receive(CanBusClientState *client,
 +                               const qemu_can_frame *buf, size_t buf_size) {
 +    XlnxZynqMPCANState *s = container_of(client, XlnxZynqMPCANState,
 +                                         bus_client);
 +    const qemu_can_frame *frame = buf;
 +
 +    if (buf_size <= 0) {
 +        g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Error in the data received.\n",
 +                      path);
 +        return 0;
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SNOOP)) {
 +        /* Snoop Mode: Just keep the data. no response back. */
 +        update_rx_fifo(s, frame);
 +    } else if ((ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP))) {
 +        /*
 +         * XlnxZynqMPCAN is in sleep mode. Any data on bus will bring it to wake
 +         * up state.
 +         */
 +        can_exit_sleep_mode(s);
 +        update_rx_fifo(s, frame);
 +    } else if ((ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP)) == 0) {
 +        update_rx_fifo(s, frame);
 +    } else {
 +        /*
 +         * XlnxZynqMPCAN will not participate in normal bus communication
 +         * and will not receive any messages transmitted by other CAN nodes.
 +         */
 +        trace_xlnx_can_rx_discard(s->regs[R_STATUS_REGISTER]);
 +    }
 +
 +    return 1;
 +}
 +
 +static CanBusClientInfo can_xilinx_bus_client_info = {
 +    .can_receive = xlnx_zynqmp_can_can_receive,
 +    .receive = xlnx_zynqmp_can_receive,
 +};
 +
 +static int xlnx_zynqmp_can_connect_to_bus(XlnxZynqMPCANState *s,
 +                                          CanBusState *bus)
 +{
 +    s->bus_client.info = &can_xilinx_bus_client_info;
 +
 +    if (can_bus_insert_client(bus, &s->bus_client) < 0) {
 +        return -1;
 +    }
 +    return 0;
 +}
 +
 +static void xlnx_zynqmp_can_realize(DeviceState *dev, Error **errp)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(dev);
 +
 +    if (s->canbus) {
 +        if (xlnx_zynqmp_can_connect_to_bus(s, s->canbus) < 0) {
 +            g_autofree char *path = object_get_canonical_path(OBJECT(s));
 +
 +            error_setg(errp, "%s: xlnx_zynqmp_can_connect_to_bus"
 +                       " failed.", path);
 +            return;
 +        }
 +    }
 +
 +    /* Create RX FIFO, TXFIFO, TXHPB storage. */
 +    fifo32_create(&s->rx_fifo, RXFIFO_SIZE);
 +    fifo32_create(&s->tx_fifo, RXFIFO_SIZE);
 +    fifo32_create(&s->txhpb_fifo, CAN_FRAME_SIZE);
 +
 +    /* Allocate a new timer. */
 +    s->can_timer = ptimer_init(xlnx_zynqmp_can_ptimer_cb, s,
 +                               PTIMER_POLICY_DEFAULT);
 +
 +    ptimer_transaction_begin(s->can_timer);
 +
 +    ptimer_set_freq(s->can_timer, s->cfg.ext_clk_freq);
 +    ptimer_set_limit(s->can_timer, CAN_TIMER_MAX, 1);
 +    ptimer_run(s->can_timer, 0);
 +    ptimer_transaction_commit(s->can_timer);
 +}
 +
 +static void xlnx_zynqmp_can_init(Object *obj)
 +{
 +    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +
 +    RegisterInfoArray *reg_array;
 +
 +    memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_CAN,
 +                        XLNX_ZYNQMP_CAN_R_MAX * 4);
 +    reg_array = register_init_block32(DEVICE(obj), can_regs_info,
 +                               ARRAY_SIZE(can_regs_info),
 +                               s->reg_info, s->regs,
 +                               &can_ops,
 +                               XLNX_ZYNQMP_CAN_ERR_DEBUG,
 +                               XLNX_ZYNQMP_CAN_R_MAX * 4);
 +
 +    memory_region_add_subregion(&s->iomem, 0x00, &reg_array->mem);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 +}
 +
 +static const VMStateDescription vmstate_can = {
 +    .name = TYPE_XLNX_ZYNQMP_CAN,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_FIFO32(rx_fifo, XlnxZynqMPCANState),
 +        VMSTATE_FIFO32(tx_fifo, XlnxZynqMPCANState),
 +        VMSTATE_FIFO32(txhpb_fifo, XlnxZynqMPCANState),
 +        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCANState, XLNX_ZYNQMP_CAN_R_MAX),
 +        VMSTATE_PTIMER(can_timer, XlnxZynqMPCANState),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
-+static Property xlnx_zynqmp_can_properties[] = {
++static void pvpanic_register_types(void)
 +    DEFINE_PROP_UINT32("ext_clk_freq", XlnxZynqMPCANState, cfg.ext_clk_freq,
 +                       CAN_DEFAULT_CLOCK),
 +    DEFINE_PROP_LINK("canbus", XlnxZynqMPCANState, canbus, TYPE_CAN_BUS,
 +                     CanBusState *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void xlnx_zynqmp_can_class_init(ObjectClass *klass, void *data)
 +{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++    type_register_static(&pvpanic_pci_info);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    rc->phases.enter = xlnx_zynqmp_can_reset_init;
 +    rc->phases.hold = xlnx_zynqmp_can_reset_hold;
 +    dc->realize = xlnx_zynqmp_can_realize;
 +    device_class_set_props(dc, xlnx_zynqmp_can_properties);
 +    dc->vmsd = &vmstate_can;
 +}
 +
-+static const TypeInfo can_info = {
++type_init(pvpanic_register_types);
-+    .name          = TYPE_XLNX_ZYNQMP_CAN,
+diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
-+    .parent        = TYPE_SYS_BUS_DEVICE,
+index XXXXXXX..XXXXXXX 100644
-+    .instance_size = sizeof(XlnxZynqMPCANState),
+--- a/hw/misc/Kconfig
-+    .class_init    = xlnx_zynqmp_can_class_init,
++++ b/hw/misc/Kconfig
-+    .instance_init = xlnx_zynqmp_can_init,
+@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
-+};
+ config PVPANIC_COMMON
      bool
 +config PVPANIC_PCI
 +    bool
 +    default y if PCI_DEVICES
 +    depends on PCI
 +    select PVPANIC_COMMON
 +
-+static void can_register_types(void)
+ config PVPANIC_ISA
-+{
+     bool
-+    type_register_static(&can_info);
+     depends on ISA_BUS
-+}
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 +
 +type_init(can_register_types)
 diff --git a/hw/Kconfig b/hw/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/Kconfig
+--- a/hw/misc/meson.build
-+++ b/hw/Kconfig
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ config XILINX_AXI
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
- config XLNX_ZYNQMP
+ softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
-     bool
-     select REGISTER
+ softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
-+    select CAN_BUS
++softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
-diff --git a/hw/net/can/meson.build b/hw/net/can/meson.build
+ softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
-index XXXXXXX..XXXXXXX 100644
+ softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
---- a/hw/net/can/meson.build
+ softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
 +++ b/hw/net/can/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_CAN_PCI', if_true: files('can_pcm3680_pci.c'))
  softmmu_ss.add(when: 'CONFIG_CAN_PCI', if_true: files('can_mioe3680_pci.c'))
  softmmu_ss.add(when: 'CONFIG_CAN_CTUCANFD', if_true: files('ctucan_core.c'))
  softmmu_ss.add(when: 'CONFIG_CAN_CTUCANFD_PCI', if_true: files('ctucan_pci.c'))
 +softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP', if_true: files('xlnx-zynqmp-can.c'))
 diff --git a/hw/net/can/trace-events b/hw/net/can/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/net/can/trace-events
@@ -XXX,XX +XXX,XX @@
 +# xlnx-zynqmp-can.c
 +xlnx_can_update_irq(uint32_t isr, uint32_t ier, uint32_t irq) "ISR: 0x%08x IER: 0x%08x IRQ: 0x%08x"
 +xlnx_can_reset(uint32_t val) "Resetting controller with value = 0x%08x"
 +xlnx_can_rx_fifo_filter_reject(uint32_t id, uint8_t dlc) "Frame: ID: 0x%08x DLC: 0x%02x"
 +xlnx_can_filter_id_pre_write(uint8_t filter_num, uint32_t value) "Filter%d ID: 0x%08x"
 +xlnx_can_filter_mask_pre_write(uint8_t filter_num, uint32_t value) "Filter%d MASK: 0x%08x"
 +xlnx_can_tx_data(uint32_t id, uint8_t dlc, uint8_t db0, uint8_t db1, uint8_t db2, uint8_t db3, uint8_t db4, uint8_t db5, uint8_t db6, uint8_t db7) "Frame: ID: 0x%08x DLC: 0x%02x DATA: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x"
 +xlnx_can_rx_data(uint32_t id, uint32_t dlc, uint8_t db0, uint8_t db1, uint8_t db2, uint8_t db3, uint8_t db4, uint8_t db5, uint8_t db6, uint8_t db7) "Frame: ID: 0x%08x DLC: 0x%02x DATA: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x"
 +xlnx_can_rx_discard(uint32_t status) "Controller is not enabled for bus communication. Status Register: 0x%08x"
 --
 .20.1

-[PULL 08/36] i.MX25: Fix bad printf format specifiers
+[PULL 20/46] pvpanic : update pvpanic spec document
-From: Alex Chen <alex.chen@huawei.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-We should use printf format specifier "%u" instead of "%d" for
+Add pvpanic PCI device support details in docs/specs/pvpanic.txt.
 argument of type "unsigned int".
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Signed-off-by: Alex Chen <alex.chen@huawei.com>
 Message-id: 20201126111109.112238-2-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/imx25_ccm.c | 12 ++++++------
+ docs/specs/pvpanic.txt | 13 ++++++++++++-
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 12 insertions(+), 1 deletion(-)
-diff --git a/hw/misc/imx25_ccm.c b/hw/misc/imx25_ccm.c
+diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/imx25_ccm.c
+--- a/docs/specs/pvpanic.txt
-+++ b/hw/misc/imx25_ccm.c
++++ b/docs/specs/pvpanic.txt
-@@ -XXX,XX +XXX,XX @@ static const char *imx25_ccm_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@
-     case IMX25_CCM_LPIMR1_REG:
+ PVPANIC DEVICE
-         return "lpimr1";
+ ==============
-     default:
--        sprintf(unknown, "[%d ?]", reg);
+-pvpanic device is a simulated ISA device, through which a guest panic
-+        sprintf(unknown, "[%u ?]", reg);
++pvpanic device is a simulated device, through which a guest panic
-         return unknown;
+ event is sent to qemu, and a QMP event is generated. This allows
-     }
+ management apps (e.g. libvirt) to be notified and respond to the event.
- }
-@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_mpll_clk(IMXCCMState *dev)
+@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
-         freq = imx_ccm_calc_pll(s->reg[IMX25_CCM_MPCTL_REG], CKIH_FREQ);
+ and/or polling for guest-panicked RunState, to learn when the pvpanic
-     }
+ device has fired a panic event.
--    DPRINTF("freq = %d\n", freq);
++The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
-+    DPRINTF("freq = %u\n", freq);
++PCI device.
++
-     return freq;
+ ISA Interface
- }
+ -------------
-@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_mcu_clk(IMXCCMState *dev)
+@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
-     freq = freq / (1 + EXTRACT(s->reg[IMX25_CCM_CCTL_REG], ARM_CLK_DIV));
+        the host should record it or report it, but should not affect
+        the execution of the guest.
--    DPRINTF("freq = %d\n", freq);
-+    DPRINTF("freq = %u\n", freq);
++PCI Interface
++-------------
-     return freq;
++
- }
++The PCI interface is similar to the ISA interface except that it uses an MMIO
-@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_ahb_clk(IMXCCMState *dev)
++address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
-     freq = imx25_ccm_get_mcu_clk(dev)
++can enable a pvpanic device by adding '-device pvpanic-pci' to the command
-            / (1 + EXTRACT(s->reg[IMX25_CCM_CCTL_REG], AHB_CLK_DIV));
++line.
++
--    DPRINTF("freq = %d\n", freq);
+ ACPI Interface
-+    DPRINTF("freq = %u\n", freq);
+ --------------
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_ipg_clk(IMXCCMState *dev)
      freq = imx25_ccm_get_ahb_clk(dev) / 2;
 -    DPRINTF("freq = %d\n", freq);
 +    DPRINTF("freq = %u\n", freq);
      return freq;
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
          break;
      }
 -    DPRINTF("Clock = %d) = %d\n", clock, freq);
 +    DPRINTF("Clock = %d) = %u\n", clock, freq);
      return freq;
  }
 --
 .20.1

-[PULL 04/36] tests/qtest: Introduce tests for Xilinx ZynqMP CAN controller
+[PULL 21/46] tests/qtest: add a test case for pvpanic-pci
-From: Vikram Garhwal <fnu.vikram@xilinx.com>
+From: Mihai Carabas <mihai.carabas@oracle.com>
-The QTests perform five tests on the Xilinx ZynqMP CAN controller:
+Add a test case for pvpanic-pci device. The scenario is the same as pvpanic
-    Tests the CAN controller in loopback, sleep and snoop mode.
+ISA device, but is using the PCI bus.
     Tests filtering of incoming CAN messages.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Acked-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1605728926-352690-4-git-send-email-fnu.vikram@xilinx.com
+Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/xlnx-can-test.c | 360 ++++++++++++++++++++++++++++++++++++
+ tests/qtest/pvpanic-pci-test.c | 94 ++++++++++++++++++++++++++++++++++
- tests/qtest/meson.build     |   1 +
+ tests/qtest/meson.build        |  1 +
-files changed, 361 insertions(+)
+files changed, 95 insertions(+)
- create mode 100644 tests/qtest/xlnx-can-test.c
+ create mode 100644 tests/qtest/pvpanic-pci-test.c
-diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
+diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/qtest/xlnx-can-test.c
++++ b/tests/qtest/pvpanic-pci-test.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QTests for the Xilinx ZynqMP CAN controller.
++ * QTest testcase for PV Panic PCI device
 + *
-+ * Copyright (c) 2020 Xilinx Inc.
++ * Copyright (C) 2020 Oracle
 + *
-+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
++ * Authors:
 + *     Mihai Carabas <mihai.carabas@oracle.com>
 + *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * of this software and associated documentation files (the "Software"), to deal
++ * See the COPYING file in the top-level directory.
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "libqos/libqtest.h"
++#include "qapi/qmp/qdict.h"
++#include "libqos/pci.h"
++#include "libqos/pci-pc.h"
++#include "hw/pci/pci_regs.h"
 +
-+/* Base address. */
++static void test_panic_nopause(void)
-+#define CAN0_BASE_ADDR          0xFF060000
++{
-+#define CAN1_BASE_ADDR          0xFF070000
++    uint8_t val;
 +    QDict *response, *data;
 +    QTestState *qts;
 +    QPCIBus *pcibus;
 +    QPCIDevice *dev;
 +    QPCIBar bar;
 +
-+/* Register addresses. */
++    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=none");
-+#define R_SRR_OFFSET            0x00
++    pcibus = qpci_new_pc(qts, NULL);
-+#define R_MSR_OFFSET            0x04
++    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
-+#define R_SR_OFFSET             0x18
++    qpci_device_enable(dev);
-+#define R_ISR_OFFSET            0x1C
++    bar = qpci_iomap(dev, 0, NULL);
 +#define R_ICR_OFFSET            0x24
 +#define R_TXID_OFFSET           0x30
 +#define R_TXDLC_OFFSET          0x34
 +#define R_TXDATA1_OFFSET        0x38
 +#define R_TXDATA2_OFFSET        0x3C
 +#define R_RXID_OFFSET           0x50
 +#define R_RXDLC_OFFSET          0x54
 +#define R_RXDATA1_OFFSET        0x58
 +#define R_RXDATA2_OFFSET        0x5C
 +#define R_AFR                   0x60
 +#define R_AFMR1                 0x64
 +#define R_AFIR1                 0x68
 +#define R_AFMR2                 0x6C
 +#define R_AFIR2                 0x70
 +#define R_AFMR3                 0x74
 +#define R_AFIR3                 0x78
 +#define R_AFMR4                 0x7C
 +#define R_AFIR4                 0x80
 +
-+/* CAN modes. */
++    qpci_memread(dev, bar, 0, &val, sizeof(val));
-+#define CONFIG_MODE             0x00
++    g_assert_cmpuint(val, ==, 3);
 +#define NORMAL_MODE             0x00
 +#define LOOPBACK_MODE           0x02
 +#define SNOOP_MODE              0x04
 +#define SLEEP_MODE              0x01
 +#define ENABLE_CAN              (1 << 1)
 +#define STATUS_NORMAL_MODE      (1 << 3)
 +#define STATUS_LOOPBACK_MODE    (1 << 1)
 +#define STATUS_SNOOP_MODE       (1 << 12)
 +#define STATUS_SLEEP_MODE       (1 << 2)
 +#define ISR_TXOK                (1 << 1)
 +#define ISR_RXOK                (1 << 4)
 +
-+static void match_rx_tx_data(const uint32_t *buf_tx, const uint32_t *buf_rx,
++    val = 1;
-+                             uint8_t can_timestamp)
++    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
 +{
 +    uint16_t size = 0;
 +    uint8_t len = 4;
 +
-+    while (size < len) {
++    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
-+        if (R_RXID_OFFSET + 4 * size == R_RXDLC_OFFSET)  {
++    g_assert(qdict_haskey(response, "data"));
-+            g_assert_cmpint(buf_rx[size], ==, buf_tx[size] + can_timestamp);
++    data = qdict_get_qdict(response, "data");
-+        } else {
++    g_assert(qdict_haskey(data, "action"));
-+            g_assert_cmpint(buf_rx[size], ==, buf_tx[size]);
++    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "run");
-+        }
++    qobject_unref(response);
 +
 +        size++;
 +    }
 +}
 +
 +static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
 +{
 +    uint32_t int_status;
 +
 +    /* Read the interrupt on CAN rx. */
 +    int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_RXOK;
 +
 +    g_assert_cmpint(int_status, ==, ISR_RXOK);
 +
 +    /* Read the RX register data for CAN. */
 +    buf_rx[0] = qtest_readl(qts, can_base_addr + R_RXID_OFFSET);
 +    buf_rx[1] = qtest_readl(qts, can_base_addr + R_RXDLC_OFFSET);
 +    buf_rx[2] = qtest_readl(qts, can_base_addr + R_RXDATA1_OFFSET);
 +    buf_rx[3] = qtest_readl(qts, can_base_addr + R_RXDATA2_OFFSET);
 +
 +    /* Clear the RX interrupt. */
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_ICR_OFFSET, ISR_RXOK);
 +}
 +
 +static void send_data(QTestState *qts, uint64_t can_base_addr,
 +                      const uint32_t *buf_tx)
 +{
 +    uint32_t int_status;
 +
 +    /* Write the TX register data for CAN. */
 +    qtest_writel(qts, can_base_addr + R_TXID_OFFSET, buf_tx[0]);
 +    qtest_writel(qts, can_base_addr + R_TXDLC_OFFSET, buf_tx[1]);
 +    qtest_writel(qts, can_base_addr + R_TXDATA1_OFFSET, buf_tx[2]);
 +    qtest_writel(qts, can_base_addr + R_TXDATA2_OFFSET, buf_tx[3]);
 +
 +    /* Read the interrupt on CAN for tx. */
 +    int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_TXOK;
 +
 +    g_assert_cmpint(int_status, ==, ISR_TXOK);
 +
 +    /* Clear the interrupt for tx. */
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_ICR_OFFSET, ISR_TXOK);
 +}
 +
 +/*
 + * This test will be transferring data from CAN0 and CAN1 through canbus. CAN0
 + * initiate the data transfer to can-bus, CAN1 receives the data. Test compares
 + * the data sent from CAN0 with received on CAN1.
 + */
 +static void test_can_bus(void)
 +{
 +    const uint32_t buf_tx[4] = { 0xFF, 0x80000000, 0x12345678, 0x87654321 };
 +    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
 +    uint32_t status = 0;
 +    uint8_t can_timestamp = 1;
 +
 +    QTestState *qts = qtest_init("-machine xlnx-zcu102"
 +                " -object can-bus,id=canbus0"
 +                " -machine xlnx-zcu102.canbus0=canbus0"
 +                " -machine xlnx-zcu102.canbus1=canbus0"
 +                );
 +
 +    /* Configure the CAN0 and CAN1. */
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +
 +    /* Check here if CAN0 and CAN1 are in normal mode. */
 +    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    send_data(qts, CAN0_BASE_ADDR, buf_tx);
 +
 +    read_data(qts, CAN1_BASE_ADDR, buf_rx);
 +    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
 +
 +    qtest_quit(qts);
 +}
 +
-+/*
++static void test_panic(void)
 + * This test is performing loopback mode on CAN0 and CAN1. Data sent from TX of
 + * each CAN0 and CAN1 are compared with RX register data for respective CAN.
 + */
 +static void test_can_loopback(void)
 +{
-+    uint32_t buf_tx[4] = { 0xFF, 0x80000000, 0x12345678, 0x87654321 };
++    uint8_t val;
-+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
++    QDict *response, *data;
-+    uint32_t status = 0;
++    QTestState *qts;
 +    QPCIBus *pcibus;
 +    QPCIDevice *dev;
 +    QPCIBar bar;
 +
-+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
++    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=pause");
-+                " -object can-bus,id=canbus0"
++    pcibus = qpci_new_pc(qts, NULL);
-+                " -machine xlnx-zcu102.canbus0=canbus0"
++    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
-+                " -machine xlnx-zcu102.canbus1=canbus0"
++    qpci_device_enable(dev);
-+                );
++    bar = qpci_iomap(dev, 0, NULL);
 +
-+    /* Configure the CAN0 in loopback mode. */
++    qpci_memread(dev, bar, 0, &val, sizeof(val));
-+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
++    g_assert_cmpuint(val, ==, 3);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, LOOPBACK_MODE);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +
-+    /* Check here if CAN0 is set in loopback mode. */
++    val = 1;
-+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
++    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
 +
-+    g_assert_cmpint(status, ==, STATUS_LOOPBACK_MODE);
++    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
-+
++    g_assert(qdict_haskey(response, "data"));
-+    send_data(qts, CAN0_BASE_ADDR, buf_tx);
++    data = qdict_get_qdict(response, "data");
-+    read_data(qts, CAN0_BASE_ADDR, buf_rx);
++    g_assert(qdict_haskey(data, "action"));
-+    match_rx_tx_data(buf_tx, buf_rx, 0);
++    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
-+
++    qobject_unref(response);
 +    /* Configure the CAN1 in loopback mode. */
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, LOOPBACK_MODE);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +
 +    /* Check here if CAN1 is set in loopback mode. */
 +    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
 +
 +    g_assert_cmpint(status, ==, STATUS_LOOPBACK_MODE);
 +
 +    send_data(qts, CAN1_BASE_ADDR, buf_tx);
 +    read_data(qts, CAN1_BASE_ADDR, buf_rx);
 +    match_rx_tx_data(buf_tx, buf_rx, 0);
 +
 +    qtest_quit(qts);
 +}
 +
 +/*
 + * Enable filters for CAN1. This will filter incoming messages with ID. In this
 + * test message will pass through filter 2.
 + */
 +static void test_can_filter(void)
 +{
 +    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
 +    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
 +    uint32_t status = 0;
 +    uint8_t can_timestamp = 1;
 +
 +    QTestState *qts = qtest_init("-machine xlnx-zcu102"
 +                " -object can-bus,id=canbus0"
 +                " -machine xlnx-zcu102.canbus0=canbus0"
 +                " -machine xlnx-zcu102.canbus1=canbus0"
 +                );
 +
 +    /* Configure the CAN0 and CAN1. */
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +
 +    /* Check here if CAN0 and CAN1 are in normal mode. */
 +    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    /* Set filter for CAN1 for incoming messages. */
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFR, 0x0);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR1, 0xF7);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR1, 0x121F);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR2, 0x5431);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR2, 0x14);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR3, 0x1234);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR3, 0x5431);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR4, 0xFFF);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR4, 0x1234);
 +
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_AFR, 0xF);
 +
 +    send_data(qts, CAN0_BASE_ADDR, buf_tx);
 +
 +    read_data(qts, CAN1_BASE_ADDR, buf_rx);
 +    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
 +
 +    qtest_quit(qts);
 +}
 +
 +/* Testing sleep mode on CAN0 while CAN1 is in normal mode. */
 +static void test_can_sleepmode(void)
 +{
 +    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
 +    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
 +    uint32_t status = 0;
 +    uint8_t can_timestamp = 1;
 +
 +    QTestState *qts = qtest_init("-machine xlnx-zcu102"
 +                " -object can-bus,id=canbus0"
 +                " -machine xlnx-zcu102.canbus0=canbus0"
 +                " -machine xlnx-zcu102.canbus1=canbus0"
 +                );
 +
 +    /* Configure the CAN0. */
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, SLEEP_MODE);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +
 +    /* Check here if CAN0 is in SLEEP mode and CAN1 in normal mode. */
 +    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_SLEEP_MODE);
 +
 +    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    send_data(qts, CAN1_BASE_ADDR, buf_tx);
 +
 +    /*
 +     * Once CAN1 sends data on can-bus. CAN0 should exit sleep mode.
 +     * Check the CAN0 status now. It should exit the sleep mode and receive the
 +     * incoming data.
 +     */
 +    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    read_data(qts, CAN0_BASE_ADDR, buf_rx);
 +
 +    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
 +
 +    qtest_quit(qts);
 +}
 +
 +/* Testing Snoop mode on CAN0 while CAN1 is in normal mode. */
 +static void test_can_snoopmode(void)
 +{
 +    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
 +    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
 +    uint32_t status = 0;
 +    uint8_t can_timestamp = 1;
 +
 +    QTestState *qts = qtest_init("-machine xlnx-zcu102"
 +                " -object can-bus,id=canbus0"
 +                " -machine xlnx-zcu102.canbus0=canbus0"
 +                " -machine xlnx-zcu102.canbus1=canbus0"
 +                );
 +
 +    /* Configure the CAN0. */
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, SNOOP_MODE);
 +    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
 +    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
 +
 +    /* Check here if CAN0 is in SNOOP mode and CAN1 in normal mode. */
 +    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_SNOOP_MODE);
 +
 +    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
 +    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
 +
 +    send_data(qts, CAN1_BASE_ADDR, buf_tx);
 +
 +    read_data(qts, CAN0_BASE_ADDR, buf_rx);
 +
 +    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
 +
 +    qtest_quit(qts);
 +}
 +
 +int main(int argc, char **argv)
 +{
++    int ret;
++
 +    g_test_init(&argc, &argv, NULL);
++    qtest_add_func("/pvpanic-pci/panic", test_panic);
++    qtest_add_func("/pvpanic-pci/panic-nopause", test_panic_nopause);
 +
-+    qtest_add_func("/net/can/can_bus", test_can_bus);
++    ret = g_test_run();
 +    qtest_add_func("/net/can/can_loopback", test_can_loopback);
 +    qtest_add_func("/net/can/can_filter", test_can_filter);
 +    qtest_add_func("/net/can/can_test_snoopmode", test_can_snoopmode);
 +    qtest_add_func("/net/can/can_test_sleepmode", test_can_sleepmode);
 +
-+    return g_test_run();
++    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
+@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
-   ['arm-cpu-features',
+    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
-    'numa-test',
+   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
-    'boot-serial-test',
+   (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
-+   'xlnx-can-test',
++  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
-    'migration-test']
+   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
+   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
- qtests_s390x = \
+   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
 --
 .20.1

-[PULL 19/36] target/arm: Move general-use constant expanders up in translate.c
+[PULL 22/46] ptimer: Add new ptimer_set_period_from_clock() function
-The constant-expander functions like negate, plus_2, etc, are
+The ptimer API currently provides two methods for setting the period:
-generally useful; move them up in translate.c so we can use them in
+ptimer_set_period(), which takes a period in nanoseconds, and
-the VFP/Neon decoders as well as in the A32/T32/T16 decoders.
+ptimer_set_freq(), which takes a frequency in Hz.  Neither of these
 lines up nicely with the Clock API, because although both the Clock
 and the ptimer track the frequency using a representation of whole
 and fractional nanoseconds, conversion via either period-in-ns or
 frequency-in-Hz will introduce a rounding error.
 Add a new function ptimer_set_period_from_clock() which takes the
 Clock object directly to avoid the rounding issues.  This includes a
 facility for the user to specify that there is a frequency divider
 between the Clock proper and the timer, as some timer devices like
 the CMSDK APB dualtimer need this.
 To avoid having to drag in clock.h from ptimer.h we add the Clock
 type to typedefs.h.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-9-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-2-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-2-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 46 +++++++++++++++++++++++-------------------
+ include/hw/ptimer.h     | 22 ++++++++++++++++++++++
-file changed, 25 insertions(+), 21 deletions(-)
+ include/qemu/typedefs.h |  1 +
  hw/core/ptimer.c        | 34 ++++++++++++++++++++++++++++++++++
 files changed, 57 insertions(+)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/include/hw/ptimer.h
-+++ b/target/arm/translate.c
++++ b/include/hw/ptimer.h
-@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ void ptimer_transaction_commit(ptimer_state *s);
   */
  void ptimer_set_period(ptimer_state *s, int64_t period);
 +/**
 + * ptimer_set_period_from_clock - Set counter increment from a Clock
 + * @s: ptimer to configure
 + * @clk: pointer to Clock object to take period from
 + * @divisor: value to scale the clock frequency down by
 + *
 + * If the ptimer is being driven from a Clock, this is the preferred
 + * way to tell the ptimer about the period, because it avoids any
 + * possible rounding errors that might happen if the internal
 + * representation of the Clock period was converted to either a period
 + * in ns or a frequency in Hz.
 + *
 + * If the ptimer should run at the same frequency as the clock,
 + * pass 1 as the @divisor; if the ptimer should run at half the
 + * frequency, pass 2, and so on.
 + *
 + * This function will assert if it is called outside a
 + * ptimer_transaction_begin/commit block.
 + */
 +void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clock,
 +                                  unsigned int divisor);
 +
  /**
   * ptimer_set_freq - Set counter frequency in Hz
   * @s: ptimer to configure
 diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/typedefs.h
 +++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct BlockDriverState BlockDriverState;
  typedef struct BusClass BusClass;
  typedef struct BusState BusState;
  typedef struct Chardev Chardev;
 +typedef struct Clock Clock;
  typedef struct CompatProperty CompatProperty;
  typedef struct CoMutex CoMutex;
  typedef struct CPUAddressSpace CPUAddressSpace;
 diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/ptimer.c
 +++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/qtest.h"
  #include "block/aio.h"
  #include "sysemu/cpus.h"
 +#include "hw/clock.h"
  #define DELTA_ADJUST     1
  #define DELTA_NO_ADJUST -1
@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period)
      }
  }
-+/*
++/* Set counter increment interval from a Clock */
-+ * Constant expanders for the decoders.
++void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clk,
-+ */
++                                  unsigned int divisor)
 +{
 +    /*
 +     * The raw clock period is a 64-bit value in units of 2^-32 ns;
 +     * put another way it's a 32.32 fixed-point ns value. Our internal
 +     * representation of the period is 64.32 fixed point ns, so
 +     * the conversion is simple.
 +     */
 +    uint64_t raw_period = clock_get(clk);
 +    uint64_t period_frac;
 +
-+static int negate(DisasContext *s, int x)
++    assert(s->in_transaction);
-+{
++    s->delta = ptimer_get_count(s);
-+    return -x;
++    s->period = extract64(raw_period, 32, 32);
 +    period_frac = extract64(raw_period, 0, 32);
 +    /*
 +     * divisor specifies a possible frequency divisor between the
 +     * clock and the timer, so it is a multiplier on the period.
 +     * We do the multiply after splitting the raw period out into
 +     * period and frac to avoid having to do a 32*64->96 multiply.
 +     */
 +    s->period *= divisor;
 +    period_frac *= divisor;
 +    s->period += extract64(period_frac, 32, 32);
 +    s->period_frac = (uint32_t)period_frac;
 +
 +    if (s->enabled) {
 +        s->need_reload = true;
 +    }
 +}
 +
-+static int plus_2(DisasContext *s, int x)
+ /* Set counter frequency in Hz.  */
-+{
+ void ptimer_set_freq(ptimer_state *s, uint32_t freq)
 +    return x + 2;
 +}
 +
 +static int times_2(DisasContext *s, int x)
 +{
 +    return x * 2;
 +}
 +
 +static int times_4(DisasContext *s, int x)
 +{
 +    return x * 4;
 +}
 +
  /* Flags for the disas_set_da_iss info argument:
   * lower bits hold the Rt register number, higher bits are flags.
   */
@@ -XXX,XX +XXX,XX @@ static void arm_skip_unless(DisasContext *s, uint32_t cond)
  /*
 - * Constant expanders for the decoders.
 + * Constant expanders used by T16/T32 decode
   */
 -static int negate(DisasContext *s, int x)
 -{
 -    return -x;
 -}
 -
 -static int plus_2(DisasContext *s, int x)
 -{
 -    return x + 2;
 -}
 -
 -static int times_2(DisasContext *s, int x)
 -{
 -    return x * 2;
 -}
 -
 -static int times_4(DisasContext *s, int x)
 -{
 -    return x * 4;
 -}
 -
  /* Return only the rotation part of T32ExpandImm.  */
  static int t32_expandimm_rot(DisasContext *s, int x)
  {
 --
 .20.1

-New patch
+[PULL 23/46] clock: Add new clock_has_source() function
+Add a function for checking whether a clock has a source.  This is
+useful for devices which have input clocks that must be wired up by
+the board as it allows them to fail in realize rather than ploughing
+on with a zero-period clock.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-3-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-3-peter.maydell@linaro.org
+---
+ docs/devel/clocks.rst | 16 ++++++++++++++++
+ include/hw/clock.h    | 15 +++++++++++++++
+files changed, 31 insertions(+)
+diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/devel/clocks.rst
++++ b/docs/devel/clocks.rst
+@@ -XXX,XX +XXX,XX @@ object during device instance init. For example:
+     /* set initial value to 10ns / 100MHz */
+     clock_set_ns(clk, 10);
++To enforce that the clock is wired up by the board code, you can
++call ``clock_has_source()`` in your device's realize method:
++
++.. code-block:: c
++
++   if (!clock_has_source(s->clk)) {
++       error_setg(errp, "MyDevice: clk input must be connected");
++       return;
++   }
++
++Note that this only checks that the clock has been wired up; it is
++still possible that the output clock connected to it is disabled
++or has not yet been configured, in which case the period will be
++zero. You should use the clock callback to find out when the clock
++period changes.
++
+ Fetching clock frequency/period
+ -------------------------------
+diff --git a/include/hw/clock.h b/include/hw/clock.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/clock.h
++++ b/include/hw/clock.h
+@@ -XXX,XX +XXX,XX @@ void clock_clear_callback(Clock *clk);
+  */
+ void clock_set_source(Clock *clk, Clock *src);
++/**
++ * clock_has_source:
++ * @clk: the clock
++ *
++ * Returns true if the clock has a source clock connected to it.
++ * This is useful for devices which have input clocks which must
++ * be connected by the board/SoC code which creates them. The
++ * device code can use this to check in its realize method that
++ * the clock has been connected.
++ */
++static inline bool clock_has_source(const Clock *clk)
++{
++    return clk->source != NULL;
++}
++
+ /**
+  * clock_set:
+  * @clk: the clock to initialize.
+--
+.20.1

-New patch
+[PULL 24/46] tests: Add a simple test of the CMSDK APB timer
+Add a simple test of the CMSDK APB timer, since we're about to do
+some refactoring of how it is clocked.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-4-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-4-peter.maydell@linaro.org
+---
+ tests/qtest/cmsdk-apb-timer-test.c | 75 ++++++++++++++++++++++++++++++
+ MAINTAINERS                        |  1 +
+ tests/qtest/meson.build            |  1 +
+files changed, 77 insertions(+)
+ create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
+diff --git a/tests/qtest/cmsdk-apb-timer-test.c b/tests/qtest/cmsdk-apb-timer-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/cmsdk-apb-timer-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for the CMSDK APB timer device
++ *
++ * Copyright (c) 2021 Linaro Limited
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * for more details.
++ */
++
++#include "qemu/osdep.h"
++#include "libqtest-single.h"
++
++/* IoTKit/ARMSSE-200 timer0; driven at 25MHz in mps2-an385, so 40ns per tick */
++#define TIMER_BASE 0x40000000
++
++#define CTRL 0
++#define VALUE 4
++#define RELOAD 8
++#define INTSTATUS 0xc
++
++static void test_timer(void)
++{
++    g_assert_true(readl(TIMER_BASE + INTSTATUS) == 0);
++
++    /* Start timer: will fire after 40 * 1000 == 40000 ns */
++    writel(TIMER_BASE + RELOAD, 1000);
++    writel(TIMER_BASE + CTRL, 9);
++
++    /* Step to just past the 500th tick and check VALUE */
++    clock_step(40 * 500 + 1);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 500);
++
++    /* Just past the 1000th tick: timer should have fired */
++    clock_step(40 * 500);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 0);
++
++    /* VALUE reloads at the following tick */
++    clock_step(40);
++    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 1000);
++
++    /* Check write-1-to-clear behaviour of INTSTATUS */
++    writel(TIMER_BASE + INTSTATUS, 0);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
++    writel(TIMER_BASE + INTSTATUS, 1);
++    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
++
++    /* Turn off the timer */
++    writel(TIMER_BASE + CTRL, 0);
++}
++
++int main(int argc, char **argv)
++{
++    int r;
++
++    g_test_init(&argc, &argv, NULL);
++
++    qtest_start("-machine mps2-an385");
++
++    qtest_add_func("/cmsdk-apb-timer/timer", test_timer);
++
++    r = g_test_run();
++
++    qtest_end();
++
++    return r;
++}
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/pl031.h
+ F: include/hw/arm/primecell.h
+ F: hw/timer/cmsdk-apb-timer.c
+ F: include/hw/timer/cmsdk-apb-timer.h
++F: tests/qtest/cmsdk-apb-timer-test.c
+ F: hw/timer/cmsdk-apb-dualtimer.c
+ F: include/hw/timer/cmsdk-apb-dualtimer.h
+ F: hw/char/cmsdk-apb-uart.c
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
+    'npcm7xx_timer-test',
+    'npcm7xx_watchdog_timer-test']
+ qtests_arm = \
++  (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
+   ['arm-cpu-features',
+--
+.20.1

-[PULL 05/36] MAINTAINERS: Add maintainer entry for Xilinx ZynqMP CAN controller
+[PULL 25/46] tests: Add a simple test of the CMSDK APB watchdog
-From: Vikram Garhwal <fnu.vikram@xilinx.com>
+Add a simple test of the CMSDK watchdog, since we're about to do some
 refactoring of how it is clocked.
-Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
-Message-id: 1605728926-352690-5-git-send-email-fnu.vikram@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20210128114145.20536-5-peter.maydell@linaro.org
+Message-id: 20210121190622.22000-5-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- MAINTAINERS | 8 ++++++++
+ tests/qtest/cmsdk-apb-watchdog-test.c | 79 +++++++++++++++++++++++++++
-file changed, 8 insertions(+)
+ MAINTAINERS                           |  1 +
  tests/qtest/meson.build               |  1 +
 files changed, 81 insertions(+)
  create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
+diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/cmsdk-apb-watchdog-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTest testcase for the CMSDK APB watchdog device
++ *
++ * Copyright (c) 2021 Linaro Limited
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * for more details.
++ */
++
++#include "qemu/osdep.h"
++#include "libqtest-single.h"
++
++/*
++ * lm3s811evb watchdog; at board startup this runs at 200MHz / 16 == 12.5MHz,
++ * which is 80ns per tick.
++ */
++#define WDOG_BASE 0x40000000
++
++#define WDOGLOAD 0
++#define WDOGVALUE 4
++#define WDOGCONTROL 8
++#define WDOGINTCLR 0xc
++#define WDOGRIS 0x10
++#define WDOGMIS 0x14
++#define WDOGLOCK 0xc00
++
++static void test_watchdog(void)
++{
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++
++    writel(WDOG_BASE + WDOGCONTROL, 1);
++    writel(WDOG_BASE + WDOGLOAD, 1000);
++
++    /* Step to just past the 500th tick */
++    clock_step(500 * 80 + 1);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
++
++    /* Just past the 1000th tick: timer should have fired */
++    clock_step(500 * 80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
++
++    /* VALUE reloads at following tick */
++    clock_step(80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
++
++    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
++    clock_step(500 * 80);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
++    writel(WDOG_BASE + WDOGINTCLR, 0);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
++}
++
++int main(int argc, char **argv)
++{
++    int r;
++
++    g_test_init(&argc, &argv, NULL);
++
++    qtest_start("-machine lm3s811evb");
++
++    qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
++
++    r = g_test_run();
++
++    qtest_end();
++
++    return r;
++}
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: hw/net/opencores_eth.c
+@@ -XXX,XX +XXX,XX @@ F: hw/char/cmsdk-apb-uart.c
+ F: include/hw/char/cmsdk-apb-uart.h
- Devices
+ F: hw/watchdog/cmsdk-apb-watchdog.c
- -------
+ F: include/hw/watchdog/cmsdk-apb-watchdog.h
-+Xilinx CAN
++F: tests/qtest/cmsdk-apb-watchdog-test.c
-+M: Vikram Garhwal <fnu.vikram@xilinx.com>
+ F: hw/misc/tz-ppc.c
-+M: Francisco Iglesias <francisco.iglesias@xilinx.com>
+ F: include/hw/misc/tz-ppc.h
-+S: Maintained
+ F: hw/misc/tz-mpc.c
-+F: hw/net/can/xlnx-*
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-+F: include/hw/net/xlnx-*
+index XXXXXXX..XXXXXXX 100644
-+F: tests/qtest/xlnx-can-test*
+--- a/tests/qtest/meson.build
-+
++++ b/tests/qtest/meson.build
- EDU
+@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
- M: Jiri Slaby <jslaby@suse.cz>
+    'npcm7xx_watchdog_timer-test']
- S: Maintained
+ qtests_arm = \
    (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
 +  (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
    (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
    (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
    ['arm-cpu-features',
 --
 .20.1

-[PULL 33/36] hw/intc/armv7m_nvic: Fix "return from inactive handler" check
+[PULL 26/46] tests: Add a simple test of the CMSDK APB dual timer
-In commit 077d7449100d824a4 we added code to handle the v8M
+Add a simple test of the CMSDK dual timer, since we're about to do
-requirement that returns from NMI or HardFault forcibly deactivate
+some refactoring of how it is clocked.
 those exceptions regardless of what interrupt the guest is trying to
 deactivate.  Unfortunately this broke the handling of the "illegal
 exception return because the returning exception number is not
 active" check for those cases.  In the pseudocode this test is done
 on the exception the guest asks to return from, but because our
 implementation was doing this in armv7m_nvic_complete_irq() after the
 new "deactivate NMI/HardFault regardless" code we ended up doing the
 test on the VecInfo for that exception instead, which usually meant
 failing to raise the illegal exception return fault.
 In the case for "configurable exception targeting the opposite
 security state" we detected the illegal-return case but went ahead
 and deactivated the VecInfo anyway, which is wrong because that is
 the VecInfo for the other security state.
 Rearrange the code so that we first identify the illegal return
 cases, then see if we really need to deactivate NMI or HardFault
 instead, and finally do the deactivation.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-25-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20210128114145.20536-6-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-6-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 59 +++++++++++++++++++++++--------------------
+ tests/qtest/cmsdk-apb-dualtimer-test.c | 130 +++++++++++++++++++++++++
-file changed, 32 insertions(+), 27 deletions(-)
+ MAINTAINERS                            |   1 +
  tests/qtest/meson.build                |   1 +
 files changed, 132 insertions(+)
  create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/tests/qtest/cmsdk-apb-dualtimer-test.c b/tests/qtest/cmsdk-apb-dualtimer-test.c
-index XXXXXXX..XXXXXXX 100644
+new file mode 100644
---- a/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX
-+++ b/hw/intc/armv7m_nvic.c
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
++++ b/tests/qtest/cmsdk-apb-dualtimer-test.c
- {
+@@ -XXX,XX +XXX,XX @@
-     NVICState *s = (NVICState *)opaque;
++/*
-     VecInfo *vec = NULL;
++ * QTest testcase for the CMSDK APB dualtimer device
--    int ret;
++ *
-+    int ret = 0;
++ * Copyright (c) 2021 Linaro Limited
++ *
-     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
-+    trace_nvic_complete_irq(irq, secure);
++ * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
-+    if (secure && exc_is_banked(irq)) {
++#include "qemu/osdep.h"
-+        vec = &s->sec_vectors[irq];
++#include "libqtest-single.h"
-+    } else {
++
-+        vec = &s->vectors[irq];
++/* IoTKit/ARMSSE dualtimer; driven at 25MHz in mps2-an385, so 40ns per tick */
-+    }
++#define TIMER_BASE 0x40002000
 +
 +#define TIMER1LOAD 0
 +#define TIMER1VALUE 4
 +#define TIMER1CONTROL 8
 +#define TIMER1INTCLR 0xc
 +#define TIMER1RIS 0x10
 +#define TIMER1MIS 0x14
 +#define TIMER1BGLOAD 0x18
 +
 +#define TIMER2LOAD 0x20
 +#define TIMER2VALUE 0x24
 +#define TIMER2CONTROL 0x28
 +#define TIMER2INTCLR 0x2c
 +#define TIMER2RIS 0x30
 +#define TIMER2MIS 0x34
 +#define TIMER2BGLOAD 0x38
 +
 +#define CTRL_ENABLE (1 << 7)
 +#define CTRL_PERIODIC (1 << 6)
 +#define CTRL_INTEN (1 << 5)
 +#define CTRL_PRESCALE_1 (0 << 2)
 +#define CTRL_PRESCALE_16 (1 << 2)
 +#define CTRL_PRESCALE_256 (2 << 2)
 +#define CTRL_32BIT (1 << 1)
 +#define CTRL_ONESHOT (1 << 0)
 +
 +static void test_dualtimer(void)
 +{
 +    g_assert_true(readl(TIMER_BASE + TIMER1RIS) == 0);
 +
 +    /* Start timer: will fire after 40000 ns */
 +    writel(TIMER_BASE + TIMER1LOAD, 1000);
 +    /* enable in free-running, wrapping, interrupt mode */
 +    writel(TIMER_BASE + TIMER1CONTROL, CTRL_ENABLE | CTRL_INTEN);
 +
 +    /* Step to just past the 500th tick and check VALUE */
 +    clock_step(500 * 40 + 1);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 500);
 +
 +    /* Just past the 1000th tick: timer should have fired */
 +    clock_step(500 * 40);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 1);
 +    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0);
 +
 +    /*
-+     * Identify illegal exception return cases. We can't immediately
++     * We are in free-running wrapping 16-bit mode, so on the following
-+     * return at this point because we still need to deactivate
++     * tick VALUE should have wrapped round to 0xffff.
 +     * (either this exception or NMI/HardFault) first.
 +     */
-+    if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
++    clock_step(40);
-+        /*
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0xffff);
 +         * Return from a configurable exception targeting the opposite
 +         * security state from the one we're trying to complete it for.
 +         * Clear vec because it's not really the VecInfo for this
 +         * (irq, secstate) so we mustn't deactivate it.
 +         */
 +        ret = -1;
 +        vec = NULL;
 +    } else if (!vec->active) {
 +        /* Return from an inactive interrupt */
 +        ret = -1;
 +    } else {
 +        /* Legal return, we will return the RETTOBASE bit value to the caller */
 +        ret = nvic_rettobase(s);
 +    }
 +
-     /*
++    /* Check that any write to INTCLR clears interrupt */
-      * For negative priorities, v8M will forcibly deactivate the appropriate
++    writel(TIMER_BASE + TIMER1INTCLR, 1);
-      * NMI or HardFault regardless of what interrupt we're being asked to
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
++
-     }
++    /* Turn off the timer */
++    writel(TIMER_BASE + TIMER1CONTROL, 0);
-     if (!vec) {
++}
--        if (secure && exc_is_banked(irq)) {
++
--            vec = &s->sec_vectors[irq];
++static void test_prescale(void)
--        } else {
++{
--            vec = &s->vectors[irq];
++    g_assert_true(readl(TIMER_BASE + TIMER2RIS) == 0);
--        }
++
--    }
++    /* Start timer: will fire after 40 * 256 * 1000 == 1024000 ns */
--
++    writel(TIMER_BASE + TIMER2LOAD, 1000);
--    trace_nvic_complete_irq(irq, secure);
++    /* enable in periodic, wrapping, interrupt mode, prescale 256 */
--
++    writel(TIMER_BASE + TIMER2CONTROL,
--    if (!vec->active) {
++           CTRL_ENABLE | CTRL_INTEN | CTRL_PERIODIC | CTRL_PRESCALE_256);
--        /* Tell the caller this was an illegal exception return */
++
--        return -1;
++    /* Step to just past the 500th tick and check VALUE */
--    }
++    clock_step(40 * 256 * 501);
--
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
--    /*
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 500);
--     * If this is a configurable exception and it is currently
++
--     * targeting the opposite security state from the one we're trying
++    /* Just past the 1000th tick: timer should have fired */
--     * to complete it for, this counts as an illegal exception return.
++    clock_step(40 * 256 * 500);
--     * We still need to deactivate whatever vector the logic above has
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 1);
--     * selected, though, as it might not be the same as the one for the
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 0);
--     * requested exception number.
++
--     */
++    /* In periodic mode the tick VALUE now reloads */
--    if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
++    clock_step(40 * 256);
--        ret = -1;
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 1000);
--    } else {
++
--        ret = nvic_rettobase(s);
++    /* Check that any write to INTCLR clears interrupt */
-+        return ret;
++    writel(TIMER_BASE + TIMER2INTCLR, 1);
-     }
++    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
++
-     vec->active = 0;
++    /* Turn off the timer */
 +    writel(TIMER_BASE + TIMER2CONTROL, 0);
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int r;
 +
 +    g_test_init(&argc, &argv, NULL);
 +
 +    qtest_start("-machine mps2-an385");
 +
 +    qtest_add_func("/cmsdk-apb-dualtimer/dualtimer", test_dualtimer);
 +    qtest_add_func("/cmsdk-apb-dualtimer/prescale", test_prescale);
 +
 +    r = g_test_run();
 +
 +    qtest_end();
 +
 +    return r;
 +}
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/timer/cmsdk-apb-timer.h
  F: tests/qtest/cmsdk-apb-timer-test.c
  F: hw/timer/cmsdk-apb-dualtimer.c
  F: include/hw/timer/cmsdk-apb-dualtimer.h
 +F: tests/qtest/cmsdk-apb-dualtimer-test.c
  F: hw/char/cmsdk-apb-uart.c
  F: include/hw/char/cmsdk-apb-uart.h
  F: hw/watchdog/cmsdk-apb-watchdog.c
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
     'npcm7xx_timer-test',
     'npcm7xx_watchdog_timer-test']
  qtests_arm = \
 +  (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
    (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
    (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
    (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
 --
 .20.1

-[PULL 34/36] target/arm: Implement M-profile "minimal RAS implementation"
+[PULL 27/46] hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
-For v8.1M the architecture mandates that CPUs must provide at
+The state struct for the CMSDK APB timer device doesn't follow our
-least the "minimal RAS implementation" from the Reliability,
+usual naming convention of camelcase -- "CMSDK" and "APB" are both
-Availability and Serviceability extension. This consists of:
+acronyms, but "TIMER" is not so should not be all-uppercase.
- * an ESB instruction which is a NOP
+Globally rename the struct to "CMSDKAPBTimer" (bringing it into line
-   -- since it is in the HINT space we need only add a comment
+with CMSDKAPBWatchdog and CMSDKAPBDualTimer; CMSDKAPBUART remains
- * an RFSR register which will RAZ/WI
+as-is because "UART" is an acronym).
- * a RAZ/WI AIRCR.IESB bit
-   -- the code which handles writes to AIRCR does not allow setting
+Commit created with:
-      of RES0 bits, so we already treat this as RAZ/WI; add a comment
+ perl -p -i -e 's/CMSDKAPBTIMER/CMSDKAPBTimer/g' hw/timer/cmsdk-apb-timer.c include/hw/arm/armsse.h include/hw/timer/cmsdk-apb-timer.h
       noting that this is deliberate
  * minimal implementation of the RAS register block at 0xe0005000
    -- this will be in a subsequent commit
  * setting the ID_PFR0.RAS field to 0b0010
    -- we will do this when we add the Cortex-M55 CPU model
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-26-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-7-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-7-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      | 14 ++++++++++++++
+ include/hw/arm/armsse.h            |  6 +++---
- target/arm/t32.decode |  4 ++++
+ include/hw/timer/cmsdk-apb-timer.h |  4 ++--
- hw/intc/armv7m_nvic.c | 13 +++++++++++++
+ hw/timer/cmsdk-apb-timer.c         | 28 ++++++++++++++--------------
-files changed, 31 insertions(+)
+files changed, 19 insertions(+), 19 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/include/hw/arm/armsse.h
-+++ b/target/arm/cpu.h
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
+@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
- FIELD(ID_MMFR4, CCIDX, 24, 4)
+     TZPPC apb_ppc0;
- FIELD(ID_MMFR4, EVT, 28, 4)
+     TZPPC apb_ppc1;
+     TZMPC mpc[IOTS_NUM_MPC];
-+FIELD(ID_PFR0, STATE0, 0, 4)
+-    CMSDKAPBTIMER timer0;
-+FIELD(ID_PFR0, STATE1, 4, 4)
+-    CMSDKAPBTIMER timer1;
-+FIELD(ID_PFR0, STATE2, 8, 4)
+-    CMSDKAPBTIMER s32ktimer;
-+FIELD(ID_PFR0, STATE3, 12, 4)
++    CMSDKAPBTimer timer0;
-+FIELD(ID_PFR0, CSV2, 16, 4)
++    CMSDKAPBTimer timer1;
-+FIELD(ID_PFR0, AMU, 20, 4)
++    CMSDKAPBTimer s32ktimer;
-+FIELD(ID_PFR0, DIT, 24, 4)
+     qemu_or_irq ppc_irq_orgate;
-+FIELD(ID_PFR0, RAS, 28, 4)
+     SplitIRQ sec_resp_splitter;
-+
+     SplitIRQ ppc_irq_splitter[NUM_PPCS];
- FIELD(ID_PFR1, PROGMOD, 0, 4)
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
- FIELD(ID_PFR1, SECURITY, 4, 4)
+index XXXXXXX..XXXXXXX 100644
- FIELD(ID_PFR1, MPROGMOD, 8, 4)
+--- a/include/hw/timer/cmsdk-apb-timer.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
++++ b/include/hw/timer/cmsdk-apb-timer.h
-     return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
+@@ -XXX,XX +XXX,XX @@
  #include "qom/object.h"
  #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
 -OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTIMER, CMSDK_APB_TIMER)
 +OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 -struct CMSDKAPBTIMER {
 +struct CMSDKAPBTimer {
      /*< private >*/
      SysBusDevice parent_obj;
 diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-timer.c
 +++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const int timer_id[] = {
 x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
  };
 -static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
 +static void cmsdk_apb_timer_update(CMSDKAPBTimer *s)
  {
      qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
  }
-+static inline bool isar_feature_aa32_ras(const ARMISARegisters *id)
+ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    return FIELD_EX32(id->id_pfr0, ID_PFR0, RAS) != 0;
 +}
 +
  static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
  {
-     return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
-diff --git a/target/arm/t32.decode b/target/arm/t32.decode
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
-index XXXXXXX..XXXXXXX 100644
+     uint64_t r;
---- a/target/arm/t32.decode
-+++ b/target/arm/t32.decode
+     switch (offset) {
-@@ -XXX,XX +XXX,XX @@ CLZ              1111 1010 1011 ---- 1111 .... 1000 ....      @rdm
+@@ -XXX,XX +XXX,XX @@ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
-       # SEV      1111 0011 1010 1111 1000 0000 0000 0100
+ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
-       # SEVL     1111 0011 1010 1111 1000 0000 0000 0101
+                                   unsigned size)
+ {
-+      # For M-profile minimal-RAS ESB can be a NOP, which is the
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
-+      # default behaviour since it is in the hint space.
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
-+      # ESB      1111 0011 1010 1111 1000 0000 0001 0000
-+
+     trace_cmsdk_apb_timer_write(offset, value, size);
-       # The canonical nop ends in 0000 0000, but the whole rest
-       # of the space is "reserved hint, behaves as nop".
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps cmsdk_apb_timer_ops = {
-       NOP        1111 0011 1010 1111 1000 0000 ---- ----
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+ static void cmsdk_apb_timer_tick(void *opaque)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/hw/intc/armv7m_nvic.c
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
-+++ b/hw/intc/armv7m_nvic.c
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-             return 0;
+     if (s->ctrl & R_CTRL_IRQEN_MASK) {
-         }
+         s->intstatus |= R_INTSTATUS_IRQ_MASK;
-         return cpu->env.v7m.sfar;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_tick(void *opaque)
-+    case 0xf04: /* RFSR */
-+        if (!cpu_isar_feature(aa32_ras, cpu)) {
+ static void cmsdk_apb_timer_reset(DeviceState *dev)
-+            goto bad_offset;
+ {
-+        }
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
-+        /* We provide minimal-RAS only: RFSR is RAZ/WI */
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
-+        return 0;
-     case 0xf34: /* FPCCR */
+     trace_cmsdk_apb_timer_reset();
-         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
+     s->ctrl = 0;
-             return 0;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+ static void cmsdk_apb_timer_init(Object *obj)
-                               R_V7M_AIRCR_PRIGROUP_SHIFT,
+ {
-                               R_V7M_AIRCR_PRIGROUP_LENGTH);
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-             }
+-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
-+            /* AIRCR.IESB is RAZ/WI because we implement only minimal RAS */
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(obj);
-             if (attrs.secure) {
-                 /* These bits are only writable by secure */
+     memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
-                 cpu->env.v7m.aircr = value &
+                           s, "cmsdk-apb-timer", 0x1000);
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
-         }
-         break;
+ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
  {
 -    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
 +    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
      if (s->pclk_frq == 0) {
          error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
      .version_id = 1,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
 -        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
 -        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
 -        VMSTATE_UINT32(value, CMSDKAPBTIMER),
 -        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
 -        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
 +        VMSTATE_PTIMER(timer, CMSDKAPBTimer),
 +        VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
 +        VMSTATE_UINT32(value, CMSDKAPBTimer),
 +        VMSTATE_UINT32(reload, CMSDKAPBTimer),
 +        VMSTATE_UINT32(intstatus, CMSDKAPBTimer),
          VMSTATE_END_OF_LIST()
      }
-+    case 0xf04: /* RFSR */
+ };
-+        if (!cpu_isar_feature(aa32_ras, cpu)) {
-+            goto bad_offset;
+ static Property cmsdk_apb_timer_properties[] = {
-+        }
+-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
-+        /* We provide minimal-RAS only: RFSR is RAZ/WI */
++    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
-+        break;
+     DEFINE_PROP_END_OF_LIST(),
-     case 0xf34: /* FPCCR */
+ };
-         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             /* Not all bits here are banked. */
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
  static const TypeInfo cmsdk_apb_timer_info = {
      .name = TYPE_CMSDK_APB_TIMER,
      .parent = TYPE_SYS_BUS_DEVICE,
 -    .instance_size = sizeof(CMSDKAPBTIMER),
 +    .instance_size = sizeof(CMSDKAPBTimer),
      .instance_init = cmsdk_apb_timer_init,
      .class_init = cmsdk_apb_timer_class_init,
  };
 --
 .20.1

-[PULL 29/36] target/arm: Implement new v8.1M NOCP check for exception return
+[PULL 28/46] hw/timer/cmsdk-apb-timer: Add Clock input
-In v8.1M a new exception return check is added which may cause a NOCP
+As the first step in converting the CMSDK_APB_TIMER device to the
-UsageFault (see rule R_XLTP): before we clear s0..s15 and the FPSCR
+Clock framework, add a Clock input.  For the moment we do nothing
-we must check whether access to CP10 from the Security state of the
+with this clock; we will change the behaviour from using the pclk-frq
-returning exception is disabled; if it is then we must take a fault.
+property to using the Clock once all the users of this device have
 been converted to wire up the Clock.
-(Note that for our implementation CPPWR is always RAZ/WI and so can
+Since the device doesn't already have a doc comment for its "QEMU
-never cause CP10 accesses to fail.)
+interface", we add one including the new Clock.
-The other v8.1M change to this register-clearing code is that if MVE
+This is a migration compatibility break for machines mps2-an505,
-is implemented VPR must also be cleared, so add a TODO comment to
+mps2-an521, musca-a, musca-b1.
 that effect.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-20-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-8-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-8-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 22 +++++++++++++++++++++-
+ include/hw/timer/cmsdk-apb-timer.h | 9 +++++++++
-file changed, 21 insertions(+), 1 deletion(-)
+ hw/timer/cmsdk-apb-timer.c         | 7 +++++--
 files changed, 14 insertions(+), 2 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/hw/timer/cmsdk-apb-timer.h
-+++ b/target/arm/m_helper.c
++++ b/include/hw/timer/cmsdk-apb-timer.h
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@
-             v7m_exception_taken(cpu, excret, true, false);
+ #include "hw/qdev-properties.h"
-             return;
+ #include "hw/sysbus.h"
-         } else {
+ #include "hw/ptimer.h"
--            /* Clear s0..s15 and FPSCR */
++#include "hw/clock.h"
-+            if (arm_feature(env, ARM_FEATURE_V8_1M)) {
+ #include "qom/object.h"
-+                /* v8.1M adds this NOCP check */
-+                bool nsacr_pass = exc_secure ||
+ #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
-+                    extract32(env->v7m.nsacr, 10, 1);
+ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
-+                bool cpacr_pass = v7m_cpacr_pass(env, exc_secure, true);
-+                if (!nsacr_pass) {
++/*
-+                    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
++ * QEMU interface:
-+                    env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
++ *  + QOM property "pclk-frq": frequency at which the timer is clocked
-+                    qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
++ *  + Clock input "pclk": clock for the timer
-+                        "stackframe: NSACR prevents clearing FPU registers\n");
++ *  + sysbus MMIO region 0: the register bank
-+                    v7m_exception_taken(cpu, excret, true, false);
++ *  + sysbus IRQ 0: timer interrupt TIMERINT
-+                } else if (!cpacr_pass) {
++ */
-+                    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+ struct CMSDKAPBTimer {
-+                                            exc_secure);
+     /*< private >*/
-+                    env->v7m.cfsr[exc_secure] |= R_V7M_CFSR_NOCP_MASK;
+     SysBusDevice parent_obj;
-+                    qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
-+                        "stackframe: CPACR prevents clearing FPU registers\n");
+     qemu_irq timerint;
-+                    v7m_exception_taken(cpu, excret, true, false);
+     uint32_t pclk_frq;
-+                }
+     struct ptimer_state *timer;
-+            }
++    Clock *pclk;
-+            /* Clear s0..s15 and FPSCR; TODO also VPR when MVE is implemented */
-             int i;
+     uint32_t ctrl;
+     uint32_t value;
-             for (i = 0; i < 16; i += 2) {
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-timer.c
 +++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/irq.h"
  #include "hw/registerfields.h"
 +#include "hw/qdev-clock.h"
  #include "hw/timer/cmsdk-apb-timer.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                            s, "cmsdk-apb-timer", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->timerint);
 +    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
  }
  static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
  static const VMStateDescription cmsdk_apb_timer_vmstate = {
      .name = "cmsdk-apb-timer",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_PTIMER(timer, CMSDKAPBTimer),
 +        VMSTATE_CLOCK(pclk, CMSDKAPBTimer),
          VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
          VMSTATE_UINT32(value, CMSDKAPBTimer),
          VMSTATE_UINT32(reload, CMSDKAPBTimer),
 --
 .20.1

-[PULL 28/36] target/arm: Implement v8.1M REVIDR register
+[PULL 29/46] hw/timer/cmsdk-apb-dualtimer: Add Clock input
-In v8.1M a REVIDR register is defined, which is at address 0xe00ecfc
+As the first step in converting the CMSDK_APB_DUALTIMER device to the
-and is a read-only IMPDEF register providing implementation specific
+Clock framework, add a Clock input.  For the moment we do nothing
-minor revision information, like the v8A REVIDR_EL1. Implement this.
+with this clock; we will change the behaviour from using the pclk-frq
 property to using the Clock once all the users of this device have
 been converted to wire up the Clock.
 We take the opportunity to correct the name of the clock input to
 match the hardware -- the dual timer names the clock which drives the
 timers TIMCLK.  (It does also have a 'pclk' input, which is used only
 for the register and APB bus logic; on the SSE-200 these clocks are
 both connected together.)
 This is a migration compatibility break for machines mps2-an385,
 mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
 musca-b1.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-19-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-9-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-9-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 5 +++++
+ include/hw/timer/cmsdk-apb-dualtimer.h | 3 +++
-file changed, 5 insertions(+)
+ hw/timer/cmsdk-apb-dualtimer.c         | 7 +++++--
 files changed, 8 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/include/hw/timer/cmsdk-apb-dualtimer.h
-+++ b/hw/intc/armv7m_nvic.c
++++ b/include/hw/timer/cmsdk-apb-dualtimer.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@
-         }
+  *
-         return val;
+  * QEMU interface:
   *  + QOM property "pclk-frq": frequency at which the timer is clocked
 + *  + Clock input "TIMCLK": clock (for both timers)
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: combined timer interrupt TIMINTC
   *  + sysbus IRO 1: timer block 1 interrupt TIMINT1
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/ptimer.h"
 +#include "hw/clock.h"
  #include "qom/object.h"
  #define TYPE_CMSDK_APB_DUALTIMER "cmsdk-apb-dualtimer"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
      MemoryRegion iomem;
      qemu_irq timerintc;
      uint32_t pclk_frq;
 +    Clock *timclk;
      CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
      uint32_t timeritcr;
 diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-dualtimer.c
 +++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
  #include "hw/registerfields.h"
 +#include "hw/qdev-clock.h"
  #include "hw/timer/cmsdk-apb-dualtimer.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
      for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
          sysbus_init_irq(sbd, &s->timermod[i].timerint);
      }
-+    case 0xcfc:
++    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8_1M)) {
+ }
-+            goto bad_offset;
-+        }
+ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
-+        return cpu->revidr;
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_dualtimermod_vmstate = {
-     case 0xd00: /* CPUID Base.  */
-         return cpu->midr;
+ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
-     case 0xd04: /* Interrupt Control State (ICSR) */
+     .name = "cmsdk-apb-dualtimer",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
 +        VMSTATE_CLOCK(timclk, CMSDKAPBDualTimer),
          VMSTATE_STRUCT_ARRAY(timermod, CMSDKAPBDualTimer,
                               CMSDK_APB_DUALTIMER_NUM_MODULES,
 , cmsdk_dualtimermod_vmstate,
 --
 .20.1

-[PULL 27/36] target/arm: In v8.1M, don't set HFSR.FORCED on vector table fetch failures
+[PULL 30/46] hw/watchdog/cmsdk-apb-watchdog: Add Clock input
-In v8.1M, vector table fetch failures don't set HFSR.FORCED (see rule
+As the first step in converting the CMSDK_APB_TIMER device to the
-R_LLRP).  (In previous versions of the architecture this was either
+Clock framework, add a Clock input.  For the moment we do nothing
-required or IMPDEF.)
+with this clock; we will change the behaviour from using the
 wdogclk-frq property to using the Clock once all the users of this
 device have been converted to wire up the Clock.
 This is a migration compatibility break for machines mps2-an385,
 mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
 musca-b1, lm3s811evb, lm3s6965evb.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-18-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-10-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-10-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 6 +++++-
+ include/hw/watchdog/cmsdk-apb-watchdog.h | 3 +++
-file changed, 5 insertions(+), 1 deletion(-)
+ hw/watchdog/cmsdk-apb-watchdog.c         | 7 +++++--
 files changed, 8 insertions(+), 2 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
-+++ b/target/arm/m_helper.c
++++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
-@@ -XXX,XX +XXX,XX @@ load_fail:
+@@ -XXX,XX +XXX,XX @@
-      * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
+  *
-      * secure); otherwise it targets the same security state as the
+  * QEMU interface:
-      * underlying exception.
+  *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
-+     * In v8.1M HardFaults from vector table fetch fails don't set FORCED.
++ *  + Clock input "WDOGCLK": clock for the watchdog's timer
-      */
+  *  + sysbus MMIO region 0: the register bank
-     if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+  *  + sysbus IRQ 0: watchdog interrupt
-         exc_secure = true;
+  *
-     }
+@@ -XXX,XX +XXX,XX @@
--    env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
-+    env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK;
+ #include "hw/sysbus.h"
-+    if (!arm_feature(env, ARM_FEATURE_V8_1M)) {
+ #include "hw/ptimer.h"
-+        env->v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
++#include "hw/clock.h"
-+    }
+ #include "qom/object.h"
-     armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
-     return false;
+ #define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
- }
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
      uint32_t wdogclk_frq;
      bool is_luminary;
      struct ptimer_state *timer;
 +    Clock *wdogclk;
      uint32_t control;
      uint32_t intstatus;
 diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/watchdog/cmsdk-apb-watchdog.c
 +++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
  #include "hw/registerfields.h"
 +#include "hw/qdev-clock.h"
  #include "hw/watchdog/cmsdk-apb-watchdog.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
                            s, "cmsdk-apb-watchdog", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->wdogint);
 +    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
      s->is_luminary = false;
      s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
  static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
      .name = "cmsdk-apb-watchdog",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
 +        VMSTATE_CLOCK(wdogclk, CMSDKAPBWatchdog),
          VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
          VMSTATE_UINT32(control, CMSDKAPBWatchdog),
          VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
 --
 .20.1

-[PULL 26/36] target/arm: For v8.1M, always clear R0-R3, R12, APSR, EPSR on exception entry
+[PULL 31/46] hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
-In v8.0M, on exception entry the registers R0-R3, R12, APSR and EPSR
+While we transition the ARMSSE code from integer properties
-are zeroed for an exception taken to Non-secure state; for an
+specifying clock frequencies to Clock objects, we want to have the
-exception taken to Secure state they become UNKNOWN, and we chose to
+device provide both at once.  We want the final name of the main
-leave them at their previous values.
+input Clock to be "MAINCLK", following the hardware name.
 Unfortunately creating an input Clock with a name X creates an
 under-the-hood QOM property X; for "MAINCLK" this clashes with the
 existing UINT32 property of that name.
-In v8.1M the behaviour is specified more tightly and these registers
+Rename the UINT32 property to MAINCLK_FRQ so it can coexist with the
-are always zeroed regardless of the security state that the exception
+MAINCLK Clock; once the transition is complete MAINCLK_FRQ will be
-targets (see rule R_KPZV).  Implement this.
+deleted.
 Commit created with:
  perl -p -i -e 's/MAINCLK/MAINCLK_FRQ/g' hw/arm/{armsse,mps2-tz,musca}.c include/hw/arm/armsse.h
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-17-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-11-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-11-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 16 ++++++++++++----
+ include/hw/arm/armsse.h | 2 +-
-file changed, 12 insertions(+), 4 deletions(-)
+ hw/arm/armsse.c         | 6 +++---
  hw/arm/mps2-tz.c        | 2 +-
  hw/arm/musca.c          | 2 +-
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/include/hw/arm/armsse.h
-+++ b/target/arm/m_helper.c
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
+@@ -XXX,XX +XXX,XX @@
-          * Clear registers if necessary to prevent non-secure exception
+  * QEMU interface:
-          * code being able to see register values from secure code.
+  *  + QOM property "memory" is a MemoryRegion containing the devices provided
-          * Where register values become architecturally UNKNOWN we leave
+  *    by the board model.
--         * them with their previous values.
+- *  + QOM property "MAINCLK" is the frequency of the main system clock
-+         * them with their previous values. v8.1M is tighter than v8.0M
++ *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
-+         * here and always zeroes the caller-saved registers regardless
+  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
-+         * of the security state the exception is targeting.
+  *    (In hardware, the SSE-200 permits the number of expansion interrupts
-          */
+  *    for the two CPUs to be configured separately, but we restrict it to
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
--            if (!targets_secure) {
+index XXXXXXX..XXXXXXX 100644
-+            if (!targets_secure || arm_feature(env, ARM_FEATURE_V8_1M)) {
+--- a/hw/arm/armsse.c
-                 /*
++++ b/hw/arm/armsse.c
-                  * Always clear the caller-saved registers (they have been
+@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
-                  * pushed to the stack earlier in v7m_push_stack()).
+     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
+                      MemoryRegion *),
-                  * v7m_push_callee_stack()).
+     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-                  */
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-                 int i;
++    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
-+                /*
+     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-+                 * r4..r11 are callee-saves, zero only if background
+     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-+                 * state was Secure (EXCRET.S == 1) and exception
+     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
-+                 * targets Non-secure state
+@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
-+                 */
+     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-+                bool zero_callee_saves = !targets_secure &&
+                      MemoryRegion *),
-+                    (lr & R_V7M_EXCRET_S_MASK);
+     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-                 for (i = 0; i < 13; i++) {
++    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
--                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
+     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
--                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
+     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-+                    if (i < 4 || i > 11 || zero_callee_saves) {
+     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
-                         env->regs[i] = 0;
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-                     }
+     }
-                 }
      if (!s->mainclk_frq) {
 -        error_setg(errp, "MAINCLK property was not set");
 +        error_setg(errp, "MAINCLK_FRQ property was not set");
          return;
      }
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
      object_property_set_link(OBJECT(&mms->iotkit), "memory",
                               OBJECT(system_memory), &error_abort);
      qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
 -    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
 +    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
      sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
      /*
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
      qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
      qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
      qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
 -    qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
 +    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
      /*
       * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
       * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
 --
 .20.1

-[PULL 24/36] target/arm: Implement FPCXT_S fp system register
+[PULL 32/46] hw/arm/armsse: Wire up clocks
-Implement the new-in-v8.1M FPCXT_S floating point system register.
+Create two input clocks on the ARMSSE devices, one for the normal
-This is for saving and restoring the secure floating point context,
+MAINCLK, and one for the 32KHz S32KCLK, and wire these up to the
-and it reads and writes bits [27:0] from the FPSCR and the
+appropriate devices.  The old property-based clock frequency setting
-CONTROL.SFPA bit in bit [31].
+will remain in place until conversion is complete.
 This is a migration compatibility break for machines mps2-an505,
 mps2-an521, musca-a, musca-b1.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-14-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-12-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-12-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.c.inc | 58 ++++++++++++++++++++++++++++++++++
+ include/hw/arm/armsse.h |  6 ++++++
-file changed, 58 insertions(+)
+ hw/arm/armsse.c         | 17 +++++++++++++++--
 files changed, 21 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.c.inc
+--- a/include/hw/arm/armsse.h
-+++ b/target/arm/translate-vfp.c.inc
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
+@@ -XXX,XX +XXX,XX @@
-             return false;
+  *  per-CPU identity and control register blocks
-         }
+  *
-         break;
+  * QEMU interface:
-+    case ARM_VFP_FPCXT_S:
++ *  + Clock input "MAINCLK": clock for CPUs and most peripherals
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
++ *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
-+            return false;
+  *  + QOM property "memory" is a MemoryRegion containing the devices provided
-+        }
+  *    by the board model.
-+        if (!s->v8m_secure) {
+  *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
-+            return false;
+@@ -XXX,XX +XXX,XX @@
-+        }
+ #include "hw/misc/armsse-mhu.h"
-+        break;
+ #include "hw/misc/unimp.h"
-     default:
+ #include "hw/or-irq.h"
-         return FPSysRegCheckFailed;
++#include "hw/clock.h"
  #include "hw/core/split-irq.h"
  #include "hw/cpu/cluster.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
      uint32_t nsccfg;
 +    Clock *mainclk;
 +    Clock *s32kclk;
 +
      /* Properties */
      MemoryRegion *board_memory;
      uint32_t exp_numirq;
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/armsse.h"
  #include "hw/arm/boot.h"
  #include "hw/irq.h"
 +#include "hw/qdev-clock.h"
  /* Format of the System Information block SYS_CONFIG register */
  typedef enum SysConfigFormat {
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
      assert(info->sram_banks <= MAX_SRAM_BANKS);
      assert(info->num_cpus <= SSE_MAX_CPUS);
 +    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
 +    s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
 +
      memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
      for (i = 0; i < info->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
       * map its upstream ends to the right place in the container.
       */
      qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
 +    qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-         tcg_temp_free_i32(tmp);
+                              &error_abort);
-         break;
      qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
 +    qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
          return;
      }
-+    case ARM_VFP_FPCXT_S:
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+    {
+                              &error_abort);
-+        TCGv_i32 sfpa, control, fpscr;
-+        /* Set FPSCR[27:0] and CONTROL.SFPA from value */
+     qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
-+        tmp = loadfn(s, opaque);
++    qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
-+        sfpa = tcg_temp_new_i32();
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
-+        tcg_gen_shri_i32(sfpa, tmp, 31);
+         return;
 +        control = load_cpu_field(v7m.control[M_REG_S]);
 +        tcg_gen_deposit_i32(control, control, sfpa,
 +                            R_V7M_CONTROL_SFPA_SHIFT, 1);
 +        store_cpu_field(control, v7m.control[M_REG_S]);
 +        fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
 +        tcg_gen_andi_i32(fpscr, fpscr, FPCR_NZCV_MASK);
 +        tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
 +        tcg_gen_or_i32(fpscr, fpscr, tmp);
 +        store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
 +        tcg_temp_free_i32(tmp);
 +        tcg_temp_free_i32(sfpa);
 +        break;
 +    }
      default:
          g_assert_not_reached();
      }
-@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-         tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
+      *   0x4002f000: S32K timer
-         storefn(s, opaque, tmp);
+      */
-         break;
+     qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
-+    case ARM_VFP_FPCXT_S:
++    qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
-+    {
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
-+        TCGv_i32 control, sfpa, fpscr;
+         return;
-+        /* Bits [27:0] from FPSCR, bit [31] from CONTROL.SFPA */
+     }
-+        tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+        sfpa = tcg_temp_new_i32();
+                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
-+        gen_helper_vfp_get_fpscr(tmp, cpu_env);
-+        tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
+     qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
-+        control = load_cpu_field(v7m.control[M_REG_S]);
++    qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
-+        tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
-+        tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);
+         return;
-+        tcg_gen_or_i32(tmp, tmp, sfpa);
+     }
-+        tcg_temp_free_i32(sfpa);
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+        /*
+     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
-+         * Store result before updating FPSCR etc, in case
-+         * it is a memory write which causes an exception.
+     qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
-+         */
++    qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
-+        storefn(s, opaque, tmp);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
-+        /*
+         return;
-+         * Now we must reset FPSCR from FPDSCR_NS, and clear
+     }
-+         * CONTROL.SFPA; so we'll end the TB here.
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+         */
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
-+        tcg_gen_andi_i32(control, control, ~R_V7M_CONTROL_SFPA_MASK);
-+        store_cpu_field(control, v7m.control[M_REG_S]);
+     qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
-+        fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
++    qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
-+        gen_helper_vfp_set_fpscr(cpu_env, fpscr);
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
-+        tcg_temp_free_i32(fpscr);
+         return;
-+        gen_lookup_tb(s);
+     }
-+        break;
+@@ -XXX,XX +XXX,XX @@ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
-+    }
-     default:
+ static const VMStateDescription armsse_vmstate = {
-         g_assert_not_reached();
+     .name = "iotkit",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
 +        VMSTATE_CLOCK(mainclk, ARMSSE),
 +        VMSTATE_CLOCK(s32kclk, ARMSSE),
          VMSTATE_UINT32(nsccfg, ARMSSE),
          VMSTATE_END_OF_LIST()
      }
 --
 .20.1

-[PULL 30/36] target/arm: Implement new v8.1M VLLDM and VLSTM encodings
+[PULL 33/46] hw/arm/mps2: Inline CMSDK_APB_TIMER creation
-v8.1M adds new encodings of VLLDM and VLSTM (where bit 7 is set).
+The old-style convenience function cmsdk_apb_timer_create() for
-The only difference is that:
+creating CMSDK_APB_TIMER objects is used in only two places in
- * the old T1 encodings UNDEF if the implementation implements 32
+mps2.c.  Most of the rest of the code in that file uses the new
-   Dregs (this is currently architecturally impossible for M-profile)
+"initialize in place" coding style.
  * the new T2 encodings have the implementation-defined option to
    read from memory (discarding the data) or write UNKNOWN values to
    memory for the stack slots that would be D16-D31
-We choose not to make those accesses, so for us the two
+We want to connect up a Clock object which should be done between the
-instructions behave identically assuming they don't UNDEF.
+object creation and realization; rather than adding a Clock* argument
 to the convenience function, convert the timer creation code in
 mps2.c to the same style as is used already for the watchdog,
 dualtimer and other devices, and delete the now-unused convenience
 function.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-21-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-13-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-13-peter.maydell@linaro.org
 ---
- target/arm/m-nocp.decode       |  2 +-
+ include/hw/timer/cmsdk-apb-timer.h | 21 ---------------------
- target/arm/translate-vfp.c.inc | 25 +++++++++++++++++++++++++
+ hw/arm/mps2.c                      | 18 ++++++++++++++++--
-files changed, 26 insertions(+), 1 deletion(-)
+files changed, 16 insertions(+), 23 deletions(-)
-diff --git a/target/arm/m-nocp.decode b/target/arm/m-nocp.decode
+diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m-nocp.decode
+--- a/include/hw/timer/cmsdk-apb-timer.h
-+++ b/target/arm/m-nocp.decode
++++ b/include/hw/timer/cmsdk-apb-timer.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
+     uint32_t intstatus;
- {
+ };
-   # Special cases which do not take an early NOCP: VLLDM and VLSTM
--  VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
+-/**
-+  VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 op:1 000 0000
+- * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
-   # VSCCLRM (new in v8.1M) is similar:
+- * @addr: location in system memory to map registers
-   VSCCLRM      1110 1100 1.01 1111 .... 1011 imm:7 0   vd=%vd_dp size=3
+- * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
-   VSCCLRM      1110 1100 1.01 1111 .... 1010 imm:8     vd=%vd_sp size=2
+- */
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+-static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
 -                                                 qemu_irq timerint,
 -                                                 uint32_t pclk_frq)
 -{
 -    DeviceState *dev;
 -    SysBusDevice *s;
 -
 -    dev = qdev_new(TYPE_CMSDK_APB_TIMER);
 -    s = SYS_BUS_DEVICE(dev);
 -    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
 -    sysbus_realize_and_unref(s, &error_fatal);
 -    sysbus_mmio_map(s, 0, addr);
 -    sysbus_connect_irq(s, 0, timerint);
 -    return dev;
 -}
 -
  #endif
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.c.inc
+--- a/hw/arm/mps2.c
-+++ b/target/arm/translate-vfp.c.inc
++++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
-         !arm_dc_feature(s, ARM_FEATURE_V8)) {
+     /* CMSDK APB subsystem */
-         return false;
+     CMSDKAPBDualTimer dualtimer;
      CMSDKAPBWatchdog watchdog;
 +    CMSDKAPBTimer timer[2];
  };
  #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      }
+     /* CMSDK APB subsystem */
+-    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
+-    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
++    for (i = 0; i < ARRAY_SIZE(mms->timer); i++) {
++        g_autofree char *name = g_strdup_printf("timer%d", i);
++        hwaddr base = 0x40000000 + i * 0x1000;
++        int irqno = 8 + i;
++        SysBusDevice *sbd;
 +
-+    if (a->op) {
++        object_initialize_child(OBJECT(mms), name, &mms->timer[i],
-+        /*
++                                TYPE_CMSDK_APB_TIMER);
-+         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
++        sbd = SYS_BUS_DEVICE(&mms->timer[i]);
-+         * to take the IMPDEF option to make memory accesses to the stack
++        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
-+         * slots that correspond to the D16-D31 registers (discarding
++        sysbus_realize_and_unref(sbd, &error_fatal);
-+         * read data and writing UNKNOWN values), so for us the T2
++        sysbus_mmio_map(sbd, 0, base);
-+         * encoding behaves identically to the T1 encoding.
++        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
 +         */
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
 +            return false;
 +        }
 +    } else {
 +        /*
 +         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
 +         * This is currently architecturally impossible, but we add the
 +         * check to stay in line with the pseudocode. Note that we must
 +         * emit code for the UNDEF so it takes precedence over the NOCP.
 +         */
 +        if (dc_isar_feature(aa32_simd_r32, s)) {
 +            unallocated_encoding(s);
 +            return true;
 +        }
 +    }
 +
-     /*
+     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
-      * If not secure, UNDEF. We must emit code for this
+                             TYPE_CMSDK_APB_DUALTIMER);
-      * rather than returning false so that this takes
+     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
 --
 .20.1

-[PULL 25/36] hw/intc/armv7m_nvic: Update FPDSCR masking for v8.1M
+[PULL 34/46] hw/arm/mps2: Create and connect SYSCLK Clock
-The FPDSCR register has a similar layout to the FPSCR.  In v8.1M it
+Create a fixed-frequency Clock object to be the SYSCLK, and wire it
-gains new fields FZ16 (if half-precision floating point is supported)
+up to the devices that require it.
 and LTPSIZE (always reads as 4).  Update the reset value and the code
 that handles writes to this register accordingly.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-16-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-14-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-14-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      | 5 +++++
+ hw/arm/mps2.c | 9 +++++++++
- hw/intc/armv7m_nvic.c | 9 ++++++++-
+file changed, 9 insertions(+)
  target/arm/cpu.c      | 3 +++
 files changed, 16 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/mps2.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
+@@ -XXX,XX +XXX,XX @@
- #define FPCR_IXE    (1 << 12)   /* Inexact exception trap enable */
+ #include "hw/net/lan9118.h"
- #define FPCR_IDE    (1 << 15)   /* Input Denormal exception trap enable */
+ #include "net/net.h"
- #define FPCR_FZ16   (1 << 19)   /* ARMv8.2+, FP16 flush-to-zero */
+ #include "hw/watchdog/cmsdk-apb-watchdog.h"
-+#define FPCR_RMODE_MASK (3 << 22) /* Rounding mode */
++#include "hw/qdev-clock.h"
- #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
+ #include "qom/object.h"
- #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
-+#define FPCR_AHP    (1 << 26)   /* Alternative half-precision */
+ typedef enum MPS2FPGAType {
- #define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
+@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
- #define FPCR_V      (1 << 28)   /* FP overflow flag */
+     CMSDKAPBDualTimer dualtimer;
- #define FPCR_C      (1 << 29)   /* FP carry flag */
+     CMSDKAPBWatchdog watchdog;
- #define FPCR_Z      (1 << 30)   /* FP zero flag */
+     CMSDKAPBTimer timer[2];
- #define FPCR_N      (1 << 31)   /* FP negative flag */
++    Clock *sysclk;
+ };
-+#define FPCR_LTPSIZE_SHIFT 16   /* LTPSIZE, M-profile only */
-+#define FPCR_LTPSIZE_MASK (7 << FPCR_LTPSIZE_SHIFT)
+ #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
          exit(EXIT_FAILURE);
      }
 +    /* This clock doesn't need migration because it is fixed-frequency */
 +    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
 +    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
 +
- #define FPCR_NZCV_MASK (FPCR_N | FPCR_Z | FPCR_C | FPCR_V)
+     /* The FPGA images have an odd combination of different RAMs,
- #define FPCR_NZCVQC_MASK (FPCR_NZCV_MASK | FPCR_QC)
+      * because in hardware they are different implementations and
+      * connected to different buses, giving varying performance/size
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-index XXXXXXX..XXXXXXX 100644
+                                 TYPE_CMSDK_APB_TIMER);
---- a/hw/intc/armv7m_nvic.c
+         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
-+++ b/hw/intc/armv7m_nvic.c
+         qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
++        qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
-         break;
+         sysbus_realize_and_unref(sbd, &error_fatal);
-     case 0xf3c: /* FPDSCR */
+         sysbus_mmio_map(sbd, 0, base);
-         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
+         sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
--            value &= 0x07c00000;
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-+            uint32_t mask = FPCR_AHP | FPCR_DN | FPCR_FZ | FPCR_RMODE_MASK;
+     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
-+            if (cpu_isar_feature(any_fp16, cpu)) {
+                             TYPE_CMSDK_APB_DUALTIMER);
-+                mask |= FPCR_FZ16;
+     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
-+            }
++    qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
-+            value &= mask;
+     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
-+            if (cpu_isar_feature(aa32_lob, cpu)) {
+     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
-+                value |= 4 << FPCR_LTPSIZE_SHIFT;
+                        qdev_get_gpio_in(armv7m, 10));
-+            }
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-             cpu->env.v7m.fpdscr[attrs.secure] = value;
+     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
-         }
+                             TYPE_CMSDK_APB_WATCHDOG);
-         break;
+     qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++    qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
-index XXXXXXX..XXXXXXX 100644
+     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
---- a/target/arm/cpu.c
+     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
-+++ b/target/arm/cpu.c
+                        qdev_get_gpio_in_named(armv7m, "NMI", 0));
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
               * always reset to 4.
               */
              env->v7m.ltpsize = 4;
 +            /* The LTPSIZE field in FPDSCR is constant and reads as 4. */
 +            env->v7m.fpdscr[M_REG_NS] = 4 << FPCR_LTPSIZE_SHIFT;
 +            env->v7m.fpdscr[M_REG_S] = 4 << FPCR_LTPSIZE_SHIFT;
          }
          if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 --
 .20.1

-[PULL 22/36] target/arm: Use new FPCR_NZCV_MASK constant
+[PULL 35/46] hw/arm/mps2-tz: Create and connect ARMSSE Clocks
-We defined a constant name for the mask of NZCV bits in the FPCR/FPSCR
+Create and connect the two clocks needed by the ARMSSE.
 in the previous commit; use it in a couple of places in existing code,
 where we're masking out everything except NZCV for the "load to Rt=15
 sets CPSR.NZCV" special case.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-12-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-15-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-15-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.c.inc | 4 ++--
+ hw/arm/mps2-tz.c | 13 +++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 13 insertions(+)
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.c.inc
+--- a/hw/arm/mps2-tz.c
-+++ b/target/arm/translate-vfp.c.inc
++++ b/hw/arm/mps2-tz.c
-@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+@@ -XXX,XX +XXX,XX @@
-          * helper call for the "VMRS to CPSR.NZCV" insn.
+ #include "hw/net/lan9118.h"
-          */
+ #include "net/net.h"
-         tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
+ #include "hw/core/split-irq.h"
--        tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
++#include "hw/qdev-clock.h"
-+        tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
+ #include "qom/object.h"
-         storefn(s, opaque, tmp);
-         break;
+ #define MPS2TZ_NUMIRQ 92
-     default:
+@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
+     qemu_or_irq uart_irq_orgate;
-         case ARM_VFP_FPSCR:
+     DeviceState *lan9118;
-             if (a->rt == 15) {
+     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
-                 tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
++    Clock *sysclk;
--                tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
++    Clock *s32kclk;
-+                tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
+ };
-             } else {
-                 tmp = tcg_temp_new_i32();
+ #define TYPE_MPS2TZ_MACHINE "mps2tz"
-                 gen_helper_vfp_get_fpscr(tmp, cpu_env);
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
  /* Main SYSCLK frequency in Hz */
  #define SYSCLK_FRQ 20000000
 +/* Slow 32Khz S32KCLK frequency in Hz */
 +#define S32KCLK_FRQ (32 * 1000)
  /* Create an alias of an entire original MemoryRegion @orig
   * located at @base in the memory map.
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
          exit(EXIT_FAILURE);
      }
 +    /* These clocks don't need migration because they are fixed-frequency */
 +    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
 +    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
 +    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
 +    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
 +
      object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
                              mmc->armsse_type);
      iotkitdev = DEVICE(&mms->iotkit);
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                               OBJECT(system_memory), &error_abort);
      qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
      qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
 +    qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
 +    qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
      /*
 --
 .20.1

-[PULL 21/36] target/arm: Implement M-profile FPSCR_nzcvqc
+[PULL 36/46] hw/arm/musca: Create and connect ARMSSE Clocks
-v8.1M defines a new FP system register FPSCR_nzcvqc; this behaves
+Create and connect the two clocks needed by the ARMSSE.
 like the existing FPSCR, except that it reads and writes only bits
 [31:27] of the FPSCR (the N, Z, C, V and QC flag bits).  (Unlike the
 FPSCR, the special case for Rt=15 of writing the CPSR.NZCV is not
 permitted.)
 Implement the register.  Since we don't yet implement MVE, we handle
 the QC bit as RES0, with todo comments for where we will need to add
 support later.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-11-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-16-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-16-peter.maydell@linaro.org
 ---
- target/arm/cpu.h               | 13 +++++++++++++
+ hw/arm/musca.c | 12 ++++++++++++
- target/arm/translate-vfp.c.inc | 27 +++++++++++++++++++++++++++
+file changed, 12 insertions(+)
 files changed, 40 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/musca.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/musca.c
-@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
+@@ -XXX,XX +XXX,XX @@
- #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
+ #include "hw/misc/tz-ppc.h"
- #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
+ #include "hw/misc/unimp.h"
- #define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
+ #include "hw/rtc/pl031.h"
-+#define FPCR_V      (1 << 28)   /* FP overflow flag */
++#include "hw/qdev-clock.h"
-+#define FPCR_C      (1 << 29)   /* FP carry flag */
+ #include "qom/object.h"
-+#define FPCR_Z      (1 << 30)   /* FP zero flag */
-+#define FPCR_N      (1 << 31)   /* FP negative flag */
+ #define MUSCA_NUMIRQ_MAX 96
@@ -XXX,XX +XXX,XX @@ struct MuscaMachineState {
      UnimplementedDeviceState sdio;
      UnimplementedDeviceState gpio;
      UnimplementedDeviceState cryptoisland;
 +    Clock *sysclk;
 +    Clock *s32kclk;
  };
  #define TYPE_MUSCA_MACHINE "musca"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
   * don't model that in our SSE-200 model yet.
   */
  #define SYSCLK_FRQ 40000000
 +/* Slow 32Khz S32KCLK frequency in Hz */
 +#define S32KCLK_FRQ (32 * 1000)
  static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
  {
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
          exit(1);
      }
 +    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
 +    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
 +    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
 +    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
 +
-+#define FPCR_NZCV_MASK (FPCR_N | FPCR_Z | FPCR_C | FPCR_V)
+     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
-+#define FPCR_NZCVQC_MASK (FPCR_NZCV_MASK | FPCR_QC)
+                             TYPE_SSE200);
+     ssedev = DEVICE(&mms->sse);
- static inline uint32_t vfp_get_fpsr(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
- {
+     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
-@@ -XXX,XX +XXX,XX @@ enum arm_cpu_mode {
+     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
- #define ARM_VFP_FPEXC   8
+     qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
- #define ARM_VFP_FPINST  9
++    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
- #define ARM_VFP_FPINST2 10
++    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
-+/* These ones are M-profile only */
+     /*
-+#define ARM_VFP_FPSCR_NZCVQC 2
+      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
-+#define ARM_VFP_VPR 12
+      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
 +#define ARM_VFP_P0 13
 +#define ARM_VFP_FPCXT_NS 14
 +#define ARM_VFP_FPCXT_S 15
  /* QEMU-internal value meaning "FPSCR, but we care only about NZCV" */
  #define QEMU_VFP_FPSCR_NZCV 0xffff
 diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c.inc
 +++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
      case ARM_VFP_FPSCR:
      case QEMU_VFP_FPSCR_NZCV:
          break;
 +    case ARM_VFP_FPSCR_NZCVQC:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
 +            return false;
 +        }
 +        break;
      default:
          return FPSysRegCheckFailed;
      }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
          tcg_temp_free_i32(tmp);
          gen_lookup_tb(s);
          break;
 +    case ARM_VFP_FPSCR_NZCVQC:
 +    {
 +        TCGv_i32 fpscr;
 +        tmp = loadfn(s, opaque);
 +        /*
 +         * TODO: when we implement MVE, write the QC bit.
 +         * For non-MVE, QC is RES0.
 +         */
 +        tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
 +        fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
 +        tcg_gen_andi_i32(fpscr, fpscr, ~FPCR_NZCV_MASK);
 +        tcg_gen_or_i32(fpscr, fpscr, tmp);
 +        store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
 +        tcg_temp_free_i32(tmp);
 +        break;
 +    }
      default:
          g_assert_not_reached();
      }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
          gen_helper_vfp_get_fpscr(tmp, cpu_env);
          storefn(s, opaque, tmp);
          break;
 +    case ARM_VFP_FPSCR_NZCVQC:
 +        /*
 +         * TODO: MVE has a QC bit, which we probably won't store
 +         * in the xregs[] field. For non-MVE, where QC is RES0,
 +         * we can just fall through to the FPSCR_NZCV case.
 +         */
      case QEMU_VFP_FPSCR_NZCV:
          /*
           * Read just NZCV; this is a special case to avoid the
 --
 .20.1

-[PULL 12/36] hw/intc/armv7m_nvic: Make all of system PPB range be RAZWI/BusFault
+[PULL 37/46] hw/arm/stellaris: Convert SSYS to QOM device
-For M-profile CPUs, the range from 0xe0000000 to 0xe00fffff is the
+Convert the SSYS code in the Stellaris boards (which encapsulates the
-Private Peripheral Bus range, which includes all of the memory mapped
+system registers) to a proper QOM device.  This will provide us with
-devices and registers that are part of the CPU itself, including the
+somewhere to put the output Clock whose frequency depends on the
-NVIC, systick timer, and debug and trace components like the Data
+setting of the PLL configuration registers.
-Watchpoint and Trace unit (DWT).  Within this large region, the range
-xe000e000 to 0xe000efff is the System Control Space (NVIC, system
+This is a migration compatibility break for lm3s811evb, lm3s6965evb.
-registers, systick) and 0xe002e000 to 0exe002efff is its Non-secure
-alias.
+We use 3-phase reset here because the Clock will need to propagate
+its value in the hold phase.
-The architecture is clear that within the SCS unimplemented registers
-should be RES0 for privileged accesses and generate BusFault for
+For the moment we reset the device during the board creation so that
-unprivileged accesses, and we currently implement this.
+the system_clock_scale global gets set; this will be removed in a
+subsequent commit.
 It is less clear about how to handle accesses to unimplemented
 regions of the wider PPB.  Unprivileged accesses should definitely
 cause BusFaults (R_DQQS), but the behaviour of privileged accesses is
 not given as a general rule.  However, the register definitions of
 individual registers for components like the DWT all state that they
 are RES0 if the relevant component is not implemented, so the
 simplest way to provide that is to provide RAZ/WI for the whole range
 for privileged accesses.  (The v7M Arm ARM does say that reserved
 registers should be UNK/SBZP.)
 Expand the container MemoryRegion that the NVIC exposes so that
 it covers the whole PPB space. This means:
  * moving the address that the ARMV7M device maps it to down by
 xe000 bytes
  * moving the off and the offsets within the container of all the
    subregions forward by 0xe000 bytes
  * adding a new default MemoryRegion that covers the whole container
    at a lower priority than anything else and which provides the
    RAZWI/BusFault behaviour
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-2-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-17-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-17-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- include/hw/intc/armv7m_nvic.h |  1 +
+ hw/arm/stellaris.c | 132 ++++++++++++++++++++++++++++++++++++---------
- hw/arm/armv7m.c               |  2 +-
+file changed, 107 insertions(+), 25 deletions(-)
- hw/intc/armv7m_nvic.c         | 78 ++++++++++++++++++++++++++++++-----
-files changed, 69 insertions(+), 12 deletions(-)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/armv7m_nvic.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/intc/armv7m_nvic.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ struct NVICState {
+@@ -XXX,XX +XXX,XX @@ static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
-     MemoryRegion systickmem;
-     MemoryRegion systick_ns_mem;
+ /* System controller.  */
-     MemoryRegion container;
-+    MemoryRegion defaultmem;
+-typedef struct {
++#define TYPE_STELLARIS_SYS "stellaris-sys"
-     uint32_t num_irq;
++OBJECT_DECLARE_SIMPLE_TYPE(ssys_state, STELLARIS_SYS)
-     qemu_irq excpout;
++
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
++struct ssys_state {
-index XXXXXXX..XXXXXXX 100644
++    SysBusDevice parent_obj;
---- a/hw/arm/armv7m.c
++
-+++ b/hw/arm/armv7m.c
+     MemoryRegion iomem;
-@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
+     uint32_t pborctl;
-     sysbus_connect_irq(sbd, 0,
+     uint32_t ldopctl;
-                        qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_IRQ));
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+     uint32_t dcgc[3];
--    memory_region_add_subregion(&s->container, 0xe000e000,
+     uint32_t clkvclr;
-+    memory_region_add_subregion(&s->container, 0xe0000000,
+     uint32_t ldoarst;
-                                 sysbus_mmio_get_region(sbd, 0));
++    qemu_irq irq;
++    /* Properties (all read-only registers) */
-     for (i = 0; i < ARRAY_SIZE(s->bitband); i++) {
+     uint32_t user0;
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+     uint32_t user1;
-index XXXXXXX..XXXXXXX 100644
+-    qemu_irq irq;
---- a/hw/intc/armv7m_nvic.c
+-    stellaris_board_info *board;
-+++ b/hw/intc/armv7m_nvic.c
+-} ssys_state;
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_systick_ops = {
++    uint32_t did0;
 +    uint32_t did1;
 +    uint32_t dc0;
 +    uint32_t dc1;
 +    uint32_t dc2;
 +    uint32_t dc3;
 +    uint32_t dc4;
 +};
  static void ssys_update(ssys_state *s)
  {
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_fury[16] = {
  static int ssys_board_class(const ssys_state *s)
  {
 -    uint32_t did0 = s->board->did0;
 +    uint32_t did0 = s->did0;
      switch (did0 & DID0_VER_MASK) {
      case DID0_VER_0:
          return DID0_CLASS_SANDSTORM;
@@ -XXX,XX +XXX,XX @@ static uint64_t ssys_read(void *opaque, hwaddr offset,
      switch (offset) {
      case 0x000: /* DID0 */
 -        return s->board->did0;
 +        return s->did0;
      case 0x004: /* DID1 */
 -        return s->board->did1;
 +        return s->did1;
      case 0x008: /* DC0 */
 -        return s->board->dc0;
 +        return s->dc0;
      case 0x010: /* DC1 */
 -        return s->board->dc1;
 +        return s->dc1;
      case 0x014: /* DC2 */
 -        return s->board->dc2;
 +        return s->dc2;
      case 0x018: /* DC3 */
 -        return s->board->dc3;
 +        return s->dc3;
      case 0x01c: /* DC4 */
 -        return s->board->dc4;
 +        return s->dc4;
      case 0x030: /* PBORCTL */
          return s->pborctl;
      case 0x034: /* LDOPCTL */
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ssys_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
-+/*
+-static void ssys_reset(void *opaque)
-+ * Unassigned portions of the PPB space are RAZ/WI for privileged
++static void stellaris_sys_reset_enter(Object *obj, ResetType type)
-+ * accesses, and fault for non-privileged accesses.
+ {
-+ */
+-    ssys_state *s = (ssys_state *)opaque;
-+static MemTxResult ppb_default_read(void *opaque, hwaddr addr,
++    ssys_state *s = STELLARIS_SYS(obj);
-+                                    uint64_t *data, unsigned size,
-+                                    MemTxAttrs attrs)
+     s->pborctl = 0x7ffd;
-+{
+     s->rcc = 0x078e3ac0;
-+    qemu_log_mask(LOG_UNIMP, "Read of unassigned area of PPB: offset 0x%x\n",
+@@ -XXX,XX +XXX,XX @@ static void ssys_reset(void *opaque)
-+                  (uint32_t)addr);
+     s->rcgc[0] = 1;
-+    if (attrs.user) {
+     s->scgc[0] = 1;
-+        return MEMTX_ERROR;
+     s->dcgc[0] = 1;
-+    }
++}
-+    *data = 0;
++
-+    return MEMTX_OK;
++static void stellaris_sys_reset_hold(Object *obj)
-+}
++{
-+
++    ssys_state *s = STELLARIS_SYS(obj);
-+static MemTxResult ppb_default_write(void *opaque, hwaddr addr,
++
-+                                     uint64_t value, unsigned size,
+     ssys_calculate_system_clock(s);
-+                                     MemTxAttrs attrs)
+ }
-+{
-+    qemu_log_mask(LOG_UNIMP, "Write of unassigned area of PPB: offset 0x%x\n",
++static void stellaris_sys_reset_exit(Object *obj)
-+                  (uint32_t)addr);
++{
-+    if (attrs.user) {
++}
-+        return MEMTX_ERROR;
++
-+    }
+ static int stellaris_sys_post_load(void *opaque, int version_id)
-+    return MEMTX_OK;
+ {
-+}
+     ssys_state *s = opaque;
-+
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
-+static const MemoryRegionOps ppb_default_ops = {
+     }
-+    .read_with_attrs = ppb_default_read,
+ };
-+    .write_with_attrs = ppb_default_write,
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++static Property stellaris_sys_properties[] = {
-+    .valid.min_access_size = 1,
++    DEFINE_PROP_UINT32("user0", ssys_state, user0, 0),
-+    .valid.max_access_size = 8,
++    DEFINE_PROP_UINT32("user1", ssys_state, user1, 0),
 +    DEFINE_PROP_UINT32("did0", ssys_state, did0, 0),
 +    DEFINE_PROP_UINT32("did1", ssys_state, did1, 0),
 +    DEFINE_PROP_UINT32("dc0", ssys_state, dc0, 0),
 +    DEFINE_PROP_UINT32("dc1", ssys_state, dc1, 0),
 +    DEFINE_PROP_UINT32("dc2", ssys_state, dc2, 0),
 +    DEFINE_PROP_UINT32("dc3", ssys_state, dc3, 0),
 +    DEFINE_PROP_UINT32("dc4", ssys_state, dc4, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
- static int nvic_post_load(void *opaque, int version_id)
++static void stellaris_sys_instance_init(Object *obj)
- {
++{
-     NVICState *s = opaque;
++    ssys_state *s = STELLARIS_SYS(obj);
-@@ -XXX,XX +XXX,XX @@ static void nvic_systick_trigger(void *opaque, int n, int level)
++    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
- static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
++
- {
++    memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
-     NVICState *s = NVIC(dev);
++    sysbus_init_mmio(sbd, &s->iomem);
--    int regionlen;
++    sysbus_init_irq(sbd, &s->irq);
++}
-     /* The armv7m container object will have set our CPU pointer */
++
-     if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
+ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
+                               stellaris_board_info * board,
-                                                   M_REG_S));
+                               uint8_t *macaddr)
-     }
+ {
+-    ssys_state *s;
--    /* The NVIC and System Control Space (SCS) starts at 0xe000e000
++    DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 -    s = g_new0(ssys_state, 1);
 -    s->irq = irq;
 -    s->board = board;
      /* Most devices come preprogrammed with a MAC address in the user data. */
 -    s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
 -    s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
 +    qdev_prop_set_uint32(dev, "user0",
 +                         macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16));
 +    qdev_prop_set_uint32(dev, "user1",
 +                         macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16));
 +    qdev_prop_set_uint32(dev, "did0", board->did0);
 +    qdev_prop_set_uint32(dev, "did1", board->did1);
 +    qdev_prop_set_uint32(dev, "dc0", board->dc0);
 +    qdev_prop_set_uint32(dev, "dc1", board->dc1);
 +    qdev_prop_set_uint32(dev, "dc2", board->dc2);
 +    qdev_prop_set_uint32(dev, "dc3", board->dc3);
 +    qdev_prop_set_uint32(dev, "dc4", board->dc4);
 +
 +    sysbus_realize_and_unref(sbd, &error_fatal);
 +    sysbus_mmio_map(sbd, 0, base);
 +    sysbus_connect_irq(sbd, 0, irq);
 +
 +    /*
-+     * This device provides a single sysbus memory region which
++     * Normally we should not be resetting devices like this during
-+     * represents the whole of the "System PPB" space. This is the
++     * board creation. For the moment we need to do so, because
-+     * range from 0xe0000000 to 0xe00fffff and includes the NVIC,
++     * system_clock_scale will only get set when the STELLARIS_SYS
-+     * the System Control Space (system registers), the systick timer,
++     * device is reset, and we need its initial value to pass to
-+     * and for CPUs with the Security extension an NS banked version
++     * the watchdog device. This hack can be removed once the
-+     * of all of these.
++     * watchdog has been converted to use a Clock input instead.
-+     *
++     */
-+     * The default behaviour for unimplemented registers/ranges
++    device_cold_reset(dev);
-+     * (for instance the Data Watchpoint and Trace unit at 0xe0001000)
-+     * is to RAZ/WI for privileged access and BusFault for non-privileged
+-    memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
-+     * access.
+-    memory_region_add_subregion(get_system_memory(), base, &s->iomem);
-+     *
+-    ssys_reset(s);
-+     * The NVIC and System Control Space (SCS) starts at 0xe000e000
+-    vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
-      * and looks like this:
+     return 0;
-      *  0x004 - ICTR
+ }
-      *  0x010 - 0xff - systick
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
+-
-      * generally code determining which banked register to use should
+ /* I2C controller.  */
-      * use attrs.secure; code determining actual behaviour of the system
-      * should use env->v7m.secure.
+ #define TYPE_STELLARIS_I2C "stellaris-i2c"
-+     *
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo stellaris_adc_info = {
-+     * The container covers the whole PPB space. Within it the priority
+     .class_init    = stellaris_adc_class_init,
-+     * of overlapping regions is:
+ };
-+     *  - default region (for RAZ/WI and BusFault) : -1
-+     *  - system register regions : 0
++static void stellaris_sys_class_init(ObjectClass *klass, void *data)
-+     *  - systick : 1
++{
-+     * This is because the systick device is a small block of registers
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+     * in the middle of the other system control registers.
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
-      */
++
--    regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
++    dc->vmsd = &vmstate_stellaris_sys;
--    memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
++    rc->phases.enter = stellaris_sys_reset_enter;
--    /* The system register region goes at the bottom of the priority
++    rc->phases.hold = stellaris_sys_reset_hold;
--     * stack as it covers the whole page.
++    rc->phases.exit = stellaris_sys_reset_exit;
--     */
++    device_class_set_props(dc, stellaris_sys_properties);
-+    memory_region_init(&s->container, OBJECT(s), "nvic", 0x100000);
++}
-+    memory_region_init_io(&s->defaultmem, OBJECT(s), &ppb_default_ops, s,
++
-+                          "nvic-default", 0x100000);
++static const TypeInfo stellaris_sys_info = {
-+    memory_region_add_subregion_overlap(&s->container, 0, &s->defaultmem, -1);
++    .name = TYPE_STELLARIS_SYS,
-     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
++    .parent = TYPE_SYS_BUS_DEVICE,
-                           "nvic_sysregs", 0x1000);
++    .instance_size = sizeof(ssys_state),
--    memory_region_add_subregion(&s->container, 0, &s->sysregmem);
++    .instance_init = stellaris_sys_instance_init,
-+    memory_region_add_subregion(&s->container, 0xe000, &s->sysregmem);
++    .class_init = stellaris_sys_class_init,
++};
-     memory_region_init_io(&s->systickmem, OBJECT(s),
++
-                           &nvic_systick_ops, s,
+ static void stellaris_register_types(void)
-                           "nvic_systick", 0xe0);
+ {
+     type_register_static(&stellaris_i2c_info);
--    memory_region_add_subregion_overlap(&s->container, 0x10,
+     type_register_static(&stellaris_gptm_info);
-+    memory_region_add_subregion_overlap(&s->container, 0xe010,
+     type_register_static(&stellaris_adc_info);
-                                         &s->systickmem, 1);
++    type_register_static(&stellaris_sys_info);
+ }
-     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
-         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
+ type_init(stellaris_register_types)
                                &nvic_sysreg_ns_ops, &s->sysregmem,
                                "nvic_sysregs_ns", 0x1000);
 -        memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
 +        memory_region_add_subregion(&s->container, 0x2e000, &s->sysreg_ns_mem);
          memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
                                &nvic_sysreg_ns_ops, &s->systickmem,
                                "nvic_systick_ns", 0xe0);
 -        memory_region_add_subregion_overlap(&s->container, 0x20010,
 +        memory_region_add_subregion_overlap(&s->container, 0x2e010,
                                              &s->systick_ns_mem, 1);
      }
 --
 .20.1

-[PULL 14/36] target/arm: Don't clobber ID_PFR1.Security on M-profile cores
+[PULL 38/46] hw/arm/stellaris: Create Clock input for watchdog
-In arm_cpu_realizefn() we check whether the board code disabled EL3
+Create and connect the Clock input for the watchdog device on the
-via the has_el3 CPU object property, which we create if the CPU
+Stellaris boards.  Because the Stellaris boards model the ability to
-starts with the ARM_FEATURE_EL3 feature bit.  If it is disabled, then
+change the clock rate by programming PLL registers, we have to create
-we turn off ARM_FEATURE_EL3 and also zero out the relevant fields in
+an output Clock on the ssys_state device and wire it up to the
-the ID_PFR1 and ID_AA64PFR0 registers.
+watchdog.
-This codepath was incorrectly being taken for M-profile CPUs, which
+Note that the old comment on ssys_calculate_system_clock() got the
-do not have an EL3 and don't set ARM_FEATURE_EL3, but which may have
+units wrong -- system_clock_scale is in nanoseconds, not
-the M-profile Security extension and so should have non-zero values
+milliseconds.  Improve the commentary to clarify how we are
-in the ID_PFR1.Security field.
+calculating the period.
 Restrict the handling of the feature flag to A/R-profile cores.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-4-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-18-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-18-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- target/arm/cpu.c | 2 +-
+ hw/arm/stellaris.c | 43 +++++++++++++++++++++++++++++++------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 31 insertions(+), 12 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/hw/arm/stellaris.c
-+++ b/target/arm/cpu.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
  #include "hw/watchdog/cmsdk-apb-watchdog.h"
  #include "migration/vmstate.h"
  #include "hw/misc/unimp.h"
 +#include "hw/qdev-clock.h"
  #include "cpu.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct ssys_state {
      uint32_t clkvclr;
      uint32_t ldoarst;
      qemu_irq irq;
 +    Clock *sysclk;
      /* Properties (all read-only registers) */
      uint32_t user0;
      uint32_t user1;
@@ -XXX,XX +XXX,XX @@ static bool ssys_use_rcc2(ssys_state *s)
  }
  /*
 - * Caculate the sys. clock period in ms.
 + * Calculate the system clock period. We only want to propagate
 + * this change to the rest of the system if we're not being called
 + * from migration post-load.
   */
 -static void ssys_calculate_system_clock(ssys_state *s)
 +static void ssys_calculate_system_clock(ssys_state *s, bool propagate_clock)
  {
 +    /*
 +     * SYSDIV field specifies divisor: 0 == /1, 1 == /2, etc.  Input
 +     * clock is 200MHz, which is a period of 5 ns. Dividing the clock
 +     * frequency by X is the same as multiplying the period by X.
 +     */
      if (ssys_use_rcc2(s)) {
          system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
      } else {
          system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
      }
 +    clock_set_ns(s->sysclk, system_clock_scale);
 +    if (propagate_clock) {
 +        clock_propagate(s->sysclk);
 +    }
  }
  static void ssys_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
              s->int_status |= (1 << 6);
          }
          s->rcc = value;
 -        ssys_calculate_system_clock(s);
 +        ssys_calculate_system_clock(s, true);
          break;
      case 0x070: /* RCC2 */
          if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
              s->int_status |= (1 << 6);
          }
          s->rcc2 = value;
 -        ssys_calculate_system_clock(s);
 +        ssys_calculate_system_clock(s, true);
          break;
      case 0x100: /* RCGC0 */
          s->rcgc[0] = value;
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_reset_hold(Object *obj)
  {
      ssys_state *s = STELLARIS_SYS(obj);
 -    ssys_calculate_system_clock(s);
 +    /* OK to propagate clocks from the hold phase */
 +    ssys_calculate_system_clock(s, true);
  }
  static void stellaris_sys_reset_exit(Object *obj)
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_post_load(void *opaque, int version_id)
  {
      ssys_state *s = opaque;
 -    ssys_calculate_system_clock(s);
 +    ssys_calculate_system_clock(s, false);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
          VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
          VMSTATE_UINT32(clkvclr, ssys_state),
          VMSTATE_UINT32(ldoarst, ssys_state),
 +        /* No field for sysclk -- handled in post-load instead */
          VMSTATE_END_OF_LIST()
      }
  };
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_instance_init(Object *obj)
      memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->irq);
 +    s->sysclk = qdev_init_clock_out(DEVICE(s), "SYSCLK");
  }
 -static int stellaris_sys_init(uint32_t base, qemu_irq irq,
 -                              stellaris_board_info * board,
 -                              uint8_t *macaddr)
 +static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
 +                                       stellaris_board_info *board,
 +                                       uint8_t *macaddr)
  {
      DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
      SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
       */
      device_cold_reset(dev);
 -    return 0;
 +    return dev;
  }
  /* I2C controller.  */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      int flash_size;
      I2CBus *i2c;
      DeviceState *dev;
 +    DeviceState *ssys_dev;
      int i;
      int j;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          }
      }
--    if (!cpu->has_el3) {
+-    stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
-+    if (!arm_feature(env, ARM_FEATURE_M) && !cpu->has_el3) {
+-                       board, nd_table[0].macaddr.a);
-         /* If the has_el3 CPU property is disabled then we need to disable the
++    ssys_dev = stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
-          * feature.
++                                  board, nd_table[0].macaddr.a);
-          */
      if (board->dc1 & (1 << 3)) { /* watchdog present */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          /* system_clock_scale is valid now */
          uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
          qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
 +        qdev_connect_clock_in(dev, "WDOGCLK",
 +                              qdev_get_clock_out(ssys_dev, "SYSCLK"));
          sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
          sysbus_mmio_map(SYS_BUS_DEVICE(dev),
 --
 .20.1

-[PULL 35/36] hw/intc/armv7m_nvic: Implement read/write for RAS register block
+[PULL 39/46] hw/timer/cmsdk-apb-timer: Convert to use Clock input
-The RAS feature has a block of memory-mapped registers at offset
+Switch the CMSDK APB timer device over to using its Clock input; the
-x5000 within the PPB.  For a "minimal RAS" implementation we provide
+pclk-frq property is now ignored.
 no error records and so the only registers that exist in the block
 are ERRIIDR and ERRDEVID.
 The "RAZ/WI for privileged, BusFault for nonprivileged" behaviour
 of the "nvic-default" region is actually valid for minimal-RAS,
 so the main benefit of providing an explicit implementation of
 the register block is more accurate LOG_UNIMP messages, and a
 framework for where we could add a real RAS implementation later
 if necessary.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-27-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-19-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-19-peter.maydell@linaro.org
 ---
- include/hw/intc/armv7m_nvic.h |  1 +
+ hw/timer/cmsdk-apb-timer.c | 18 ++++++++++++++----
- hw/intc/armv7m_nvic.c         | 56 +++++++++++++++++++++++++++++++++++
+file changed, 14 insertions(+), 4 deletions(-)
 files changed, 57 insertions(+)
-diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/armv7m_nvic.h
+--- a/hw/timer/cmsdk-apb-timer.c
-+++ b/include/hw/intc/armv7m_nvic.h
++++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@ struct NVICState {
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
-     MemoryRegion sysreg_ns_mem;
+     ptimer_transaction_commit(s->timer);
-     MemoryRegion systickmem;
+ }
-     MemoryRegion systick_ns_mem;
-+    MemoryRegion ras_mem;
++static void cmsdk_apb_timer_clk_update(void *opaque)
-     MemoryRegion container;
++{
-     MemoryRegion defaultmem;
++    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_systick_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 +
-+static MemTxResult ras_read(void *opaque, hwaddr addr,
++    ptimer_transaction_begin(s->timer);
-+                            uint64_t *data, unsigned size,
++    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
-+                            MemTxAttrs attrs)
++    ptimer_transaction_commit(s->timer);
 +{
 +    if (attrs.user) {
 +        return MEMTX_ERROR;
 +    }
 +
 +    switch (addr) {
 +    case 0xe10: /* ERRIIDR */
 +        /* architect field = Arm; product/variant/revision 0 */
 +        *data = 0x43b;
 +        break;
 +    case 0xfc8: /* ERRDEVID */
 +        /* Minimal RAS: we implement 0 error record indexes */
 +        *data = 0;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_UNIMP, "Read RAS register offset 0x%x\n",
 +                      (uint32_t)addr);
 +        *data = 0;
 +        break;
 +    }
 +    return MEMTX_OK;
 +}
 +
-+static MemTxResult ras_write(void *opaque, hwaddr addr,
+ static void cmsdk_apb_timer_init(Object *obj)
-+                             uint64_t value, unsigned size,
+ {
-+                             MemTxAttrs attrs)
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+{
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
-+    if (attrs.user) {
+                           s, "cmsdk-apb-timer", 0x1000);
-+        return MEMTX_ERROR;
+     sysbus_init_mmio(sbd, &s->iomem);
-+    }
+     sysbus_init_irq(sbd, &s->timerint);
-+
+-    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
-+    switch (addr) {
++    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk",
-+    default:
++                                 cmsdk_apb_timer_clk_update, s);
-+        qemu_log_mask(LOG_UNIMP, "Write to RAS register offset 0x%x\n",
+ }
-+                      (uint32_t)addr);
-+        break;
+ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
-+    }
+ {
-+    return MEMTX_OK;
+     CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
-+}
-+
+-    if (s->pclk_frq == 0) {
-+static const MemoryRegionOps ras_ops = {
+-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
-+    .read_with_attrs = ras_read,
++    if (!clock_has_source(s->pclk)) {
-+    .write_with_attrs = ras_write,
++        error_setg(errp, "CMSDK APB timer: pclk clock must be connected");
-+    .endianness = DEVICE_NATIVE_ENDIAN,
+         return;
 +};
 +
  /*
   * Unassigned portions of the PPB space are RAZ/WI for privileged
   * accesses, and fault for non-privileged accesses.
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
                                              &s->systick_ns_mem, 1);
      }
-+    if (cpu_isar_feature(aa32_ras, s->cpu)) {
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
-+        memory_region_init_io(&s->ras_mem, OBJECT(s),
+                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+                              &ras_ops, s, "nvic_ras", 0x1000);
-+        memory_region_add_subregion(&s->container, 0x5000, &s->ras_mem);
+     ptimer_transaction_begin(s->timer);
-+    }
+-    ptimer_set_freq(s->timer, s->pclk_frq);
-+
++    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
-     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->container);
+     ptimer_transaction_commit(s->timer);
  }
 --
 .20.1

-[PULL 18/36] target/arm: Refactor M-profile VMSR/VMRS handling
+[PULL 40/46] hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
-Currently M-profile borrows the A-profile code for VMSR and VMRS
+Switch the CMSDK APB dualtimer device over to using its Clock input;
-(access to the FP system registers), because all it needs to support
+the pclk-frq property is now ignored.
 is the FPSCR.  In v8.1M things become significantly more complicated
 in two ways:
  * there are several new FP system registers; some have side effects
    on read, and one (FPCXT_NS) needs to avoid the usual
    vfp_access_check() and the "only if FPU implemented" check
  * all sysregs are now accessible both by VMRS/VMSR (which
    reads/writes a general purpose register) and also by VLDR/VSTR
    (which reads/writes them directly to memory)
 Refactor the structure of how we handle VMSR/VMRS to cope with this:
  * keep the M-profile code entirely separate from the A-profile code
  * abstract out the "read or write the general purpose register" part
    of the code into a loadfn or storefn function pointer, so we can
    reuse it for VLDR/VSTR.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-8-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-20-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-20-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- target/arm/cpu.h               |   3 +
+ hw/timer/cmsdk-apb-dualtimer.c | 42 ++++++++++++++++++++++++++++++----
- target/arm/translate-vfp.c.inc | 182 ++++++++++++++++++++++++++++++---
+file changed, 37 insertions(+), 5 deletions(-)
 files changed, 171 insertions(+), 14 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/timer/cmsdk-apb-dualtimer.c
-+++ b/target/arm/cpu.h
++++ b/hw/timer/cmsdk-apb-dualtimer.c
-@@ -XXX,XX +XXX,XX @@ enum arm_cpu_mode {
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_update(CMSDKAPBDualTimer *s)
- #define ARM_VFP_FPINST  9
+     qemu_set_irq(s->timerintc, timintc);
  #define ARM_VFP_FPINST2 10
 +/* QEMU-internal value meaning "FPSCR, but we care only about NZCV" */
 +#define QEMU_VFP_FPSCR_NZCV 0xffff
 +
  /* iwMMXt coprocessor control registers.  */
  #define ARM_IWMMXT_wCID  0
  #define ARM_IWMMXT_wCon  1
 diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c.inc
 +++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
      return true;
  }
-+/*
++static int cmsdk_dualtimermod_divisor(CMSDKAPBDualTimerModule *m)
 + * M-profile provides two different sets of instructions that can
 + * access floating point system registers: VMSR/VMRS (which move
 + * to/from a general purpose register) and VLDR/VSTR sysreg (which
 + * move directly to/from memory). In some cases there are also side
 + * effects which must happen after any write to memory (which could
 + * cause an exception). So we implement the common logic for the
 + * sysreg access in gen_M_fp_sysreg_write() and gen_M_fp_sysreg_read(),
 + * which take pointers to callback functions which will perform the
 + * actual "read/write general purpose register" and "read/write
 + * memory" operations.
 + */
 +
 +/*
 + * Emit code to store the sysreg to its final destination; frees the
 + * TCG temp 'value' it is passed.
 + */
 +typedef void fp_sysreg_storefn(DisasContext *s, void *opaque, TCGv_i32 value);
 +/*
 + * Emit code to load the value to be copied to the sysreg; returns
 + * a new TCG temporary
 + */
 +typedef TCGv_i32 fp_sysreg_loadfn(DisasContext *s, void *opaque);
 +
 +/* Common decode/access checks for fp sysreg read/write */
 +typedef enum FPSysRegCheckResult {
 +    FPSysRegCheckFailed, /* caller should return false */
 +    FPSysRegCheckDone, /* caller should return true */
 +    FPSysRegCheckContinue, /* caller should continue generating code */
 +} FPSysRegCheckResult;
 +
 +static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
 +{
-+    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
++    /* Return the divisor set by the current CONTROL.PRESCALE value */
-+        return FPSysRegCheckFailed;
++    switch (FIELD_EX32(m->control, CONTROL, PRESCALE)) {
-+    }
++    case 0:
-+
++        return 1;
-+    switch (regno) {
++    case 1:
-+    case ARM_VFP_FPSCR:
++        return 16;
-+    case QEMU_VFP_FPSCR_NZCV:
++    case 2:
-+        break;
++    case 3: /* UNDEFINED, we treat like 2 (and complained when it was set) */
-+    default:
++        return 256;
 +        return FPSysRegCheckFailed;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return FPSysRegCheckDone;
 +    }
 +
 +    return FPSysRegCheckContinue;
 +}
 +
 +static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
 +
 +                                  fp_sysreg_loadfn *loadfn,
 +                                 void *opaque)
 +{
 +    /* Do a write to an M-profile floating point system register */
 +    TCGv_i32 tmp;
 +
 +    switch (fp_sysreg_checks(s, regno)) {
 +    case FPSysRegCheckFailed:
 +        return false;
 +    case FPSysRegCheckDone:
 +        return true;
 +    case FPSysRegCheckContinue:
 +        break;
 +    }
 +
 +    switch (regno) {
 +    case ARM_VFP_FPSCR:
 +        tmp = loadfn(s, opaque);
 +        gen_helper_vfp_set_fpscr(cpu_env, tmp);
 +        tcg_temp_free_i32(tmp);
 +        gen_lookup_tb(s);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
-+    return true;
 +}
 +
-+static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
-+                                fp_sysreg_storefn *storefn,
+                                              uint32_t newctrl)
-+                                void *opaque)
+ {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
          default:
              g_assert_not_reached();
          }
 -        ptimer_set_freq(m->timer, m->parent->pclk_frq / divisor);
 +        ptimer_set_period_from_clock(m->timer, m->parent->timclk, divisor);
      }
      if (changed & R_CONTROL_MODE_MASK) {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
       * limit must both be set to 0xffff, so we wrap at 16 bits.
       */
      ptimer_set_limit(m->timer, 0xffff, 1);
 -    ptimer_set_freq(m->timer, m->parent->pclk_frq);
 +    ptimer_set_period_from_clock(m->timer, m->parent->timclk,
 +                                 cmsdk_dualtimermod_divisor(m));
      ptimer_transaction_commit(m->timer);
  }
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
      s->timeritop = 0;
  }
 +static void cmsdk_apb_dualtimer_clk_update(void *opaque)
 +{
-+    /* Do a read from an M-profile floating point system register */
++    CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(opaque);
-+    TCGv_i32 tmp;
++    int i;
 +
-+    switch (fp_sysreg_checks(s, regno)) {
++    for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
-+    case FPSysRegCheckFailed:
++        CMSDKAPBDualTimerModule *m = &s->timermod[i];
-+        return false;
++        ptimer_transaction_begin(m->timer);
-+    case FPSysRegCheckDone:
++        ptimer_set_period_from_clock(m->timer, m->parent->timclk,
-+        return true;
++                                     cmsdk_dualtimermod_divisor(m));
-+    case FPSysRegCheckContinue:
++        ptimer_transaction_commit(m->timer);
 +        break;
 +    }
 +
 +    switch (regno) {
 +    case ARM_VFP_FPSCR:
 +        tmp = tcg_temp_new_i32();
 +        gen_helper_vfp_get_fpscr(tmp, cpu_env);
 +        storefn(s, opaque, tmp);
 +        break;
 +    case QEMU_VFP_FPSCR_NZCV:
 +        /*
 +         * Read just NZCV; this is a special case to avoid the
 +         * helper call for the "VMRS to CPSR.NZCV" insn.
 +         */
 +        tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
 +        tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
 +        storefn(s, opaque, tmp);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return true;
 +}
 +
 +static void fp_sysreg_to_gpr(DisasContext *s, void *opaque, TCGv_i32 value)
 +{
 +    arg_VMSR_VMRS *a = opaque;
 +
 +    if (a->rt == 15) {
 +        /* Set the 4 flag bits in the CPSR */
 +        gen_set_nzcv(value);
 +        tcg_temp_free_i32(value);
 +    } else {
 +        store_reg(s, a->rt, value);
 +    }
 +}
 +
-+static TCGv_i32 gpr_to_fp_sysreg(DisasContext *s, void *opaque)
+ static void cmsdk_apb_dualtimer_init(Object *obj)
 +{
 +    arg_VMSR_VMRS *a = opaque;
 +
 +    return load_reg(s, a->rt);
 +}
 +
 +static bool gen_M_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
 +{
 +    /*
 +     * Accesses to R15 are UNPREDICTABLE; we choose to undef.
 +     * FPSCR -> r15 is a special case which writes to the PSR flags;
 +     * set a->reg to a special value to tell gen_M_fp_sysreg_read()
 +     * we only care about the top 4 bits of FPSCR there.
 +     */
 +    if (a->rt == 15) {
 +        if (a->l && a->reg == ARM_VFP_FPSCR) {
 +            a->reg = QEMU_VFP_FPSCR_NZCV;
 +        } else {
 +            return false;
 +        }
 +    }
 +
 +    if (a->l) {
 +        /* VMRS, move FP system register to gp register */
 +        return gen_M_fp_sysreg_read(s, a->reg, fp_sysreg_to_gpr, a);
 +    } else {
 +        /* VMSR, move gp register to FP system register */
 +        return gen_M_fp_sysreg_write(s, a->reg, gpr_to_fp_sysreg, a);
 +    }
 +}
 +
  static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
  {
-     TCGv_i32 tmp;
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-     bool ignore_vfp_enabled = false;
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
+     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
--    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
+         sysbus_init_irq(sbd, &s->timermod[i].timerint);
 -        return false;
 +    if (arm_dc_feature(s, ARM_FEATURE_M)) {
 +        return gen_M_VMSR_VMRS(s, a);
      }
+-    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
--    if (arm_dc_feature(s, ARM_FEATURE_M)) {
++    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK",
--        /*
++                                   cmsdk_apb_dualtimer_clk_update, s);
--         * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
+ }
--         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
--         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
+ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
--         */
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
--        if (a->reg != ARM_VFP_FPSCR) {
+     CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(dev);
--            return false;
+     int i;
--        }
--        if (a->rt == 15 && !a->l) {
+-    if (s->pclk_frq == 0) {
--            return false;
+-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
--        }
++    if (!clock_has_source(s->timclk)) {
-+    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
++        error_setg(errp, "CMSDK APB dualtimer: TIMCLK clock must be connected");
-+        return false;
+         return;
      }
-     switch (a->reg) {
 --
 .20.1

-[PULL 32/36] target/arm: Implement CCR_S.TRD behaviour for SG insns
+[PULL 41/46] hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
-v8.1M introduces a new TRD flag in the CCR register, which enables
+Switch the CMSDK APB watchdog device over to using its Clock input;
-checking for stack frame integrity signatures on SG instructions.
+the wdogclk_frq property is now ignored.
 Add the code in the SG insn implementation for the new behaviour.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-24-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-21-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-21-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 86 +++++++++++++++++++++++++++++++++++++++++++
+ hw/watchdog/cmsdk-apb-watchdog.c | 18 ++++++++++++++----
-file changed, 86 insertions(+)
+file changed, 14 insertions(+), 4 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/hw/watchdog/cmsdk-apb-watchdog.c
-+++ b/target/arm/m_helper.c
++++ b/hw/watchdog/cmsdk-apb-watchdog.c
-@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
-     return true;
+     ptimer_transaction_commit(s->timer);
  }
-+static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
++static void cmsdk_apb_watchdog_clk_update(void *opaque)
 +                                   uint32_t addr, uint32_t *spdata)
 +{
-+    /*
++    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
 +     * Read a word of data from the stack for the SG instruction,
 +     * writing the value into *spdata. If the load succeeds, return
 +     * true; otherwise pend an appropriate exception and return false.
 +     * (We can't use data load helpers here that throw an exception
 +     * because of the context we're called in, which is halfway through
 +     * arm_v7m_cpu_do_interrupt().)
 +     */
 +    CPUState *cs = CPU(cpu);
 +    CPUARMState *env = &cpu->env;
 +    MemTxAttrs attrs = {};
 +    MemTxResult txres;
 +    target_ulong page_size;
 +    hwaddr physaddr;
 +    int prot;
 +    ARMMMUFaultInfo fi = {};
 +    ARMCacheAttrs cacheattrs = {};
 +    uint32_t value;
 +
-+    if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
++    ptimer_transaction_begin(s->timer);
-+                      &attrs, &prot, &page_size, &fi, &cacheattrs)) {
++    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
-+        /* MPU/SAU lookup failed */
++    ptimer_transaction_commit(s->timer);
 +        if (fi.type == ARMFault_QEMU_SFault) {
 +            qemu_log_mask(CPU_LOG_INT,
 +                          "...SecureFault during stack word read\n");
 +            env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
 +            env->v7m.sfar = addr;
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +        } else {
 +            qemu_log_mask(CPU_LOG_INT,
 +                          "...MemManageFault during stack word read\n");
 +            env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_DACCVIOL_MASK |
 +                R_V7M_CFSR_MMARVALID_MASK;
 +            env->v7m.mmfar[M_REG_S] = addr;
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, false);
 +        }
 +        return false;
 +    }
 +    value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
 +                              attrs, &txres);
 +    if (txres != MEMTX_OK) {
 +        /* BusFault trying to read the data */
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "...BusFault during stack word read\n");
 +        env->v7m.cfsr[M_REG_NS] |=
 +            (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
 +        env->v7m.bfar = addr;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
 +        return false;
 +    }
 +
 +    *spdata = value;
 +    return true;
 +}
 +
- static bool v7m_handle_execute_nsc(ARMCPU *cpu)
+ static void cmsdk_apb_watchdog_init(Object *obj)
  {
-     /*
+     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
-      */
+                           s, "cmsdk-apb-watchdog", 0x1000);
-     qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
+     sysbus_init_mmio(sbd, &s->iomem);
-                   ", executing it\n", env->regs[15]);
+     sysbus_init_irq(sbd, &s->wdogint);
-+
+-    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
-+    if (cpu_isar_feature(aa32_m_sec_state, cpu) &&
++    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK",
-+        !arm_v7m_is_handler_mode(env)) {
++                                    cmsdk_apb_watchdog_clk_update, s);
-+        /*
-+         * v8.1M exception stack frame integrity check. Note that we
+     s->is_luminary = false;
-+         * must perform the memory access even if CCR_S.TRD is zero
+     s->id = cmsdk_apb_watchdog_id;
-+         * and we aren't going to check what the data loaded is.
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
-+         */
+ {
-+        uint32_t spdata, sp;
+     CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
-+
-+        /*
+-    if (s->wdogclk_frq == 0) {
-+         * We know we are currently NS, so the S stack pointers must be
++    if (!clock_has_source(s->wdogclk)) {
-+         * in other_ss_{psp,msp}, not in regs[13]/other_sp.
+         error_setg(errp,
-+         */
+-                   "CMSDK APB watchdog: wdogclk-frq property must be set");
-+        sp = v7m_using_psp(env) ? env->v7m.other_ss_psp : env->v7m.other_ss_msp;
++                   "CMSDK APB watchdog: WDOGCLK clock must be connected");
-+        if (!v7m_read_sg_stack_word(cpu, mmu_idx, sp, &spdata)) {
+         return;
-+            /* Stack access failed and an exception has been pended */
+     }
-+            return false;
-+        }
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
-+
+                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+        if (env->v7m.ccr[M_REG_S] & R_V7M_CCR_TRD_MASK) {
-+            if (((spdata & ~1) == 0xfefa125a) ||
+     ptimer_transaction_begin(s->timer);
-+                !(env->v7m.control[M_REG_S] & 1)) {
+-    ptimer_set_freq(s->timer, s->wdogclk_frq);
-+                goto gen_invep;
++    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
-+            }
+     ptimer_transaction_commit(s->timer);
-+        }
+ }
-+    }
 +
      env->regs[14] &= ~1;
      env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
      switch_v7m_security_state(env, true);
 --
 .20.1

-[PULL 23/36] target/arm: Factor out preserve-fp-state from full_vfp_access_check()
+[PULL 42/46] tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
-Factor out the code which handles M-profile lazy FP state preservation
+Now that the CMSDK APB watchdog uses its Clock input, it will
-from full_vfp_access_check(); accesses to the FPCXT_NS register are
+correctly respond when the system clock frequency is changed using
-a special case which need to do just this part (corresponding in the
+the RCC register on in the Stellaris board system registers.  Test
-pseudocode to the PreserveFPState() function), and not the full
+that when the RCC register is written it causes the watchdog timer to
-set of actions matching the pseudocode ExecuteFPCheck() which
+change speed.
 normal FP instructions need to do.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-13-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-22-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-22-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.c.inc | 45 ++++++++++++++++++++--------------
+ tests/qtest/cmsdk-apb-watchdog-test.c | 52 +++++++++++++++++++++++++++
-file changed, 27 insertions(+), 18 deletions(-)
+file changed, 52 insertions(+)
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.c.inc
+--- a/tests/qtest/cmsdk-apb-watchdog-test.c
-+++ b/target/arm/translate-vfp.c.inc
++++ b/tests/qtest/cmsdk-apb-watchdog-test.c
-@@ -XXX,XX +XXX,XX @@ static inline long vfp_f16_offset(unsigned reg, bool top)
+@@ -XXX,XX +XXX,XX @@
-     return offs;
+  */
  #include "qemu/osdep.h"
 +#include "qemu/bitops.h"
  #include "libqtest-single.h"
  /*
@@ -XXX,XX +XXX,XX @@
  #define WDOGMIS 0x14
  #define WDOGLOCK 0xc00
 +#define SSYS_BASE 0x400fe000
 +#define RCC 0x60
 +#define SYSDIV_SHIFT 23
 +#define SYSDIV_LENGTH 4
 +
  static void test_watchdog(void)
  {
      g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
@@ -XXX,XX +XXX,XX @@ static void test_watchdog(void)
      g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
  }
-+/*
++static void test_clock_change(void)
 + * Generate code for M-profile lazy FP state preservation if needed;
 + * this corresponds to the pseudocode PreserveFPState() function.
 + */
 +static void gen_preserve_fp_state(DisasContext *s)
 +{
-+    if (s->v7m_lspact) {
++    uint32_t rcc;
-+        /*
++
-+         * Lazy state saving affects external memory and also the NVIC,
++    /*
-+         * so we must mark it as an IO operation for icount (and cause
++     * Test that writing to the stellaris board's RCC register to
-+         * this to be the last insn in the TB).
++     * change the system clock frequency causes the watchdog
-+         */
++     * to change the speed it counts at.
-+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
++     */
-+            s->base.is_jmp = DISAS_UPDATE_EXIT;
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
-+            gen_io_start();
++
-+        }
++    writel(WDOG_BASE + WDOGCONTROL, 1);
-+        gen_helper_v7m_preserve_fp_state(cpu_env);
++    writel(WDOG_BASE + WDOGLOAD, 1000);
-+        /*
++
-+         * If the preserve_fp_state helper doesn't throw an exception
++    /* Step to just past the 500th tick */
-+         * then it will clear LSPACT; we don't need to repeat this for
++    clock_step(80 * 500 + 1);
-+         * any further FP insns in this TB.
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
-+         */
++    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
-+        s->v7m_lspact = false;
++
-+    }
++    /* Rewrite RCC.SYSDIV from 16 to 8, so the clock is now 40ns per tick */
 +    rcc = readl(SSYS_BASE + RCC);
 +    g_assert_cmpuint(extract32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH), ==, 0xf);
 +    rcc = deposit32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH, 7);
 +    writel(SSYS_BASE + RCC, rcc);
 +
 +    /* Just past the 1000th tick: timer should have fired */
 +    clock_step(40 * 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
 +
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
 +
 +    /* VALUE reloads at following tick */
 +    clock_step(41);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
 +
 +    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
 +    clock_step(40 * 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
 +    writel(WDOG_BASE + WDOGINTCLR, 0);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
 +    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 +}
 +
- /*
+ int main(int argc, char **argv)
-  * Check that VFP access is enabled. If it is, do the necessary
+ {
-  * M-profile lazy-FP handling and then return true.
+     int r;
-@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-         /* Handle M-profile lazy FP state mechanics */
+     qtest_start("-machine lm3s811evb");
-         /* Trigger lazy-state preservation if necessary */
+     qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
--        if (s->v7m_lspact) {
++    qtest_add_func("/cmsdk-apb-watchdog/watchdog_clock_change",
--            /*
++                   test_clock_change);
--             * Lazy state saving affects external memory and also the NVIC,
--             * so we must mark it as an IO operation for icount (and cause
+     r = g_test_run();
--             * this to be the last insn in the TB).
 -             */
 -            if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
 -                s->base.is_jmp = DISAS_UPDATE_EXIT;
 -                gen_io_start();
 -            }
 -            gen_helper_v7m_preserve_fp_state(cpu_env);
 -            /*
 -             * If the preserve_fp_state helper doesn't throw an exception
 -             * then it will clear LSPACT; we don't need to repeat this for
 -             * any further FP insns in this TB.
 -             */
 -            s->v7m_lspact = false;
 -        }
 +        gen_preserve_fp_state(s);
          /* Update ownership of FP context: set FPCCR.S to match current state */
          if (s->v8m_fpccr_s_wrong) {
 --
 .20.1

-[PULL 15/36] target/arm: Implement VSCCLRM insn
+[PULL 43/46] hw/arm/armsse: Use Clock to set system_clock_scale
-Implement the v8.1M VSCCLRM insn, which zeros floating point
+Use the MAINCLK Clock input to set the system_clock_scale variable
-registers if there is an active floating point context.
+rather than using the mainclk_frq property.
 This requires support in write_neon_element32() for the MO_32
 element size, so add it.
 Because we want to use arm_gen_condlabel(), we need to move
 the definition of that function up in translate.c so it is
 before the #include of translate-vfp.c.inc.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-5-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20210128114145.20536-23-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-23-peter.maydell@linaro.org
 ---
- target/arm/cpu.h               |  9 ++++
+ hw/arm/armsse.c | 24 +++++++++++++++++++-----
- target/arm/m-nocp.decode       |  8 +++-
+file changed, 19 insertions(+), 5 deletions(-)
  target/arm/translate.c         | 21 +++++----
  target/arm/translate-vfp.c.inc | 84 ++++++++++++++++++++++++++++++++++
 files changed, 111 insertions(+), 11 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/armsse.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static void armsse_forward_sec_resp_cfg(ARMSSE *s)
-     return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
+     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
  }
-+static inline bool isar_feature_aa32_m_sec_state(const ARMISARegisters *id)
++static void armsse_mainclk_update(void *opaque)
 +{
++    ARMSSE *s = ARM_SSE(opaque);
 +    /*
-+     * Return true if M-profile state handling insns
++     * Set system_clock_scale from our Clock input; this is what
-+     * (VSCCLRM, CLRM, FPCTX access insns) are implemented
++     * controls the tick rate of the CPU SysTick timer.
 +     */
-+    return FIELD_EX32(id->id_pfr1, ID_PFR1, SECURITY) >= 3;
++    system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
 +}
 +
- static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
+ static void armsse_init(Object *obj)
  {
-     /* Sadly this is encoded differently for A-profile and M-profile */
+     ARMSSE *s = ARM_SSE(obj);
-diff --git a/target/arm/m-nocp.decode b/target/arm/m-nocp.decode
+@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
-index XXXXXXX..XXXXXXX 100644
+     assert(info->sram_banks <= MAX_SRAM_BANKS);
---- a/target/arm/m-nocp.decode
+     assert(info->num_cpus <= SSE_MAX_CPUS);
-+++ b/target/arm/m-nocp.decode
-@@ -XXX,XX +XXX,XX @@
+-    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
- # If the coprocessor is not present or disabled then we will generate
++    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
- # the NOCP exception; otherwise we let the insn through to the main decode.
++                                    armsse_mainclk_update, s);
+     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
-+%vd_dp  22:1 12:4
-+%vd_sp  12:4 22:1
+     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
-+
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
- &nocp cp
+         return;
+     }
- {
-   # Special cases which do not take an early NOCP: VLLDM and VLSTM
+-    if (!s->mainclk_frq) {
-   VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
+-        error_setg(errp, "MAINCLK_FRQ property was not set");
--  # TODO: VSCCLRM (new in v8.1M) is similar:
+-        return;
--  #VSCCLRM      1110 1100 1-01 1111 ---- 1011 ---- ---0
++    if (!clock_has_source(s->mainclk)) {
-+  # VSCCLRM (new in v8.1M) is similar:
++        error_setg(errp, "MAINCLK clock was not connected");
-+  VSCCLRM      1110 1100 1.01 1111 .... 1011 imm:7 0   vd=%vd_dp size=3
++    }
-+  VSCCLRM      1110 1100 1.01 1111 .... 1010 imm:8     vd=%vd_sp size=2
++    if (!clock_has_source(s->s32kclk)) {
++        error_setg(errp, "S32KCLK clock was not connected");
-   NOCP         111- 1110 ---- ---- ---- cp:4 ---- ---- &nocp
+     }
-   NOCP         111- 110- ---- ---- ---- cp:4 ---- ---- &nocp
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+     assert(info->num_cpus <= SSE_MAX_CPUS);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
---- a/target/arm/translate.c
+      */
-+++ b/target/arm/translate.c
+     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
-@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
-     a64_translate_init();
+-    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
 +    /* Set initial system_clock_scale from MAINCLK */
 +    armsse_mainclk_update(s);
  }
-+/* Generate a label used for skipping this instruction */
+ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
 +static void arm_gen_condlabel(DisasContext *s)
 +{
 +    if (!s->condjmp) {
 +        s->condlabel = gen_new_label();
 +        s->condjmp = 1;
 +    }
 +}
 +
  /* Flags for the disas_set_da_iss info argument:
   * lower bits hold the Rt register number, higher bits are flags.
   */
@@ -XXX,XX +XXX,XX @@ static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
      long off = neon_element_offset(reg, ele, memop);
      switch (memop) {
 +    case MO_32:
 +        tcg_gen_st32_i64(src, cpu_env, off);
 +        break;
      case MO_64:
          tcg_gen_st_i64(src, cpu_env, off);
          break;
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
      s->base.is_jmp = DISAS_UPDATE_EXIT;
  }
 -/* Generate a label used for skipping this instruction */
 -static void arm_gen_condlabel(DisasContext *s)
 -{
 -    if (!s->condjmp) {
 -        s->condlabel = gen_new_label();
 -        s->condjmp = 1;
 -    }
 -}
 -
  /* Skip this instruction if the ARM condition is false */
  static void arm_skip_unless(DisasContext *s, uint32_t cond)
  {
 diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c.inc
 +++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
      return true;
  }
 +static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
 +{
 +    int btmreg, topreg;
 +    TCGv_i64 zero;
 +    TCGv_i32 aspen, sfpa;
 +
 +    if (!dc_isar_feature(aa32_m_sec_state, s)) {
 +        /* Before v8.1M, fall through in decode to NOCP check */
 +        return false;
 +    }
 +
 +    /* Explicitly UNDEF because this takes precedence over NOCP */
 +    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    if (!dc_isar_feature(aa32_vfp_simd, s)) {
 +        /* NOP if we have neither FP nor MVE */
 +        return true;
 +    }
 +
 +    /*
 +     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
 +     * active floating point context so we must NOP (without doing
 +     * any lazy state preservation or the NOCP check).
 +     */
 +    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
 +    sfpa = load_cpu_field(v7m.control[M_REG_S]);
 +    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
 +    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
 +    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
 +    tcg_gen_or_i32(sfpa, sfpa, aspen);
 +    arm_gen_condlabel(s);
 +    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
 +
 +    if (s->fp_excp_el != 0) {
 +        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
 +                           syn_uncategorized(), s->fp_excp_el);
 +        return true;
 +    }
 +
 +    topreg = a->vd + a->imm - 1;
 +    btmreg = a->vd;
 +
 +    /* Convert to Sreg numbers if the insn specified in Dregs */
 +    if (a->size == 3) {
 +        topreg = topreg * 2 + 1;
 +        btmreg *= 2;
 +    }
 +
 +    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
 +        /* UNPREDICTABLE: we choose to undef */
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    /* Silently ignore requests to clear D16-D31 if they don't exist */
 +    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
 +        topreg = 31;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    /* Zero the Sregs from btmreg to topreg inclusive. */
 +    zero = tcg_const_i64(0);
 +    if (btmreg & 1) {
 +        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
 +        btmreg++;
 +    }
 +    for (; btmreg + 1 <= topreg; btmreg += 2) {
 +        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
 +    }
 +    if (btmreg == topreg) {
 +        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
 +        btmreg++;
 +    }
 +    assert(btmreg == topreg + 1);
 +    /* TODO: when MVE is implemented, zero VPR here */
 +    return true;
 +}
 +
  static bool trans_NOCP(DisasContext *s, arg_nocp *a)
  {
      /*
 --
 .20.1

-[PULL 36/36] hw/arm/armv7m: Correct typo in QOM object name
+[PULL 44/46] arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
-Correct a typo in the name we give the NVIC object.
+Remove all the code that sets frequency properties on the CMSDK
 timer, dualtimer and watchdog devices and on the ARMSSE SoC device:
 these properties are unused now that the devices rely on their Clock
 inputs instead.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-28-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-24-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-24-peter.maydell@linaro.org
 ---
- hw/arm/armv7m.c | 2 +-
+ hw/arm/armsse.c    | 7 -------
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/arm/mps2-tz.c   | 1 -
  hw/arm/mps2.c      | 3 ---
  hw/arm/musca.c     | 1 -
  hw/arm/stellaris.c | 3 ---
 files changed, 15 deletions(-)
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
+--- a/hw/arm/armsse.c
-+++ b/hw/arm/armv7m.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_instance_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+      * it to the appropriate PPC port; then we can realize the PPC and
-     memory_region_init(&s->container, obj, "armv7m-container", UINT64_MAX);
+      * map its upstream ends to the right place in the container.
+      */
--    object_initialize_child(obj, "nvnic", &s->nvic, TYPE_NVIC);
+-    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
-+    object_initialize_child(obj, "nvic", &s->nvic, TYPE_NVIC);
+     qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
-     object_property_add_alias(obj, "num-irq",
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
-                               OBJECT(&s->nvic), "num-irq");
+         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      object_property_set_link(OBJECT(&s->apb_ppc0), "port[0]", OBJECT(mr),
                               &error_abort);
 -    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      object_property_set_link(OBJECT(&s->apb_ppc0), "port[1]", OBJECT(mr),
                               &error_abort);
 -    qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* Devices behind APB PPC1:
       *   0x4002f000: S32K timer
       */
 -    qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
      qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
                            qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 -    qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
      qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 -    qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                         armsse_get_common_irq_in(s, 1));
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 -    qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
      qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
      if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
          return;
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
      object_property_set_link(OBJECT(&mms->iotkit), "memory",
                               OBJECT(system_memory), &error_abort);
      qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
 -    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
      qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
      qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
          object_initialize_child(OBJECT(mms), name, &mms->timer[i],
                                  TYPE_CMSDK_APB_TIMER);
          sbd = SYS_BUS_DEVICE(&mms->timer[i]);
 -        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
          qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
          sysbus_realize_and_unref(sbd, &error_fatal);
          sysbus_mmio_map(sbd, 0, base);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                              TYPE_CMSDK_APB_DUALTIMER);
 -    qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
      qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
      sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
      sysbus_mmio_map(SYS_BUS_DEVICE(&mms->dualtimer), 0, 0x40002000);
      object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                              TYPE_CMSDK_APB_WATCHDOG);
 -    qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
      qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
      sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
      sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
      qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
      qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
      qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
 -    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
      qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
      qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
      /*
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      if (board->dc1 & (1 << 3)) { /* watchdog present */
          dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
 -        /* system_clock_scale is valid now */
 -        uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
 -        qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
          qdev_connect_clock_in(dev, "WDOGCLK",
                                qdev_get_clock_out(ssys_dev, "SYSCLK"));
 --
 .20.1

-[PULL 17/36] target/arm: Enforce M-profile VMRS/VMSR register restrictions
+[PULL 45/46] arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
-For M-profile before v8.1M, the only valid register for VMSR/VMRS is
+Now no users are setting the frq properties on the CMSDK timer,
-the FPSCR.  We have a comment that states this, but the actual logic
+dualtimer, watchdog or ARMSSE SoC devices, we can remove the
-to forbid accesses for any other register value is missing, so we
+properties and the struct fields that back them.
 would end up with A-profile style behaviour.  Add the missing check.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201119215617.29887-7-peter.maydell@linaro.org
+Reviewed-by: Luc Michel <luc@lmichel.fr>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-25-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-25-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.c.inc | 5 ++++-
+ include/hw/arm/armsse.h                  | 2 --
-file changed, 4 insertions(+), 1 deletion(-)
+ include/hw/timer/cmsdk-apb-dualtimer.h   | 2 --
  include/hw/timer/cmsdk-apb-timer.h       | 2 --
  include/hw/watchdog/cmsdk-apb-watchdog.h | 2 --
  hw/arm/armsse.c                          | 2 --
  hw/timer/cmsdk-apb-dualtimer.c           | 6 ------
  hw/timer/cmsdk-apb-timer.c               | 6 ------
  hw/watchdog/cmsdk-apb-watchdog.c         | 6 ------
 files changed, 28 deletions(-)
-diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.c.inc
+--- a/include/hw/arm/armsse.h
-+++ b/target/arm/translate-vfp.c.inc
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
+@@ -XXX,XX +XXX,XX @@
-          * Accesses to R15 are UNPREDICTABLE; we choose to undef.
+  *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
-          * (FPSCR -> r15 is a special case which writes to the PSR flags.)
+  *  + QOM property "memory" is a MemoryRegion containing the devices provided
-          */
+  *    by the board model.
--        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
+- *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
-+        if (a->reg != ARM_VFP_FPSCR) {
+  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
-+            return false;
+  *    (In hardware, the SSE-200 permits the number of expansion interrupts
-+        }
+  *    for the two CPUs to be configured separately, but we restrict it to
-+        if (a->rt == 15 && !a->l) {
+@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
-             return false;
+     /* Properties */
-         }
+     MemoryRegion *board_memory;
      uint32_t exp_numirq;
 -    uint32_t mainclk_frq;
      uint32_t sram_addr_width;
      uint32_t init_svtor;
      bool cpu_fpu[SSE_MAX_CPUS];
 diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/cmsdk-apb-dualtimer.h
 +++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
   * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
   *
   * QEMU interface:
 - *  + QOM property "pclk-frq": frequency at which the timer is clocked
   *  + Clock input "TIMCLK": clock (for both timers)
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: combined timer interrupt TIMINTC
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq timerintc;
 -    uint32_t pclk_frq;
      Clock *timclk;
      CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
 diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/cmsdk-apb-timer.h
 +++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
  /*
   * QEMU interface:
 - *  + QOM property "pclk-frq": frequency at which the timer is clocked
   *  + Clock input "pclk": clock for the timer
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: timer interrupt TIMERINT
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq timerint;
 -    uint32_t pclk_frq;
      struct ptimer_state *timer;
      Clock *pclk;
 diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/watchdog/cmsdk-apb-watchdog.h
 +++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
   * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
   *
   * QEMU interface:
 - *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
   *  + Clock input "WDOGCLK": clock for the watchdog's timer
   *  + sysbus MMIO region 0: the register bank
   *  + sysbus IRQ 0: watchdog interrupt
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
      /*< public >*/
      MemoryRegion iomem;
      qemu_irq wdogint;
 -    uint32_t wdogclk_frq;
      bool is_luminary;
      struct ptimer_state *timer;
      Clock *wdogclk;
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
      DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                       MemoryRegion *),
      DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 -    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
      DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
      DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
      DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
      DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                       MemoryRegion *),
      DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 -    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
      DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
      DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
      DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
 diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/cmsdk-apb-dualtimer.c
 +++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
      }
+ };
+-static Property cmsdk_apb_dualtimer_properties[] = {
+-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBDualTimer, pclk_frq, 0),
+-    DEFINE_PROP_END_OF_LIST(),
+-};
+-
+ static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
+     dc->realize = cmsdk_apb_dualtimer_realize;
+     dc->vmsd = &cmsdk_apb_dualtimer_vmstate;
+     dc->reset = cmsdk_apb_dualtimer_reset;
+-    device_class_set_props(dc, cmsdk_apb_dualtimer_properties);
+ }
+ static const TypeInfo cmsdk_apb_dualtimer_info = {
+diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/timer/cmsdk-apb-timer.c
++++ b/hw/timer/cmsdk-apb-timer.c
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
+     }
+ };
+-static Property cmsdk_apb_timer_properties[] = {
+-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
+-    DEFINE_PROP_END_OF_LIST(),
+-};
+-
+ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
+     dc->realize = cmsdk_apb_timer_realize;
+     dc->vmsd = &cmsdk_apb_timer_vmstate;
+     dc->reset = cmsdk_apb_timer_reset;
+-    device_class_set_props(dc, cmsdk_apb_timer_properties);
+ }
+ static const TypeInfo cmsdk_apb_timer_info = {
+diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/watchdog/cmsdk-apb-watchdog.c
++++ b/hw/watchdog/cmsdk-apb-watchdog.c
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
+     }
+ };
+-static Property cmsdk_apb_watchdog_properties[] = {
+-    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
+-    DEFINE_PROP_END_OF_LIST(),
+-};
+-
+ static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
+     dc->realize = cmsdk_apb_watchdog_realize;
+     dc->vmsd = &cmsdk_apb_watchdog_vmstate;
+     dc->reset = cmsdk_apb_watchdog_reset;
+-    device_class_set_props(dc, cmsdk_apb_watchdog_properties);
+ }
+ static const TypeInfo cmsdk_apb_watchdog_info = {
 --
 .20.1

-[PULL 16/36] target/arm: Implement CLRM instruction
+[PULL 46/46] hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS
-In v8.1M the new CLRM instruction allows zeroing an arbitrary set of
+Now that the watchdog device uses its Clock input rather than being
-the general-purpose registers and APSR.  Implement this.
+passed the value of system_clock_scale at creation time, we can
+remove the hack where we reset the STELLARIS_SYS at board creation
-The encoding is a subset of the LDMIA T2 encoding, using what would
+time to force it to set system_clock_scale.  Instead it will be reset
-be Rn=0b1111 (which UNDEFs for LDMIA).
+at the usual point in startup and will inform the watchdog of the
 clock frequency at that point.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20201119215617.29887-6-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210128114145.20536-26-peter.maydell@linaro.org
 Message-id: 20210121190622.22000-26-peter.maydell@linaro.org
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- target/arm/t32.decode  |  6 +++++-
+ hw/arm/stellaris.c | 10 ----------
- target/arm/translate.c | 38 ++++++++++++++++++++++++++++++++++++++
+file changed, 10 deletions(-)
 files changed, 43 insertions(+), 1 deletion(-)
-diff --git a/target/arm/t32.decode b/target/arm/t32.decode
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/t32.decode
+--- a/hw/arm/stellaris.c
-+++ b/target/arm/t32.decode
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ UXTAB            1111 1010 0101 .... 1111 .... 10.. ....      @rrr_rot
+@@ -XXX,XX +XXX,XX @@ static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
+     sysbus_mmio_map(sbd, 0, base);
- STM_t32          1110 1000 10.0 .... ................         @ldstm i=1 b=0
+     sysbus_connect_irq(sbd, 0, irq);
- STM_t32          1110 1001 00.0 .... ................         @ldstm i=0 b=1
--LDM_t32          1110 1000 10.1 .... ................         @ldstm i=1 b=0
+-    /*
-+{
+-     * Normally we should not be resetting devices like this during
-+  # Rn=15 UNDEFs for LDM; M-profile CLRM uses that encoding
+-     * board creation. For the moment we need to do so, because
-+  CLRM           1110 1000 1001 1111 list:16
+-     * system_clock_scale will only get set when the STELLARIS_SYS
-+  LDM_t32        1110 1000 10.1 .... ................         @ldstm i=1 b=0
+-     * device is reset, and we need its initial value to pass to
-+}
+-     * the watchdog device. This hack can be removed once the
- LDM_t32          1110 1001 00.1 .... ................         @ldstm i=0 b=1
+-     * watchdog has been converted to use a Clock input instead.
+-     */
- &rfe             !extern rn w pu
+-    device_cold_reset(dev);
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+-
-index XXXXXXX..XXXXXXX 100644
+     return dev;
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_t16(DisasContext *s, arg_ldst_block *a)
      return do_ldm(s, a, 1);
  }
-+static bool trans_CLRM(DisasContext *s, arg_CLRM *a)
-+{
-+    int i;
-+    TCGv_i32 zero;
-+
-+    if (!dc_isar_feature(aa32_m_sec_state, s)) {
-+        return false;
-+    }
-+
-+    if (extract32(a->list, 13, 1)) {
-+        return false;
-+    }
-+
-+    if (!a->list) {
-+        /* UNPREDICTABLE; we choose to UNDEF */
-+        return false;
-+    }
-+
-+    zero = tcg_const_i32(0);
-+    for (i = 0; i < 15; i++) {
-+        if (extract32(a->list, i, 1)) {
-+            /* Clear R[i] */
-+            tcg_gen_mov_i32(cpu_R[i], zero);
-+        }
-+    }
-+    if (extract32(a->list, 15, 1)) {
-+        /*
-+         * Clear APSR (by calling the MSR helper with the same argument
-+         * as for "MSR APSR_nzcvqg, Rn": mask = 0b1100, SYSM=0)
-+         */
-+        TCGv_i32 maskreg = tcg_const_i32(0xc << 8);
-+        gen_helper_v7m_msr(cpu_env, maskreg, zero);
-+        tcg_temp_free_i32(maskreg);
-+    }
-+    tcg_temp_free_i32(zero);
-+    return true;
-+}
-+
- /*
-  * Branch, branch with link
-  */
 --
 .20.1

First pullreq for 6.0: mostly my v8.1M work, plus some other
bits and pieces. (I still have a lot of stuff in my to-review
folder, which I may or may not get to before the Christmas break...)

thanks
-- PMM

The following changes since commit 5e7b204dbfae9a562fc73684986f936b97f63877:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2020-12-09 20:08:54 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201210

for you to fetch changes up to 71f916be1c7e9ede0e37d9cabc781b5a9e8638ff:

hw/arm/armv7m: Correct typo in QOM object name (2020-12-10 11:44:56 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Fix up L1STD_SPAN decoding
 * xlnx-zynqmp: Support Xilinx ZynqMP CAN controllers
 * sbsa-ref: allow to use Cortex-A53/57/72 cpus
 * Various minor code cleanups
 * hw/intc/armv7m_nvic: Make all of system PPB range be RAZWI/BusFault
 * Implement more pieces of ARMv8.1M support

----------------------------------------------------------------
Alex Chen (4):
      i.MX25: Fix bad printf format specifiers
      i.MX31: Fix bad printf format specifiers
      i.MX6: Fix bad printf format specifiers
      i.MX6ul: Fix bad printf format specifiers

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: dump random data on failure

Kunkun Jiang (1):
      hw/arm/smmuv3: Fix up L1STD_SPAN decoding

Marcin Juszkiewicz (1):
      sbsa-ref: allow to use Cortex-A53/57/72 cpus

Peter Maydell (25):
      hw/intc/armv7m_nvic: Make all of system PPB range be RAZWI/BusFault
      target/arm: Implement v8.1M PXN extension
      target/arm: Don't clobber ID_PFR1.Security on M-profile cores
      target/arm: Implement VSCCLRM insn
      target/arm: Implement CLRM instruction
      target/arm: Enforce M-profile VMRS/VMSR register restrictions
      target/arm: Refactor M-profile VMSR/VMRS handling
      target/arm: Move general-use constant expanders up in translate.c
      target/arm: Implement VLDR/VSTR system register
      target/arm: Implement M-profile FPSCR_nzcvqc
      target/arm: Use new FPCR_NZCV_MASK constant
      target/arm: Factor out preserve-fp-state from full_vfp_access_check()
      target/arm: Implement FPCXT_S fp system register
      hw/intc/armv7m_nvic: Update FPDSCR masking for v8.1M
      target/arm: For v8.1M, always clear R0-R3, R12, APSR, EPSR on exception entry
      target/arm: In v8.1M, don't set HFSR.FORCED on vector table fetch failures
      target/arm: Implement v8.1M REVIDR register
      target/arm: Implement new v8.1M NOCP check for exception return
      target/arm: Implement new v8.1M VLLDM and VLSTM encodings
      hw/intc/armv7m_nvic: Support v8.1M CCR.TRD bit
      target/arm: Implement CCR_S.TRD behaviour for SG insns
      hw/intc/armv7m_nvic: Fix "return from inactive handler" check
      target/arm: Implement M-profile "minimal RAS implementation"
      hw/intc/armv7m_nvic: Implement read/write for RAS register block
      hw/arm/armv7m: Correct typo in QOM object name

Vikram Garhwal (4):
      hw/net/can: Introduce Xilinx ZynqMP CAN controller
      xlnx-zynqmp: Connect Xilinx ZynqMP CAN controllers
      tests/qtest: Introduce tests for Xilinx ZynqMP CAN controller
      MAINTAINERS: Add maintainer entry for Xilinx ZynqMP CAN controller

From: Vikram Garhwal <fnu.vikram@xilinx.com>

The Xilinx ZynqMP CAN controller is developed based on SocketCAN, QEMU CAN bus
implementation. Bus connection and socketCAN connection for each CAN module
can be set through command lines.

Example for using single CAN:
    -object can-bus,id=canbus0 \
    -machine xlnx-zcu102.canbus0=canbus0 \
    -object can-host-socketcan,id=socketcan0,if=vcan0,canbus=canbus0

Example for connecting both CAN to same virtual CAN on host machine:
    -object can-bus,id=canbus0 -object can-bus,id=canbus1 \
    -machine xlnx-zcu102.canbus0=canbus0 \
    -machine xlnx-zcu102.canbus1=canbus1 \
    -object can-host-socketcan,id=socketcan0,if=vcan0,canbus=canbus0 \
    -object can-host-socketcan,id=socketcan1,if=vcan0,canbus=canbus1

To create virtual CAN on the host machine, please check the QEMU CAN docs:
https://github.com/qemu/qemu/blob/master/docs/can.txt

Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
Message-id: 1605728926-352690-2-git-send-email-fnu.vikram@xilinx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build                      |    1 +
 hw/net/can/trace.h               |    1 +
 include/hw/net/xlnx-zynqmp-can.h |   78 ++
 hw/net/can/xlnx-zynqmp-can.c     | 1161 ++++++++++++++++++++++++++++++
 hw/Kconfig                       |    1 +
 hw/net/can/meson.build           |    1 +
 hw/net/can/trace-events          |    9 +
 7 files changed, 1252 insertions(+)
 create mode 100644 hw/net/can/trace.h
 create mode 100644 include/hw/net/xlnx-zynqmp-can.h
 create mode 100644 hw/net/can/xlnx-zynqmp-can.c
 create mode 100644 hw/net/can/trace-events

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if have_system
     'hw/misc',
     'hw/misc/macio',
     'hw/net',
+    'hw/net/can',
     'hw/nvram',
     'hw/pci',
     'hw/pci-host',
diff --git a/hw/net/can/trace.h b/hw/net/can/trace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/can/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-hw_net_can.h"
diff --git a/include/hw/net/xlnx-zynqmp-can.h b/include/hw/net/xlnx-zynqmp-can.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/net/xlnx-zynqmp-can.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx ZynqMP CAN controller.
+ *
+ * Copyright (c) 2020 Xilinx Inc.
+ *
+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
+ *
+ * Based on QEMU CAN Device emulation implemented by Jin Yang, Deniz Eren and
+ * Pavel Pisa.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef XLNX_ZYNQMP_CAN_H
+#define XLNX_ZYNQMP_CAN_H
+
+#include "hw/register.h"
+#include "net/can_emu.h"
+#include "net/can_host.h"
+#include "qemu/fifo32.h"
+#include "hw/ptimer.h"
+#include "hw/qdev-clock.h"
+
+#define TYPE_XLNX_ZYNQMP_CAN "xlnx.zynqmp-can"
+
+#define XLNX_ZYNQMP_CAN(obj) \
+     OBJECT_CHECK(XlnxZynqMPCANState, (obj), TYPE_XLNX_ZYNQMP_CAN)
+
+#define MAX_CAN_CTRLS      2
+#define XLNX_ZYNQMP_CAN_R_MAX     (0x84 / 4)
+#define MAILBOX_CAPACITY   64
+#define CAN_TIMER_MAX  0XFFFFUL
+#define CAN_DEFAULT_CLOCK (24 * 1000 * 1000)
+
+/* Each CAN_FRAME will have 4 * 32bit size. */
+#define CAN_FRAME_SIZE     4
+#define RXFIFO_SIZE        (MAILBOX_CAPACITY * CAN_FRAME_SIZE)
+
+typedef struct XlnxZynqMPCANState {
+    SysBusDevice        parent_obj;
+    MemoryRegion        iomem;
+
+    qemu_irq            irq;
+
+    CanBusClientState   bus_client;
+    CanBusState         *canbus;
+
+    struct {
+        uint32_t        ext_clk_freq;
+    } cfg;
+
+    RegisterInfo        reg_info[XLNX_ZYNQMP_CAN_R_MAX];
+    uint32_t            regs[XLNX_ZYNQMP_CAN_R_MAX];
+
+    Fifo32              rx_fifo;
+    Fifo32              tx_fifo;
+    Fifo32              txhpb_fifo;
+
+    ptimer_state        *can_timer;
+} XlnxZynqMPCANState;
+
+#endif
diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/can/xlnx-zynqmp-can.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Xilinx ZynqMP CAN controller.
+ * This implementation is based on the following datasheet:
+ * https://www.xilinx.com/support/documentation/user_guides/ug1085-zynq-ultrascale-trm.pdf
+ *
+ * Copyright (c) 2020 Xilinx Inc.
+ *
+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
+ *
+ * Based on QEMU CAN Device emulation implemented by Jin Yang, Deniz Eren and
+ * Pavel Pisa
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "hw/irq.h"
+#include "qapi/error.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "qemu/cutils.h"
+#include "sysemu/sysemu.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "net/can_emu.h"
+#include "net/can_host.h"
+#include "qemu/event_notifier.h"
+#include "qom/object_interfaces.h"
+#include "hw/net/xlnx-zynqmp-can.h"
+#include "trace.h"
+
+#ifndef XLNX_ZYNQMP_CAN_ERR_DEBUG
+#define XLNX_ZYNQMP_CAN_ERR_DEBUG 0
+#endif
+
+#define MAX_DLC            8
+#undef ERROR
+
+REG32(SOFTWARE_RESET_REGISTER, 0x0)
+    FIELD(SOFTWARE_RESET_REGISTER, CEN, 1, 1)
+    FIELD(SOFTWARE_RESET_REGISTER, SRST, 0, 1)
+REG32(MODE_SELECT_REGISTER, 0x4)
+    FIELD(MODE_SELECT_REGISTER, SNOOP, 2, 1)
+    FIELD(MODE_SELECT_REGISTER, LBACK, 1, 1)
+    FIELD(MODE_SELECT_REGISTER, SLEEP, 0, 1)
+REG32(ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER, 0x8)
+    FIELD(ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER, BRP, 0, 8)
+REG32(ARBITRATION_PHASE_BIT_TIMING_REGISTER, 0xc)
+    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, SJW, 7, 2)
+    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, TS2, 4, 3)
+    FIELD(ARBITRATION_PHASE_BIT_TIMING_REGISTER, TS1, 0, 4)
+REG32(ERROR_COUNTER_REGISTER, 0x10)
+    FIELD(ERROR_COUNTER_REGISTER, REC, 8, 8)
+    FIELD(ERROR_COUNTER_REGISTER, TEC, 0, 8)
+REG32(ERROR_STATUS_REGISTER, 0x14)
+    FIELD(ERROR_STATUS_REGISTER, ACKER, 4, 1)
+    FIELD(ERROR_STATUS_REGISTER, BERR, 3, 1)
+    FIELD(ERROR_STATUS_REGISTER, STER, 2, 1)
+    FIELD(ERROR_STATUS_REGISTER, FMER, 1, 1)
+    FIELD(ERROR_STATUS_REGISTER, CRCER, 0, 1)
+REG32(STATUS_REGISTER, 0x18)
+    FIELD(STATUS_REGISTER, SNOOP, 12, 1)
+    FIELD(STATUS_REGISTER, ACFBSY, 11, 1)
+    FIELD(STATUS_REGISTER, TXFLL, 10, 1)
+    FIELD(STATUS_REGISTER, TXBFLL, 9, 1)
+    FIELD(STATUS_REGISTER, ESTAT, 7, 2)
+    FIELD(STATUS_REGISTER, ERRWRN, 6, 1)
+    FIELD(STATUS_REGISTER, BBSY, 5, 1)
+    FIELD(STATUS_REGISTER, BIDLE, 4, 1)
+    FIELD(STATUS_REGISTER, NORMAL, 3, 1)
+    FIELD(STATUS_REGISTER, SLEEP, 2, 1)
+    FIELD(STATUS_REGISTER, LBACK, 1, 1)
+    FIELD(STATUS_REGISTER, CONFIG, 0, 1)
+REG32(INTERRUPT_STATUS_REGISTER, 0x1c)
+    FIELD(INTERRUPT_STATUS_REGISTER, TXFEMP, 14, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, TXFWMEMP, 13, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, RXFWMFLL, 12, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, WKUP, 11, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, SLP, 10, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, BSOFF, 9, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, ERROR, 8, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, RXNEMP, 7, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, RXOFLW, 6, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, RXUFLW, 5, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, RXOK, 4, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, TXBFLL, 3, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, TXFLL, 2, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, TXOK, 1, 1)
+    FIELD(INTERRUPT_STATUS_REGISTER, ARBLST, 0, 1)
+REG32(INTERRUPT_ENABLE_REGISTER, 0x20)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFEMP, 14, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFWMEMP, 13, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ERXFWMFLL, 12, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, EWKUP, 11, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ESLP, 10, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, EBSOFF, 9, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, EERROR, 8, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ERXNEMP, 7, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ERXOFLW, 6, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ERXUFLW, 5, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ERXOK, 4, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ETXBFLL, 3, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ETXFLL, 2, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, ETXOK, 1, 1)
+    FIELD(INTERRUPT_ENABLE_REGISTER, EARBLST, 0, 1)
+REG32(INTERRUPT_CLEAR_REGISTER, 0x24)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFEMP, 14, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFWMEMP, 13, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CRXFWMFLL, 12, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CWKUP, 11, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CSLP, 10, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CBSOFF, 9, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CERROR, 8, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CRXNEMP, 7, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CRXOFLW, 6, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CRXUFLW, 5, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CRXOK, 4, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CTXBFLL, 3, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CTXFLL, 2, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CTXOK, 1, 1)
+    FIELD(INTERRUPT_CLEAR_REGISTER, CARBLST, 0, 1)
+REG32(TIMESTAMP_REGISTER, 0x28)
+    FIELD(TIMESTAMP_REGISTER, CTS, 0, 1)
+REG32(WIR, 0x2c)
+    FIELD(WIR, EW, 8, 8)
+    FIELD(WIR, FW, 0, 8)
+REG32(TXFIFO_ID, 0x30)
+    FIELD(TXFIFO_ID, IDH, 21, 11)
+    FIELD(TXFIFO_ID, SRRRTR, 20, 1)
+    FIELD(TXFIFO_ID, IDE, 19, 1)
+    FIELD(TXFIFO_ID, IDL, 1, 18)
+    FIELD(TXFIFO_ID, RTR, 0, 1)
+REG32(TXFIFO_DLC, 0x34)
+    FIELD(TXFIFO_DLC, DLC, 28, 4)
+REG32(TXFIFO_DATA1, 0x38)
+    FIELD(TXFIFO_DATA1, DB0, 24, 8)
+    FIELD(TXFIFO_DATA1, DB1, 16, 8)
+    FIELD(TXFIFO_DATA1, DB2, 8, 8)
+    FIELD(TXFIFO_DATA1, DB3, 0, 8)
+REG32(TXFIFO_DATA2, 0x3c)
+    FIELD(TXFIFO_DATA2, DB4, 24, 8)
+    FIELD(TXFIFO_DATA2, DB5, 16, 8)
+    FIELD(TXFIFO_DATA2, DB6, 8, 8)
+    FIELD(TXFIFO_DATA2, DB7, 0, 8)
+REG32(TXHPB_ID, 0x40)
+    FIELD(TXHPB_ID, IDH, 21, 11)
+    FIELD(TXHPB_ID, SRRRTR, 20, 1)
+    FIELD(TXHPB_ID, IDE, 19, 1)
+    FIELD(TXHPB_ID, IDL, 1, 18)
+    FIELD(TXHPB_ID, RTR, 0, 1)
+REG32(TXHPB_DLC, 0x44)
+    FIELD(TXHPB_DLC, DLC, 28, 4)
+REG32(TXHPB_DATA1, 0x48)
+    FIELD(TXHPB_DATA1, DB0, 24, 8)
+    FIELD(TXHPB_DATA1, DB1, 16, 8)
+    FIELD(TXHPB_DATA1, DB2, 8, 8)
+    FIELD(TXHPB_DATA1, DB3, 0, 8)
+REG32(TXHPB_DATA2, 0x4c)
+    FIELD(TXHPB_DATA2, DB4, 24, 8)
+    FIELD(TXHPB_DATA2, DB5, 16, 8)
+    FIELD(TXHPB_DATA2, DB6, 8, 8)
+    FIELD(TXHPB_DATA2, DB7, 0, 8)
+REG32(RXFIFO_ID, 0x50)
+    FIELD(RXFIFO_ID, IDH, 21, 11)
+    FIELD(RXFIFO_ID, SRRRTR, 20, 1)
+    FIELD(RXFIFO_ID, IDE, 19, 1)
+    FIELD(RXFIFO_ID, IDL, 1, 18)
+    FIELD(RXFIFO_ID, RTR, 0, 1)
+REG32(RXFIFO_DLC, 0x54)
+    FIELD(RXFIFO_DLC, DLC, 28, 4)
+    FIELD(RXFIFO_DLC, RXT, 0, 16)
+REG32(RXFIFO_DATA1, 0x58)
+    FIELD(RXFIFO_DATA1, DB0, 24, 8)
+    FIELD(RXFIFO_DATA1, DB1, 16, 8)
+    FIELD(RXFIFO_DATA1, DB2, 8, 8)
+    FIELD(RXFIFO_DATA1, DB3, 0, 8)
+REG32(RXFIFO_DATA2, 0x5c)
+    FIELD(RXFIFO_DATA2, DB4, 24, 8)
+    FIELD(RXFIFO_DATA2, DB5, 16, 8)
+    FIELD(RXFIFO_DATA2, DB6, 8, 8)
+    FIELD(RXFIFO_DATA2, DB7, 0, 8)
+REG32(AFR, 0x60)
+    FIELD(AFR, UAF4, 3, 1)
+    FIELD(AFR, UAF3, 2, 1)
+    FIELD(AFR, UAF2, 1, 1)
+    FIELD(AFR, UAF1, 0, 1)
+REG32(AFMR1, 0x64)
+    FIELD(AFMR1, AMIDH, 21, 11)
+    FIELD(AFMR1, AMSRR, 20, 1)
+    FIELD(AFMR1, AMIDE, 19, 1)
+    FIELD(AFMR1, AMIDL, 1, 18)
+    FIELD(AFMR1, AMRTR, 0, 1)
+REG32(AFIR1, 0x68)
+    FIELD(AFIR1, AIIDH, 21, 11)
+    FIELD(AFIR1, AISRR, 20, 1)
+    FIELD(AFIR1, AIIDE, 19, 1)
+    FIELD(AFIR1, AIIDL, 1, 18)
+    FIELD(AFIR1, AIRTR, 0, 1)
+REG32(AFMR2, 0x6c)
+    FIELD(AFMR2, AMIDH, 21, 11)
+    FIELD(AFMR2, AMSRR, 20, 1)
+    FIELD(AFMR2, AMIDE, 19, 1)
+    FIELD(AFMR2, AMIDL, 1, 18)
+    FIELD(AFMR2, AMRTR, 0, 1)
+REG32(AFIR2, 0x70)
+    FIELD(AFIR2, AIIDH, 21, 11)
+    FIELD(AFIR2, AISRR, 20, 1)
+    FIELD(AFIR2, AIIDE, 19, 1)
+    FIELD(AFIR2, AIIDL, 1, 18)
+    FIELD(AFIR2, AIRTR, 0, 1)
+REG32(AFMR3, 0x74)
+    FIELD(AFMR3, AMIDH, 21, 11)
+    FIELD(AFMR3, AMSRR, 20, 1)
+    FIELD(AFMR3, AMIDE, 19, 1)
+    FIELD(AFMR3, AMIDL, 1, 18)
+    FIELD(AFMR3, AMRTR, 0, 1)
+REG32(AFIR3, 0x78)
+    FIELD(AFIR3, AIIDH, 21, 11)
+    FIELD(AFIR3, AISRR, 20, 1)
+    FIELD(AFIR3, AIIDE, 19, 1)
+    FIELD(AFIR3, AIIDL, 1, 18)
+    FIELD(AFIR3, AIRTR, 0, 1)
+REG32(AFMR4, 0x7c)
+    FIELD(AFMR4, AMIDH, 21, 11)
+    FIELD(AFMR4, AMSRR, 20, 1)
+    FIELD(AFMR4, AMIDE, 19, 1)
+    FIELD(AFMR4, AMIDL, 1, 18)
+    FIELD(AFMR4, AMRTR, 0, 1)
+REG32(AFIR4, 0x80)
+    FIELD(AFIR4, AIIDH, 21, 11)
+    FIELD(AFIR4, AISRR, 20, 1)
+    FIELD(AFIR4, AIIDE, 19, 1)
+    FIELD(AFIR4, AIIDL, 1, 18)
+    FIELD(AFIR4, AIRTR, 0, 1)
+
+static void can_update_irq(XlnxZynqMPCANState *s)
+{
+    uint32_t irq;
+
+    /* Watermark register interrupts. */
+    if ((fifo32_num_free(&s->tx_fifo) / CAN_FRAME_SIZE) >
+            ARRAY_FIELD_EX32(s->regs, WIR, EW)) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFWMEMP, 1);
+    }
+
+    if ((fifo32_num_used(&s->rx_fifo) / CAN_FRAME_SIZE) >
+            ARRAY_FIELD_EX32(s->regs, WIR, FW)) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXFWMFLL, 1);
+    }
+
+    /* RX Interrupts. */
+    if (fifo32_num_used(&s->rx_fifo) >= CAN_FRAME_SIZE) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXNEMP, 1);
+    }
+
+    /* TX interrupts. */
+    if (fifo32_is_empty(&s->tx_fifo)) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFEMP, 1);
+    }
+
+    if (fifo32_is_full(&s->tx_fifo)) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXFLL, 1);
+    }
+
+    if (fifo32_is_full(&s->txhpb_fifo)) {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXBFLL, 1);
+    }
+
+    irq = s->regs[R_INTERRUPT_STATUS_REGISTER];
+    irq &= s->regs[R_INTERRUPT_ENABLE_REGISTER];
+
+    trace_xlnx_can_update_irq(s->regs[R_INTERRUPT_STATUS_REGISTER],
+                              s->regs[R_INTERRUPT_ENABLE_REGISTER], irq);
+    qemu_set_irq(s->irq, irq);
+}
+
+static void can_ier_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    can_update_irq(s);
+}
+
+static uint64_t can_icr_pre_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    s->regs[R_INTERRUPT_STATUS_REGISTER] &= ~val;
+    can_update_irq(s);
+
+    return 0;
+}
+
+static void can_config_reset(XlnxZynqMPCANState *s)
+{
+    /* Reset all the configuration registers. */
+    register_reset(&s->reg_info[R_SOFTWARE_RESET_REGISTER]);
+    register_reset(&s->reg_info[R_MODE_SELECT_REGISTER]);
+    register_reset(
+              &s->reg_info[R_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER]);
+    register_reset(&s->reg_info[R_ARBITRATION_PHASE_BIT_TIMING_REGISTER]);
+    register_reset(&s->reg_info[R_STATUS_REGISTER]);
+    register_reset(&s->reg_info[R_INTERRUPT_STATUS_REGISTER]);
+    register_reset(&s->reg_info[R_INTERRUPT_ENABLE_REGISTER]);
+    register_reset(&s->reg_info[R_INTERRUPT_CLEAR_REGISTER]);
+    register_reset(&s->reg_info[R_WIR]);
+}
+
+static void can_config_mode(XlnxZynqMPCANState *s)
+{
+    register_reset(&s->reg_info[R_ERROR_COUNTER_REGISTER]);
+    register_reset(&s->reg_info[R_ERROR_STATUS_REGISTER]);
+
+    /* Put XlnxZynqMPCAN in configuration mode. */
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, CONFIG, 1);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, WKUP, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, SLP, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, BSOFF, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, ERROR, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXOK, 0);
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, ARBLST, 0);
+
+    can_update_irq(s);
+}
+
+static void update_status_register_mode_bits(XlnxZynqMPCANState *s)
+{
+    bool sleep_status = ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP);
+    bool sleep_mode = ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SLEEP);
+    /* Wake up interrupt bit. */
+    bool wakeup_irq_val = sleep_status && (sleep_mode == 0);
+    /* Sleep interrupt bit. */
+    bool sleep_irq_val = sleep_mode && (sleep_status == 0);
+
+    /* Clear previous core mode status bits. */
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, LBACK, 0);
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SLEEP, 0);
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SNOOP, 0);
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, NORMAL, 0);
+
+    /* set current mode bit and generate irqs accordingly. */
+    if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, LBACK)) {
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, LBACK, 1);
+    } else if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SLEEP)) {
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SLEEP, 1);
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, SLP,
+                         sleep_irq_val);
+    } else if (ARRAY_FIELD_EX32(s->regs, MODE_SELECT_REGISTER, SNOOP)) {
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, SNOOP, 1);
+    } else {
+        /*
+         * If all bits are zero then XlnxZynqMPCAN is set in normal mode.
+         */
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, NORMAL, 1);
+        /* Set wakeup interrupt bit. */
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, WKUP,
+                         wakeup_irq_val);
+    }
+
+    can_update_irq(s);
+}
+
+static void can_exit_sleep_mode(XlnxZynqMPCANState *s)
+{
+    ARRAY_FIELD_DP32(s->regs, MODE_SELECT_REGISTER, SLEEP, 0);
+    update_status_register_mode_bits(s);
+}
+
+static void generate_frame(qemu_can_frame *frame, uint32_t *data)
+{
+    frame->can_id = data[0];
+    frame->can_dlc = FIELD_EX32(data[1], TXFIFO_DLC, DLC);
+
+    frame->data[0] = FIELD_EX32(data[2], TXFIFO_DATA1, DB3);
+    frame->data[1] = FIELD_EX32(data[2], TXFIFO_DATA1, DB2);
+    frame->data[2] = FIELD_EX32(data[2], TXFIFO_DATA1, DB1);
+    frame->data[3] = FIELD_EX32(data[2], TXFIFO_DATA1, DB0);
+
+    frame->data[4] = FIELD_EX32(data[3], TXFIFO_DATA2, DB7);
+    frame->data[5] = FIELD_EX32(data[3], TXFIFO_DATA2, DB6);
+    frame->data[6] = FIELD_EX32(data[3], TXFIFO_DATA2, DB5);
+    frame->data[7] = FIELD_EX32(data[3], TXFIFO_DATA2, DB4);
+}
+
+static bool tx_ready_check(XlnxZynqMPCANState *s)
+{
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, SRST)) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer data while"
+                      " data while controller is in reset mode.\n",
+                      path);
+        return false;
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer"
+                      " data while controller is in configuration mode. Reset"
+                      " the core so operations can start fresh.\n",
+                      path);
+        return false;
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SNOOP)) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to transfer"
+                      " data while controller is in SNOOP MODE.\n",
+                      path);
+        return false;
+    }
+
+    return true;
+}
+
+static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
+{
+    qemu_can_frame frame;
+    uint32_t data[CAN_FRAME_SIZE];
+    int i;
+    bool can_tx = tx_ready_check(s);
+
+    if (!can_tx) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is not enabled for data"
+                      " transfer.\n", path);
+        can_update_irq(s);
+        return;
+    }
+
+    while (!fifo32_is_empty(fifo)) {
+        for (i = 0; i < CAN_FRAME_SIZE; i++) {
+            data[i] = fifo32_pop(fifo);
+        }
+
+        if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, LBACK)) {
+            /*
+             * Controller is in loopback. In Loopback mode, the CAN core
+             * transmits a recessive bitstream on to the XlnxZynqMPCAN Bus.
+             * Any message transmitted is looped back to the RX line and
+             * acknowledged. The XlnxZynqMPCAN core receives any message
+             * that it transmits.
+             */
+            if (fifo32_is_full(&s->rx_fifo)) {
+                ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
+            } else {
+                for (i = 0; i < CAN_FRAME_SIZE; i++) {
+                    fifo32_push(&s->rx_fifo, data[i]);
+                }
+
+                ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 1);
+            }
+        } else {
+            /* Normal mode Tx. */
+            generate_frame(&frame, data);
+
+            trace_xlnx_can_tx_data(frame.can_id, frame.can_dlc,
+                                   frame.data[0], frame.data[1],
+                                   frame.data[2], frame.data[3],
+                                   frame.data[4], frame.data[5],
+                                   frame.data[6], frame.data[7]);
+            can_bus_client_send(&s->bus_client, &frame, 1);
+        }
+    }
+
+    ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, TXOK, 1);
+    ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, TXBFLL, 0);
+
+    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP)) {
+        can_exit_sleep_mode(s);
+    }
+
+    can_update_irq(s);
+}
+
+static uint64_t can_srr_pre_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    ARRAY_FIELD_DP32(s->regs, SOFTWARE_RESET_REGISTER, CEN,
+                     FIELD_EX32(val, SOFTWARE_RESET_REGISTER, CEN));
+
+    if (FIELD_EX32(val, SOFTWARE_RESET_REGISTER, SRST)) {
+        trace_xlnx_can_reset(val);
+
+        /* First, core will do software reset then will enter in config mode. */
+        can_config_reset(s);
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
+        can_config_mode(s);
+    } else {
+        /*
+         * Leave config mode. Now XlnxZynqMPCAN core will enter normal,
+         * sleep, snoop or loopback mode depending upon LBACK, SLEEP, SNOOP
+         * register states.
+         */
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, CONFIG, 0);
+
+        ptimer_transaction_begin(s->can_timer);
+        ptimer_set_count(s->can_timer, 0);
+        ptimer_transaction_commit(s->can_timer);
+
+        /* XlnxZynqMPCAN is out of config mode. It will send pending data. */
+        transfer_fifo(s, &s->txhpb_fifo);
+        transfer_fifo(s, &s->tx_fifo);
+    }
+
+    update_status_register_mode_bits(s);
+
+    return s->regs[R_SOFTWARE_RESET_REGISTER];
+}
+
+static uint64_t can_msr_pre_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+    uint8_t multi_mode;
+
+    /*
+     * Multiple mode set check. This is done to make sure user doesn't set
+     * multiple modes.
+     */
+    multi_mode = FIELD_EX32(val, MODE_SELECT_REGISTER, LBACK) +
+                 FIELD_EX32(val, MODE_SELECT_REGISTER, SLEEP) +
+                 FIELD_EX32(val, MODE_SELECT_REGISTER, SNOOP);
+
+    if (multi_mode > 1) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to config"
+                      " several modes simultaneously. One mode will be selected"
+                      " according to their priority: LBACK > SLEEP > SNOOP.\n",
+                      path);
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN) == 0) {
+        /* We are in configuration mode, any mode can be selected. */
+        s->regs[R_MODE_SELECT_REGISTER] = val;
+    } else {
+        bool sleep_mode_bit = FIELD_EX32(val, MODE_SELECT_REGISTER, SLEEP);
+
+        ARRAY_FIELD_DP32(s->regs, MODE_SELECT_REGISTER, SLEEP, sleep_mode_bit);
+
+        if (FIELD_EX32(val, MODE_SELECT_REGISTER, LBACK)) {
+            g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to set"
+                          " LBACK mode without setting CEN bit as 0.\n",
+                          path);
+        } else if (FIELD_EX32(val, MODE_SELECT_REGISTER, SNOOP)) {
+            g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Attempting to set"
+                          " SNOOP mode without setting CEN bit as 0.\n",
+                          path);
+        }
+
+        update_status_register_mode_bits(s);
+    }
+
+    return s->regs[R_MODE_SELECT_REGISTER];
+}
+
+static uint64_t can_brpr_pre_write(RegisterInfo  *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    /* Only allow writes when in config mode. */
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
+        return s->regs[R_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER];
+    }
+
+    return val;
+}
+
+static uint64_t can_btr_pre_write(RegisterInfo  *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    /* Only allow writes when in config mode. */
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
+        return s->regs[R_ARBITRATION_PHASE_BIT_TIMING_REGISTER];
+    }
+
+    return val;
+}
+
+static uint64_t can_tcr_pre_write(RegisterInfo  *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    if (FIELD_EX32(val, TIMESTAMP_REGISTER, CTS)) {
+        ptimer_transaction_begin(s->can_timer);
+        ptimer_set_count(s->can_timer, 0);
+        ptimer_transaction_commit(s->can_timer);
+    }
+
+    return 0;
+}
+
+static void update_rx_fifo(XlnxZynqMPCANState *s, const qemu_can_frame *frame)
+{
+    bool filter_pass = false;
+    uint16_t timestamp = 0;
+
+    /* If no filter is enabled. Message will be stored in FIFO. */
+    if (!((ARRAY_FIELD_EX32(s->regs, AFR, UAF1)) |
+       (ARRAY_FIELD_EX32(s->regs, AFR, UAF2)) |
+       (ARRAY_FIELD_EX32(s->regs, AFR, UAF3)) |
+       (ARRAY_FIELD_EX32(s->regs, AFR, UAF4)))) {
+        filter_pass = true;
+    }
+
+    /*
+     * Messages that pass any of the acceptance filters will be stored in
+     * the RX FIFO.
+     */
+    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF1)) {
+        uint32_t id_masked = s->regs[R_AFMR1] & frame->can_id;
+        uint32_t filter_id_masked = s->regs[R_AFMR1] & s->regs[R_AFIR1];
+
+        if (filter_id_masked == id_masked) {
+            filter_pass = true;
+        }
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF2)) {
+        uint32_t id_masked = s->regs[R_AFMR2] & frame->can_id;
+        uint32_t filter_id_masked = s->regs[R_AFMR2] & s->regs[R_AFIR2];
+
+        if (filter_id_masked == id_masked) {
+            filter_pass = true;
+        }
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF3)) {
+        uint32_t id_masked = s->regs[R_AFMR3] & frame->can_id;
+        uint32_t filter_id_masked = s->regs[R_AFMR3] & s->regs[R_AFIR3];
+
+        if (filter_id_masked == id_masked) {
+            filter_pass = true;
+        }
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF4)) {
+        uint32_t id_masked = s->regs[R_AFMR4] & frame->can_id;
+        uint32_t filter_id_masked = s->regs[R_AFMR4] & s->regs[R_AFIR4];
+
+        if (filter_id_masked == id_masked) {
+            filter_pass = true;
+        }
+    }
+
+    if (!filter_pass) {
+        trace_xlnx_can_rx_fifo_filter_reject(frame->can_id, frame->can_dlc);
+        return;
+    }
+
+    /* Store the message in fifo if it passed through any of the filters. */
+    if (filter_pass && frame->can_dlc <= MAX_DLC) {
+
+        if (fifo32_is_full(&s->rx_fifo)) {
+            ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
+        } else {
+            timestamp = CAN_TIMER_MAX - ptimer_get_count(s->can_timer);
+
+            fifo32_push(&s->rx_fifo, frame->can_id);
+
+            fifo32_push(&s->rx_fifo, deposit32(0, R_RXFIFO_DLC_DLC_SHIFT,
+                                               R_RXFIFO_DLC_DLC_LENGTH,
+                                               frame->can_dlc) |
+                                     deposit32(0, R_RXFIFO_DLC_RXT_SHIFT,
+                                               R_RXFIFO_DLC_RXT_LENGTH,
+                                               timestamp));
+
+            /* First 32 bit of the data. */
+            fifo32_push(&s->rx_fifo, deposit32(0, R_TXFIFO_DATA1_DB3_SHIFT,
+                                               R_TXFIFO_DATA1_DB3_LENGTH,
+                                               frame->data[0]) |
+                                     deposit32(0, R_TXFIFO_DATA1_DB2_SHIFT,
+                                               R_TXFIFO_DATA1_DB2_LENGTH,
+                                               frame->data[1]) |
+                                     deposit32(0, R_TXFIFO_DATA1_DB1_SHIFT,
+                                               R_TXFIFO_DATA1_DB1_LENGTH,
+                                               frame->data[2]) |
+                                     deposit32(0, R_TXFIFO_DATA1_DB0_SHIFT,
+                                               R_TXFIFO_DATA1_DB0_LENGTH,
+                                               frame->data[3]));
+            /* Last 32 bit of the data. */
+            fifo32_push(&s->rx_fifo, deposit32(0, R_TXFIFO_DATA2_DB7_SHIFT,
+                                               R_TXFIFO_DATA2_DB7_LENGTH,
+                                               frame->data[4]) |
+                                     deposit32(0, R_TXFIFO_DATA2_DB6_SHIFT,
+                                               R_TXFIFO_DATA2_DB6_LENGTH,
+                                               frame->data[5]) |
+                                     deposit32(0, R_TXFIFO_DATA2_DB5_SHIFT,
+                                               R_TXFIFO_DATA2_DB5_LENGTH,
+                                               frame->data[6]) |
+                                     deposit32(0, R_TXFIFO_DATA2_DB4_SHIFT,
+                                               R_TXFIFO_DATA2_DB4_LENGTH,
+                                               frame->data[7]));
+
+            ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOK, 1);
+            trace_xlnx_can_rx_data(frame->can_id, frame->can_dlc,
+                                   frame->data[0], frame->data[1],
+                                   frame->data[2], frame->data[3],
+                                   frame->data[4], frame->data[5],
+                                   frame->data[6], frame->data[7]);
+        }
+
+        can_update_irq(s);
+    }
+}
+
+static uint64_t can_rxfifo_pre_read(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    if (!fifo32_is_empty(&s->rx_fifo)) {
+        val = fifo32_pop(&s->rx_fifo);
+    } else {
+        ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXUFLW, 1);
+    }
+
+    can_update_irq(s);
+    return val;
+}
+
+static void can_filter_enable_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    if (ARRAY_FIELD_EX32(s->regs, AFR, UAF1) &&
+        ARRAY_FIELD_EX32(s->regs, AFR, UAF2) &&
+        ARRAY_FIELD_EX32(s->regs, AFR, UAF3) &&
+        ARRAY_FIELD_EX32(s->regs, AFR, UAF4)) {
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, ACFBSY, 1);
+    } else {
+        ARRAY_FIELD_DP32(s->regs, STATUS_REGISTER, ACFBSY, 0);
+    }
+}
+
+static uint64_t can_filter_mask_pre_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+    uint32_t reg_idx = (reg->access->addr) / 4;
+    uint32_t filter_number = (reg_idx - R_AFMR1) / 2;
+
+    /* modify an acceptance filter, the corresponding UAF bit should be '0'. */
+    if (!(s->regs[R_AFR] & (1 << filter_number))) {
+        s->regs[reg_idx] = val;
+
+        trace_xlnx_can_filter_mask_pre_write(filter_number, s->regs[reg_idx]);
+    } else {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d"
+                      " mask is not set as corresponding UAF bit is not 0.\n",
+                      path, filter_number + 1);
+    }
+
+    return s->regs[reg_idx];
+}
+
+static uint64_t can_filter_id_pre_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+    uint32_t reg_idx = (reg->access->addr) / 4;
+    uint32_t filter_number = (reg_idx - R_AFIR1) / 2;
+
+    if (!(s->regs[R_AFR] & (1 << filter_number))) {
+        s->regs[reg_idx] = val;
+
+        trace_xlnx_can_filter_id_pre_write(filter_number, s->regs[reg_idx]);
+    } else {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d"
+                      " id is not set as corresponding UAF bit is not 0.\n",
+                      path, filter_number + 1);
+    }
+
+    return s->regs[reg_idx];
+}
+
+static void can_tx_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(reg->opaque);
+
+    bool is_txhpb = reg->access->addr > A_TXFIFO_DATA2;
+
+    bool initiate_transfer = (reg->access->addr == A_TXFIFO_DATA2) ||
+                             (reg->access->addr == A_TXHPB_DATA2);
+
+    Fifo32 *f = is_txhpb ? &s->txhpb_fifo : &s->tx_fifo;
+
+    if (!fifo32_is_full(f)) {
+        fifo32_push(f, val);
+    } else {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: TX FIFO is full.\n", path);
+    }
+
+    /* Initiate the message send if TX register is written. */
+    if (initiate_transfer &&
+        ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) {
+        transfer_fifo(s, f);
+    }
+
+    can_update_irq(s);
+}
+
+static const RegisterAccessInfo can_regs_info[] = {
+    {   .name = "SOFTWARE_RESET_REGISTER",
+        .addr = A_SOFTWARE_RESET_REGISTER,
+        .rsvd = 0xfffffffc,
+        .pre_write = can_srr_pre_write,
+    },{ .name = "MODE_SELECT_REGISTER",
+        .addr = A_MODE_SELECT_REGISTER,
+        .rsvd = 0xfffffff8,
+        .pre_write = can_msr_pre_write,
+    },{ .name = "ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER",
+        .addr = A_ARBITRATION_PHASE_BAUD_RATE_PRESCALER_REGISTER,
+        .rsvd = 0xffffff00,
+        .pre_write = can_brpr_pre_write,
+    },{ .name = "ARBITRATION_PHASE_BIT_TIMING_REGISTER",
+        .addr = A_ARBITRATION_PHASE_BIT_TIMING_REGISTER,
+        .rsvd = 0xfffffe00,
+        .pre_write = can_btr_pre_write,
+    },{ .name = "ERROR_COUNTER_REGISTER",
+        .addr = A_ERROR_COUNTER_REGISTER,
+        .rsvd = 0xffff0000,
+        .ro = 0xffffffff,
+    },{ .name = "ERROR_STATUS_REGISTER",
+        .addr = A_ERROR_STATUS_REGISTER,
+        .rsvd = 0xffffffe0,
+        .w1c = 0x1f,
+    },{ .name = "STATUS_REGISTER",  .addr = A_STATUS_REGISTER,
+        .reset = 0x1,
+        .rsvd = 0xffffe000,
+        .ro = 0x1fff,
+    },{ .name = "INTERRUPT_STATUS_REGISTER",
+        .addr = A_INTERRUPT_STATUS_REGISTER,
+        .reset = 0x6000,
+        .rsvd = 0xffff8000,
+        .ro = 0x7fff,
+    },{ .name = "INTERRUPT_ENABLE_REGISTER",
+        .addr = A_INTERRUPT_ENABLE_REGISTER,
+        .rsvd = 0xffff8000,
+        .post_write = can_ier_post_write,
+    },{ .name = "INTERRUPT_CLEAR_REGISTER",
+        .addr = A_INTERRUPT_CLEAR_REGISTER,
+        .rsvd = 0xffff8000,
+        .pre_write = can_icr_pre_write,
+    },{ .name = "TIMESTAMP_REGISTER",
+        .addr = A_TIMESTAMP_REGISTER,
+        .rsvd = 0xfffffffe,
+        .pre_write = can_tcr_pre_write,
+    },{ .name = "WIR",  .addr = A_WIR,
+        .reset = 0x3f3f,
+        .rsvd = 0xffff0000,
+    },{ .name = "TXFIFO_ID",  .addr = A_TXFIFO_ID,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXFIFO_DLC",  .addr = A_TXFIFO_DLC,
+        .rsvd = 0xfffffff,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXFIFO_DATA1",  .addr = A_TXFIFO_DATA1,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXFIFO_DATA2",  .addr = A_TXFIFO_DATA2,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXHPB_ID",  .addr = A_TXHPB_ID,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXHPB_DLC",  .addr = A_TXHPB_DLC,
+        .rsvd = 0xfffffff,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXHPB_DATA1",  .addr = A_TXHPB_DATA1,
+        .post_write = can_tx_post_write,
+    },{ .name = "TXHPB_DATA2",  .addr = A_TXHPB_DATA2,
+        .post_write = can_tx_post_write,
+    },{ .name = "RXFIFO_ID",  .addr = A_RXFIFO_ID,
+        .ro = 0xffffffff,
+        .post_read = can_rxfifo_pre_read,
+    },{ .name = "RXFIFO_DLC",  .addr = A_RXFIFO_DLC,
+        .rsvd = 0xfff0000,
+        .post_read = can_rxfifo_pre_read,
+    },{ .name = "RXFIFO_DATA1",  .addr = A_RXFIFO_DATA1,
+        .post_read = can_rxfifo_pre_read,
+    },{ .name = "RXFIFO_DATA2",  .addr = A_RXFIFO_DATA2,
+        .post_read = can_rxfifo_pre_read,
+    },{ .name = "AFR",  .addr = A_AFR,
+        .rsvd = 0xfffffff0,
+        .post_write = can_filter_enable_post_write,
+    },{ .name = "AFMR1",  .addr = A_AFMR1,
+        .pre_write = can_filter_mask_pre_write,
+    },{ .name = "AFIR1",  .addr = A_AFIR1,
+        .pre_write = can_filter_id_pre_write,
+    },{ .name = "AFMR2",  .addr = A_AFMR2,
+        .pre_write = can_filter_mask_pre_write,
+    },{ .name = "AFIR2",  .addr = A_AFIR2,
+        .pre_write = can_filter_id_pre_write,
+    },{ .name = "AFMR3",  .addr = A_AFMR3,
+        .pre_write = can_filter_mask_pre_write,
+    },{ .name = "AFIR3",  .addr = A_AFIR3,
+        .pre_write = can_filter_id_pre_write,
+    },{ .name = "AFMR4",  .addr = A_AFMR4,
+        .pre_write = can_filter_mask_pre_write,
+    },{ .name = "AFIR4",  .addr = A_AFIR4,
+        .pre_write = can_filter_id_pre_write,
+    }
+};
+
+static void xlnx_zynqmp_can_ptimer_cb(void *opaque)
+{
+    /* No action required on the timer rollover. */
+}
+
+static const MemoryRegionOps can_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void xlnx_zynqmp_can_reset_init(Object *obj, ResetType type)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
+    unsigned int i;
+
+    for (i = R_RXFIFO_ID; i < ARRAY_SIZE(s->reg_info); ++i) {
+        register_reset(&s->reg_info[i]);
+    }
+
+    ptimer_transaction_begin(s->can_timer);
+    ptimer_set_count(s->can_timer, 0);
+    ptimer_transaction_commit(s->can_timer);
+}
+
+static void xlnx_zynqmp_can_reset_hold(Object *obj)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
+    unsigned int i;
+
+    for (i = 0; i < R_RXFIFO_ID; ++i) {
+        register_reset(&s->reg_info[i]);
+    }
+
+    /*
+     * Reset FIFOs when CAN model is reset. This will clear the fifo writes
+     * done by post_write which gets called from register_reset function,
+     * post_write handle will not be able to trigger tx because CAN will be
+     * disabled when software_reset_register is cleared first.
+     */
+    fifo32_reset(&s->rx_fifo);
+    fifo32_reset(&s->tx_fifo);
+    fifo32_reset(&s->txhpb_fifo);
+}
+
+static bool xlnx_zynqmp_can_can_receive(CanBusClientState *client)
+{
+    XlnxZynqMPCANState *s = container_of(client, XlnxZynqMPCANState,
+                                         bus_client);
+
+    if (ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, SRST)) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is in reset state.\n",
+                      path);
+        return false;
+    }
+
+    if ((ARRAY_FIELD_EX32(s->regs, SOFTWARE_RESET_REGISTER, CEN)) == 0) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Controller is disabled. Incoming"
+                      " messages will be discarded.\n", path);
+        return false;
+    }
+
+    return true;
+}
+
+static ssize_t xlnx_zynqmp_can_receive(CanBusClientState *client,
+                               const qemu_can_frame *buf, size_t buf_size) {
+    XlnxZynqMPCANState *s = container_of(client, XlnxZynqMPCANState,
+                                         bus_client);
+    const qemu_can_frame *frame = buf;
+
+    if (buf_size <= 0) {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Error in the data received.\n",
+                      path);
+        return 0;
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SNOOP)) {
+        /* Snoop Mode: Just keep the data. no response back. */
+        update_rx_fifo(s, frame);
+    } else if ((ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP))) {
+        /*
+         * XlnxZynqMPCAN is in sleep mode. Any data on bus will bring it to wake
+         * up state.
+         */
+        can_exit_sleep_mode(s);
+        update_rx_fifo(s, frame);
+    } else if ((ARRAY_FIELD_EX32(s->regs, STATUS_REGISTER, SLEEP)) == 0) {
+        update_rx_fifo(s, frame);
+    } else {
+        /*
+         * XlnxZynqMPCAN will not participate in normal bus communication
+         * and will not receive any messages transmitted by other CAN nodes.
+         */
+        trace_xlnx_can_rx_discard(s->regs[R_STATUS_REGISTER]);
+    }
+
+    return 1;
+}
+
+static CanBusClientInfo can_xilinx_bus_client_info = {
+    .can_receive = xlnx_zynqmp_can_can_receive,
+    .receive = xlnx_zynqmp_can_receive,
+};
+
+static int xlnx_zynqmp_can_connect_to_bus(XlnxZynqMPCANState *s,
+                                          CanBusState *bus)
+{
+    s->bus_client.info = &can_xilinx_bus_client_info;
+
+    if (can_bus_insert_client(bus, &s->bus_client) < 0) {
+        return -1;
+    }
+    return 0;
+}
+
+static void xlnx_zynqmp_can_realize(DeviceState *dev, Error **errp)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(dev);
+
+    if (s->canbus) {
+        if (xlnx_zynqmp_can_connect_to_bus(s, s->canbus) < 0) {
+            g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+            error_setg(errp, "%s: xlnx_zynqmp_can_connect_to_bus"
+                       " failed.", path);
+            return;
+        }
+    }
+
+    /* Create RX FIFO, TXFIFO, TXHPB storage. */
+    fifo32_create(&s->rx_fifo, RXFIFO_SIZE);
+    fifo32_create(&s->tx_fifo, RXFIFO_SIZE);
+    fifo32_create(&s->txhpb_fifo, CAN_FRAME_SIZE);
+
+    /* Allocate a new timer. */
+    s->can_timer = ptimer_init(xlnx_zynqmp_can_ptimer_cb, s,
+                               PTIMER_POLICY_DEFAULT);
+
+    ptimer_transaction_begin(s->can_timer);
+
+    ptimer_set_freq(s->can_timer, s->cfg.ext_clk_freq);
+    ptimer_set_limit(s->can_timer, CAN_TIMER_MAX, 1);
+    ptimer_run(s->can_timer, 0);
+    ptimer_transaction_commit(s->can_timer);
+}
+
+static void xlnx_zynqmp_can_init(Object *obj)
+{
+    XlnxZynqMPCANState *s = XLNX_ZYNQMP_CAN(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    RegisterInfoArray *reg_array;
+
+    memory_region_init(&s->iomem, obj, TYPE_XLNX_ZYNQMP_CAN,
+                        XLNX_ZYNQMP_CAN_R_MAX * 4);
+    reg_array = register_init_block32(DEVICE(obj), can_regs_info,
+                               ARRAY_SIZE(can_regs_info),
+                               s->reg_info, s->regs,
+                               &can_ops,
+                               XLNX_ZYNQMP_CAN_ERR_DEBUG,
+                               XLNX_ZYNQMP_CAN_R_MAX * 4);
+
+    memory_region_add_subregion(&s->iomem, 0x00, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+}
+
+static const VMStateDescription vmstate_can = {
+    .name = TYPE_XLNX_ZYNQMP_CAN,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_FIFO32(rx_fifo, XlnxZynqMPCANState),
+        VMSTATE_FIFO32(tx_fifo, XlnxZynqMPCANState),
+        VMSTATE_FIFO32(txhpb_fifo, XlnxZynqMPCANState),
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCANState, XLNX_ZYNQMP_CAN_R_MAX),
+        VMSTATE_PTIMER(can_timer, XlnxZynqMPCANState),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static Property xlnx_zynqmp_can_properties[] = {
+    DEFINE_PROP_UINT32("ext_clk_freq", XlnxZynqMPCANState, cfg.ext_clk_freq,
+                       CAN_DEFAULT_CLOCK),
+    DEFINE_PROP_LINK("canbus", XlnxZynqMPCANState, canbus, TYPE_CAN_BUS,
+                     CanBusState *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xlnx_zynqmp_can_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    rc->phases.enter = xlnx_zynqmp_can_reset_init;
+    rc->phases.hold = xlnx_zynqmp_can_reset_hold;
+    dc->realize = xlnx_zynqmp_can_realize;
+    device_class_set_props(dc, xlnx_zynqmp_can_properties);
+    dc->vmsd = &vmstate_can;
+}
+
+static const TypeInfo can_info = {
+    .name          = TYPE_XLNX_ZYNQMP_CAN,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxZynqMPCANState),
+    .class_init    = xlnx_zynqmp_can_class_init,
+    .instance_init = xlnx_zynqmp_can_init,
+};
+
+static void can_register_types(void)
+{
+    type_register_static(&can_info);
+}
+
+type_init(can_register_types)
diff --git a/hw/Kconfig b/hw/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -XXX,XX +XXX,XX @@ config XILINX_AXI
 config XLNX_ZYNQMP
     bool
     select REGISTER
+    select CAN_BUS
diff --git a/hw/net/can/meson.build b/hw/net/can/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/can/meson.build
+++ b/hw/net/can/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_CAN_PCI', if_true: files('can_pcm3680_pci.c'))
 softmmu_ss.add(when: 'CONFIG_CAN_PCI', if_true: files('can_mioe3680_pci.c'))
 softmmu_ss.add(when: 'CONFIG_CAN_CTUCANFD', if_true: files('ctucan_core.c'))
 softmmu_ss.add(when: 'CONFIG_CAN_CTUCANFD_PCI', if_true: files('ctucan_pci.c'))
+softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP', if_true: files('xlnx-zynqmp-can.c'))
diff --git a/hw/net/can/trace-events b/hw/net/can/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/can/trace-events
@@ -XXX,XX +XXX,XX @@
+# xlnx-zynqmp-can.c
+xlnx_can_update_irq(uint32_t isr, uint32_t ier, uint32_t irq) "ISR: 0x%08x IER: 0x%08x IRQ: 0x%08x"
+xlnx_can_reset(uint32_t val) "Resetting controller with value = 0x%08x"
+xlnx_can_rx_fifo_filter_reject(uint32_t id, uint8_t dlc) "Frame: ID: 0x%08x DLC: 0x%02x"
+xlnx_can_filter_id_pre_write(uint8_t filter_num, uint32_t value) "Filter%d ID: 0x%08x"
+xlnx_can_filter_mask_pre_write(uint8_t filter_num, uint32_t value) "Filter%d MASK: 0x%08x"
+xlnx_can_tx_data(uint32_t id, uint8_t dlc, uint8_t db0, uint8_t db1, uint8_t db2, uint8_t db3, uint8_t db4, uint8_t db5, uint8_t db6, uint8_t db7) "Frame: ID: 0x%08x DLC: 0x%02x DATA: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x"
+xlnx_can_rx_data(uint32_t id, uint32_t dlc, uint8_t db0, uint8_t db1, uint8_t db2, uint8_t db3, uint8_t db4, uint8_t db5, uint8_t db6, uint8_t db7) "Frame: ID: 0x%08x DLC: 0x%02x DATA: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x"
+xlnx_can_rx_discard(uint32_t status) "Controller is not enabled for bus communication. Status Register: 0x%08x"
-- 
2.20.1

From: Vikram Garhwal <fnu.vikram@xilinx.com>

Connect CAN0 and CAN1 on the ZynqMP.

Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
Message-id: 1605728926-352690-3-git-send-email-fnu.vikram@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  8 ++++++++
 hw/arm/xlnx-zcu102.c         | 20 ++++++++++++++++++++
 hw/arm/xlnx-zynqmp.c         | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
+#include "hw/net/xlnx-zynqmp-can.h"
 #include "hw/ide/ahci.h"
 #include "hw/sd/sdhci.h"
 #include "hw/ssi/xilinx_spips.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/cluster.h"
 #include "target/arm/cpu.h"
 #include "qom/object.h"
+#include "net/can_emu.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx,zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 #define XLNX_ZYNQMP_NUM_RPU_CPUS 2
 #define XLNX_ZYNQMP_NUM_GEMS 4
 #define XLNX_ZYNQMP_NUM_UARTS 2
+#define XLNX_ZYNQMP_NUM_CAN 2
+#define XLNX_ZYNQMP_CAN_REF_CLK (24 * 1000 * 1000)
 #define XLNX_ZYNQMP_NUM_SDHCI 2
 #define XLNX_ZYNQMP_NUM_SPIS 2
 #define XLNX_ZYNQMP_NUM_GDMA_CH 8
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
 
     CadenceGEMState gem[XLNX_ZYNQMP_NUM_GEMS];
     CadenceUARTState uart[XLNX_ZYNQMP_NUM_UARTS];
+    XlnxZynqMPCANState can[XLNX_ZYNQMP_NUM_CAN];
     SysbusAHCIState sata;
     SDHCIState sdhci[XLNX_ZYNQMP_NUM_SDHCI];
     XilinxSPIPS spi[XLNX_ZYNQMP_NUM_SPIS];
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
+
+    /* CAN bus. */
+    CanBusState *canbus[XLNX_ZYNQMP_NUM_CAN];
 };
 
 #endif
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "sysemu/device_tree.h"
 #include "qom/object.h"
+#include "net/can_emu.h"
 
 struct XlnxZCU102 {
     MachineState parent_obj;
@@ -XXX,XX +XXX,XX @@ struct XlnxZCU102 {
     bool secure;
     bool virt;
 
+    CanBusState *canbus[XLNX_ZYNQMP_NUM_CAN];
+
     struct arm_boot_info binfo;
 };
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
     object_property_set_bool(OBJECT(&s->soc), "virtualization", s->virt,
                              &error_fatal);
 
+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
+        gchar *bus_name = g_strdup_printf("canbus%d", i);
+
+        object_property_set_link(OBJECT(&s->soc), bus_name,
+                                 OBJECT(s->canbus[i]), &error_fatal);
+        g_free(bus_name);
+    }
+
     qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
 
     /* Create and plug in the SD cards */
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
     s->secure = false;
     /* Default to virt (EL2) being disabled */
     s->virt = false;
+    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
+                             (Object **)&s->canbus[0],
+                             object_property_allow_set_link,
+                             0);
+
+    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
+                             (Object **)&s->canbus[1],
+                             object_property_allow_set_link,
+                             0);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static const int uart_intr[XLNX_ZYNQMP_NUM_UARTS] = {
     21, 22,
 };
 
+static const uint64_t can_addr[XLNX_ZYNQMP_NUM_CAN] = {
+    0xFF060000, 0xFF070000,
+};
+
+static const int can_intr[XLNX_ZYNQMP_NUM_CAN] = {
+    23, 24,
+};
+
 static const uint64_t sdhci_addr[XLNX_ZYNQMP_NUM_SDHCI] = {
     0xFF160000, 0xFF170000,
 };
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
                                 TYPE_CADENCE_UART);
     }
 
+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
+        object_initialize_child(obj, "can[*]", &s->can[i],
+                                TYPE_XLNX_ZYNQMP_CAN);
+    }
+
     object_initialize_child(obj, "sata", &s->sata, TYPE_SYSBUS_AHCI);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_SDHCI; i++) {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
                            gic_spi[uart_intr[i]]);
     }
 
+    for (i = 0; i < XLNX_ZYNQMP_NUM_CAN; i++) {
+        object_property_set_int(OBJECT(&s->can[i]), "ext_clk_freq",
+                                XLNX_ZYNQMP_CAN_REF_CLK, &error_abort);
+
+        object_property_set_link(OBJECT(&s->can[i]), "canbus",
+                                 OBJECT(s->canbus[i]), &error_fatal);
+
+        sysbus_realize(SYS_BUS_DEVICE(&s->can[i]), &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->can[i]), 0, can_addr[i]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->can[i]), 0,
+                           gic_spi[can_intr[i]]);
+    }
+
     object_property_set_int(OBJECT(&s->sata), "num-ports", SATA_NUM_PORTS,
                             &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sata), errp)) {
@@ -XXX,XX +XXX,XX @@ static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
+    DEFINE_PROP_LINK("canbus0", XlnxZynqMPState, canbus[0], TYPE_CAN_BUS,
+                     CanBusState *),
+    DEFINE_PROP_LINK("canbus1", XlnxZynqMPState, canbus[1], TYPE_CAN_BUS,
+                     CanBusState *),
     DEFINE_PROP_END_OF_LIST()
 };
 
-- 
2.20.1

From: Vikram Garhwal <fnu.vikram@xilinx.com>

The QTests perform five tests on the Xilinx ZynqMP CAN controller:
    Tests the CAN controller in loopback, sleep and snoop mode.
    Tests filtering of incoming CAN messages.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com>
Message-id: 1605728926-352690-4-git-send-email-fnu.vikram@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/xlnx-can-test.c | 360 ++++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build     |   1 +
 2 files changed, 361 insertions(+)
 create mode 100644 tests/qtest/xlnx-can-test.c

diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/xlnx-can-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTests for the Xilinx ZynqMP CAN controller.
+ *
+ * Copyright (c) 2020 Xilinx Inc.
+ *
+ * Written-by: Vikram Garhwal<fnu.vikram@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "libqos/libqtest.h"
+
+/* Base address. */
+#define CAN0_BASE_ADDR          0xFF060000
+#define CAN1_BASE_ADDR          0xFF070000
+
+/* Register addresses. */
+#define R_SRR_OFFSET            0x00
+#define R_MSR_OFFSET            0x04
+#define R_SR_OFFSET             0x18
+#define R_ISR_OFFSET            0x1C
+#define R_ICR_OFFSET            0x24
+#define R_TXID_OFFSET           0x30
+#define R_TXDLC_OFFSET          0x34
+#define R_TXDATA1_OFFSET        0x38
+#define R_TXDATA2_OFFSET        0x3C
+#define R_RXID_OFFSET           0x50
+#define R_RXDLC_OFFSET          0x54
+#define R_RXDATA1_OFFSET        0x58
+#define R_RXDATA2_OFFSET        0x5C
+#define R_AFR                   0x60
+#define R_AFMR1                 0x64
+#define R_AFIR1                 0x68
+#define R_AFMR2                 0x6C
+#define R_AFIR2                 0x70
+#define R_AFMR3                 0x74
+#define R_AFIR3                 0x78
+#define R_AFMR4                 0x7C
+#define R_AFIR4                 0x80
+
+/* CAN modes. */
+#define CONFIG_MODE             0x00
+#define NORMAL_MODE             0x00
+#define LOOPBACK_MODE           0x02
+#define SNOOP_MODE              0x04
+#define SLEEP_MODE              0x01
+#define ENABLE_CAN              (1 << 1)
+#define STATUS_NORMAL_MODE      (1 << 3)
+#define STATUS_LOOPBACK_MODE    (1 << 1)
+#define STATUS_SNOOP_MODE       (1 << 12)
+#define STATUS_SLEEP_MODE       (1 << 2)
+#define ISR_TXOK                (1 << 1)
+#define ISR_RXOK                (1 << 4)
+
+static void match_rx_tx_data(const uint32_t *buf_tx, const uint32_t *buf_rx,
+                             uint8_t can_timestamp)
+{
+    uint16_t size = 0;
+    uint8_t len = 4;
+
+    while (size < len) {
+        if (R_RXID_OFFSET + 4 * size == R_RXDLC_OFFSET)  {
+            g_assert_cmpint(buf_rx[size], ==, buf_tx[size] + can_timestamp);
+        } else {
+            g_assert_cmpint(buf_rx[size], ==, buf_tx[size]);
+        }
+
+        size++;
+    }
+}
+
+static void read_data(QTestState *qts, uint64_t can_base_addr, uint32_t *buf_rx)
+{
+    uint32_t int_status;
+
+    /* Read the interrupt on CAN rx. */
+    int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_RXOK;
+
+    g_assert_cmpint(int_status, ==, ISR_RXOK);
+
+    /* Read the RX register data for CAN. */
+    buf_rx[0] = qtest_readl(qts, can_base_addr + R_RXID_OFFSET);
+    buf_rx[1] = qtest_readl(qts, can_base_addr + R_RXDLC_OFFSET);
+    buf_rx[2] = qtest_readl(qts, can_base_addr + R_RXDATA1_OFFSET);
+    buf_rx[3] = qtest_readl(qts, can_base_addr + R_RXDATA2_OFFSET);
+
+    /* Clear the RX interrupt. */
+    qtest_writel(qts, CAN1_BASE_ADDR + R_ICR_OFFSET, ISR_RXOK);
+}
+
+static void send_data(QTestState *qts, uint64_t can_base_addr,
+                      const uint32_t *buf_tx)
+{
+    uint32_t int_status;
+
+    /* Write the TX register data for CAN. */
+    qtest_writel(qts, can_base_addr + R_TXID_OFFSET, buf_tx[0]);
+    qtest_writel(qts, can_base_addr + R_TXDLC_OFFSET, buf_tx[1]);
+    qtest_writel(qts, can_base_addr + R_TXDATA1_OFFSET, buf_tx[2]);
+    qtest_writel(qts, can_base_addr + R_TXDATA2_OFFSET, buf_tx[3]);
+
+    /* Read the interrupt on CAN for tx. */
+    int_status = qtest_readl(qts, can_base_addr + R_ISR_OFFSET) & ISR_TXOK;
+
+    g_assert_cmpint(int_status, ==, ISR_TXOK);
+
+    /* Clear the interrupt for tx. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_ICR_OFFSET, ISR_TXOK);
+}
+
+/*
+ * This test will be transferring data from CAN0 and CAN1 through canbus. CAN0
+ * initiate the data transfer to can-bus, CAN1 receives the data. Test compares
+ * the data sent from CAN0 with received on CAN1.
+ */
+static void test_can_bus(void)
+{
+    const uint32_t buf_tx[4] = { 0xFF, 0x80000000, 0x12345678, 0x87654321 };
+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
+    uint32_t status = 0;
+    uint8_t can_timestamp = 1;
+
+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
+                " -object can-bus,id=canbus0"
+                " -machine xlnx-zcu102.canbus0=canbus0"
+                " -machine xlnx-zcu102.canbus1=canbus0"
+                );
+
+    /* Configure the CAN0 and CAN1. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+
+    /* Check here if CAN0 and CAN1 are in normal mode. */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    send_data(qts, CAN0_BASE_ADDR, buf_tx);
+
+    read_data(qts, CAN1_BASE_ADDR, buf_rx);
+    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
+
+    qtest_quit(qts);
+}
+
+/*
+ * This test is performing loopback mode on CAN0 and CAN1. Data sent from TX of
+ * each CAN0 and CAN1 are compared with RX register data for respective CAN.
+ */
+static void test_can_loopback(void)
+{
+    uint32_t buf_tx[4] = { 0xFF, 0x80000000, 0x12345678, 0x87654321 };
+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
+    uint32_t status = 0;
+
+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
+                " -object can-bus,id=canbus0"
+                " -machine xlnx-zcu102.canbus0=canbus0"
+                " -machine xlnx-zcu102.canbus1=canbus0"
+                );
+
+    /* Configure the CAN0 in loopback mode. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, LOOPBACK_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+
+    /* Check here if CAN0 is set in loopback mode. */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+
+    g_assert_cmpint(status, ==, STATUS_LOOPBACK_MODE);
+
+    send_data(qts, CAN0_BASE_ADDR, buf_tx);
+    read_data(qts, CAN0_BASE_ADDR, buf_rx);
+    match_rx_tx_data(buf_tx, buf_rx, 0);
+
+    /* Configure the CAN1 in loopback mode. */
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, LOOPBACK_MODE);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+
+    /* Check here if CAN1 is set in loopback mode. */
+    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
+
+    g_assert_cmpint(status, ==, STATUS_LOOPBACK_MODE);
+
+    send_data(qts, CAN1_BASE_ADDR, buf_tx);
+    read_data(qts, CAN1_BASE_ADDR, buf_rx);
+    match_rx_tx_data(buf_tx, buf_rx, 0);
+
+    qtest_quit(qts);
+}
+
+/*
+ * Enable filters for CAN1. This will filter incoming messages with ID. In this
+ * test message will pass through filter 2.
+ */
+static void test_can_filter(void)
+{
+    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
+    uint32_t status = 0;
+    uint8_t can_timestamp = 1;
+
+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
+                " -object can-bus,id=canbus0"
+                " -machine xlnx-zcu102.canbus0=canbus0"
+                " -machine xlnx-zcu102.canbus1=canbus0"
+                );
+
+    /* Configure the CAN0 and CAN1. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+
+    /* Check here if CAN0 and CAN1 are in normal mode. */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    /* Set filter for CAN1 for incoming messages. */
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFR, 0x0);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR1, 0xF7);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR1, 0x121F);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR2, 0x5431);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR2, 0x14);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR3, 0x1234);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR3, 0x5431);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFMR4, 0xFFF);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFIR4, 0x1234);
+
+    qtest_writel(qts, CAN1_BASE_ADDR + R_AFR, 0xF);
+
+    send_data(qts, CAN0_BASE_ADDR, buf_tx);
+
+    read_data(qts, CAN1_BASE_ADDR, buf_rx);
+    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
+
+    qtest_quit(qts);
+}
+
+/* Testing sleep mode on CAN0 while CAN1 is in normal mode. */
+static void test_can_sleepmode(void)
+{
+    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
+    uint32_t status = 0;
+    uint8_t can_timestamp = 1;
+
+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
+                " -object can-bus,id=canbus0"
+                " -machine xlnx-zcu102.canbus0=canbus0"
+                " -machine xlnx-zcu102.canbus1=canbus0"
+                );
+
+    /* Configure the CAN0. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, SLEEP_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+
+    /* Check here if CAN0 is in SLEEP mode and CAN1 in normal mode. */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_SLEEP_MODE);
+
+    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    send_data(qts, CAN1_BASE_ADDR, buf_tx);
+
+    /*
+     * Once CAN1 sends data on can-bus. CAN0 should exit sleep mode.
+     * Check the CAN0 status now. It should exit the sleep mode and receive the
+     * incoming data.
+     */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    read_data(qts, CAN0_BASE_ADDR, buf_rx);
+
+    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
+
+    qtest_quit(qts);
+}
+
+/* Testing Snoop mode on CAN0 while CAN1 is in normal mode. */
+static void test_can_snoopmode(void)
+{
+    uint32_t buf_tx[4] = { 0x14, 0x80000000, 0x12345678, 0x87654321 };
+    uint32_t buf_rx[4] = { 0x00, 0x00, 0x00, 0x00 };
+    uint32_t status = 0;
+    uint8_t can_timestamp = 1;
+
+    QTestState *qts = qtest_init("-machine xlnx-zcu102"
+                " -object can-bus,id=canbus0"
+                " -machine xlnx-zcu102.canbus0=canbus0"
+                " -machine xlnx-zcu102.canbus1=canbus0"
+                );
+
+    /* Configure the CAN0. */
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, CONFIG_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_MSR_OFFSET, SNOOP_MODE);
+    qtest_writel(qts, CAN0_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+
+    qtest_writel(qts, CAN1_BASE_ADDR + R_SRR_OFFSET, ENABLE_CAN);
+    qtest_writel(qts, CAN1_BASE_ADDR + R_MSR_OFFSET, NORMAL_MODE);
+
+    /* Check here if CAN0 is in SNOOP mode and CAN1 in normal mode. */
+    status = qtest_readl(qts, CAN0_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_SNOOP_MODE);
+
+    status = qtest_readl(qts, CAN1_BASE_ADDR + R_SR_OFFSET);
+    g_assert_cmpint(status, ==, STATUS_NORMAL_MODE);
+
+    send_data(qts, CAN1_BASE_ADDR, buf_tx);
+
+    read_data(qts, CAN0_BASE_ADDR, buf_rx);
+
+    match_rx_tx_data(buf_tx, buf_rx, can_timestamp);
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("/net/can/can_bus", test_can_bus);
+    qtest_add_func("/net/can/can_loopback", test_can_loopback);
+    qtest_add_func("/net/can/can_filter", test_can_filter);
+    qtest_add_func("/net/can/can_test_snoopmode", test_can_snoopmode);
+    qtest_add_func("/net/can/can_test_sleepmode", test_can_sleepmode);
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
   ['arm-cpu-features',
    'numa-test',
    'boot-serial-test',
+   'xlnx-can-test',
    'migration-test']
 
 qtests_s390x = \
-- 
2.20.1

From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Trusted Firmware now supports A72 on sbsa-ref by default [1] so enable
it for QEMU as well. A53 was already enabled there.

1. https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/7117

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201120141705.246690-1-marcin.juszkiewicz@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
     [SBSA_GWDT] = 16,
 };
 
+static const char * const valid_cpus[] = {
+    ARM_CPU_TYPE_NAME("cortex-a53"),
+    ARM_CPU_TYPE_NAME("cortex-a57"),
+    ARM_CPU_TYPE_NAME("cortex-a72"),
+};
+
+static bool cpu_type_valid(const char *cpu)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(valid_cpus); i++) {
+        if (strcmp(cpu, valid_cpus[i]) == 0) {
+            return true;
+        }
+    }
+    return false;
+}
+
 static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
 {
     uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
     const CPUArchIdList *possible_cpus;
     int n, sbsa_max_cpus;
 
-    if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a57"))) {
-        error_report("sbsa-ref: CPU type other than the built-in "
-                     "cortex-a57 not supported");
+    if (!cpu_type_valid(machine->cpu_type)) {
+        error_report("mach-virt: CPU type %s not supported", machine->cpu_type);
         exit(1);
     }
 
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

Dump the collected random data after a randomness test failure.

Note that this relies on the test having called
g_test_set_nonfatal_assertions() so we don't abort immediately on the
assertion failure.

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: minor commit message tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@
 
 #include "libqtest-single.h"
 #include "qemu/bitops.h"
+#include "qemu-common.h"
 
 #define RNG_BASE_ADDR   0xf000b000
 
@@ -XXX,XX +XXX,XX @@
 /* Number of bits to collect for randomness tests. */
 #define TEST_INPUT_BITS  (128)
 
+static void dump_buf_if_failed(const uint8_t *buf, size_t size)
+{
+    if (g_test_failed()) {
+        qemu_hexdump(stderr, "", buf, size);
+    }
+}
+
 static void rng_writeb(unsigned int offset, uint8_t value)
 {
     writeb(RNG_BASE_ADDR + offset, value);
@@ -XXX,XX +XXX,XX @@ static void test_continuous_monobit(void)
     }
 
     g_assert_cmpfloat(calc_monobit_p(buf, sizeof(buf)), >, 0.01);
+    dump_buf_if_failed(buf, sizeof(buf));
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void test_continuous_runs(void)
     }
 
     g_assert_cmpfloat(calc_runs_p(buf.l, sizeof(buf) * BITS_PER_BYTE), >, 0.01);
+    dump_buf_if_failed(buf.c, sizeof(buf));
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void test_first_byte_monobit(void)
     }
 
     g_assert_cmpfloat(calc_monobit_p(buf, sizeof(buf)), >, 0.01);
+    dump_buf_if_failed(buf, sizeof(buf));
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void test_first_byte_runs(void)
     }
 
     g_assert_cmpfloat(calc_runs_p(buf.l, sizeof(buf) * BITS_PER_BYTE), >, 0.01);
+    dump_buf_if_failed(buf.c, sizeof(buf));
 }
 
 int main(int argc, char **argv)
-- 
2.20.1

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201126111109.112238-2-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/imx25_ccm.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/misc/imx25_ccm.c b/hw/misc/imx25_ccm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx25_ccm.c
+++ b/hw/misc/imx25_ccm.c
@@ -XXX,XX +XXX,XX @@ static const char *imx25_ccm_reg_name(uint32_t reg)
     case IMX25_CCM_LPIMR1_REG:
         return "lpimr1";
     default:
-        sprintf(unknown, "[%d ?]", reg);
+        sprintf(unknown, "[%u ?]", reg);
         return unknown;
     }
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_mpll_clk(IMXCCMState *dev)
         freq = imx_ccm_calc_pll(s->reg[IMX25_CCM_MPCTL_REG], CKIH_FREQ);
     }
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_mcu_clk(IMXCCMState *dev)
 
     freq = freq / (1 + EXTRACT(s->reg[IMX25_CCM_CCTL_REG], ARM_CLK_DIV));
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_ahb_clk(IMXCCMState *dev)
     freq = imx25_ccm_get_mcu_clk(dev)
            / (1 + EXTRACT(s->reg[IMX25_CCM_CCTL_REG], AHB_CLK_DIV));
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_ipg_clk(IMXCCMState *dev)
 
     freq = imx25_ccm_get_ahb_clk(dev) / 2;
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx25_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
         break;
     }
 
-    DPRINTF("Clock = %d) = %d\n", clock, freq);
+    DPRINTF("Clock = %d) = %u\n", clock, freq);
 
     return freq;
 }
-- 
2.20.1

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201126111109.112238-3-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/imx31_ccm.c | 14 +++++++-------
 hw/misc/imx_ccm.c   |  4 ++--
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/misc/imx31_ccm.c b/hw/misc/imx31_ccm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx31_ccm.c
+++ b/hw/misc/imx31_ccm.c
@@ -XXX,XX +XXX,XX @@ static const char *imx31_ccm_reg_name(uint32_t reg)
     case IMX31_CCM_PDR2_REG:
         return "PDR2";
     default:
-        sprintf(unknown, "[%d ?]", reg);
+        sprintf(unknown, "[%u ?]", reg);
         return unknown;
     }
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_pll_ref_clk(IMXCCMState *dev)
         freq = CKIH_FREQ;
     }
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_mpll_clk(IMXCCMState *dev)
     freq = imx_ccm_calc_pll(s->reg[IMX31_CCM_MPCTL_REG],
                             imx31_ccm_get_pll_ref_clk(dev));
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_mcu_main_clk(IMXCCMState *dev)
         freq = imx31_ccm_get_mpll_clk(dev);
     }
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_hclk_clk(IMXCCMState *dev)
     freq = imx31_ccm_get_mcu_main_clk(dev)
            / (1 + EXTRACT(s->reg[IMX31_CCM_PDR0_REG], MAX));
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_ipg_clk(IMXCCMState *dev)
     freq = imx31_ccm_get_hclk_clk(dev)
            / (1 + EXTRACT(s->reg[IMX31_CCM_PDR0_REG], IPG));
 
-    DPRINTF("freq = %d\n", freq);
+    DPRINTF("freq = %u\n", freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx31_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
         break;
     }
 
-    DPRINTF("Clock = %d) = %d\n", clock, freq);
+    DPRINTF("Clock = %d) = %u\n", clock, freq);
 
     return freq;
 }
diff --git a/hw/misc/imx_ccm.c b/hw/misc/imx_ccm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx_ccm.c
+++ b/hw/misc/imx_ccm.c
@@ -XXX,XX +XXX,XX @@ uint32_t imx_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
         freq = klass->get_clock_frequency(dev, clock);
     }
 
-    DPRINTF("(clock = %d) = %d\n", clock, freq);
+    DPRINTF("(clock = %d) = %u\n", clock, freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ uint32_t imx_ccm_calc_pll(uint32_t pllreg, uint32_t base_freq)
     freq = ((2 * (base_freq >> 10) * (mfi * mfd + mfn)) /
             (mfd * pd)) << 10;
 
-    DPRINTF("(pllreg = 0x%08x, base_freq = %d) = %d\n", pllreg, base_freq,
+    DPRINTF("(pllreg = 0x%08x, base_freq = %u) = %d\n", pllreg, base_freq,
             freq);
 
     return freq;
-- 
2.20.1

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201126111109.112238-4-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/imx6_ccm.c | 20 ++++++++++----------
 hw/misc/imx6_src.c |  2 +-
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx6_ccm.c
+++ b/hw/misc/imx6_ccm.c
@@ -XXX,XX +XXX,XX @@ static const char *imx6_ccm_reg_name(uint32_t reg)
     case CCM_CMEOR:
         return "CMEOR";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
@@ -XXX,XX +XXX,XX @@ static const char *imx6_analog_reg_name(uint32_t reg)
     case USB_ANALOG_DIGPROG:
         return "USB_ANALOG_DIGPROG";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_clk(IMX6CCMState *dev)
         freq *= 20;
     }
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_pfd0_clk(IMX6CCMState *dev)
     freq = imx6_analog_get_pll2_clk(dev) * 18
            / EXTRACT(dev->analog[CCM_ANALOG_PFD_528], PFD0_FRAC);
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_pll2_pfd2_clk(IMX6CCMState *dev)
     freq = imx6_analog_get_pll2_clk(dev) * 18
            / EXTRACT(dev->analog[CCM_ANALOG_PFD_528], PFD2_FRAC);
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_analog_get_periph_clk(IMX6CCMState *dev)
         break;
     }
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_ahb_clk(IMX6CCMState *dev)
     freq = imx6_analog_get_periph_clk(dev)
            / (1 + EXTRACT(dev->ccm[CCM_CBCDR], AHB_PODF));
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_ipg_clk(IMX6CCMState *dev)
     freq = imx6_ccm_get_ahb_clk(dev)
            / (1 + EXTRACT(dev->ccm[CCM_CBCDR], IPG_PODF));
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint64_t imx6_ccm_get_per_clk(IMX6CCMState *dev)
     freq = imx6_ccm_get_ipg_clk(dev)
            / (1 + EXTRACT(dev->ccm[CCM_CSCMR1], PERCLK_PODF));
 
-    DPRINTF("freq = %d\n", (uint32_t)freq);
+    DPRINTF("freq = %u\n", (uint32_t)freq);
 
     return freq;
 }
@@ -XXX,XX +XXX,XX @@ static uint32_t imx6_ccm_get_clock_frequency(IMXCCMState *dev, IMXClk clock)
         break;
     }
 
-    DPRINTF("Clock = %d) = %d\n", clock, freq);
+    DPRINTF("Clock = %d) = %u\n", clock, freq);
 
     return freq;
 }
diff --git a/hw/misc/imx6_src.c b/hw/misc/imx6_src.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx6_src.c
+++ b/hw/misc/imx6_src.c
@@ -XXX,XX +XXX,XX @@ static const char *imx6_src_reg_name(uint32_t reg)
     case SRC_GPR10:
         return "SRC_GPR10";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
-- 
2.20.1

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201126111109.112238-5-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/imx6ul_ccm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/imx6ul_ccm.c b/hw/misc/imx6ul_ccm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/imx6ul_ccm.c
+++ b/hw/misc/imx6ul_ccm.c
@@ -XXX,XX +XXX,XX @@ static const char *imx6ul_ccm_reg_name(uint32_t reg)
     case CCM_CMEOR:
         return "CMEOR";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
@@ -XXX,XX +XXX,XX @@ static const char *imx6ul_analog_reg_name(uint32_t reg)
     case USB_ANALOG_DIGPROG:
         return "USB_ANALOG_DIGPROG";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
-- 
2.20.1

For M-profile CPUs, the range from 0xe0000000 to 0xe00fffff is the
Private Peripheral Bus range, which includes all of the memory mapped
devices and registers that are part of the CPU itself, including the
NVIC, systick timer, and debug and trace components like the Data
Watchpoint and Trace unit (DWT).  Within this large region, the range
0xe000e000 to 0xe000efff is the System Control Space (NVIC, system
registers, systick) and 0xe002e000 to 0exe002efff is its Non-secure
alias.

The architecture is clear that within the SCS unimplemented registers
should be RES0 for privileged accesses and generate BusFault for
unprivileged accesses, and we currently implement this.

It is less clear about how to handle accesses to unimplemented
regions of the wider PPB.  Unprivileged accesses should definitely
cause BusFaults (R_DQQS), but the behaviour of privileged accesses is
not given as a general rule.  However, the register definitions of
individual registers for components like the DWT all state that they
are RES0 if the relevant component is not implemented, so the
simplest way to provide that is to provide RAZ/WI for the whole range
for privileged accesses.  (The v7M Arm ARM does say that reserved
registers should be UNK/SBZP.)

Expand the container MemoryRegion that the NVIC exposes so that
it covers the whole PPB space. This means:
 * moving the address that the ARMV7M device maps it to down by
   0xe000 bytes
 * moving the off and the offsets within the container of all the
   subregions forward by 0xe000 bytes
 * adding a new default MemoryRegion that covers the whole container
   at a lower priority than anything else and which provides the
   RAZWI/BusFault behaviour

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-2-peter.maydell@linaro.org
---
 include/hw/intc/armv7m_nvic.h |  1 +
 hw/arm/armv7m.c               |  2 +-
 hw/intc/armv7m_nvic.c         | 78 ++++++++++++++++++++++++++++++-----
 3 files changed, 69 insertions(+), 12 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/armv7m_nvic.h
+++ b/include/hw/intc/armv7m_nvic.h
@@ -XXX,XX +XXX,XX @@ struct NVICState {
     MemoryRegion systickmem;
     MemoryRegion systick_ns_mem;
     MemoryRegion container;
+    MemoryRegion defaultmem;
 
     uint32_t num_irq;
     qemu_irq excpout;
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(sbd, 0,
                        qdev_get_gpio_in(DEVICE(s->cpu), ARM_CPU_IRQ));
 
-    memory_region_add_subregion(&s->container, 0xe000e000,
+    memory_region_add_subregion(&s->container, 0xe0000000,
                                 sysbus_mmio_get_region(sbd, 0));
 
     for (i = 0; i < ARRAY_SIZE(s->bitband); i++) {
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvic_systick_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
+/*
+ * Unassigned portions of the PPB space are RAZ/WI for privileged
+ * accesses, and fault for non-privileged accesses.
+ */
+static MemTxResult ppb_default_read(void *opaque, hwaddr addr,
+                                    uint64_t *data, unsigned size,
+                                    MemTxAttrs attrs)
+{
+    qemu_log_mask(LOG_UNIMP, "Read of unassigned area of PPB: offset 0x%x\n",
+                  (uint32_t)addr);
+    if (attrs.user) {
+        return MEMTX_ERROR;
+    }
+    *data = 0;
+    return MEMTX_OK;
+}
+
+static MemTxResult ppb_default_write(void *opaque, hwaddr addr,
+                                     uint64_t value, unsigned size,
+                                     MemTxAttrs attrs)
+{
+    qemu_log_mask(LOG_UNIMP, "Write of unassigned area of PPB: offset 0x%x\n",
+                  (uint32_t)addr);
+    if (attrs.user) {
+        return MEMTX_ERROR;
+    }
+    return MEMTX_OK;
+}
+
+static const MemoryRegionOps ppb_default_ops = {
+    .read_with_attrs = ppb_default_read,
+    .write_with_attrs = ppb_default_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 8,
+};
+
 static int nvic_post_load(void *opaque, int version_id)
 {
     NVICState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static void nvic_systick_trigger(void *opaque, int n, int level)
 static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
 {
     NVICState *s = NVIC(dev);
-    int regionlen;
 
     /* The armv7m container object will have set our CPU pointer */
     if (!s->cpu || !arm_feature(&s->cpu->env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
                                                   M_REG_S));
     }
 
-    /* The NVIC and System Control Space (SCS) starts at 0xe000e000
+    /*
+     * This device provides a single sysbus memory region which
+     * represents the whole of the "System PPB" space. This is the
+     * range from 0xe0000000 to 0xe00fffff and includes the NVIC,
+     * the System Control Space (system registers), the systick timer,
+     * and for CPUs with the Security extension an NS banked version
+     * of all of these.
+     *
+     * The default behaviour for unimplemented registers/ranges
+     * (for instance the Data Watchpoint and Trace unit at 0xe0001000)
+     * is to RAZ/WI for privileged access and BusFault for non-privileged
+     * access.
+     *
+     * The NVIC and System Control Space (SCS) starts at 0xe000e000
      * and looks like this:
      *  0x004 - ICTR
      *  0x010 - 0xff - systick
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp)
      * generally code determining which banked register to use should
      * use attrs.secure; code determining actual behaviour of the system
      * should use env->v7m.secure.
+     *
+     * The container covers the whole PPB space. Within it the priority
+     * of overlapping regions is:
+     *  - default region (for RAZ/WI and BusFault) : -1
+     *  - system register regions : 0
+     *  - systick : 1
+     * This is because the systick device is a small block of registers
+     * in the middle of the other system control registers.
      */
-    regionlen = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? 0x21000 : 0x1000;
-    memory_region_init(&s->container, OBJECT(s), "nvic", regionlen);
-    /* The system register region goes at the bottom of the priority
-     * stack as it covers the whole page.
-     */
+    memory_region_init(&s->container, OBJECT(s), "nvic", 0x100000);
+    memory_region_init_io(&s->defaultmem, OBJECT(s), &ppb_default_ops, s,
+                          "nvic-default", 0x100000);
+    memory_region_add_subregion_overlap(&s->container, 0, &s->defaultmem, -1);
     memory_region_init_io(&s->sysregmem, OBJECT(s), &nvic_sysreg_ops, s,
                           "nvic_sysregs", 0x1000);
-    memory_region_add_subregion(&s->container, 0, &s->sysregmem);
+    memory_region_add_subregion(&s->container, 0xe000, &s->sysregmem);
 
     memory_region_init_io(&s->systickmem, OBJECT(s),
                           &nvic_systick_ops, s,
                           "nvic_systick", 0xe0);
 
-    memory_region_add_subregion_overlap(&s->container, 0x10,
+    memory_region_add_subregion_overlap(&s->container, 0xe010,
                                         &s->systickmem, 1);
 
     if (arm_feature(&s->cpu->env, ARM_FEATURE_V8)) {
         memory_region_init_io(&s->sysreg_ns_mem, OBJECT(s),
                               &nvic_sysreg_ns_ops, &s->sysregmem,
                               "nvic_sysregs_ns", 0x1000);
-        memory_region_add_subregion(&s->container, 0x20000, &s->sysreg_ns_mem);
+        memory_region_add_subregion(&s->container, 0x2e000, &s->sysreg_ns_mem);
         memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
                               &nvic_sysreg_ns_ops, &s->systickmem,
                               "nvic_systick_ns", 0xe0);
-        memory_region_add_subregion_overlap(&s->container, 0x20010,
+        memory_region_add_subregion_overlap(&s->container, 0x2e010,
                                             &s->systick_ns_mem, 1);
     }
 
-- 
2.20.1

In v8.1M the PXN architecture extension adds a new PXN bit to the
MPU_RLAR registers, which forbids execution of code in the region
from a privileged mode.

This is another feature which is just in the generic "in v8.1M" set
and has no ID register field indicating its presence.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-3-peter.maydell@linaro.org
---
 target/arm/helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
     } else {
         uint32_t ap = extract32(env->pmsav8.rbar[secure][matchregion], 1, 2);
         uint32_t xn = extract32(env->pmsav8.rbar[secure][matchregion], 0, 1);
+        bool pxn = false;
+
+        if (arm_feature(env, ARM_FEATURE_V8_1M)) {
+            pxn = extract32(env->pmsav8.rlar[secure][matchregion], 4, 1);
+        }
 
         if (m_is_system_region(env, address)) {
             /* System space is always execute never */
@@ -XXX,XX +XXX,XX @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
         }
 
         *prot = simple_ap_to_rw_prot(env, mmu_idx, ap);
-        if (*prot && !xn) {
+        if (*prot && !xn && !(pxn && !is_user)) {
             *prot |= PAGE_EXEC;
         }
         /* We don't need to look the attribute up in the MAIR0/MAIR1
-- 
2.20.1

In arm_cpu_realizefn() we check whether the board code disabled EL3
via the has_el3 CPU object property, which we create if the CPU
starts with the ARM_FEATURE_EL3 feature bit.  If it is disabled, then
we turn off ARM_FEATURE_EL3 and also zero out the relevant fields in
the ID_PFR1 and ID_AA64PFR0 registers.

This codepath was incorrectly being taken for M-profile CPUs, which
do not have an EL3 and don't set ARM_FEATURE_EL3, but which may have
the M-profile Security extension and so should have non-zero values
in the ID_PFR1.Security field.

Restrict the handling of the feature flag to A/R-profile cores.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-4-peter.maydell@linaro.org
---
 target/arm/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
-    if (!cpu->has_el3) {
+    if (!arm_feature(env, ARM_FEATURE_M) && !cpu->has_el3) {
         /* If the has_el3 CPU property is disabled then we need to disable the
          * feature.
          */
-- 
2.20.1

Implement the v8.1M VSCCLRM insn, which zeros floating point
registers if there is an active floating point context.
This requires support in write_neon_element32() for the MO_32
element size, so add it.

Because we want to use arm_gen_condlabel(), we need to move
the definition of that function up in translate.c so it is
before the #include of translate-vfp.c.inc.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-5-peter.maydell@linaro.org
---
 target/arm/cpu.h               |  9 ++++
 target/arm/m-nocp.decode       |  8 +++-
 target/arm/translate.c         | 21 +++++----
 target/arm/translate-vfp.c.inc | 84 ++++++++++++++++++++++++++++++++++
 4 files changed, 111 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
     return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
 }
 
+static inline bool isar_feature_aa32_m_sec_state(const ARMISARegisters *id)
+{
+    /*
+     * Return true if M-profile state handling insns
+     * (VSCCLRM, CLRM, FPCTX access insns) are implemented
+     */
+    return FIELD_EX32(id->id_pfr1, ID_PFR1, SECURITY) >= 3;
+}
+
 static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
 {
     /* Sadly this is encoded differently for A-profile and M-profile */
diff --git a/target/arm/m-nocp.decode b/target/arm/m-nocp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m-nocp.decode
+++ b/target/arm/m-nocp.decode
@@ -XXX,XX +XXX,XX @@
 # If the coprocessor is not present or disabled then we will generate
 # the NOCP exception; otherwise we let the insn through to the main decode.
 
+%vd_dp  22:1 12:4
+%vd_sp  12:4 22:1
+
 &nocp cp
 
 {
   # Special cases which do not take an early NOCP: VLLDM and VLSTM
   VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
-  # TODO: VSCCLRM (new in v8.1M) is similar:
-  #VSCCLRM      1110 1100 1-01 1111 ---- 1011 ---- ---0
+  # VSCCLRM (new in v8.1M) is similar:
+  VSCCLRM      1110 1100 1.01 1111 .... 1011 imm:7 0   vd=%vd_dp size=3
+  VSCCLRM      1110 1100 1.01 1111 .... 1010 imm:8     vd=%vd_sp size=2
 
   NOCP         111- 1110 ---- ---- ---- cp:4 ---- ---- &nocp
   NOCP         111- 110- ---- ---- ---- cp:4 ---- ---- &nocp
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
     a64_translate_init();
 }
 
+/* Generate a label used for skipping this instruction */
+static void arm_gen_condlabel(DisasContext *s)
+{
+    if (!s->condjmp) {
+        s->condlabel = gen_new_label();
+        s->condjmp = 1;
+    }
+}
+
 /* Flags for the disas_set_da_iss info argument:
  * lower bits hold the Rt register number, higher bits are flags.
  */
@@ -XXX,XX +XXX,XX @@ static void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
     long off = neon_element_offset(reg, ele, memop);
 
     switch (memop) {
+    case MO_32:
+        tcg_gen_st32_i64(src, cpu_env, off);
+        break;
     case MO_64:
         tcg_gen_st_i64(src, cpu_env, off);
         break;
@@ -XXX,XX +XXX,XX @@ static void gen_srs(DisasContext *s,
     s->base.is_jmp = DISAS_UPDATE_EXIT;
 }
 
-/* Generate a label used for skipping this instruction */
-static void arm_gen_condlabel(DisasContext *s)
-{
-    if (!s->condjmp) {
-        s->condlabel = gen_new_label();
-        s->condjmp = 1;
-    }
-}
-
 /* Skip this instruction if the ARM condition is false */
 static void arm_skip_unless(DisasContext *s, uint32_t cond)
 {
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
     return true;
 }
 
+static bool trans_VSCCLRM(DisasContext *s, arg_VSCCLRM *a)
+{
+    int btmreg, topreg;
+    TCGv_i64 zero;
+    TCGv_i32 aspen, sfpa;
+
+    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+        /* Before v8.1M, fall through in decode to NOCP check */
+        return false;
+    }
+
+    /* Explicitly UNDEF because this takes precedence over NOCP */
+    if (!arm_dc_feature(s, ARM_FEATURE_M_MAIN) || !s->v8m_secure) {
+        unallocated_encoding(s);
+        return true;
+    }
+
+    if (!dc_isar_feature(aa32_vfp_simd, s)) {
+        /* NOP if we have neither FP nor MVE */
+        return true;
+    }
+
+    /*
+     * If FPCCR.ASPEN != 0 && CONTROL_S.SFPA == 0 then there is no
+     * active floating point context so we must NOP (without doing
+     * any lazy state preservation or the NOCP check).
+     */
+    aspen = load_cpu_field(v7m.fpccr[M_REG_S]);
+    sfpa = load_cpu_field(v7m.control[M_REG_S]);
+    tcg_gen_andi_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_xori_i32(aspen, aspen, R_V7M_FPCCR_ASPEN_MASK);
+    tcg_gen_andi_i32(sfpa, sfpa, R_V7M_CONTROL_SFPA_MASK);
+    tcg_gen_or_i32(sfpa, sfpa, aspen);
+    arm_gen_condlabel(s);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, sfpa, 0, s->condlabel);
+
+    if (s->fp_excp_el != 0) {
+        gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                           syn_uncategorized(), s->fp_excp_el);
+        return true;
+    }
+
+    topreg = a->vd + a->imm - 1;
+    btmreg = a->vd;
+
+    /* Convert to Sreg numbers if the insn specified in Dregs */
+    if (a->size == 3) {
+        topreg = topreg * 2 + 1;
+        btmreg *= 2;
+    }
+
+    if (topreg > 63 || (topreg > 31 && !(topreg & 1))) {
+        /* UNPREDICTABLE: we choose to undef */
+        unallocated_encoding(s);
+        return true;
+    }
+
+    /* Silently ignore requests to clear D16-D31 if they don't exist */
+    if (topreg > 31 && !dc_isar_feature(aa32_simd_r32, s)) {
+        topreg = 31;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    /* Zero the Sregs from btmreg to topreg inclusive. */
+    zero = tcg_const_i64(0);
+    if (btmreg & 1) {
+        write_neon_element64(zero, btmreg >> 1, 1, MO_32);
+        btmreg++;
+    }
+    for (; btmreg + 1 <= topreg; btmreg += 2) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_64);
+    }
+    if (btmreg == topreg) {
+        write_neon_element64(zero, btmreg >> 1, 0, MO_32);
+        btmreg++;
+    }
+    assert(btmreg == topreg + 1);
+    /* TODO: when MVE is implemented, zero VPR here */
+    return true;
+}
+
 static bool trans_NOCP(DisasContext *s, arg_nocp *a)
 {
     /*
-- 
2.20.1

In v8.1M the new CLRM instruction allows zeroing an arbitrary set of
the general-purpose registers and APSR.  Implement this.

The encoding is a subset of the LDMIA T2 encoding, using what would
be Rn=0b1111 (which UNDEFs for LDMIA).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-6-peter.maydell@linaro.org
---
 target/arm/t32.decode  |  6 +++++-
 target/arm/translate.c | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/target/arm/t32.decode b/target/arm/t32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/t32.decode
+++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@ UXTAB            1111 1010 0101 .... 1111 .... 10.. ....      @rrr_rot
 
 STM_t32          1110 1000 10.0 .... ................         @ldstm i=1 b=0
 STM_t32          1110 1001 00.0 .... ................         @ldstm i=0 b=1
-LDM_t32          1110 1000 10.1 .... ................         @ldstm i=1 b=0
+{
+  # Rn=15 UNDEFs for LDM; M-profile CLRM uses that encoding
+  CLRM           1110 1000 1001 1111 list:16
+  LDM_t32        1110 1000 10.1 .... ................         @ldstm i=1 b=0
+}
 LDM_t32          1110 1001 00.1 .... ................         @ldstm i=0 b=1
 
 &rfe             !extern rn w pu
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LDM_t16(DisasContext *s, arg_ldst_block *a)
     return do_ldm(s, a, 1);
 }
 
+static bool trans_CLRM(DisasContext *s, arg_CLRM *a)
+{
+    int i;
+    TCGv_i32 zero;
+
+    if (!dc_isar_feature(aa32_m_sec_state, s)) {
+        return false;
+    }
+
+    if (extract32(a->list, 13, 1)) {
+        return false;
+    }
+
+    if (!a->list) {
+        /* UNPREDICTABLE; we choose to UNDEF */
+        return false;
+    }
+
+    zero = tcg_const_i32(0);
+    for (i = 0; i < 15; i++) {
+        if (extract32(a->list, i, 1)) {
+            /* Clear R[i] */
+            tcg_gen_mov_i32(cpu_R[i], zero);
+        }
+    }
+    if (extract32(a->list, 15, 1)) {
+        /*
+         * Clear APSR (by calling the MSR helper with the same argument
+         * as for "MSR APSR_nzcvqg, Rn": mask = 0b1100, SYSM=0)
+         */
+        TCGv_i32 maskreg = tcg_const_i32(0xc << 8);
+        gen_helper_v7m_msr(cpu_env, maskreg, zero);
+        tcg_temp_free_i32(maskreg);
+    }
+    tcg_temp_free_i32(zero);
+    return true;
+}
+
 /*
  * Branch, branch with link
  */
-- 
2.20.1

For M-profile before v8.1M, the only valid register for VMSR/VMRS is
the FPSCR.  We have a comment that states this, but the actual logic
to forbid accesses for any other register value is missing, so we
would end up with A-profile style behaviour.  Add the missing check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-7-peter.maydell@linaro.org
---
 target/arm/translate-vfp.c.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
          * Accesses to R15 are UNPREDICTABLE; we choose to undef.
          * (FPSCR -> r15 is a special case which writes to the PSR flags.)
          */
-        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
+        if (a->reg != ARM_VFP_FPSCR) {
+            return false;
+        }
+        if (a->rt == 15 && !a->l) {
             return false;
         }
     }
-- 
2.20.1

Currently M-profile borrows the A-profile code for VMSR and VMRS
(access to the FP system registers), because all it needs to support
is the FPSCR.  In v8.1M things become significantly more complicated
in two ways:

* there are several new FP system registers; some have side effects
   on read, and one (FPCXT_NS) needs to avoid the usual
   vfp_access_check() and the "only if FPU implemented" check

* all sysregs are now accessible both by VMRS/VMSR (which
   reads/writes a general purpose register) and also by VLDR/VSTR
   (which reads/writes them directly to memory)

Refactor the structure of how we handle VMSR/VMRS to cope with this:

* keep the M-profile code entirely separate from the A-profile code

* abstract out the "read or write the general purpose register" part
   of the code into a loadfn or storefn function pointer, so we can
   reuse it for VLDR/VSTR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-8-peter.maydell@linaro.org
---
 target/arm/cpu.h               |   3 +
 target/arm/translate-vfp.c.inc | 182 ++++++++++++++++++++++++++++++---
 2 files changed, 171 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_cpu_mode {
 #define ARM_VFP_FPINST  9
 #define ARM_VFP_FPINST2 10
 
+/* QEMU-internal value meaning "FPSCR, but we care only about NZCV" */
+#define QEMU_VFP_FPSCR_NZCV 0xffff
+
 /* iwMMXt coprocessor control registers.  */
 #define ARM_IWMMXT_wCID  0
 #define ARM_IWMMXT_wCon  1
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
     return true;
 }
 
+/*
+ * M-profile provides two different sets of instructions that can
+ * access floating point system registers: VMSR/VMRS (which move
+ * to/from a general purpose register) and VLDR/VSTR sysreg (which
+ * move directly to/from memory). In some cases there are also side
+ * effects which must happen after any write to memory (which could
+ * cause an exception). So we implement the common logic for the
+ * sysreg access in gen_M_fp_sysreg_write() and gen_M_fp_sysreg_read(),
+ * which take pointers to callback functions which will perform the
+ * actual "read/write general purpose register" and "read/write
+ * memory" operations.
+ */
+
+/*
+ * Emit code to store the sysreg to its final destination; frees the
+ * TCG temp 'value' it is passed.
+ */
+typedef void fp_sysreg_storefn(DisasContext *s, void *opaque, TCGv_i32 value);
+/*
+ * Emit code to load the value to be copied to the sysreg; returns
+ * a new TCG temporary
+ */
+typedef TCGv_i32 fp_sysreg_loadfn(DisasContext *s, void *opaque);
+
+/* Common decode/access checks for fp sysreg read/write */
+typedef enum FPSysRegCheckResult {
+    FPSysRegCheckFailed, /* caller should return false */
+    FPSysRegCheckDone, /* caller should return true */
+    FPSysRegCheckContinue, /* caller should continue generating code */
+} FPSysRegCheckResult;
+
+static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
+{
+    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
+        return FPSysRegCheckFailed;
+    }
+
+    switch (regno) {
+    case ARM_VFP_FPSCR:
+    case QEMU_VFP_FPSCR_NZCV:
+        break;
+    default:
+        return FPSysRegCheckFailed;
+    }
+
+    if (!vfp_access_check(s)) {
+        return FPSysRegCheckDone;
+    }
+
+    return FPSysRegCheckContinue;
+}
+
+static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
+
+                                  fp_sysreg_loadfn *loadfn,
+                                 void *opaque)
+{
+    /* Do a write to an M-profile floating point system register */
+    TCGv_i32 tmp;
+
+    switch (fp_sysreg_checks(s, regno)) {
+    case FPSysRegCheckFailed:
+        return false;
+    case FPSysRegCheckDone:
+        return true;
+    case FPSysRegCheckContinue:
+        break;
+    }
+
+    switch (regno) {
+    case ARM_VFP_FPSCR:
+        tmp = loadfn(s, opaque);
+        gen_helper_vfp_set_fpscr(cpu_env, tmp);
+        tcg_temp_free_i32(tmp);
+        gen_lookup_tb(s);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return true;
+}
+
+static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
+                                fp_sysreg_storefn *storefn,
+                                void *opaque)
+{
+    /* Do a read from an M-profile floating point system register */
+    TCGv_i32 tmp;
+
+    switch (fp_sysreg_checks(s, regno)) {
+    case FPSysRegCheckFailed:
+        return false;
+    case FPSysRegCheckDone:
+        return true;
+    case FPSysRegCheckContinue:
+        break;
+    }
+
+    switch (regno) {
+    case ARM_VFP_FPSCR:
+        tmp = tcg_temp_new_i32();
+        gen_helper_vfp_get_fpscr(tmp, cpu_env);
+        storefn(s, opaque, tmp);
+        break;
+    case QEMU_VFP_FPSCR_NZCV:
+        /*
+         * Read just NZCV; this is a special case to avoid the
+         * helper call for the "VMRS to CPSR.NZCV" insn.
+         */
+        tmp = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_gen_andi_i32(tmp, tmp, 0xf0000000);
+        storefn(s, opaque, tmp);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return true;
+}
+
+static void fp_sysreg_to_gpr(DisasContext *s, void *opaque, TCGv_i32 value)
+{
+    arg_VMSR_VMRS *a = opaque;
+
+    if (a->rt == 15) {
+        /* Set the 4 flag bits in the CPSR */
+        gen_set_nzcv(value);
+        tcg_temp_free_i32(value);
+    } else {
+        store_reg(s, a->rt, value);
+    }
+}
+
+static TCGv_i32 gpr_to_fp_sysreg(DisasContext *s, void *opaque)
+{
+    arg_VMSR_VMRS *a = opaque;
+
+    return load_reg(s, a->rt);
+}
+
+static bool gen_M_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
+{
+    /*
+     * Accesses to R15 are UNPREDICTABLE; we choose to undef.
+     * FPSCR -> r15 is a special case which writes to the PSR flags;
+     * set a->reg to a special value to tell gen_M_fp_sysreg_read()
+     * we only care about the top 4 bits of FPSCR there.
+     */
+    if (a->rt == 15) {
+        if (a->l && a->reg == ARM_VFP_FPSCR) {
+            a->reg = QEMU_VFP_FPSCR_NZCV;
+        } else {
+            return false;
+        }
+    }
+
+    if (a->l) {
+        /* VMRS, move FP system register to gp register */
+        return gen_M_fp_sysreg_read(s, a->reg, fp_sysreg_to_gpr, a);
+    } else {
+        /* VMSR, move gp register to FP system register */
+        return gen_M_fp_sysreg_write(s, a->reg, gpr_to_fp_sysreg, a);
+    }
+}
+
 static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
 {
     TCGv_i32 tmp;
     bool ignore_vfp_enabled = false;
 
-    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
-        return false;
+    if (arm_dc_feature(s, ARM_FEATURE_M)) {
+        return gen_M_VMSR_VMRS(s, a);
     }
 
-    if (arm_dc_feature(s, ARM_FEATURE_M)) {
-        /*
-         * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
-         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
-         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
-         */
-        if (a->reg != ARM_VFP_FPSCR) {
-            return false;
-        }
-        if (a->rt == 15 && !a->l) {
-            return false;
-        }
+    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
+        return false;
     }
 
     switch (a->reg) {
-- 
2.20.1

The constant-expander functions like negate, plus_2, etc, are
generally useful; move them up in translate.c so we can use them in
the VFP/Neon decoders as well as in the A32/T32/T16 decoders.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-9-peter.maydell@linaro.org
---
 target/arm/translate.c | 46 +++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_gen_condlabel(DisasContext *s)
     }
 }
 
+/*
+ * Constant expanders for the decoders.
+ */
+
+static int negate(DisasContext *s, int x)
+{
+    return -x;
+}
+
+static int plus_2(DisasContext *s, int x)
+{
+    return x + 2;
+}
+
+static int times_2(DisasContext *s, int x)
+{
+    return x * 2;
+}
+
+static int times_4(DisasContext *s, int x)
+{
+    return x * 4;
+}
+
 /* Flags for the disas_set_da_iss info argument:
  * lower bits hold the Rt register number, higher bits are flags.
  */
@@ -XXX,XX +XXX,XX @@ static void arm_skip_unless(DisasContext *s, uint32_t cond)
 
 
 /*
- * Constant expanders for the decoders.
+ * Constant expanders used by T16/T32 decode
  */
 
-static int negate(DisasContext *s, int x)
-{
-    return -x;
-}
-
-static int plus_2(DisasContext *s, int x)
-{
-    return x + 2;
-}
-
-static int times_2(DisasContext *s, int x)
-{
-    return x * 2;
-}
-
-static int times_4(DisasContext *s, int x)
-{
-    return x * 4;
-}
-
 /* Return only the rotation part of T32ExpandImm.  */
 static int t32_expandimm_rot(DisasContext *s, int x)
 {
-- 
2.20.1

Implement the new-in-v8.1M VLDR/VSTR variants which directly
read or write FP system registers to memory.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-10-peter.maydell@linaro.org
---
 target/arm/vfp.decode          | 14 ++++++
 target/arm/translate-vfp.c.inc | 91 ++++++++++++++++++++++++++++++++++
 2 files changed, 105 insertions(+)

diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp.decode
+++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@ VLDR_VSTR_hp ---- 1101 u:1 .0 l:1 rn:4 .... 1001 imm:8      vd=%vd_sp
 VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
 VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
 
+# M-profile VLDR/VSTR to sysreg
+%vldr_sysreg 22:1 13:3
+%imm7_0x4 0:7 !function=times_4
+
+&vldr_sysreg rn reg imm a w p
+@vldr_sysreg .... ... . a:1 . . . rn:4 ... . ... .. ....... \
+             reg=%vldr_sysreg imm=%imm7_0x4 &vldr_sysreg
+
+# P=0 W=0 is SEE "Related encodings", so split into two patterns
+VLDR_sysreg  ---- 110 1 . . w:1 1 .... ... 0 111 11 ....... @vldr_sysreg p=1
+VLDR_sysreg  ---- 110 0 . . 1   1 .... ... 0 111 11 ....... @vldr_sysreg p=0 w=1
+VSTR_sysreg  ---- 110 1 . . w:1 0 .... ... 0 111 11 ....... @vldr_sysreg p=1
+VSTR_sysreg  ---- 110 0 . . 1   0 .... ... 0 111 11 ....... @vldr_sysreg p=0 w=1
+
 # We split the load/store multiple up into two patterns to avoid
 # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
 # grouping:
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
     return true;
 }
 
+static void fp_sysreg_to_memory(DisasContext *s, void *opaque, TCGv_i32 value)
+{
+    arg_vldr_sysreg *a = opaque;
+    uint32_t offset = a->imm;
+    TCGv_i32 addr;
+
+    if (!a->a) {
+        offset = - offset;
+    }
+
+    addr = load_reg(s, a->rn);
+    if (a->p) {
+        tcg_gen_addi_i32(addr, addr, offset);
+    }
+
+    if (s->v8m_stackcheck && a->rn == 13 && a->w) {
+        gen_helper_v8m_stackcheck(cpu_env, addr);
+    }
+
+    gen_aa32_st_i32(s, value, addr, get_mem_index(s),
+                    MO_UL | MO_ALIGN | s->be_data);
+    tcg_temp_free_i32(value);
+
+    if (a->w) {
+        /* writeback */
+        if (!a->p) {
+            tcg_gen_addi_i32(addr, addr, offset);
+        }
+        store_reg(s, a->rn, addr);
+    } else {
+        tcg_temp_free_i32(addr);
+    }
+}
+
+static TCGv_i32 memory_to_fp_sysreg(DisasContext *s, void *opaque)
+{
+    arg_vldr_sysreg *a = opaque;
+    uint32_t offset = a->imm;
+    TCGv_i32 addr;
+    TCGv_i32 value = tcg_temp_new_i32();
+
+    if (!a->a) {
+        offset = - offset;
+    }
+
+    addr = load_reg(s, a->rn);
+    if (a->p) {
+        tcg_gen_addi_i32(addr, addr, offset);
+    }
+
+    if (s->v8m_stackcheck && a->rn == 13 && a->w) {
+        gen_helper_v8m_stackcheck(cpu_env, addr);
+    }
+
+    gen_aa32_ld_i32(s, value, addr, get_mem_index(s),
+                    MO_UL | MO_ALIGN | s->be_data);
+
+    if (a->w) {
+        /* writeback */
+        if (!a->p) {
+            tcg_gen_addi_i32(addr, addr, offset);
+        }
+        store_reg(s, a->rn, addr);
+    } else {
+        tcg_temp_free_i32(addr);
+    }
+    return value;
+}
+
+static bool trans_VLDR_sysreg(DisasContext *s, arg_vldr_sysreg *a)
+{
+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+        return false;
+    }
+    if (a->rn == 15) {
+        return false;
+    }
+    return gen_M_fp_sysreg_write(s, a->reg, memory_to_fp_sysreg, a);
+}
+
+static bool trans_VSTR_sysreg(DisasContext *s, arg_vldr_sysreg *a)
+{
+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+        return false;
+    }
+    if (a->rn == 15) {
+        return false;
+    }
+    return gen_M_fp_sysreg_read(s, a->reg, fp_sysreg_to_memory, a);
+}
+
 static bool trans_VMOV_half(DisasContext *s, arg_VMOV_single *a)
 {
     TCGv_i32 tmp;
-- 
2.20.1

v8.1M defines a new FP system register FPSCR_nzcvqc; this behaves
like the existing FPSCR, except that it reads and writes only bits
[31:27] of the FPSCR (the N, Z, C, V and QC flag bits).  (Unlike the
FPSCR, the special case for Rt=15 of writing the CPSR.NZCV is not
permitted.)

Implement the register.  Since we don't yet implement MVE, we handle
the QC bit as RES0, with todo comments for where we will need to add
support later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-11-peter.maydell@linaro.org
---
 target/arm/cpu.h               | 13 +++++++++++++
 target/arm/translate-vfp.c.inc | 27 +++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
 #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
 #define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
+#define FPCR_V      (1 << 28)   /* FP overflow flag */
+#define FPCR_C      (1 << 29)   /* FP carry flag */
+#define FPCR_Z      (1 << 30)   /* FP zero flag */
+#define FPCR_N      (1 << 31)   /* FP negative flag */
+
+#define FPCR_NZCV_MASK (FPCR_N | FPCR_Z | FPCR_C | FPCR_V)
+#define FPCR_NZCVQC_MASK (FPCR_NZCV_MASK | FPCR_QC)
 
 static inline uint32_t vfp_get_fpsr(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ enum arm_cpu_mode {
 #define ARM_VFP_FPEXC   8
 #define ARM_VFP_FPINST  9
 #define ARM_VFP_FPINST2 10
+/* These ones are M-profile only */
+#define ARM_VFP_FPSCR_NZCVQC 2
+#define ARM_VFP_VPR 12
+#define ARM_VFP_P0 13
+#define ARM_VFP_FPCXT_NS 14
+#define ARM_VFP_FPCXT_S 15
 
 /* QEMU-internal value meaning "FPSCR, but we care only about NZCV" */
 #define QEMU_VFP_FPSCR_NZCV 0xffff
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
     case ARM_VFP_FPSCR:
     case QEMU_VFP_FPSCR_NZCV:
         break;
+    case ARM_VFP_FPSCR_NZCVQC:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+        break;
     default:
         return FPSysRegCheckFailed;
     }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         tcg_temp_free_i32(tmp);
         gen_lookup_tb(s);
         break;
+    case ARM_VFP_FPSCR_NZCVQC:
+    {
+        TCGv_i32 fpscr;
+        tmp = loadfn(s, opaque);
+        /*
+         * TODO: when we implement MVE, write the QC bit.
+         * For non-MVE, QC is RES0.
+         */
+        tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
+        fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_gen_andi_i32(fpscr, fpscr, ~FPCR_NZCV_MASK);
+        tcg_gen_or_i32(fpscr, fpscr, tmp);
+        store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_temp_free_i32(tmp);
+        break;
+    }
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
         gen_helper_vfp_get_fpscr(tmp, cpu_env);
         storefn(s, opaque, tmp);
         break;
+    case ARM_VFP_FPSCR_NZCVQC:
+        /*
+         * TODO: MVE has a QC bit, which we probably won't store
+         * in the xregs[] field. For non-MVE, where QC is RES0,
+         * we can just fall through to the FPSCR_NZCV case.
+         */
     case QEMU_VFP_FPSCR_NZCV:
         /*
          * Read just NZCV; this is a special case to avoid the
-- 
2.20.1

We defined a constant name for the mask of NZCV bits in the FPCR/FPSCR
in the previous commit; use it in a couple of places in existing code,
where we're masking out everything except NZCV for the "load to Rt=15
sets CPSR.NZCV" special case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-12-peter.maydell@linaro.org
---
 target/arm/translate-vfp.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Factor out the code which handles M-profile lazy FP state preservation
from full_vfp_access_check(); accesses to the FPCXT_NS register are
a special case which need to do just this part (corresponding in the
pseudocode to the PreserveFPState() function), and not the full
set of actions matching the pseudocode ExecuteFPCheck() which
normal FP instructions need to do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201119215617.29887-13-peter.maydell@linaro.org
---
 target/arm/translate-vfp.c.inc | 45 ++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static inline long vfp_f16_offset(unsigned reg, bool top)
     return offs;
 }
 
+/*
+ * Generate code for M-profile lazy FP state preservation if needed;
+ * this corresponds to the pseudocode PreserveFPState() function.
+ */
+static void gen_preserve_fp_state(DisasContext *s)
+{
+    if (s->v7m_lspact) {
+        /*
+         * Lazy state saving affects external memory and also the NVIC,
+         * so we must mark it as an IO operation for icount (and cause
+         * this to be the last insn in the TB).
+         */
+        if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+            s->base.is_jmp = DISAS_UPDATE_EXIT;
+            gen_io_start();
+        }
+        gen_helper_v7m_preserve_fp_state(cpu_env);
+        /*
+         * If the preserve_fp_state helper doesn't throw an exception
+         * then it will clear LSPACT; we don't need to repeat this for
+         * any further FP insns in this TB.
+         */
+        s->v7m_lspact = false;
+    }
+}
+
 /*
  * Check that VFP access is enabled. If it is, do the necessary
  * M-profile lazy-FP handling and then return true.
@@ -XXX,XX +XXX,XX @@ static bool full_vfp_access_check(DisasContext *s, bool ignore_vfp_enabled)
         /* Handle M-profile lazy FP state mechanics */
 
         /* Trigger lazy-state preservation if necessary */
-        if (s->v7m_lspact) {
-            /*
-             * Lazy state saving affects external memory and also the NVIC,
-             * so we must mark it as an IO operation for icount (and cause
-             * this to be the last insn in the TB).
-             */
-            if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
-                s->base.is_jmp = DISAS_UPDATE_EXIT;
-                gen_io_start();
-            }
-            gen_helper_v7m_preserve_fp_state(cpu_env);
-            /*
-             * If the preserve_fp_state helper doesn't throw an exception
-             * then it will clear LSPACT; we don't need to repeat this for
-             * any further FP insns in this TB.
-             */
-            s->v7m_lspact = false;
-        }
+        gen_preserve_fp_state(s);
 
         /* Update ownership of FP context: set FPCCR.S to match current state */
         if (s->v8m_fpccr_s_wrong) {
-- 
2.20.1

Implement the new-in-v8.1M FPCXT_S floating point system register.
This is for saving and restoring the secure floating point context,
and it reads and writes bits [27:0] from the FPSCR and the
CONTROL.SFPA bit in bit [31].

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-14-peter.maydell@linaro.org
---
 target/arm/translate-vfp.c.inc | 58 ++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
             return false;
         }
         break;
+    case ARM_VFP_FPCXT_S:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+        if (!s->v8m_secure) {
+            return false;
+        }
+        break;
     default:
         return FPSysRegCheckFailed;
     }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         tcg_temp_free_i32(tmp);
         break;
     }
+    case ARM_VFP_FPCXT_S:
+    {
+        TCGv_i32 sfpa, control, fpscr;
+        /* Set FPSCR[27:0] and CONTROL.SFPA from value */
+        tmp = loadfn(s, opaque);
+        sfpa = tcg_temp_new_i32();
+        tcg_gen_shri_i32(sfpa, tmp, 31);
+        control = load_cpu_field(v7m.control[M_REG_S]);
+        tcg_gen_deposit_i32(control, control, sfpa,
+                            R_V7M_CONTROL_SFPA_SHIFT, 1);
+        store_cpu_field(control, v7m.control[M_REG_S]);
+        fpscr = load_cpu_field(vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_gen_andi_i32(fpscr, fpscr, FPCR_NZCV_MASK);
+        tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
+        tcg_gen_or_i32(fpscr, fpscr, tmp);
+        store_cpu_field(fpscr, vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_temp_free_i32(tmp);
+        tcg_temp_free_i32(sfpa);
+        break;
+    }
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
         tcg_gen_andi_i32(tmp, tmp, FPCR_NZCV_MASK);
         storefn(s, opaque, tmp);
         break;
+    case ARM_VFP_FPCXT_S:
+    {
+        TCGv_i32 control, sfpa, fpscr;
+        /* Bits [27:0] from FPSCR, bit [31] from CONTROL.SFPA */
+        tmp = tcg_temp_new_i32();
+        sfpa = tcg_temp_new_i32();
+        gen_helper_vfp_get_fpscr(tmp, cpu_env);
+        tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
+        control = load_cpu_field(v7m.control[M_REG_S]);
+        tcg_gen_andi_i32(sfpa, control, R_V7M_CONTROL_SFPA_MASK);
+        tcg_gen_shli_i32(sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);
+        tcg_gen_or_i32(tmp, tmp, sfpa);
+        tcg_temp_free_i32(sfpa);
+        /*
+         * Store result before updating FPSCR etc, in case
+         * it is a memory write which causes an exception.
+         */
+        storefn(s, opaque, tmp);
+        /*
+         * Now we must reset FPSCR from FPDSCR_NS, and clear
+         * CONTROL.SFPA; so we'll end the TB here.
+         */
+        tcg_gen_andi_i32(control, control, ~R_V7M_CONTROL_SFPA_MASK);
+        store_cpu_field(control, v7m.control[M_REG_S]);
+        fpscr = load_cpu_field(v7m.fpdscr[M_REG_NS]);
+        gen_helper_vfp_set_fpscr(cpu_env, fpscr);
+        tcg_temp_free_i32(fpscr);
+        gen_lookup_tb(s);
+        break;
+    }
     default:
         g_assert_not_reached();
     }
-- 
2.20.1

The FPDSCR register has a similar layout to the FPSCR.  In v8.1M it
gains new fields FZ16 (if half-precision floating point is supported)
and LTPSIZE (always reads as 4).  Update the reset value and the code
that handles writes to this register accordingly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-16-peter.maydell@linaro.org
---
 target/arm/cpu.h      | 5 +++++
 hw/intc/armv7m_nvic.c | 9 ++++++++-
 target/arm/cpu.c      | 3 +++
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 #define FPCR_IXE    (1 << 12)   /* Inexact exception trap enable */
 #define FPCR_IDE    (1 << 15)   /* Input Denormal exception trap enable */
 #define FPCR_FZ16   (1 << 19)   /* ARMv8.2+, FP16 flush-to-zero */
+#define FPCR_RMODE_MASK (3 << 22) /* Rounding mode */
 #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
 #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
+#define FPCR_AHP    (1 << 26)   /* Alternative half-precision */
 #define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
 #define FPCR_V      (1 << 28)   /* FP overflow flag */
 #define FPCR_C      (1 << 29)   /* FP carry flag */
 #define FPCR_Z      (1 << 30)   /* FP zero flag */
 #define FPCR_N      (1 << 31)   /* FP negative flag */
 
+#define FPCR_LTPSIZE_SHIFT 16   /* LTPSIZE, M-profile only */
+#define FPCR_LTPSIZE_MASK (7 << FPCR_LTPSIZE_SHIFT)
+
 #define FPCR_NZCV_MASK (FPCR_N | FPCR_Z | FPCR_C | FPCR_V)
 #define FPCR_NZCVQC_MASK (FPCR_NZCV_MASK | FPCR_QC)
 
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         break;
     case 0xf3c: /* FPDSCR */
         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-            value &= 0x07c00000;
+            uint32_t mask = FPCR_AHP | FPCR_DN | FPCR_FZ | FPCR_RMODE_MASK;
+            if (cpu_isar_feature(any_fp16, cpu)) {
+                mask |= FPCR_FZ16;
+            }
+            value &= mask;
+            if (cpu_isar_feature(aa32_lob, cpu)) {
+                value |= 4 << FPCR_LTPSIZE_SHIFT;
+            }
             cpu->env.v7m.fpdscr[attrs.secure] = value;
         }
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
              * always reset to 4.
              */
             env->v7m.ltpsize = 4;
+            /* The LTPSIZE field in FPDSCR is constant and reads as 4. */
+            env->v7m.fpdscr[M_REG_NS] = 4 << FPCR_LTPSIZE_SHIFT;
+            env->v7m.fpdscr[M_REG_S] = 4 << FPCR_LTPSIZE_SHIFT;
         }
 
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-- 
2.20.1

In v8.0M, on exception entry the registers R0-R3, R12, APSR and EPSR
are zeroed for an exception taken to Non-secure state; for an
exception taken to Secure state they become UNKNOWN, and we chose to
leave them at their previous values.

In v8.1M the behaviour is specified more tightly and these registers
are always zeroed regardless of the security state that the exception
targets (see rule R_KPZV).  Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-17-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
          * Clear registers if necessary to prevent non-secure exception
          * code being able to see register values from secure code.
          * Where register values become architecturally UNKNOWN we leave
-         * them with their previous values.
+         * them with their previous values. v8.1M is tighter than v8.0M
+         * here and always zeroes the caller-saved registers regardless
+         * of the security state the exception is targeting.
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            if (!targets_secure) {
+            if (!targets_secure || arm_feature(env, ARM_FEATURE_V8_1M)) {
                 /*
                  * Always clear the caller-saved registers (they have been
                  * pushed to the stack earlier in v7m_push_stack()).
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
                  * v7m_push_callee_stack()).
                  */
                 int i;
+                /*
+                 * r4..r11 are callee-saves, zero only if background
+                 * state was Secure (EXCRET.S == 1) and exception
+                 * targets Non-secure state
+                 */
+                bool zero_callee_saves = !targets_secure &&
+                    (lr & R_V7M_EXCRET_S_MASK);
 
                 for (i = 0; i < 13; i++) {
-                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
-                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
+                    if (i < 4 || i > 11 || zero_callee_saves) {
                         env->regs[i] = 0;
                     }
                 }
-- 
2.20.1

In v8.1M, vector table fetch failures don't set HFSR.FORCED (see rule
R_LLRP).  (In previous versions of the architecture this was either
required or IMPDEF.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-18-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ load_fail:
      * The HardFault is Secure if BFHFNMINS is 0 (meaning that all HFs are
      * secure); otherwise it targets the same security state as the
      * underlying exception.
+     * In v8.1M HardFaults from vector table fetch fails don't set FORCED.
      */
     if (!(cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
         exc_secure = true;
     }
-    env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK | R_V7M_HFSR_FORCED_MASK;
+    env->v7m.hfsr |= R_V7M_HFSR_VECTTBL_MASK;
+    if (!arm_feature(env, ARM_FEATURE_V8_1M)) {
+        env->v7m.hfsr |= R_V7M_HFSR_FORCED_MASK;
+    }
     armv7m_nvic_set_pending_derived(env->nvic, ARMV7M_EXCP_HARD, exc_secure);
     return false;
 }
-- 
2.20.1

In v8.1M a REVIDR register is defined, which is at address 0xe00ecfc
and is a read-only IMPDEF register providing implementation specific
minor revision information, like the v8A REVIDR_EL1. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-19-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return val;
     }
+    case 0xcfc:
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8_1M)) {
+            goto bad_offset;
+        }
+        return cpu->revidr;
     case 0xd00: /* CPUID Base.  */
         return cpu->midr;
     case 0xd04: /* Interrupt Control State (ICSR) */
-- 
2.20.1

In v8.1M a new exception return check is added which may cause a NOCP
UsageFault (see rule R_XLTP): before we clear s0..s15 and the FPSCR
we must check whether access to CP10 from the Security state of the
returning exception is disabled; if it is then we must take a fault.

(Note that for our implementation CPPWR is always RAZ/WI and so can
never cause CP10 accesses to fail.)

The other v8.1M change to this register-clearing code is that if MVE
is implemented VPR must also be cleared, so add a TODO comment to
that effect.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-20-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
             v7m_exception_taken(cpu, excret, true, false);
             return;
         } else {
-            /* Clear s0..s15 and FPSCR */
+            if (arm_feature(env, ARM_FEATURE_V8_1M)) {
+                /* v8.1M adds this NOCP check */
+                bool nsacr_pass = exc_secure ||
+                    extract32(env->v7m.nsacr, 10, 1);
+                bool cpacr_pass = v7m_cpacr_pass(env, exc_secure, true);
+                if (!nsacr_pass) {
+                    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, true);
+                    env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_NOCP_MASK;
+                    qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                        "stackframe: NSACR prevents clearing FPU registers\n");
+                    v7m_exception_taken(cpu, excret, true, false);
+                } else if (!cpacr_pass) {
+                    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                            exc_secure);
+                    env->v7m.cfsr[exc_secure] |= R_V7M_CFSR_NOCP_MASK;
+                    qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                        "stackframe: CPACR prevents clearing FPU registers\n");
+                    v7m_exception_taken(cpu, excret, true, false);
+                }
+            }
+            /* Clear s0..s15 and FPSCR; TODO also VPR when MVE is implemented */
             int i;
 
             for (i = 0; i < 16; i += 2) {
-- 
2.20.1

v8.1M adds new encodings of VLLDM and VLSTM (where bit 7 is set).
The only difference is that:
 * the old T1 encodings UNDEF if the implementation implements 32
   Dregs (this is currently architecturally impossible for M-profile)
 * the new T2 encodings have the implementation-defined option to
   read from memory (discarding the data) or write UNKNOWN values to
   memory for the stack slots that would be D16-D31

We choose not to make those accesses, so for us the two
instructions behave identically assuming they don't UNDEF.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-21-peter.maydell@linaro.org
---
 target/arm/m-nocp.decode       |  2 +-
 target/arm/translate-vfp.c.inc | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/target/arm/m-nocp.decode b/target/arm/m-nocp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m-nocp.decode
+++ b/target/arm/m-nocp.decode
@@ -XXX,XX +XXX,XX @@
 
 {
   # Special cases which do not take an early NOCP: VLLDM and VLSTM
-  VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
+  VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 op:1 000 0000
   # VSCCLRM (new in v8.1M) is similar:
   VSCCLRM      1110 1100 1.01 1111 .... 1011 imm:7 0   vd=%vd_dp size=3
   VSCCLRM      1110 1100 1.01 1111 .... 1010 imm:8     vd=%vd_sp size=2
diff --git a/target/arm/translate-vfp.c.inc b/target/arm/translate-vfp.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c.inc
+++ b/target/arm/translate-vfp.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
         !arm_dc_feature(s, ARM_FEATURE_V8)) {
         return false;
     }
+
+    if (a->op) {
+        /*
+         * T2 encoding ({D0-D31} reglist): v8.1M and up. We choose not
+         * to take the IMPDEF option to make memory accesses to the stack
+         * slots that correspond to the D16-D31 registers (discarding
+         * read data and writing UNKNOWN values), so for us the T2
+         * encoding behaves identically to the T1 encoding.
+         */
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+    } else {
+        /*
+         * T1 encoding ({D0-D15} reglist); undef if we have 32 Dregs.
+         * This is currently architecturally impossible, but we add the
+         * check to stay in line with the pseudocode. Note that we must
+         * emit code for the UNDEF so it takes precedence over the NOCP.
+         */
+        if (dc_isar_feature(aa32_simd_r32, s)) {
+            unallocated_encoding(s);
+            return true;
+        }
+    }
+
     /*
      * If not secure, UNDEF. We must emit code for this
      * rather than returning false so that this takes
-- 
2.20.1

v8.1M introduces a new TRD flag in the CCR register, which enables
checking for stack frame integrity signatures on SG instructions.
This bit is not banked, and is always RAZ/WI to Non-secure code.
Adjust the code for handling CCR reads and writes to handle this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-23-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  2 ++
 hw/intc/armv7m_nvic.c | 26 ++++++++++++++++++--------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKOFHFNMIGN, 10, 1)
 FIELD(V7M_CCR, DC, 16, 1)
 FIELD(V7M_CCR, IC, 17, 1)
 FIELD(V7M_CCR, BP, 18, 1)
+FIELD(V7M_CCR, LOB, 19, 1)
+FIELD(V7M_CCR, TRD, 20, 1)
 
 /* V7M SCR bits */
 FIELD(V7M_SCR, SLEEPONEXIT, 1, 1)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return cpu->env.v7m.scr[attrs.secure];
     case 0xd14: /* Configuration Control.  */
-        /* The BFHFNMIGN bit is the only non-banked bit; we
-         * keep it in the non-secure copy of the register.
+        /*
+         * Non-banked bits: BFHFNMIGN (stored in the NS copy of the register)
+         * and TRD (stored in the S copy of the register)
          */
         val = cpu->env.v7m.ccr[attrs.secure];
         val |= cpu->env.v7m.ccr[M_REG_NS] & R_V7M_CCR_BFHFNMIGN_MASK;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         cpu->env.v7m.scr[attrs.secure] = value;
         break;
     case 0xd14: /* Configuration Control.  */
+    {
+        uint32_t mask;
+
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
 
         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
-        value &= (R_V7M_CCR_STKALIGN_MASK |
-                  R_V7M_CCR_BFHFNMIGN_MASK |
-                  R_V7M_CCR_DIV_0_TRP_MASK |
-                  R_V7M_CCR_UNALIGN_TRP_MASK |
-                  R_V7M_CCR_USERSETMPEND_MASK |
-                  R_V7M_CCR_NONBASETHRDENA_MASK);
+        mask = R_V7M_CCR_STKALIGN_MASK |
+            R_V7M_CCR_BFHFNMIGN_MASK |
+            R_V7M_CCR_DIV_0_TRP_MASK |
+            R_V7M_CCR_UNALIGN_TRP_MASK |
+            R_V7M_CCR_USERSETMPEND_MASK |
+            R_V7M_CCR_NONBASETHRDENA_MASK;
+        if (arm_feature(&cpu->env, ARM_FEATURE_V8_1M) && attrs.secure) {
+            /* TRD is always RAZ/WI from NS */
+            mask |= R_V7M_CCR_TRD_MASK;
+        }
+        value &= mask;
 
         if (arm_feature(&cpu->env, ARM_FEATURE_V8)) {
             /* v8M makes NONBASETHRDENA and STKALIGN be RES1 */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
 
         cpu->env.v7m.ccr[attrs.secure] = value;
         break;
+    }
     case 0xd24: /* System Handler Control and State (SHCSR) */
         if (!arm_feature(&cpu->env, ARM_FEATURE_V7)) {
             goto bad_offset;
-- 
2.20.1

v8.1M introduces a new TRD flag in the CCR register, which enables
checking for stack frame integrity signatures on SG instructions.
Add the code in the SG insn implementation for the new behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-24-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 86 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
     return true;
 }
 
+static bool v7m_read_sg_stack_word(ARMCPU *cpu, ARMMMUIdx mmu_idx,
+                                   uint32_t addr, uint32_t *spdata)
+{
+    /*
+     * Read a word of data from the stack for the SG instruction,
+     * writing the value into *spdata. If the load succeeds, return
+     * true; otherwise pend an appropriate exception and return false.
+     * (We can't use data load helpers here that throw an exception
+     * because of the context we're called in, which is halfway through
+     * arm_v7m_cpu_do_interrupt().)
+     */
+    CPUState *cs = CPU(cpu);
+    CPUARMState *env = &cpu->env;
+    MemTxAttrs attrs = {};
+    MemTxResult txres;
+    target_ulong page_size;
+    hwaddr physaddr;
+    int prot;
+    ARMMMUFaultInfo fi = {};
+    ARMCacheAttrs cacheattrs = {};
+    uint32_t value;
+
+    if (get_phys_addr(env, addr, MMU_DATA_LOAD, mmu_idx, &physaddr,
+                      &attrs, &prot, &page_size, &fi, &cacheattrs)) {
+        /* MPU/SAU lookup failed */
+        if (fi.type == ARMFault_QEMU_SFault) {
+            qemu_log_mask(CPU_LOG_INT,
+                          "...SecureFault during stack word read\n");
+            env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK | R_V7M_SFSR_SFARVALID_MASK;
+            env->v7m.sfar = addr;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+        } else {
+            qemu_log_mask(CPU_LOG_INT,
+                          "...MemManageFault during stack word read\n");
+            env->v7m.cfsr[M_REG_S] |= R_V7M_CFSR_DACCVIOL_MASK |
+                R_V7M_CFSR_MMARVALID_MASK;
+            env->v7m.mmfar[M_REG_S] = addr;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, false);
+        }
+        return false;
+    }
+    value = address_space_ldl(arm_addressspace(cs, attrs), physaddr,
+                              attrs, &txres);
+    if (txres != MEMTX_OK) {
+        /* BusFault trying to read the data */
+        qemu_log_mask(CPU_LOG_INT,
+                      "...BusFault during stack word read\n");
+        env->v7m.cfsr[M_REG_NS] |=
+            (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+        env->v7m.bfar = addr;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+        return false;
+    }
+
+    *spdata = value;
+    return true;
+}
+
 static bool v7m_handle_execute_nsc(ARMCPU *cpu)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static bool v7m_handle_execute_nsc(ARMCPU *cpu)
      */
     qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
                   ", executing it\n", env->regs[15]);
+
+    if (cpu_isar_feature(aa32_m_sec_state, cpu) &&
+        !arm_v7m_is_handler_mode(env)) {
+        /*
+         * v8.1M exception stack frame integrity check. Note that we
+         * must perform the memory access even if CCR_S.TRD is zero
+         * and we aren't going to check what the data loaded is.
+         */
+        uint32_t spdata, sp;
+
+        /*
+         * We know we are currently NS, so the S stack pointers must be
+         * in other_ss_{psp,msp}, not in regs[13]/other_sp.
+         */
+        sp = v7m_using_psp(env) ? env->v7m.other_ss_psp : env->v7m.other_ss_msp;
+        if (!v7m_read_sg_stack_word(cpu, mmu_idx, sp, &spdata)) {
+            /* Stack access failed and an exception has been pended */
+            return false;
+        }
+
+        if (env->v7m.ccr[M_REG_S] & R_V7M_CCR_TRD_MASK) {
+            if (((spdata & ~1) == 0xfefa125a) ||
+                !(env->v7m.control[M_REG_S] & 1)) {
+                goto gen_invep;
+            }
+        }
+    }
+
     env->regs[14] &= ~1;
     env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
     switch_v7m_security_state(env, true);
-- 
2.20.1

In commit 077d7449100d824a4 we added code to handle the v8M
requirement that returns from NMI or HardFault forcibly deactivate
those exceptions regardless of what interrupt the guest is trying to
deactivate.  Unfortunately this broke the handling of the "illegal
exception return because the returning exception number is not
active" check for those cases.  In the pseudocode this test is done
on the exception the guest asks to return from, but because our
implementation was doing this in armv7m_nvic_complete_irq() after the
new "deactivate NMI/HardFault regardless" code we ended up doing the
test on the VecInfo for that exception instead, which usually meant
failing to raise the illegal exception return fault.

In the case for "configurable exception targeting the opposite
security state" we detected the illegal-return case but went ahead
and deactivated the VecInfo anyway, which is wrong because that is
the VecInfo for the other security state.

Rearrange the code so that we first identify the illegal return
cases, then see if we really need to deactivate NMI or HardFault
instead, and finally do the deactivation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-25-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 59 +++++++++++++++++++++++--------------------
 1 file changed, 32 insertions(+), 27 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
 {
     NVICState *s = (NVICState *)opaque;
     VecInfo *vec = NULL;
-    int ret;
+    int ret = 0;
 
     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
 
+    trace_nvic_complete_irq(irq, secure);
+
+    if (secure && exc_is_banked(irq)) {
+        vec = &s->sec_vectors[irq];
+    } else {
+        vec = &s->vectors[irq];
+    }
+
+    /*
+     * Identify illegal exception return cases. We can't immediately
+     * return at this point because we still need to deactivate
+     * (either this exception or NMI/HardFault) first.
+     */
+    if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
+        /*
+         * Return from a configurable exception targeting the opposite
+         * security state from the one we're trying to complete it for.
+         * Clear vec because it's not really the VecInfo for this
+         * (irq, secstate) so we mustn't deactivate it.
+         */
+        ret = -1;
+        vec = NULL;
+    } else if (!vec->active) {
+        /* Return from an inactive interrupt */
+        ret = -1;
+    } else {
+        /* Legal return, we will return the RETTOBASE bit value to the caller */
+        ret = nvic_rettobase(s);
+    }
+
     /*
      * For negative priorities, v8M will forcibly deactivate the appropriate
      * NMI or HardFault regardless of what interrupt we're being asked to
@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
     }
 
     if (!vec) {
-        if (secure && exc_is_banked(irq)) {
-            vec = &s->sec_vectors[irq];
-        } else {
-            vec = &s->vectors[irq];
-        }
-    }
-
-    trace_nvic_complete_irq(irq, secure);
-
-    if (!vec->active) {
-        /* Tell the caller this was an illegal exception return */
-        return -1;
-    }
-
-    /*
-     * If this is a configurable exception and it is currently
-     * targeting the opposite security state from the one we're trying
-     * to complete it for, this counts as an illegal exception return.
-     * We still need to deactivate whatever vector the logic above has
-     * selected, though, as it might not be the same as the one for the
-     * requested exception number.
-     */
-    if (!exc_is_banked(irq) && exc_targets_secure(s, irq) != secure) {
-        ret = -1;
-    } else {
-        ret = nvic_rettobase(s);
+        return ret;
     }
 
     vec->active = 0;
-- 
2.20.1

For v8.1M the architecture mandates that CPUs must provide at
least the "minimal RAS implementation" from the Reliability,
Availability and Serviceability extension. This consists of:
 * an ESB instruction which is a NOP
   -- since it is in the HINT space we need only add a comment
 * an RFSR register which will RAZ/WI
 * a RAZ/WI AIRCR.IESB bit
   -- the code which handles writes to AIRCR does not allow setting
      of RES0 bits, so we already treat this as RAZ/WI; add a comment
      noting that this is deliberate
 * minimal implementation of the RAS register block at 0xe0005000
   -- this will be in a subsequent commit
 * setting the ID_PFR0.RAS field to 0b0010
   -- we will do this when we add the Cortex-M55 CPU model

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-26-peter.maydell@linaro.org
---
 target/arm/cpu.h      | 14 ++++++++++++++
 target/arm/t32.decode |  4 ++++
 hw/intc/armv7m_nvic.c | 13 +++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
 FIELD(ID_MMFR4, CCIDX, 24, 4)
 FIELD(ID_MMFR4, EVT, 28, 4)
 
+FIELD(ID_PFR0, STATE0, 0, 4)
+FIELD(ID_PFR0, STATE1, 4, 4)
+FIELD(ID_PFR0, STATE2, 8, 4)
+FIELD(ID_PFR0, STATE3, 12, 4)
+FIELD(ID_PFR0, CSV2, 16, 4)
+FIELD(ID_PFR0, AMU, 20, 4)
+FIELD(ID_PFR0, DIT, 24, 4)
+FIELD(ID_PFR0, RAS, 28, 4)
+
 FIELD(ID_PFR1, PROGMOD, 0, 4)
 FIELD(ID_PFR1, SECURITY, 4, 4)
 FIELD(ID_PFR1, MPROGMOD, 8, 4)
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_predinv(const ARMISARegisters *id)
     return FIELD_EX32(id->id_isar6, ID_ISAR6, SPECRES) != 0;
 }
 
+static inline bool isar_feature_aa32_ras(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_pfr0, ID_PFR0, RAS) != 0;
+}
+
 static inline bool isar_feature_aa32_mprofile(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->id_pfr1, ID_PFR1, MPROGMOD) != 0;
diff --git a/target/arm/t32.decode b/target/arm/t32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/t32.decode
+++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@ CLZ              1111 1010 1011 ---- 1111 .... 1000 ....      @rdm
       # SEV      1111 0011 1010 1111 1000 0000 0000 0100
       # SEVL     1111 0011 1010 1111 1000 0000 0000 0101
 
+      # For M-profile minimal-RAS ESB can be a NOP, which is the
+      # default behaviour since it is in the hint space.
+      # ESB      1111 0011 1010 1111 1000 0000 0001 0000
+
       # The canonical nop ends in 0000 0000, but the whole rest
       # of the space is "reserved hint, behaves as nop".
       NOP        1111 0011 1010 1111 1000 0000 ---- ----
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             return 0;
         }
         return cpu->env.v7m.sfar;
+    case 0xf04: /* RFSR */
+        if (!cpu_isar_feature(aa32_ras, cpu)) {
+            goto bad_offset;
+        }
+        /* We provide minimal-RAS only: RFSR is RAZ/WI */
+        return 0;
     case 0xf34: /* FPCCR */
         if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
                               R_V7M_AIRCR_PRIGROUP_SHIFT,
                               R_V7M_AIRCR_PRIGROUP_LENGTH);
             }
+            /* AIRCR.IESB is RAZ/WI because we implement only minimal RAS */
             if (attrs.secure) {
                 /* These bits are only writable by secure */
                 cpu->env.v7m.aircr = value &
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     }
+    case 0xf04: /* RFSR */
+        if (!cpu_isar_feature(aa32_ras, cpu)) {
+            goto bad_offset;
+        }
+        /* We provide minimal-RAS only: RFSR is RAZ/WI */
+        break;
     case 0xf34: /* FPCCR */
         if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* Not all bits here are banked. */
-- 
2.20.1

The RAS feature has a block of memory-mapped registers at offset
0x5000 within the PPB.  For a "minimal RAS" implementation we provide
no error records and so the only registers that exist in the block
are ERRIIDR and ERRDEVID.

The "RAZ/WI for privileged, BusFault for nonprivileged" behaviour
of the "nvic-default" region is actually valid for minimal-RAS,
so the main benefit of providing an explicit implementation of
the register block is more accurate LOG_UNIMP messages, and a
framework for where we could add a real RAS implementation later
if necessary.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201119215617.29887-27-peter.maydell@linaro.org
---
 include/hw/intc/armv7m_nvic.h |  1 +
 hw/intc/armv7m_nvic.c         | 56 +++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)

The following changes since commit 7e7eb9f852a46b51a71ae9d82590b2e4d28827ee:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-01-28' into staging (2021-01-28 22:43:18 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210129

for you to fetch changes up to 11749122e1a86866591306d43603d2795a3dea1a:

hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS (2021-01-29 10:47:29 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement ID_PFR2
 * Conditionalize DBGDIDR
 * rename xlnx-zcu102.canbusN properties
 * provide powerdown/reset mechanism for secure firmware on 'virt' board
 * hw/misc: Fix arith overflow in NPCM7XX PWM module
 * target/arm: Replace magic value by MMU_DATA_LOAD definition
 * configure: fix preadv errors on Catalina macOS with new XCode
 * Various configure and other cleanups in preparation for iOS support
 * hvf: Add hypervisor entitlement to output binaries (needed for Big Sur)
 * Implement pvpanic-pci device
 * Convert the CMSDK timer devices to the Clock framework

----------------------------------------------------------------
Alexander Graf (1):
      hvf: Add hypervisor entitlement to output binaries

Hao Wu (1):
      hw/misc: Fix arith overflow in NPCM7XX PWM module

Joelle van Dyne (7):
      configure: cross-compiling with empty cross_prefix
      osdep: build with non-working system() function
      darwin: remove redundant dependency declaration
      darwin: fix cross-compiling for Darwin
      configure: cross compile should use x86_64 cpu_family
      darwin: detect CoreAudio for build
      darwin: remove 64-bit build detection on 32-bit OS

Maxim Uvarov (3):
      hw: gpio: implement gpio-pwr driver for qemu reset/poweroff
      arm-virt: refactor gpios creation
      arm-virt: add secure pl061 for reset/power down

Mihai Carabas (4):
      hw/misc/pvpanic: split-out generic and bus dependent code
      hw/misc/pvpanic: add PCI interface support
      pvpanic : update pvpanic spec document
      tests/qtest: add a test case for pvpanic-pci

Paolo Bonzini (1):
      arm: rename xlnx-zcu102.canbusN properties

Peter Maydell (26):
      configure: Move preadv check to meson.build
      ptimer: Add new ptimer_set_period_from_clock() function
      clock: Add new clock_has_source() function
      tests: Add a simple test of the CMSDK APB timer
      tests: Add a simple test of the CMSDK APB watchdog
      tests: Add a simple test of the CMSDK APB dual timer
      hw/timer/cmsdk-apb-timer: Rename CMSDKAPBTIMER struct to CMSDKAPBTimer
      hw/timer/cmsdk-apb-timer: Add Clock input
      hw/timer/cmsdk-apb-dualtimer: Add Clock input
      hw/watchdog/cmsdk-apb-watchdog: Add Clock input
      hw/arm/armsse: Rename "MAINCLK" property to "MAINCLK_FRQ"
      hw/arm/armsse: Wire up clocks
      hw/arm/mps2: Inline CMSDK_APB_TIMER creation
      hw/arm/mps2: Create and connect SYSCLK Clock
      hw/arm/mps2-tz: Create and connect ARMSSE Clocks
      hw/arm/musca: Create and connect ARMSSE Clocks
      hw/arm/stellaris: Convert SSYS to QOM device
      hw/arm/stellaris: Create Clock input for watchdog
      hw/timer/cmsdk-apb-timer: Convert to use Clock input
      hw/timer/cmsdk-apb-dualtimer: Convert to use Clock input
      hw/watchdog/cmsdk-apb-watchdog: Convert to use Clock input
      tests/qtest/cmsdk-apb-watchdog-test: Test clock changes
      hw/arm/armsse: Use Clock to set system_clock_scale
      arm: Don't set freq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
      arm: Remove frq properties on CMSDK timer, dualtimer, watchdog, ARMSSE
      hw/arm/stellaris: Remove board-creation reset of STELLARIS_SYS

Philippe Mathieu-Daudé (1):
      target/arm: Replace magic value by MMU_DATA_LOAD definition

Richard Henderson (2):
      target/arm: Implement ID_PFR2
      target/arm: Conditionalize DBGDIDR

docs/devel/clocks.rst                    |  16 +++
 docs/specs/pci-ids.txt                   |   1 +
 docs/specs/pvpanic.txt                   |  13 ++-
 docs/system/arm/virt.rst                 |   2 +
 configure                                |  78 ++++++++------
 meson.build                              |  34 ++++++-
 include/hw/arm/armsse.h                  |  14 ++-
 include/hw/arm/virt.h                    |   2 +
 include/hw/clock.h                       |  15 +++
 include/hw/misc/pvpanic.h                |  24 ++++-
 include/hw/pci/pci.h                     |   1 +
 include/hw/ptimer.h                      |  22 ++++
 include/hw/timer/cmsdk-apb-dualtimer.h   |   5 +-
 include/hw/timer/cmsdk-apb-timer.h       |  34 ++-----
 include/hw/watchdog/cmsdk-apb-watchdog.h |   5 +-
 include/qemu/osdep.h                     |  12 +++
 include/qemu/typedefs.h                  |   1 +
 target/arm/cpu.h                         |   1 +
 hw/arm/armsse.c                          |  48 ++++++---
 hw/arm/mps2-tz.c                         |  14 ++-
 hw/arm/mps2.c                            |  28 ++++-
 hw/arm/musca.c                           |  13 ++-
 hw/arm/stellaris.c                       | 170 +++++++++++++++++++++++--------
 hw/arm/virt.c                            | 111 ++++++++++++++++----
 hw/arm/xlnx-zcu102.c                     |   4 +-
 hw/core/ptimer.c                         |  34 +++++++
 hw/gpio/gpio_pwr.c                       |  70 +++++++++++++
 hw/misc/npcm7xx_pwm.c                    |  23 ++++-
 hw/misc/pvpanic-isa.c                    |  94 +++++++++++++++++
 hw/misc/pvpanic-pci.c                    |  94 +++++++++++++++++
 hw/misc/pvpanic.c                        |  85 ++--------------
 hw/timer/cmsdk-apb-dualtimer.c           |  53 +++++++---
 hw/timer/cmsdk-apb-timer.c               |  55 +++++-----
 hw/watchdog/cmsdk-apb-watchdog.c         |  29 ++++--
 target/arm/helper.c                      |  27 +++--
 target/arm/kvm64.c                       |   2 +
 tests/qtest/cmsdk-apb-dualtimer-test.c   | 130 +++++++++++++++++++++++
 tests/qtest/cmsdk-apb-timer-test.c       |  75 ++++++++++++++
 tests/qtest/cmsdk-apb-watchdog-test.c    | 131 ++++++++++++++++++++++++
 tests/qtest/npcm7xx_pwm-test.c           |   4 +-
 tests/qtest/pvpanic-pci-test.c           |  94 +++++++++++++++++
 tests/qtest/xlnx-can-test.c              |  30 +++---
 MAINTAINERS                              |   3 +
 accel/hvf/entitlements.plist             |   8 ++
 hw/arm/Kconfig                           |   1 +
 hw/gpio/Kconfig                          |   3 +
 hw/gpio/meson.build                      |   1 +
 hw/i386/Kconfig                          |   2 +-
 hw/misc/Kconfig                          |  12 ++-
 hw/misc/meson.build                      |   4 +-
 scripts/entitlement.sh                   |  13 +++
 tests/qtest/meson.build                  |   6 +-
 52 files changed, 1432 insertions(+), 319 deletions(-)
 create mode 100644 hw/gpio/gpio_pwr.c
 create mode 100644 hw/misc/pvpanic-isa.c
 create mode 100644 hw/misc/pvpanic-pci.c
 create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c
 create mode 100644 tests/qtest/cmsdk-apb-timer-test.c
 create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c
 create mode 100644 tests/qtest/pvpanic-pci-test.c
 create mode 100644 accel/hvf/entitlements.plist
 create mode 100755 scripts/entitlement.sh

From: Richard Henderson <richard.henderson@linaro.org>

This was defined at some point before ARMv8.4, and will
shortly be used by new processor descriptions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210120204400.1056582-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 1 +
 target/arm/helper.c | 4 ++--
 target/arm/kvm64.c  | 2 ++
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint32_t id_mmfr4;
         uint32_t id_pfr0;
         uint32_t id_pfr1;
+        uint32_t id_pfr2;
         uint32_t mvfr0;
         uint32_t mvfr1;
         uint32_t mvfr2;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
-            { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
+            { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = 0 },
+              .resetvalue = cpu->isar.id_pfr2 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 1, 0));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr1,
                               ARM64_SYS_REG(3, 0, 0, 1, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_pfr2,
+                              ARM64_SYS_REG(3, 0, 0, 3, 4));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_dfr0,
                               ARM64_SYS_REG(3, 0, 0, 1, 2));
         err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_mmfr0,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Only define the register if it exists for the cpu.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210120031656.737646-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
      */
     int i;
     int wrps, brps, ctx_cmps;
-    ARMCPRegInfo dbgdidr = {
-        .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 0,
-        .access = PL0_R, .accessfn = access_tda,
-        .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
-    };
+
+    /*
+     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
+     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
+     * the register must not exist for this cpu.
+     */
+    if (cpu->isar.dbgdidr != 0) {
+        ARMCPRegInfo dbgdidr = {
+            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
+            .opc1 = 0, .opc2 = 0,
+            .access = PL0_R, .accessfn = access_tda,
+            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
+        };
+        define_one_arm_cp_reg(cpu, &dbgdidr);
+    }
 
     /* Note that all these register fields hold "number of Xs minus 1". */
     brps = arm_num_brps(cpu);
@@ -XXX,XX +XXX,XX @@ static void define_debug_regs(ARMCPU *cpu)
 
     assert(ctx_cmps <= brps);
 
-    define_one_arm_cp_reg(cpu, &dbgdidr);
     define_arm_cp_regs(cpu, debug_cp_reginfo);
 
     if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
-- 
2.20.1

From: Paolo Bonzini <pbonzini@redhat.com>

The properties to attach a CANBUS object to the xlnx-zcu102 machine have
a period in them.  We want to use periods in properties for compound QAPI types,
and besides the "xlnx-zcu102." prefix is both unnecessary and different
from any other machine property name.  Remove it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20210118162537.779542-1-pbonzini@redhat.com
Reviewed-by: Vikram Garhwal <fnu.vikram@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c        |  4 ++--
 tests/qtest/xlnx-can-test.c | 30 +++++++++++++++---------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
     s->secure = false;
     /* Default to virt (EL2) being disabled */
     s->virt = false;
-    object_property_add_link(obj, "xlnx-zcu102.canbus0", TYPE_CAN_BUS,
+    object_property_add_link(obj, "canbus0", TYPE_CAN_BUS,
                              (Object **)&s->canbus[0],
                              object_property_allow_set_link,
                              0);
 
-    object_property_add_link(obj, "xlnx-zcu102.canbus1", TYPE_CAN_BUS,
+    object_property_add_link(obj, "canbus1", TYPE_CAN_BUS,
                              (Object **)&s->canbus[1],
                              object_property_allow_set_link,
                              0);
diff --git a/tests/qtest/xlnx-can-test.c b/tests/qtest/xlnx-can-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/xlnx-can-test.c
+++ b/tests/qtest/xlnx-can-test.c
@@ -XXX,XX +XXX,XX @@ static void test_can_bus(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_loopback(void)
     uint32_t status = 0;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 in loopback mode. */
@@ -XXX,XX +XXX,XX @@ static void test_can_filter(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0 and CAN1. */
@@ -XXX,XX +XXX,XX @@ static void test_can_sleepmode(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0. */
@@ -XXX,XX +XXX,XX @@ static void test_can_snoopmode(void)
     uint8_t can_timestamp = 1;
 
     QTestState *qts = qtest_init("-machine xlnx-zcu102"
-                " -object can-bus,id=canbus0"
-                " -machine xlnx-zcu102.canbus0=canbus0"
-                " -machine xlnx-zcu102.canbus1=canbus0"
+                " -object can-bus,id=canbus"
+                " -machine canbus0=canbus"
+                " -machine canbus1=canbus"
                 );
 
     /* Configure the CAN0. */
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

Implement gpio-pwr driver to allow reboot and poweroff machine.
This is simple driver with just 2 gpios lines. Current use case
is to reboot and poweroff virt machine in secure mode. Secure
pl066 gpio chip is needed for that.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/gpio_pwr.c  | 70 +++++++++++++++++++++++++++++++++++++++++++++
 hw/gpio/Kconfig     |  3 ++
 hw/gpio/meson.build |  1 +
 3 files changed, 74 insertions(+)
 create mode 100644 hw/gpio/gpio_pwr.c

diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/gpio_pwr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * GPIO qemu power controller
+ *
+ * Copyright (c) 2020 Linaro Limited
+ *
+ * Author: Maxim Uvarov <maxim.uvarov@linaro.org>
+ *
+ * Virtual gpio driver which can be used on top of pl061
+ * to reboot and shutdown qemu virtual machine. One of use
+ * case is gpio driver for secure world application (ARM
+ * Trusted Firmware.).
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+/*
+ * QEMU interface:
+ * two named input GPIO lines:
+ *   'reset' : when asserted, trigger system reset
+ *   'shutdown' : when asserted, trigger system shutdown
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "sysemu/runstate.h"
+
+#define TYPE_GPIOPWR "gpio-pwr"
+OBJECT_DECLARE_SIMPLE_TYPE(GPIO_PWR_State, GPIOPWR)
+
+struct GPIO_PWR_State {
+    SysBusDevice parent_obj;
+};
+
+static void gpio_pwr_reset(void *opaque, int n, int level)
+{
+    if (level) {
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+    }
+}
+
+static void gpio_pwr_shutdown(void *opaque, int n, int level)
+{
+    if (level) {
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+    }
+}
+
+static void gpio_pwr_init(Object *obj)
+{
+    DeviceState *dev = DEVICE(obj);
+
+    qdev_init_gpio_in_named(dev, gpio_pwr_reset, "reset", 1);
+    qdev_init_gpio_in_named(dev, gpio_pwr_shutdown, "shutdown", 1);
+}
+
+static const TypeInfo gpio_pwr_info = {
+    .name          = TYPE_GPIOPWR,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(GPIO_PWR_State),
+    .instance_init = gpio_pwr_init,
+};
+
+static void gpio_pwr_register_types(void)
+{
+    type_register_static(&gpio_pwr_info);
+}
+
+type_init(gpio_pwr_register_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config PL061
 config GPIO_KEY
     bool
 
+config GPIO_PWR
+    bool
+
 config SIFIVE_GPIO
     bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@
 softmmu_ss.add(when: 'CONFIG_E500', if_true: files('mpc8xxx.c'))
 softmmu_ss.add(when: 'CONFIG_GPIO_KEY', if_true: files('gpio_key.c'))
+softmmu_ss.add(when: 'CONFIG_GPIO_PWR', if_true: files('gpio_pwr.c'))
 softmmu_ss.add(when: 'CONFIG_MAX7310', if_true: files('max7310.c'))
 softmmu_ss.add(when: 'CONFIG_PL061', if_true: files('pl061.c'))
 softmmu_ss.add(when: 'CONFIG_PUV3', if_true: files('puv3_gpio.c'))
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

No functional change. Just refactor code to better
support secure and normal world gpios.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 57 ++++++++++++++++++++++++++++++++-------------------
 1 file changed, 36 insertions(+), 21 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_powerdown_req(Notifier *n, void *opaque)
     }
 }
 
-static void create_gpio(const VirtMachineState *vms)
+static void create_gpio_keys(const VirtMachineState *vms,
+                             DeviceState *pl061_dev,
+                             uint32_t phandle)
+{
+    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
+                                        qdev_get_gpio_in(pl061_dev, 3));
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
+                            "label", "GPIO Key Poweroff");
+    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
+                          KEY_POWER);
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
+                           "gpios", phandle, 3, 0);
+}
+
+static void create_gpio_devices(const VirtMachineState *vms, int gpio,
+                                MemoryRegion *mem)
 {
     char *nodename;
     DeviceState *pl061_dev;
-    hwaddr base = vms->memmap[VIRT_GPIO].base;
-    hwaddr size = vms->memmap[VIRT_GPIO].size;
-    int irq = vms->irqmap[VIRT_GPIO];
+    hwaddr base = vms->memmap[gpio].base;
+    hwaddr size = vms->memmap[gpio].size;
+    int irq = vms->irqmap[gpio];
     const char compat[] = "arm,pl061\0arm,primecell";
+    SysBusDevice *s;
 
-    pl061_dev = sysbus_create_simple("pl061", base,
-                                     qdev_get_gpio_in(vms->gic, irq));
+    pl061_dev = qdev_new("pl061");
+    s = SYS_BUS_DEVICE(pl061_dev);
+    sysbus_realize_and_unref(s, &error_fatal);
+    memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(vms->gic, irq));
 
     uint32_t phandle = qemu_fdt_alloc_phandle(vms->fdt);
     nodename = g_strdup_printf("/pl061@%" PRIx64, base);
@@ -XXX,XX +XXX,XX @@ static void create_gpio(const VirtMachineState *vms)
     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 
-    gpio_key_dev = sysbus_create_simple("gpio-key", -1,
-                                        qdev_get_gpio_in(pl061_dev, 3));
-    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
-    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
-
-    qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
-    qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
-                            "label", "GPIO Key Poweroff");
-    qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
-                          KEY_POWER);
-    qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
-                           "gpios", phandle, 3, 0);
     g_free(nodename);
+
+    /* Child gpio devices */
+    create_gpio_keys(vms, pl061_dev, phandle);
 }
 
 static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
         vms->acpi_dev = create_acpi_ged(vms);
     } else {
-        create_gpio(vms);
+        create_gpio_devices(vms, VIRT_GPIO, sysmem);
     }
 
      /* connect powerdown request */
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

Add secure pl061 for reset/power down machine from
the secure world (Arm Trusted Firmware). Connect it
with gpio-pwr driver.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
[PMM: Added mention of the new device to the documentation]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst |  2 ++
 include/hw/arm/virt.h    |  2 ++
 hw/arm/virt.c            | 56 +++++++++++++++++++++++++++++++++++++++-
 hw/arm/Kconfig           |  1 +
 4 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ The virt board supports:
 - Secure-World-only devices if the CPU has TrustZone:
 
   - A second PL011 UART
+  - A second PL061 GPIO controller, with GPIO lines for triggering
+    a system reset or system poweroff
   - A secure flash memory
   - 16MB of secure RAM
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_GPIO,
     VIRT_SECURE_UART,
     VIRT_SECURE_MEM,
+    VIRT_SECURE_GPIO,
     VIRT_PCDIMM_ACPI,
     VIRT_ACPI_GED,
     VIRT_NVDIMM_ACPI,
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     bool kvm_no_adjvtime;
     bool no_kvm_steal_time;
     bool acpi_expose_flash;
+    bool no_secure_gpio;
 };
 
 struct VirtMachineState {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
     [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
+    [VIRT_SECURE_GPIO] =        { 0x090b0000, 0x00001000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void create_gpio_keys(const VirtMachineState *vms,
                            "gpios", phandle, 3, 0);
 }
 
+#define SECURE_GPIO_POWEROFF 0
+#define SECURE_GPIO_RESET    1
+
+static void create_secure_gpio_pwr(const VirtMachineState *vms,
+                                   DeviceState *pl061_dev,
+                                   uint32_t phandle)
+{
+    DeviceState *gpio_pwr_dev;
+
+    /* gpio-pwr */
+    gpio_pwr_dev = sysbus_create_simple("gpio-pwr", -1, NULL);
+
+    /* connect secure pl061 to gpio-pwr */
+    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_RESET,
+                          qdev_get_gpio_in_named(gpio_pwr_dev, "reset", 0));
+    qdev_connect_gpio_out(pl061_dev, SECURE_GPIO_POWEROFF,
+                          qdev_get_gpio_in_named(gpio_pwr_dev, "shutdown", 0));
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-poweroff");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "compatible",
+                            "gpio-poweroff");
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-poweroff",
+                           "gpios", phandle, SECURE_GPIO_POWEROFF, 0);
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "status", "disabled");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-poweroff", "secure-status",
+                            "okay");
+
+    qemu_fdt_add_subnode(vms->fdt, "/gpio-restart");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "compatible",
+                            "gpio-restart");
+    qemu_fdt_setprop_cells(vms->fdt, "/gpio-restart",
+                           "gpios", phandle, SECURE_GPIO_RESET, 0);
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "status", "disabled");
+    qemu_fdt_setprop_string(vms->fdt, "/gpio-restart", "secure-status",
+                            "okay");
+}
+
 static void create_gpio_devices(const VirtMachineState *vms, int gpio,
                                 MemoryRegion *mem)
 {
@@ -XXX,XX +XXX,XX @@ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
 
+    if (gpio != VIRT_GPIO) {
+        /* Mark as not usable by the normal world */
+        qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
+        qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
+    }
     g_free(nodename);
 
     /* Child gpio devices */
-    create_gpio_keys(vms, pl061_dev, phandle);
+    if (gpio == VIRT_GPIO) {
+        create_gpio_keys(vms, pl061_dev, phandle);
+    } else {
+        create_secure_gpio_pwr(vms, pl061_dev, phandle);
+    }
 }
 
 static void create_virtio_devices(const VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         create_gpio_devices(vms, VIRT_GPIO, sysmem);
     }
 
+    if (vms->secure && !vmc->no_secure_gpio) {
+        create_gpio_devices(vms, VIRT_SECURE_GPIO, secure_sysmem);
+    }
+
      /* connect powerdown request */
      vms->powerdown_notifier.notify = virt_powerdown_req;
      qemu_register_powerdown_notifier(&vms->powerdown_notifier);
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 0)
 
 static void virt_machine_5_2_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_6_0_options(mc);
     compat_props_add(mc->compat_props, hw_compat_5_2, hw_compat_5_2_len);
+    vmc->no_secure_gpio = true;
 }
 DEFINE_VIRT_MACHINE(5, 2)
 
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
     select PL011 # UART
     select PL031 # RTC
     select PL061 # GPIO
+    select GPIO_PWR
     select PLATFORM_BUS
     select SMBIOS
     select VIRTIO_MMIO
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

Fix potential overflow problem when calculating pwm_duty.
1. Ensure p->cmr and p->cnr to be from [0,65535], according to the
   hardware specification.
2. Changed duty to uint32_t. However, since MAX_DUTY * (p->cmr+1)
   can excceed UINT32_MAX, we convert them to uint64_t in computation
   and converted them back to uint32_t.
   (duty is guaranteed to be <= MAX_DUTY so it won't overflow.)

Fixes: CID 1442342
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Doug Evans <dje@google.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210127011142.2122790-1-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/npcm7xx_pwm.c          | 23 +++++++++++++++++++----
 tests/qtest/npcm7xx_pwm-test.c |  4 ++--
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_pwm.c
+++ b/hw/misc/npcm7xx_pwm.c
@@ -XXX,XX +XXX,XX @@ REG32(NPCM7XX_PWM_PWDR3, 0x50);
 #define NPCM7XX_CH_INV              BIT(2)
 #define NPCM7XX_CH_MOD              BIT(3)
 
+#define NPCM7XX_MAX_CMR             65535
+#define NPCM7XX_MAX_CNR             65535
+
 /* Offset of each PWM channel's prescaler in the PPR register. */
 static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
 /* Offset of each PWM channel's clock selector in the CSR register. */
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
 
 static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
 {
-    uint64_t duty;
+    uint32_t duty;
 
     if (p->running) {
         if (p->cnr == 0) {
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
         } else if (p->cmr >= p->cnr) {
             duty = NPCM7XX_PWM_MAX_DUTY;
         } else {
-            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
+            duty = (uint64_t)NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
         }
     } else {
         duty = 0;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
     case A_NPCM7XX_PWM_CNR2:
     case A_NPCM7XX_PWM_CNR3:
         p = &s->pwm[npcm7xx_cnr_index(offset)];
-        p->cnr = value;
+        if (value > NPCM7XX_MAX_CNR) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid cnr value: %u", __func__, value);
+            p->cnr = NPCM7XX_MAX_CNR;
+        } else {
+            p->cnr = value;
+        }
         npcm7xx_pwm_update_output(p);
         break;
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
     case A_NPCM7XX_PWM_CMR2:
     case A_NPCM7XX_PWM_CMR3:
         p = &s->pwm[npcm7xx_cmr_index(offset)];
-        p->cmr = value;
+        if (value > NPCM7XX_MAX_CMR) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid cmr value: %u", __func__, value);
+            p->cmr = NPCM7XX_MAX_CMR;
+        } else {
+            p->cmr = value;
+        }
         npcm7xx_pwm_update_output(p);
         break;
 
diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_pwm-test.c
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
 
 static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
 {
-    uint64_t duty;
+    uint32_t duty;
 
     if (cnr == 0) {
         /* PWM is stopped. */
@@ -XXX,XX +XXX,XX @@ static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
     } else if (cmr >= cnr) {
         duty = MAX_DUTY;
     } else {
-        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
+        duty = (uint64_t)MAX_DUTY * (cmr + 1) / (cnr + 1);
     }
 
     if (inverted) {
-- 
2.20.1

Move the preadv availability check to meson.build.  This is what we
want to be doing for host-OS-feature-checks anyway, but it also fixes
a problem with building for macOS with the most recent XCode SDK on a
Catalina host.

On that configuration, 'preadv()' is provided as a weak symbol, so
that programs can be built with optional support for it and make a
runtime availability check to see whether the preadv() they have is a
working one or one which they must not call because it will
runtime-assert.  QEMU's configure test passes (unless you're building
with --enable-werror) because the test program using preadv()
compiles, but then QEMU crashes at runtime when preadv() is called,
with errors like:

dyld: lazy symbol binding failed: Symbol not found: _preadv
    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
    Expected in: /usr/lib/libSystem.B.dylib

dyld: Symbol not found: _preadv
    Referenced from: /Users/pm215/src/qemu/./build/x86/tests/test-replication
    Expected in: /usr/lib/libSystem.B.dylib

Meson's own function availability check has a special case for macOS
which adds '-Wl,-no_weak_imports' to the compiler flags, which forces
the test to require the real function, not the macOS-version-too-old
stub.

So this commit fixes the bug where macOS builds on Catalina currently
require --disable-werror.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20210126155846.17109-1-peter.maydell@linaro.org
---
 configure   | 16 ----------------
 meson.build |  4 +++-
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if compile_prog "" "" ; then
   iovec=yes
 fi
 
-##########################################
-# preadv probe
-cat > $TMPC <<EOF
-#include <sys/types.h>
-#include <sys/uio.h>
-#include <unistd.h>
-int main(void) { return preadv(0, 0, 0, 0); }
-EOF
-preadv=no
-if compile_prog "" "" ; then
-  preadv=yes
-fi
-
 ##########################################
 # fdt probe
 
@@ -XXX,XX +XXX,XX @@ fi
 if test "$iovec" = "yes" ; then
   echo "CONFIG_IOVEC=y" >> $config_host_mak
 fi
-if test "$preadv" = "yes" ; then
-  echo "CONFIG_PREADV=y" >> $config_host_mak
-fi
 if test "$membarrier" = "yes" ; then
   echo "CONFIG_MEMBARRIER=y" >> $config_host_mak
 fi
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
 config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
 config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
 
+config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
+
 ignored = ['CONFIG_QEMU_INTERP_PREFIX'] # actually per-target
 arrays = ['CONFIG_AUDIO_DRIVERS', 'CONFIG_BDRV_RW_WHITELIST', 'CONFIG_BDRV_RO_WHITELIST']
 strings = ['HOST_DSOSUF', 'CONFIG_IASL']
@@ -XXX,XX +XXX,XX @@ summary_info += {'PIE':               get_option('b_pie')}
 summary_info += {'static build':      config_host.has_key('CONFIG_STATIC')}
 summary_info += {'malloc trim support': has_malloc_trim}
 summary_info += {'membarrier':        config_host.has_key('CONFIG_MEMBARRIER')}
-summary_info += {'preadv support':    config_host.has_key('CONFIG_PREADV')}
+summary_info += {'preadv support':    config_host_data.get('CONFIG_PREADV')}
 summary_info += {'fdatasync':         config_host.has_key('CONFIG_FDATASYNC')}
 summary_info += {'madvise':           config_host.has_key('CONFIG_MADVISE')}
 summary_info += {'posix_madvise':     config_host.has_key('CONFIG_POSIX_MADVISE')}
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

The iOS toolchain does not use the host prefix naming convention. So we
need to enable cross-compile options while allowing the PREFIX to be
blank.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-3-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ cpu=""
 iasl="iasl"
 interp_prefix="/usr/gnemul/qemu-%M"
 static="no"
+cross_compile="no"
 cross_prefix=""
 audio_drv_list=""
 block_drv_rw_whitelist=""
@@ -XXX,XX +XXX,XX @@ for opt do
   optarg=$(expr "x$opt" : 'x[^=]*=$.*$')
   case "$opt" in
   --cross-prefix=*) cross_prefix="$optarg"
+                    cross_compile="yes"
   ;;
   --cc=*) CC="$optarg"
   ;;
@@ -XXX,XX +XXX,XX @@ $(echo Deprecated targets: $deprecated_targets_list | \
   --target-list-exclude=LIST exclude a set of targets from the default target-list
 
 Advanced options (experts only):
-  --cross-prefix=PREFIX    use PREFIX for compile tools [$cross_prefix]
+  --cross-prefix=PREFIX    use PREFIX for compile tools, PREFIX can be blank [$cross_prefix]
   --cc=CC                  use C compiler CC [$cc]
   --iasl=IASL              use ACPI compiler IASL [$iasl]
   --host-cc=CC             use C compiler CC [$host_cc] for code run at
@@ -XXX,XX +XXX,XX @@ if has $sdl2_config; then
 fi
 echo "strip = [$(meson_quote $strip)]" >> $cross
 echo "windres = [$(meson_quote $windres)]" >> $cross
-if test -n "$cross_prefix"; then
+if test "$cross_compile" = "yes"; then
     cross_arg="--cross-file config-meson.cross"
     echo "[host_machine]" >> $cross
     if test "$mingw32" = "yes" ; then
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

Build without error on hosts without a working system(). If system()
is called, return -1 with ENOSYS.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-6-j@getutm.app
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build          |  1 +
 include/qemu/osdep.h | 12 ++++++++++++
 2 files changed, 13 insertions(+)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('HAVE_DRM_H', cc.has_header('libdrm/drm.h'))
 config_host_data.set('HAVE_PTY_H', cc.has_header('pty.h'))
 config_host_data.set('HAVE_SYS_IOCCOM_H', cc.has_header('sys/ioccom.h'))
 config_host_data.set('HAVE_SYS_KCOV_H', cc.has_header('sys/kcov.h'))
+config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
 
 config_host_data.set('CONFIG_PREADV', cc.has_function('preadv', prefix: '#include <sys/uio.h>'))
 
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ static inline void qemu_thread_jit_write(void) {}
 static inline void qemu_thread_jit_execute(void) {}
 #endif
 
+/**
+ * Platforms which do not support system() return ENOSYS
+ */
+#ifndef HAVE_SYSTEM_FUNCTION
+#define system platform_does_not_support_system
+static inline int platform_does_not_support_system(const char *command)
+{
+    errno = ENOSYS;
+    return -1;
+}
+#endif /* !HAVE_SYSTEM_FUNCTION */
+
 #endif
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

Add objc to the Meson cross file as well as detection of Darwin.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210126012457.39046-8-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ echo "cpp_link_args = [${LDFLAGS:+$(meson_quote $LDFLAGS)}]" >> $cross
 echo "[binaries]" >> $cross
 echo "c = [$(meson_quote $cc)]" >> $cross
 test -n "$cxx" && echo "cpp = [$(meson_quote $cxx)]" >> $cross
+test -n "$objcc" && echo "objc = [$(meson_quote $objcc)]" >> $cross
 echo "ar = [$(meson_quote $ar)]" >> $cross
 echo "nm = [$(meson_quote $nm)]" >> $cross
 echo "pkgconfig = [$(meson_quote $pkg_config_exe)]" >> $cross
@@ -XXX,XX +XXX,XX @@ if test "$cross_compile" = "yes"; then
     if test "$linux" = "yes" ; then
         echo "system = 'linux'" >> $cross
     fi
+    if test "$darwin" = "yes" ; then
+        echo "system = 'darwin'" >> $cross
+    fi
     case "$ARCH" in
         i386|x86_64)
             echo "cpu_family = 'x86'" >> $cross
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

On iOS there is no CoreAudio, so we should not assume Darwin always
has it.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210126012457.39046-11-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fdt="auto"
 netmap="no"
 sdl="auto"
 sdl_image="auto"
+coreaudio="auto"
 virtiofsd="auto"
 virtfs="auto"
 libudev="auto"
@@ -XXX,XX +XXX,XX @@ Darwin)
     QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
     QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
   fi
-  audio_drv_list="coreaudio try-sdl"
+  audio_drv_list="try-coreaudio try-sdl"
   audio_possible_drivers="coreaudio sdl"
   # Disable attempts to use ObjectiveC features in os/object.h since they
   # won't work when we're compiling with gcc as a C compiler.
@@ -XXX,XX +XXX,XX @@ EOF
   fi
 fi
 
+##########################################
+# detect CoreAudio
+if test "$coreaudio" != "no" ; then
+  coreaudio_libs="-framework CoreAudio"
+  cat > $TMPC << EOF
+#include <CoreAudio/CoreAudio.h>
+int main(void)
+{
+  return (int)AudioGetCurrentHostTime();
+}
+EOF
+  if compile_prog "" "$coreaudio_libs" ; then
+    coreaudio=yes
+  else
+    coreaudio=no
+  fi
+fi
+
 ##########################################
 # Sound support libraries probe
 
@@ -XXX,XX +XXX,XX @@ for drv in $audio_drv_list; do
     fi
     ;;
 
-    coreaudio)
+    coreaudio | try-coreaudio)
+    if test "$coreaudio" = "no"; then
+      if test "$drv" = "try-coreaudio"; then
+        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio//')
+      else
+        error_exit "$drv check failed" \
+                "Make sure to have the $drv is available."
+      fi
+    else
       coreaudio_libs="-framework CoreAudio"
+      if test "$drv" = "try-coreaudio"; then
+        audio_drv_list=$(echo "$audio_drv_list" | sed -e 's/try-coreaudio/coreaudio/')
+      fi
+    fi
     ;;
 
     dsound)
-- 
2.20.1

From: Joelle van Dyne <j@getutm.app>

A workaround added in early days of 64-bit OSX forced x86_64 if the
host machine had 64-bit support. This creates issues when cross-
compiling for ARM64. Additionally, the user can always use --cpu=* to
manually set the host CPU and therefore this workaround should be
removed.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Joelle van Dyne <j@getutm.app>
Message-id: 20210126012457.39046-12-j@getutm.app
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 # the correct CPU with the --cpu option.
 case $targetos in
 Darwin)
-  # on Leopard most of the system is 32-bit, so we have to ask the kernel if we can
-  # run 64-bit userspace code.
-  # If the user didn't specify a CPU explicitly and the kernel says this is
-  # 64 bit hw, then assume x86_64. Otherwise fall through to the usual detection code.
-  if test -z "$cpu" && test "$(sysctl -n hw.optional.x86_64)" = "1"; then
-    cpu="x86_64"
-  fi
   HOST_DSOSUF=".dylib"
   ;;
 SunOS)
@@ -XXX,XX +XXX,XX @@ OpenBSD)
 Darwin)
   bsd="yes"
   darwin="yes"
-  if [ "$cpu" = "x86_64" ] ; then
-    QEMU_CFLAGS="-arch x86_64 $QEMU_CFLAGS"
-    QEMU_LDFLAGS="-arch x86_64 $QEMU_LDFLAGS"
-  fi
   audio_drv_list="try-coreaudio try-sdl"
   audio_possible_drivers="coreaudio sdl"
   # Disable attempts to use ObjectiveC features in os/object.h since they
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

In macOS 11, QEMU only gets access to Hypervisor.framework if it has the
respective entitlement. Add an entitlement template and automatically self
sign and apply the entitlement in the build.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Tested-by: Roman Bolshakov <r.bolshakov@yadro.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build                  | 29 +++++++++++++++++++++++++----
 accel/hvf/entitlements.plist |  8 ++++++++
 scripts/entitlement.sh       | 13 +++++++++++++
 3 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 accel/hvf/entitlements.plist
 create mode 100755 scripts/entitlement.sh

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
     }]
   endif
   foreach exe: execs
-    emulators += {exe['name']:
-         executable(exe['name'], exe['sources'],
-               install: true,
+    exe_name = exe['name']
+    exe_sign = 'CONFIG_HVF' in config_target
+    if exe_sign
+      exe_name += '-unsigned'
+    endif
+
+    emulator = executable(exe_name, exe['sources'],
+               install: not exe_sign,
                c_args: c_args,
                dependencies: arch_deps + deps + exe['dependencies'],
                objects: lib.extract_all_objects(recursive: true),
@@ -XXX,XX +XXX,XX @@ foreach target : target_dirs
                link_depends: [block_syms, qemu_syms] + exe.get('link_depends', []),
                link_args: link_args,
                gui_app: exe['gui'])
-    }
+
+    if exe_sign
+      emulators += {exe['name'] : custom_target(exe['name'],
+                   install: true,
+                   install_dir: get_option('bindir'),
+                   depends: emulator,
+                   output: exe['name'],
+                   command: [
+                     meson.current_source_dir() / 'scripts/entitlement.sh',
+                     meson.current_build_dir() / exe_name,
+                     meson.current_build_dir() / exe['name'],
+                     meson.current_source_dir() / 'accel/hvf/entitlements.plist'
+                   ])
+      }
+    else
+      emulators += {exe['name']: emulator}
+    endif
 
     if 'CONFIG_TRACE_SYSTEMTAP' in config_host
       foreach stp: [
diff --git a/accel/hvf/entitlements.plist b/accel/hvf/entitlements.plist
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/accel/hvf/entitlements.plist
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.hypervisor</key>
+    <true/>
+</dict>
+</plist>
diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/scripts/entitlement.sh
@@ -XXX,XX +XXX,XX @@
+#!/bin/sh -e
+#
+# Helper script for the build process to apply entitlements
+
+SRC="$1"
+DST="$2"
+ENTITLEMENT="$3"
+
+trap 'rm "$DST.tmp"' exit
+cp -af "$SRC" "$DST.tmp"
+codesign --entitlements "$ENTITLEMENT" --force -s - "$DST.tmp"
+mv "$DST.tmp" "$DST"
+trap '' exit
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

To ease the PCI device addition in next patches, split the code as follows:
- generic code (read/write/setup) is being kept in pvpanic.c
- ISA dependent code moved to pvpanic-isa.c

Also, rename:
- ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
- TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
- MemoryRegion io -> mr.
- pvpanic_ioport_* in pvpanic_*.

Update the build system with the new files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/pvpanic.h | 23 +++++++++-
 hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
 hw/misc/pvpanic.c         | 85 +++--------------------------------
 hw/i386/Kconfig           |  2 +-
 hw/misc/Kconfig           |  6 ++-
 hw/misc/meson.build       |  3 +-
 tests/qtest/meson.build   |  2 +-
 7 files changed, 130 insertions(+), 85 deletions(-)
 create mode 100644 hw/misc/pvpanic-isa.c

diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qom/object.h"
 
-#define TYPE_PVPANIC "pvpanic"
+#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
+/* The bit of supported pv event, TODO: include uapi header and remove this */
+#define PVPANIC_F_PANICKED      0
+#define PVPANIC_F_CRASHLOADED   1
+
+/* The pv event value */
+#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
+#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
+
+/*
+ * PVPanicState for any device type
+ */
+typedef struct PVPanicState PVPanicState;
+struct PVPanicState {
+    MemoryRegion mr;
+    uint8_t events;
+};
+
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
+
 static inline uint16_t pvpanic_port(void)
 {
-    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
+    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
     if (!o) {
         return 0;
     }
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-isa.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated pvpanic device.
+ *
+ * Copyright Fujitsu, Corp. 2013
+ *
+ * Authors:
+ *     Wen Congyang <wency@cn.fujitsu.com>
+ *     Hu Tao <hutao@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/isa/isa.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
+
+/*
+ * PVPanicISAState for ISA device and
+ * use ioport.
+ */
+struct PVPanicISAState {
+    ISADevice parent_obj;
+
+    uint16_t ioport;
+    PVPanicState pvpanic;
+};
+
+static void pvpanic_isa_initfn(Object *obj)
+{
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
+}
+
+static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
+{
+    ISADevice *d = ISA_DEVICE(dev);
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+    FWCfgState *fw_cfg = fw_cfg_find();
+    uint16_t *pvpanic_port;
+
+    if (!fw_cfg) {
+        return;
+    }
+
+    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
+    *pvpanic_port = cpu_to_le16(s->ioport);
+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
+                    sizeof(*pvpanic_port));
+
+    isa_register_ioport(d, &ps->mr, s->ioport);
+}
+
+static Property pvpanic_isa_properties[] = {
+    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
+    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = pvpanic_isa_realizefn;
+    device_class_set_props(dc, pvpanic_isa_properties);
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_isa_info = {
+    .name          = TYPE_PVPANIC_ISA_DEVICE,
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(PVPanicISAState),
+    .instance_init = pvpanic_isa_initfn,
+    .class_init    = pvpanic_isa_class_init,
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_isa_info);
+}
+
+type_init(pvpanic_register_types)
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/pvpanic.h"
 #include "qom/object.h"
 
-/* The bit of supported pv event, TODO: include uapi header and remove this */
-#define PVPANIC_F_PANICKED      0
-#define PVPANIC_F_CRASHLOADED   1
-
-/* The pv event value */
-#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
-#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
-
-typedef struct PVPanicState PVPanicState;
-DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
-                         TYPE_PVPANIC)
-
 static void handle_event(int event)
 {
     static bool logged;
@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
     }
 }
 
-#include "hw/isa/isa.h"
-
-struct PVPanicState {
-    ISADevice parent_obj;
-
-    MemoryRegion io;
-    uint16_t ioport;
-    uint8_t events;
-};
-
 /* return supported events on read */
-static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
+static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
 {
     PVPanicState *pvp = opaque;
     return pvp->events;
 }
 
-static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
+static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
                                  unsigned size)
 {
     handle_event(val);
 }
 
 static const MemoryRegionOps pvpanic_ops = {
-    .read = pvpanic_ioport_read,
-    .write = pvpanic_ioport_write,
+    .read = pvpanic_read,
+    .write = pvpanic_write,
     .impl = {
         .min_access_size = 1,
         .max_access_size = 1,
     },
 };
 
-static void pvpanic_isa_initfn(Object *obj)
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
 {
-    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
-
-    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
+    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
 }
-
-static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
-{
-    ISADevice *d = ISA_DEVICE(dev);
-    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
-    FWCfgState *fw_cfg = fw_cfg_find();
-    uint16_t *pvpanic_port;
-
-    if (!fw_cfg) {
-        return;
-    }
-
-    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
-    *pvpanic_port = cpu_to_le16(s->ioport);
-    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
-                    sizeof(*pvpanic_port));
-
-    isa_register_ioport(d, &s->io, s->ioport);
-}
-
-static Property pvpanic_isa_properties[] = {
-    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
-    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = pvpanic_isa_realizefn;
-    device_class_set_props(dc, pvpanic_isa_properties);
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-}
-
-static TypeInfo pvpanic_isa_info = {
-    .name          = TYPE_PVPANIC,
-    .parent        = TYPE_ISA_DEVICE,
-    .instance_size = sizeof(PVPanicState),
-    .instance_init = pvpanic_isa_initfn,
-    .class_init    = pvpanic_isa_class_init,
-};
-
-static void pvpanic_register_types(void)
-{
-    type_register_static(&pvpanic_isa_info);
-}
-
-type_init(pvpanic_register_types)
diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -XXX,XX +XXX,XX @@ config PC
     imply ISA_DEBUG
     imply PARALLEL
     imply PCI_DEVICES
-    imply PVPANIC
+    imply PVPANIC_ISA
     imply QXL
     imply SEV
     imply SGA
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
 config IOTKIT_SYSINFO
     bool
 
-config PVPANIC
+config PVPANIC_COMMON
+    bool
+
+config PVPANIC_ISA
     bool
     depends on ISA_BUS
+    select PVPANIC_COMMON
 
 config AUX
     bool
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
 softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
 softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
 softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
 
 # ARM devices
 softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
 softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
-softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
   (config_host.has_key('CONFIG_LINUX') and                                                  \
    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
-  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
+  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
where the PCI specific routines reside and update the build system with the new
files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/specs/pci-ids.txt    |  1 +
 include/hw/misc/pvpanic.h |  1 +
 include/hw/pci/pci.h      |  1 +
 hw/misc/pvpanic-pci.c     | 94 +++++++++++++++++++++++++++++++++++++++
 hw/misc/Kconfig           |  6 +++
 hw/misc/meson.build       |  1 +
 6 files changed, 104 insertions(+)
 create mode 100644 hw/misc/pvpanic-pci.c

diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pci-ids.txt
+++ b/docs/specs/pci-ids.txt
@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
 1b36:000d  PCI xhci usb host adapter
 1b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
 1b36:0010  PCIe NVMe device (-device nvme)
+1b36:0011  PCI PVPanic device (-device pvpanic-pci)
 
 All these devices are documented in docs/specs.
 
diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
+#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
 #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
 #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
 #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
+#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
 #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
 
 #define FMT_PCIBUS                      PRIx64
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-pci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated PCI pvpanic device.
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/pci/pci.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
+
+/*
+ * PVPanicPCIState for PCI device
+ */
+typedef struct PVPanicPCIState {
+    PCIDevice dev;
+    PVPanicState pvpanic;
+} PVPanicPCIState;
+
+static const VMStateDescription vmstate_pvpanic_pci = {
+    .name = "pvpanic-pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
+{
+    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
+
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
+}
+
+static Property pvpanic_pci_properties[] = {
+    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, pvpanic_pci_properties);
+
+    pc->realize = pvpanic_pci_realizefn;
+    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
+    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
+    pc->revision = 1;
+    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
+    dc->vmsd = &vmstate_pvpanic_pci;
+
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_pci_info = {
+    .name          = TYPE_PVPANIC_PCI_DEVICE,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PVPanicPCIState),
+    .class_init    = pvpanic_pci_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { }
+    }
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_pci_info);
+}
+
+type_init(pvpanic_register_types);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
 config PVPANIC_COMMON
     bool
 
+config PVPANIC_PCI
+    bool
+    default y if PCI_DEVICES
+    depends on PCI
+    select PVPANIC_COMMON
+
 config PVPANIC_ISA
     bool
     depends on ISA_BUS
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
 softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add pvpanic PCI device support details in docs/specs/pvpanic.txt.

diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pvpanic.txt
+++ b/docs/specs/pvpanic.txt
@@ -XXX,XX +XXX,XX @@
 PVPANIC DEVICE
 ==============
 
-pvpanic device is a simulated ISA device, through which a guest panic
+pvpanic device is a simulated device, through which a guest panic
 event is sent to qemu, and a QMP event is generated. This allows
 management apps (e.g. libvirt) to be notified and respond to the event.
 
@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
 and/or polling for guest-panicked RunState, to learn when the pvpanic
 device has fired a panic event.
 
+The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
+PCI device.
+
 ISA Interface
 -------------
 
@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
        the host should record it or report it, but should not affect
        the execution of the guest.
 
+PCI Interface
+-------------
+
+The PCI interface is similar to the ISA interface except that it uses an MMIO
+address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
+can enable a pvpanic device by adding '-device pvpanic-pci' to the command
+line.
+
 ACPI Interface
 --------------
 
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add a test case for pvpanic-pci device. The scenario is the same as pvpanic
ISA device, but is using the PCI bus.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/pvpanic-pci-test.c | 94 ++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 2 files changed, 95 insertions(+)
 create mode 100644 tests/qtest/pvpanic-pci-test.c

diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/pvpanic-pci-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for PV Panic PCI device
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "libqos/libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "libqos/pci.h"
+#include "libqos/pci-pc.h"
+#include "hw/pci/pci_regs.h"
+
+static void test_panic_nopause(void)
+{
+    uint8_t val;
+    QDict *response, *data;
+    QTestState *qts;
+    QPCIBus *pcibus;
+    QPCIDevice *dev;
+    QPCIBar bar;
+
+    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=none");
+    pcibus = qpci_new_pc(qts, NULL);
+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
+    qpci_device_enable(dev);
+    bar = qpci_iomap(dev, 0, NULL);
+
+    qpci_memread(dev, bar, 0, &val, sizeof(val));
+    g_assert_cmpuint(val, ==, 3);
+
+    val = 1;
+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
+
+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
+    g_assert(qdict_haskey(response, "data"));
+    data = qdict_get_qdict(response, "data");
+    g_assert(qdict_haskey(data, "action"));
+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "run");
+    qobject_unref(response);
+
+    qtest_quit(qts);
+}
+
+static void test_panic(void)
+{
+    uint8_t val;
+    QDict *response, *data;
+    QTestState *qts;
+    QPCIBus *pcibus;
+    QPCIDevice *dev;
+    QPCIBar bar;
+
+    qts = qtest_init("-device pvpanic-pci,addr=04.0 -action panic=pause");
+    pcibus = qpci_new_pc(qts, NULL);
+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
+    qpci_device_enable(dev);
+    bar = qpci_iomap(dev, 0, NULL);
+
+    qpci_memread(dev, bar, 0, &val, sizeof(val));
+    g_assert_cmpuint(val, ==, 3);
+
+    val = 1;
+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
+
+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
+    g_assert(qdict_haskey(response, "data"));
+    data = qdict_get_qdict(response, "data");
+    g_assert(qdict_haskey(data, "action"));
+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
+    qobject_unref(response);
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/pvpanic-pci/panic", test_panic);
+    qtest_add_func("/pvpanic-pci/panic-nopause", test_panic_nopause);
+
+    ret = g_test_run();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
+  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
-- 
2.20.1

The ptimer API currently provides two methods for setting the period:
ptimer_set_period(), which takes a period in nanoseconds, and
ptimer_set_freq(), which takes a frequency in Hz.  Neither of these
lines up nicely with the Clock API, because although both the Clock
and the ptimer track the frequency using a representation of whole
and fractional nanoseconds, conversion via either period-in-ns or
frequency-in-Hz will introduce a rounding error.

Add a new function ptimer_set_period_from_clock() which takes the
Clock object directly to avoid the rounding issues.  This includes a
facility for the user to specify that there is a frequency divider
between the Clock proper and the timer, as some timer devices like
the CMSDK APB dualtimer need this.

To avoid having to drag in clock.h from ptimer.h we add the Clock
type to typedefs.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-2-peter.maydell@linaro.org
Message-id: 20210121190622.22000-2-peter.maydell@linaro.org
---
 include/hw/ptimer.h     | 22 ++++++++++++++++++++++
 include/qemu/typedefs.h |  1 +
 hw/core/ptimer.c        | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+)

diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ptimer.h
+++ b/include/hw/ptimer.h
@@ -XXX,XX +XXX,XX @@ void ptimer_transaction_commit(ptimer_state *s);
  */
 void ptimer_set_period(ptimer_state *s, int64_t period);
 
+/**
+ * ptimer_set_period_from_clock - Set counter increment from a Clock
+ * @s: ptimer to configure
+ * @clk: pointer to Clock object to take period from
+ * @divisor: value to scale the clock frequency down by
+ *
+ * If the ptimer is being driven from a Clock, this is the preferred
+ * way to tell the ptimer about the period, because it avoids any
+ * possible rounding errors that might happen if the internal
+ * representation of the Clock period was converted to either a period
+ * in ns or a frequency in Hz.
+ *
+ * If the ptimer should run at the same frequency as the clock,
+ * pass 1 as the @divisor; if the ptimer should run at half the
+ * frequency, pass 2, and so on.
+ *
+ * This function will assert if it is called outside a
+ * ptimer_transaction_begin/commit block.
+ */
+void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clock,
+                                  unsigned int divisor);
+
 /**
  * ptimer_set_freq - Set counter frequency in Hz
  * @s: ptimer to configure
diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/typedefs.h
+++ b/include/qemu/typedefs.h
@@ -XXX,XX +XXX,XX @@ typedef struct BlockDriverState BlockDriverState;
 typedef struct BusClass BusClass;
 typedef struct BusState BusState;
 typedef struct Chardev Chardev;
+typedef struct Clock Clock;
 typedef struct CompatProperty CompatProperty;
 typedef struct CoMutex CoMutex;
 typedef struct CPUAddressSpace CPUAddressSpace;
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "block/aio.h"
 #include "sysemu/cpus.h"
+#include "hw/clock.h"
 
 #define DELTA_ADJUST     1
 #define DELTA_NO_ADJUST -1
@@ -XXX,XX +XXX,XX @@ void ptimer_set_period(ptimer_state *s, int64_t period)
     }
 }
 
+/* Set counter increment interval from a Clock */
+void ptimer_set_period_from_clock(ptimer_state *s, const Clock *clk,
+                                  unsigned int divisor)
+{
+    /*
+     * The raw clock period is a 64-bit value in units of 2^-32 ns;
+     * put another way it's a 32.32 fixed-point ns value. Our internal
+     * representation of the period is 64.32 fixed point ns, so
+     * the conversion is simple.
+     */
+    uint64_t raw_period = clock_get(clk);
+    uint64_t period_frac;
+
+    assert(s->in_transaction);
+    s->delta = ptimer_get_count(s);
+    s->period = extract64(raw_period, 32, 32);
+    period_frac = extract64(raw_period, 0, 32);
+    /*
+     * divisor specifies a possible frequency divisor between the
+     * clock and the timer, so it is a multiplier on the period.
+     * We do the multiply after splitting the raw period out into
+     * period and frac to avoid having to do a 32*64->96 multiply.
+     */
+    s->period *= divisor;
+    period_frac *= divisor;
+    s->period += extract64(period_frac, 32, 32);
+    s->period_frac = (uint32_t)period_frac;
+
+    if (s->enabled) {
+        s->need_reload = true;
+    }
+}
+
 /* Set counter frequency in Hz.  */
 void ptimer_set_freq(ptimer_state *s, uint32_t freq)
 {
-- 
2.20.1

Add a function for checking whether a clock has a source.  This is
useful for devices which have input clocks that must be wired up by
the board as it allows them to fail in realize rather than ploughing
on with a zero-period clock.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-3-peter.maydell@linaro.org
Message-id: 20210121190622.22000-3-peter.maydell@linaro.org
---
 docs/devel/clocks.rst | 16 ++++++++++++++++
 include/hw/clock.h    | 15 +++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/clocks.rst
+++ b/docs/devel/clocks.rst
@@ -XXX,XX +XXX,XX @@ object during device instance init. For example:
     /* set initial value to 10ns / 100MHz */
     clock_set_ns(clk, 10);
 
+To enforce that the clock is wired up by the board code, you can
+call ``clock_has_source()`` in your device's realize method:
+
+.. code-block:: c
+
+   if (!clock_has_source(s->clk)) {
+       error_setg(errp, "MyDevice: clk input must be connected");
+       return;
+   }
+
+Note that this only checks that the clock has been wired up; it is
+still possible that the output clock connected to it is disabled
+or has not yet been configured, in which case the period will be
+zero. You should use the clock callback to find out when the clock
+period changes.
+
 Fetching clock frequency/period
 -------------------------------
 
diff --git a/include/hw/clock.h b/include/hw/clock.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/clock.h
+++ b/include/hw/clock.h
@@ -XXX,XX +XXX,XX @@ void clock_clear_callback(Clock *clk);
  */
 void clock_set_source(Clock *clk, Clock *src);
 
+/**
+ * clock_has_source:
+ * @clk: the clock
+ *
+ * Returns true if the clock has a source clock connected to it.
+ * This is useful for devices which have input clocks which must
+ * be connected by the board/SoC code which creates them. The
+ * device code can use this to check in its realize method that
+ * the clock has been connected.
+ */
+static inline bool clock_has_source(const Clock *clk)
+{
+    return clk->source != NULL;
+}
+
 /**
  * clock_set:
  * @clk: the clock to initialize.
-- 
2.20.1

Add a simple test of the CMSDK APB timer, since we're about to do
some refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-4-peter.maydell@linaro.org
Message-id: 20210121190622.22000-4-peter.maydell@linaro.org
---
 tests/qtest/cmsdk-apb-timer-test.c | 75 ++++++++++++++++++++++++++++++
 MAINTAINERS                        |  1 +
 tests/qtest/meson.build            |  1 +
 3 files changed, 77 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-timer-test.c

diff --git a/tests/qtest/cmsdk-apb-timer-test.c b/tests/qtest/cmsdk-apb-timer-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-timer-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB timer device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/* IoTKit/ARMSSE-200 timer0; driven at 25MHz in mps2-an385, so 40ns per tick */
+#define TIMER_BASE 0x40000000
+
+#define CTRL 0
+#define VALUE 4
+#define RELOAD 8
+#define INTSTATUS 0xc
+
+static void test_timer(void)
+{
+    g_assert_true(readl(TIMER_BASE + INTSTATUS) == 0);
+
+    /* Start timer: will fire after 40 * 1000 == 40000 ns */
+    writel(TIMER_BASE + RELOAD, 1000);
+    writel(TIMER_BASE + CTRL, 9);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(40 * 500 + 1);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 0);
+
+    /* VALUE reloads at the following tick */
+    clock_step(40);
+    g_assert_cmpuint(readl(TIMER_BASE + VALUE), ==, 1000);
+
+    /* Check write-1-to-clear behaviour of INTSTATUS */
+    writel(TIMER_BASE + INTSTATUS, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 1);
+    writel(TIMER_BASE + INTSTATUS, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + INTSTATUS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + CTRL, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine mps2-an385");
+
+    qtest_add_func("/cmsdk-apb-timer/timer", test_timer);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/pl031.h
 F: include/hw/arm/primecell.h
 F: hw/timer/cmsdk-apb-timer.c
 F: include/hw/timer/cmsdk-apb-timer.h
+F: tests/qtest/cmsdk-apb-timer-test.c
 F: hw/timer/cmsdk-apb-dualtimer.c
 F: include/hw/timer/cmsdk-apb-dualtimer.h
 F: hw/char/cmsdk-apb-uart.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   ['arm-cpu-features',
-- 
2.20.1

Add a simple test of the CMSDK watchdog, since we're about to do some
refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-5-peter.maydell@linaro.org
Message-id: 20210121190622.22000-5-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 tests/qtest/cmsdk-apb-watchdog-test.c | 79 +++++++++++++++++++++++++++
 MAINTAINERS                           |  1 +
 tests/qtest/meson.build               |  1 +
 3 files changed, 81 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-watchdog-test.c

diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB watchdog device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/*
+ * lm3s811evb watchdog; at board startup this runs at 200MHz / 16 == 12.5MHz,
+ * which is 80ns per tick.
+ */
+#define WDOG_BASE 0x40000000
+
+#define WDOGLOAD 0
+#define WDOGVALUE 4
+#define WDOGCONTROL 8
+#define WDOGINTCLR 0xc
+#define WDOGRIS 0x10
+#define WDOGMIS 0x14
+#define WDOGLOCK 0xc00
+
+static void test_watchdog(void)
+{
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+
+    writel(WDOG_BASE + WDOGCONTROL, 1);
+    writel(WDOG_BASE + WDOGLOAD, 1000);
+
+    /* Step to just past the 500th tick */
+    clock_step(500 * 80 + 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(500 * 80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
+
+    /* VALUE reloads at following tick */
+    clock_step(80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+
+    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
+    clock_step(500 * 80);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    writel(WDOG_BASE + WDOGINTCLR, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine lm3s811evb");
+
+    qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
 F: hw/watchdog/cmsdk-apb-watchdog.c
 F: include/hw/watchdog/cmsdk-apb-watchdog.h
+F: tests/qtest/cmsdk-apb-watchdog-test.c
 F: hw/misc/tz-ppc.c
 F: include/hw/misc/tz-ppc.h
 F: hw/misc/tz-mpc.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   ['arm-cpu-features',
-- 
2.20.1

Add a simple test of the CMSDK dual timer, since we're about to do
some refactoring of how it is clocked.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20210128114145.20536-6-peter.maydell@linaro.org
Message-id: 20210121190622.22000-6-peter.maydell@linaro.org
---
 tests/qtest/cmsdk-apb-dualtimer-test.c | 130 +++++++++++++++++++++++++
 MAINTAINERS                            |   1 +
 tests/qtest/meson.build                |   1 +
 3 files changed, 132 insertions(+)
 create mode 100644 tests/qtest/cmsdk-apb-dualtimer-test.c

diff --git a/tests/qtest/cmsdk-apb-dualtimer-test.c b/tests/qtest/cmsdk-apb-dualtimer-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/cmsdk-apb-dualtimer-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for the CMSDK APB dualtimer device
+ *
+ * Copyright (c) 2021 Linaro Limited
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+/* IoTKit/ARMSSE dualtimer; driven at 25MHz in mps2-an385, so 40ns per tick */
+#define TIMER_BASE 0x40002000
+
+#define TIMER1LOAD 0
+#define TIMER1VALUE 4
+#define TIMER1CONTROL 8
+#define TIMER1INTCLR 0xc
+#define TIMER1RIS 0x10
+#define TIMER1MIS 0x14
+#define TIMER1BGLOAD 0x18
+
+#define TIMER2LOAD 0x20
+#define TIMER2VALUE 0x24
+#define TIMER2CONTROL 0x28
+#define TIMER2INTCLR 0x2c
+#define TIMER2RIS 0x30
+#define TIMER2MIS 0x34
+#define TIMER2BGLOAD 0x38
+
+#define CTRL_ENABLE (1 << 7)
+#define CTRL_PERIODIC (1 << 6)
+#define CTRL_INTEN (1 << 5)
+#define CTRL_PRESCALE_1 (0 << 2)
+#define CTRL_PRESCALE_16 (1 << 2)
+#define CTRL_PRESCALE_256 (2 << 2)
+#define CTRL_32BIT (1 << 1)
+#define CTRL_ONESHOT (1 << 0)
+
+static void test_dualtimer(void)
+{
+    g_assert_true(readl(TIMER_BASE + TIMER1RIS) == 0);
+
+    /* Start timer: will fire after 40000 ns */
+    writel(TIMER_BASE + TIMER1LOAD, 1000);
+    /* enable in free-running, wrapping, interrupt mode */
+    writel(TIMER_BASE + TIMER1CONTROL, CTRL_ENABLE | CTRL_INTEN);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(500 * 40 + 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(500 * 40);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0);
+
+    /*
+     * We are in free-running wrapping 16-bit mode, so on the following
+     * tick VALUE should have wrapped round to 0xffff.
+     */
+    clock_step(40);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1VALUE), ==, 0xffff);
+
+    /* Check that any write to INTCLR clears interrupt */
+    writel(TIMER_BASE + TIMER1INTCLR, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER1RIS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + TIMER1CONTROL, 0);
+}
+
+static void test_prescale(void)
+{
+    g_assert_true(readl(TIMER_BASE + TIMER2RIS) == 0);
+
+    /* Start timer: will fire after 40 * 256 * 1000 == 1024000 ns */
+    writel(TIMER_BASE + TIMER2LOAD, 1000);
+    /* enable in periodic, wrapping, interrupt mode, prescale 256 */
+    writel(TIMER_BASE + TIMER2CONTROL,
+           CTRL_ENABLE | CTRL_INTEN | CTRL_PERIODIC | CTRL_PRESCALE_256);
+
+    /* Step to just past the 500th tick and check VALUE */
+    clock_step(40 * 256 * 501);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 500);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 256 * 500);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 0);
+
+    /* In periodic mode the tick VALUE now reloads */
+    clock_step(40 * 256);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2VALUE), ==, 1000);
+
+    /* Check that any write to INTCLR clears interrupt */
+    writel(TIMER_BASE + TIMER2INTCLR, 1);
+    g_assert_cmpuint(readl(TIMER_BASE + TIMER2RIS), ==, 0);
+
+    /* Turn off the timer */
+    writel(TIMER_BASE + TIMER2CONTROL, 0);
+}
+
+int main(int argc, char **argv)
+{
+    int r;
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_start("-machine mps2-an385");
+
+    qtest_add_func("/cmsdk-apb-dualtimer/dualtimer", test_dualtimer);
+    qtest_add_func("/cmsdk-apb-dualtimer/prescale", test_prescale);
+
+    r = g_test_run();
+
+    qtest_end();
+
+    return r;
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/timer/cmsdk-apb-timer.h
 F: tests/qtest/cmsdk-apb-timer-test.c
 F: hw/timer/cmsdk-apb-dualtimer.c
 F: include/hw/timer/cmsdk-apb-dualtimer.h
+F: tests/qtest/cmsdk-apb-dualtimer-test.c
 F: hw/char/cmsdk-apb-uart.c
 F: include/hw/char/cmsdk-apb-uart.h
 F: hw/watchdog/cmsdk-apb-watchdog.c
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
 qtests_arm = \
+  (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
   (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
-- 
2.20.1

The state struct for the CMSDK APB timer device doesn't follow our
usual naming convention of camelcase -- "CMSDK" and "APB" are both
acronyms, but "TIMER" is not so should not be all-uppercase.
Globally rename the struct to "CMSDKAPBTimer" (bringing it into line
with CMSDKAPBWatchdog and CMSDKAPBDualTimer; CMSDKAPBUART remains
as-is because "UART" is an acronym).

Commit created with:
 perl -p -i -e 's/CMSDKAPBTIMER/CMSDKAPBTimer/g' hw/timer/cmsdk-apb-timer.c include/hw/arm/armsse.h include/hw/timer/cmsdk-apb-timer.h

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-7-peter.maydell@linaro.org
Message-id: 20210121190622.22000-7-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h            |  6 +++---
 include/hw/timer/cmsdk-apb-timer.h |  4 ++--
 hw/timer/cmsdk-apb-timer.c         | 28 ++++++++++++++--------------
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
     TZPPC apb_ppc0;
     TZPPC apb_ppc1;
     TZMPC mpc[IOTS_NUM_MPC];
-    CMSDKAPBTIMER timer0;
-    CMSDKAPBTIMER timer1;
-    CMSDKAPBTIMER s32ktimer;
+    CMSDKAPBTimer timer0;
+    CMSDKAPBTimer timer1;
+    CMSDKAPBTimer s32ktimer;
     qemu_or_irq ppc_irq_orgate;
     SplitIRQ sec_resp_splitter;
     SplitIRQ ppc_irq_splitter[NUM_PPCS];
diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
-OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTIMER, CMSDK_APB_TIMER)
+OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
-struct CMSDKAPBTIMER {
+struct CMSDKAPBTimer {
     /*< private >*/
     SysBusDevice parent_obj;
 
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const int timer_id[] = {
     0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 };
 
-static void cmsdk_apb_timer_update(CMSDKAPBTIMER *s)
+static void cmsdk_apb_timer_update(CMSDKAPBTimer *s)
 {
     qemu_set_irq(s->timerint, !!(s->intstatus & R_INTSTATUS_IRQ_MASK));
 }
 
 static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
     uint64_t r;
 
     switch (offset) {
@@ -XXX,XX +XXX,XX @@ static uint64_t cmsdk_apb_timer_read(void *opaque, hwaddr offset, unsigned size)
 static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
                                   unsigned size)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 
     trace_cmsdk_apb_timer_write(offset, value, size);
 
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps cmsdk_apb_timer_ops = {
 
 static void cmsdk_apb_timer_tick(void *opaque)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(opaque);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
 
     if (s->ctrl & R_CTRL_IRQEN_MASK) {
         s->intstatus |= R_INTSTATUS_IRQ_MASK;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_tick(void *opaque)
 
 static void cmsdk_apb_timer_reset(DeviceState *dev)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
     trace_cmsdk_apb_timer_reset();
     s->ctrl = 0;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
 static void cmsdk_apb_timer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(obj);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(obj);
 
     memory_region_init_io(&s->iomem, obj, &cmsdk_apb_timer_ops,
                           s, "cmsdk-apb-timer", 0x1000);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 {
-    CMSDKAPBTIMER *s = CMSDK_APB_TIMER(dev);
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
     if (s->pclk_frq == 0) {
         error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_PTIMER(timer, CMSDKAPBTIMER),
-        VMSTATE_UINT32(ctrl, CMSDKAPBTIMER),
-        VMSTATE_UINT32(value, CMSDKAPBTIMER),
-        VMSTATE_UINT32(reload, CMSDKAPBTIMER),
-        VMSTATE_UINT32(intstatus, CMSDKAPBTIMER),
+        VMSTATE_PTIMER(timer, CMSDKAPBTimer),
+        VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
+        VMSTATE_UINT32(value, CMSDKAPBTimer),
+        VMSTATE_UINT32(reload, CMSDKAPBTimer),
+        VMSTATE_UINT32(intstatus, CMSDKAPBTimer),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static Property cmsdk_apb_timer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTIMER, pclk_frq, 0),
+    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
 static const TypeInfo cmsdk_apb_timer_info = {
     .name = TYPE_CMSDK_APB_TIMER,
     .parent = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(CMSDKAPBTIMER),
+    .instance_size = sizeof(CMSDKAPBTimer),
     .instance_init = cmsdk_apb_timer_init,
     .class_init = cmsdk_apb_timer_class_init,
 };
-- 
2.20.1

As the first step in converting the CMSDK_APB_TIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the pclk-frq
property to using the Clock once all the users of this device have
been converted to wire up the Clock.

Since the device doesn't already have a doc comment for its "QEMU
interface", we add one including the new Clock.

This is a migration compatibility break for machines mps2-an505,
mps2-an521, musca-a, musca-b1.

diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_TIMER "cmsdk-apb-timer"
 OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
+/*
+ * QEMU interface:
+ *  + QOM property "pclk-frq": frequency at which the timer is clocked
+ *  + Clock input "pclk": clock for the timer
+ *  + sysbus MMIO region 0: the register bank
+ *  + sysbus IRQ 0: timer interrupt TIMERINT
+ */
 struct CMSDKAPBTimer {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     qemu_irq timerint;
     uint32_t pclk_frq;
     struct ptimer_state *timer;
+    Clock *pclk;
 
     uint32_t ctrl;
     uint32_t value;
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/irq.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/timer/cmsdk-apb-timer.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                           s, "cmsdk-apb-timer", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->timerint);
+    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
 }
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 
 static const VMStateDescription cmsdk_apb_timer_vmstate = {
     .name = "cmsdk-apb-timer",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_PTIMER(timer, CMSDKAPBTimer),
+        VMSTATE_CLOCK(pclk, CMSDKAPBTimer),
         VMSTATE_UINT32(ctrl, CMSDKAPBTimer),
         VMSTATE_UINT32(value, CMSDKAPBTimer),
         VMSTATE_UINT32(reload, CMSDKAPBTimer),
-- 
2.20.1

As the first step in converting the CMSDK_APB_DUALTIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the pclk-frq
property to using the Clock once all the users of this device have
been converted to wire up the Clock.

We take the opportunity to correct the name of the clock input to
match the hardware -- the dual timer names the clock which drives the
timers TIMCLK.  (It does also have a 'pclk' input, which is used only
for the register and APB bus logic; on the SSE-200 these clocks are
both connected together.)

This is a migration compatibility break for machines mps2-an385,
mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
musca-b1.

diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-dualtimer.h
+++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
  *
  * QEMU interface:
  *  + QOM property "pclk-frq": frequency at which the timer is clocked
+ *  + Clock input "TIMCLK": clock (for both timers)
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: combined timer interrupt TIMINTC
  *  + sysbus IRO 1: timer block 1 interrupt TIMINT1
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_DUALTIMER "cmsdk-apb-dualtimer"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
     MemoryRegion iomem;
     qemu_irq timerintc;
     uint32_t pclk_frq;
+    Clock *timclk;
 
     CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
     uint32_t timeritcr;
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/timer/cmsdk-apb-dualtimer.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
         sysbus_init_irq(sbd, &s->timermod[i].timerint);
     }
+    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
 }
 
 static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_dualtimermod_vmstate = {
 
 static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
     .name = "cmsdk-apb-dualtimer",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(timclk, CMSDKAPBDualTimer),
         VMSTATE_STRUCT_ARRAY(timermod, CMSDKAPBDualTimer,
                              CMSDK_APB_DUALTIMER_NUM_MODULES,
                              1, cmsdk_dualtimermod_vmstate,
-- 
2.20.1

As the first step in converting the CMSDK_APB_TIMER device to the
Clock framework, add a Clock input.  For the moment we do nothing
with this clock; we will change the behaviour from using the
wdogclk-frq property to using the Clock once all the users of this
device have been converted to wire up the Clock.

This is a migration compatibility break for machines mps2-an385,
mps2-an386, mps2-an500, mps2-an511, mps2-an505, mps2-an521, musca-a,
musca-b1, lm3s811evb, lm3s6965evb.

diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
+++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
  *
  * QEMU interface:
  *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
+ *  + Clock input "WDOGCLK": clock for the watchdog's timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: watchdog interrupt
  *
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/ptimer.h"
+#include "hw/clock.h"
 #include "qom/object.h"
 
 #define TYPE_CMSDK_APB_WATCHDOG "cmsdk-apb-watchdog"
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
     uint32_t wdogclk_frq;
     bool is_luminary;
     struct ptimer_state *timer;
+    Clock *wdogclk;
 
     uint32_t control;
     uint32_t intstatus;
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/registerfields.h"
+#include "hw/qdev-clock.h"
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
 #include "migration/vmstate.h"
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
                           s, "cmsdk-apb-watchdog", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->wdogint);
+    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
 
     s->is_luminary = false;
     s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
 
 static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
     .name = "cmsdk-apb-watchdog",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(wdogclk, CMSDKAPBWatchdog),
         VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
         VMSTATE_UINT32(control, CMSDKAPBWatchdog),
         VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
-- 
2.20.1

While we transition the ARMSSE code from integer properties
specifying clock frequencies to Clock objects, we want to have the
device provide both at once.  We want the final name of the main
input Clock to be "MAINCLK", following the hardware name.
Unfortunately creating an input Clock with a name X creates an
under-the-hood QOM property X; for "MAINCLK" this clashes with the
existing UINT32 property of that name.

Rename the UINT32 property to MAINCLK_FRQ so it can coexist with the
MAINCLK Clock; once the transition is complete MAINCLK_FRQ will be
deleted.

Commit created with:
 perl -p -i -e 's/MAINCLK/MAINCLK_FRQ/g' hw/arm/{armsse,mps2-tz,musca}.c include/hw/arm/armsse.h

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  * QEMU interface:
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
- *  + QOM property "MAINCLK" is the frequency of the main system clock
+ *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
  *    (In hardware, the SSE-200 permits the number of expansion interrupts
  *    for the two CPUs to be configured separately, but we restrict it to
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     }
 
     if (!s->mainclk_frq) {
-        error_setg(errp, "MAINCLK property was not set");
+        error_setg(errp, "MAINCLK_FRQ property was not set");
         return;
     }
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
     object_property_set_link(OBJECT(&mms->iotkit), "memory",
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
-    qdev_prop_set_uint32(iotkitdev, "MAINCLK", SYSCLK_FRQ);
+    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 
     /*
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
-    qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
     /*
      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
-- 
2.20.1

Create two input clocks on the ARMSSE devices, one for the normal
MAINCLK, and one for the 32KHz S32KCLK, and wire these up to the
appropriate devices.  The old property-based clock frequency setting
will remain in place until conversion is complete.

This is a migration compatibility break for machines mps2-an505,
mps2-an521, musca-a, musca-b1.

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *  per-CPU identity and control register blocks
  *
  * QEMU interface:
+ *  + Clock input "MAINCLK": clock for CPUs and most peripherals
+ *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
  *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/armsse-mhu.h"
 #include "hw/misc/unimp.h"
 #include "hw/or-irq.h"
+#include "hw/clock.h"
 #include "hw/core/split-irq.h"
 #include "hw/cpu/cluster.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
 
     uint32_t nsccfg;
 
+    Clock *mainclk;
+    Clock *s32kclk;
+
     /* Properties */
     MemoryRegion *board_memory;
     uint32_t exp_numirq;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/armsse.h"
 #include "hw/arm/boot.h"
 #include "hw/irq.h"
+#include "hw/qdev-clock.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
     assert(info->sram_banks <= MAX_SRAM_BANKS);
     assert(info->num_cpus <= SSE_MAX_CPUS);
 
+    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
+    s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
+
     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
 
     for (i = 0; i < info->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      * map its upstream ends to the right place in the container.
      */
     qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                              &error_abort);
 
     qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                              &error_abort);
 
     qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      *   0x4002f000: S32K timer
      */
     qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
+    qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 
     qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
+    qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 
     qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 
     qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
+    qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
 
 static const VMStateDescription armsse_vmstate = {
     .name = "iotkit",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(mainclk, ARMSSE),
+        VMSTATE_CLOCK(s32kclk, ARMSSE),
         VMSTATE_UINT32(nsccfg, ARMSSE),
         VMSTATE_END_OF_LIST()
     }
-- 
2.20.1

The old-style convenience function cmsdk_apb_timer_create() for
creating CMSDK_APB_TIMER objects is used in only two places in
mps2.c.  Most of the rest of the code in that file uses the new
"initialize in place" coding style.

We want to connect up a Clock object which should be done between the
object creation and realization; rather than adding a Clock* argument
to the convenience function, convert the timer creation code in
mps2.c to the same style as is used already for the watchdog,
dualtimer and other devices, and delete the now-unused convenience
function.

diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     uint32_t intstatus;
 };
 
-/**
- * cmsdk_apb_timer_create - convenience function to create TYPE_CMSDK_APB_TIMER
- * @addr: location in system memory to map registers
- * @pclk_frq: frequency in Hz of the PCLK clock (used for calculating baud rate)
- */
-static inline DeviceState *cmsdk_apb_timer_create(hwaddr addr,
-                                                 qemu_irq timerint,
-                                                 uint32_t pclk_frq)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qdev_new(TYPE_CMSDK_APB_TIMER);
-    s = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_uint32(dev, "pclk-frq", pclk_frq);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_mmio_map(s, 0, addr);
-    sysbus_connect_irq(s, 0, timerint);
-    return dev;
-}
-
 #endif
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
     /* CMSDK APB subsystem */
     CMSDKAPBDualTimer dualtimer;
     CMSDKAPBWatchdog watchdog;
+    CMSDKAPBTimer timer[2];
 };
 
 #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     }
 
     /* CMSDK APB subsystem */
-    cmsdk_apb_timer_create(0x40000000, qdev_get_gpio_in(armv7m, 8), SYSCLK_FRQ);
-    cmsdk_apb_timer_create(0x40001000, qdev_get_gpio_in(armv7m, 9), SYSCLK_FRQ);
+    for (i = 0; i < ARRAY_SIZE(mms->timer); i++) {
+        g_autofree char *name = g_strdup_printf("timer%d", i);
+        hwaddr base = 0x40000000 + i * 0x1000;
+        int irqno = 8 + i;
+        SysBusDevice *sbd;
+
+        object_initialize_child(OBJECT(mms), name, &mms->timer[i],
+                                TYPE_CMSDK_APB_TIMER);
+        sbd = SYS_BUS_DEVICE(&mms->timer[i]);
+        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
+        sysbus_realize_and_unref(sbd, &error_fatal);
+        sysbus_mmio_map(sbd, 0, base);
+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
+    }
+
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
-- 
2.20.1

Create a fixed-frequency Clock object to be the SYSCLK, and wire it
up to the devices that require it.

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "net/net.h"
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 typedef enum MPS2FPGAType {
@@ -XXX,XX +XXX,XX @@ struct MPS2MachineState {
     CMSDKAPBDualTimer dualtimer;
     CMSDKAPBWatchdog watchdog;
     CMSDKAPBTimer timer[2];
+    Clock *sysclk;
 };
 
 #define TYPE_MPS2_MACHINE "mps2"
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
+    /* This clock doesn't need migration because it is fixed-frequency */
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+
     /* The FPGA images have an odd combination of different RAMs,
      * because in hardware they are different implementations and
      * connected to different buses, giving varying performance/size
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                 TYPE_CMSDK_APB_TIMER);
         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
         qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
+        qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
         sysbus_realize_and_unref(sbd, &error_fatal);
         sysbus_mmio_map(sbd, 0, base);
         sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(armv7m, irqno));
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
     qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
+    qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
                        qdev_get_gpio_in(armv7m, 10));
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                             TYPE_CMSDK_APB_WATCHDOG);
     qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
+    qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
                        qdev_get_gpio_in_named(armv7m, "NMI", 0));
-- 
2.20.1

Create and connect the two clocks needed by the ARMSSE.

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "net/net.h"
 #include "hw/core/split-irq.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 #define MPS2TZ_NUMIRQ 92
@@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState {
     qemu_or_irq uart_irq_orgate;
     DeviceState *lan9118;
     SplitIRQ cpu_irq_splitter[MPS2TZ_NUMIRQ];
+    Clock *sysclk;
+    Clock *s32kclk;
 };
 
 #define TYPE_MPS2TZ_MACHINE "mps2tz"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
 
 /* Main SYSCLK frequency in Hz */
 #define SYSCLK_FRQ 20000000
+/* Slow 32Khz S32KCLK frequency in Hz */
+#define S32KCLK_FRQ (32 * 1000)
 
 /* Create an alias of an entire original MemoryRegion @orig
  * located at @base in the memory map.
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
+    /* These clocks don't need migration because they are fixed-frequency */
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
+    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
+
     object_initialize_child(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
                             mmc->armsse_type);
     iotkitdev = DEVICE(&mms->iotkit);
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
     qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
+    qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
+    qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
 
     /*
-- 
2.20.1

Create and connect the two clocks needed by the ARMSSE.

diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/tz-ppc.h"
 #include "hw/misc/unimp.h"
 #include "hw/rtc/pl031.h"
+#include "hw/qdev-clock.h"
 #include "qom/object.h"
 
 #define MUSCA_NUMIRQ_MAX 96
@@ -XXX,XX +XXX,XX @@ struct MuscaMachineState {
     UnimplementedDeviceState sdio;
     UnimplementedDeviceState gpio;
     UnimplementedDeviceState cryptoisland;
+    Clock *sysclk;
+    Clock *s32kclk;
 };
 
 #define TYPE_MUSCA_MACHINE "musca"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(MuscaMachineState, MuscaMachineClass, MUSCA_MACHINE)
  * don't model that in our SSE-200 model yet.
  */
 #define SYSCLK_FRQ 40000000
+/* Slow 32Khz S32KCLK frequency in Hz */
+#define S32KCLK_FRQ (32 * 1000)
 
 static qemu_irq get_sse_irq_in(MuscaMachineState *mms, int irqno)
 {
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
         exit(1);
     }
 
+    mms->sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(mms->sysclk, SYSCLK_FRQ);
+    mms->s32kclk = clock_new(OBJECT(machine), "S32KCLK");
+    clock_set_hz(mms->s32kclk, S32KCLK_FRQ);
+
     object_initialize_child(OBJECT(machine), "sse-200", &mms->sse,
                             TYPE_SSE200);
     ssedev = DEVICE(&mms->sse);
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
+    qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
+    qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
     /*
      * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
      * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
-- 
2.20.1

Convert the SSYS code in the Stellaris boards (which encapsulates the
system registers) to a proper QOM device.  This will provide us with
somewhere to put the output Clock whose frequency depends on the
setting of the PLL configuration registers.

This is a migration compatibility break for lm3s811evb, lm3s6965evb.

We use 3-phase reset here because the Clock will need to propagate
its value in the hold phase.

For the moment we reset the device during the board creation so that
the system_clock_scale global gets set; this will be removed in a
subsequent commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-17-peter.maydell@linaro.org
Message-id: 20210121190622.22000-17-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 132 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 107 insertions(+), 25 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_gptm_realize(DeviceState *dev, Error **errp)
 
 /* System controller.  */
 
-typedef struct {
+#define TYPE_STELLARIS_SYS "stellaris-sys"
+OBJECT_DECLARE_SIMPLE_TYPE(ssys_state, STELLARIS_SYS)
+
+struct ssys_state {
+    SysBusDevice parent_obj;
+
     MemoryRegion iomem;
     uint32_t pborctl;
     uint32_t ldopctl;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t dcgc[3];
     uint32_t clkvclr;
     uint32_t ldoarst;
+    qemu_irq irq;
+    /* Properties (all read-only registers) */
     uint32_t user0;
     uint32_t user1;
-    qemu_irq irq;
-    stellaris_board_info *board;
-} ssys_state;
+    uint32_t did0;
+    uint32_t did1;
+    uint32_t dc0;
+    uint32_t dc1;
+    uint32_t dc2;
+    uint32_t dc3;
+    uint32_t dc4;
+};
 
 static void ssys_update(ssys_state *s)
 {
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_fury[16] = {
 
 static int ssys_board_class(const ssys_state *s)
 {
-    uint32_t did0 = s->board->did0;
+    uint32_t did0 = s->did0;
     switch (did0 & DID0_VER_MASK) {
     case DID0_VER_0:
         return DID0_CLASS_SANDSTORM;
@@ -XXX,XX +XXX,XX @@ static uint64_t ssys_read(void *opaque, hwaddr offset,
 
     switch (offset) {
     case 0x000: /* DID0 */
-        return s->board->did0;
+        return s->did0;
     case 0x004: /* DID1 */
-        return s->board->did1;
+        return s->did1;
     case 0x008: /* DC0 */
-        return s->board->dc0;
+        return s->dc0;
     case 0x010: /* DC1 */
-        return s->board->dc1;
+        return s->dc1;
     case 0x014: /* DC2 */
-        return s->board->dc2;
+        return s->dc2;
     case 0x018: /* DC3 */
-        return s->board->dc3;
+        return s->dc3;
     case 0x01c: /* DC4 */
-        return s->board->dc4;
+        return s->dc4;
     case 0x030: /* PBORCTL */
         return s->pborctl;
     case 0x034: /* LDOPCTL */
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps ssys_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-static void ssys_reset(void *opaque)
+static void stellaris_sys_reset_enter(Object *obj, ResetType type)
 {
-    ssys_state *s = (ssys_state *)opaque;
+    ssys_state *s = STELLARIS_SYS(obj);
 
     s->pborctl = 0x7ffd;
     s->rcc = 0x078e3ac0;
@@ -XXX,XX +XXX,XX @@ static void ssys_reset(void *opaque)
     s->rcgc[0] = 1;
     s->scgc[0] = 1;
     s->dcgc[0] = 1;
+}
+
+static void stellaris_sys_reset_hold(Object *obj)
+{
+    ssys_state *s = STELLARIS_SYS(obj);
+
     ssys_calculate_system_clock(s);
 }
 
+static void stellaris_sys_reset_exit(Object *obj)
+{
+}
+
 static int stellaris_sys_post_load(void *opaque, int version_id)
 {
     ssys_state *s = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
     }
 };
 
+static Property stellaris_sys_properties[] = {
+    DEFINE_PROP_UINT32("user0", ssys_state, user0, 0),
+    DEFINE_PROP_UINT32("user1", ssys_state, user1, 0),
+    DEFINE_PROP_UINT32("did0", ssys_state, did0, 0),
+    DEFINE_PROP_UINT32("did1", ssys_state, did1, 0),
+    DEFINE_PROP_UINT32("dc0", ssys_state, dc0, 0),
+    DEFINE_PROP_UINT32("dc1", ssys_state, dc1, 0),
+    DEFINE_PROP_UINT32("dc2", ssys_state, dc2, 0),
+    DEFINE_PROP_UINT32("dc3", ssys_state, dc3, 0),
+    DEFINE_PROP_UINT32("dc4", ssys_state, dc4, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static void stellaris_sys_instance_init(Object *obj)
+{
+    ssys_state *s = STELLARIS_SYS(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(s);
+
+    memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
 static int stellaris_sys_init(uint32_t base, qemu_irq irq,
                               stellaris_board_info * board,
                               uint8_t *macaddr)
 {
-    ssys_state *s;
+    DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
-    s = g_new0(ssys_state, 1);
-    s->irq = irq;
-    s->board = board;
     /* Most devices come preprogrammed with a MAC address in the user data. */
-    s->user0 = macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16);
-    s->user1 = macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16);
+    qdev_prop_set_uint32(dev, "user0",
+                         macaddr[0] | (macaddr[1] << 8) | (macaddr[2] << 16));
+    qdev_prop_set_uint32(dev, "user1",
+                         macaddr[3] | (macaddr[4] << 8) | (macaddr[5] << 16));
+    qdev_prop_set_uint32(dev, "did0", board->did0);
+    qdev_prop_set_uint32(dev, "did1", board->did1);
+    qdev_prop_set_uint32(dev, "dc0", board->dc0);
+    qdev_prop_set_uint32(dev, "dc1", board->dc1);
+    qdev_prop_set_uint32(dev, "dc2", board->dc2);
+    qdev_prop_set_uint32(dev, "dc3", board->dc3);
+    qdev_prop_set_uint32(dev, "dc4", board->dc4);
+
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, base);
+    sysbus_connect_irq(sbd, 0, irq);
+
+    /*
+     * Normally we should not be resetting devices like this during
+     * board creation. For the moment we need to do so, because
+     * system_clock_scale will only get set when the STELLARIS_SYS
+     * device is reset, and we need its initial value to pass to
+     * the watchdog device. This hack can be removed once the
+     * watchdog has been converted to use a Clock input instead.
+     */
+    device_cold_reset(dev);
 
-    memory_region_init_io(&s->iomem, NULL, &ssys_ops, s, "ssys", 0x00001000);
-    memory_region_add_subregion(get_system_memory(), base, &s->iomem);
-    ssys_reset(s);
-    vmstate_register(NULL, VMSTATE_INSTANCE_ID_ANY, &vmstate_stellaris_sys, s);
     return 0;
 }
 
-
 /* I2C controller.  */
 
 #define TYPE_STELLARIS_I2C "stellaris-i2c"
@@ -XXX,XX +XXX,XX @@ static const TypeInfo stellaris_adc_info = {
     .class_init    = stellaris_adc_class_init,
 };
 
+static void stellaris_sys_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    dc->vmsd = &vmstate_stellaris_sys;
+    rc->phases.enter = stellaris_sys_reset_enter;
+    rc->phases.hold = stellaris_sys_reset_hold;
+    rc->phases.exit = stellaris_sys_reset_exit;
+    device_class_set_props(dc, stellaris_sys_properties);
+}
+
+static const TypeInfo stellaris_sys_info = {
+    .name = TYPE_STELLARIS_SYS,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(ssys_state),
+    .instance_init = stellaris_sys_instance_init,
+    .class_init = stellaris_sys_class_init,
+};
+
 static void stellaris_register_types(void)
 {
     type_register_static(&stellaris_i2c_info);
     type_register_static(&stellaris_gptm_info);
     type_register_static(&stellaris_adc_info);
+    type_register_static(&stellaris_sys_info);
 }
 
 type_init(stellaris_register_types)
-- 
2.20.1

Create and connect the Clock input for the watchdog device on the
Stellaris boards.  Because the Stellaris boards model the ability to
change the clock rate by programming PLL registers, we have to create
an output Clock on the ssys_state device and wire it up to the
watchdog.

Note that the old comment on ssys_calculate_system_clock() got the
units wrong -- system_clock_scale is in nanoseconds, not
milliseconds.  Improve the commentary to clarify how we are
calculating the period.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-18-peter.maydell@linaro.org
Message-id: 20210121190622.22000-18-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 43 +++++++++++++++++++++++++++++++------------
 1 file changed, 31 insertions(+), 12 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/watchdog/cmsdk-apb-watchdog.h"
 #include "migration/vmstate.h"
 #include "hw/misc/unimp.h"
+#include "hw/qdev-clock.h"
 #include "cpu.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct ssys_state {
     uint32_t clkvclr;
     uint32_t ldoarst;
     qemu_irq irq;
+    Clock *sysclk;
     /* Properties (all read-only registers) */
     uint32_t user0;
     uint32_t user1;
@@ -XXX,XX +XXX,XX @@ static bool ssys_use_rcc2(ssys_state *s)
 }
 
 /*
- * Caculate the sys. clock period in ms.
+ * Calculate the system clock period. We only want to propagate
+ * this change to the rest of the system if we're not being called
+ * from migration post-load.
  */
-static void ssys_calculate_system_clock(ssys_state *s)
+static void ssys_calculate_system_clock(ssys_state *s, bool propagate_clock)
 {
+    /*
+     * SYSDIV field specifies divisor: 0 == /1, 1 == /2, etc.  Input
+     * clock is 200MHz, which is a period of 5 ns. Dividing the clock
+     * frequency by X is the same as multiplying the period by X.
+     */
     if (ssys_use_rcc2(s)) {
         system_clock_scale = 5 * (((s->rcc2 >> 23) & 0x3f) + 1);
     } else {
         system_clock_scale = 5 * (((s->rcc >> 23) & 0xf) + 1);
     }
+    clock_set_ns(s->sysclk, system_clock_scale);
+    if (propagate_clock) {
+        clock_propagate(s->sysclk);
+    }
 }
 
 static void ssys_write(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
             s->int_status |= (1 << 6);
         }
         s->rcc = value;
-        ssys_calculate_system_clock(s);
+        ssys_calculate_system_clock(s, true);
         break;
     case 0x070: /* RCC2 */
         if (ssys_board_class(s) == DID0_CLASS_SANDSTORM) {
@@ -XXX,XX +XXX,XX @@ static void ssys_write(void *opaque, hwaddr offset,
             s->int_status |= (1 << 6);
         }
         s->rcc2 = value;
-        ssys_calculate_system_clock(s);
+        ssys_calculate_system_clock(s, true);
         break;
     case 0x100: /* RCGC0 */
         s->rcgc[0] = value;
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_reset_hold(Object *obj)
 {
     ssys_state *s = STELLARIS_SYS(obj);
 
-    ssys_calculate_system_clock(s);
+    /* OK to propagate clocks from the hold phase */
+    ssys_calculate_system_clock(s, true);
 }
 
 static void stellaris_sys_reset_exit(Object *obj)
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_post_load(void *opaque, int version_id)
 {
     ssys_state *s = opaque;
 
-    ssys_calculate_system_clock(s);
+    ssys_calculate_system_clock(s, false);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_sys = {
         VMSTATE_UINT32_ARRAY(dcgc, ssys_state, 3),
         VMSTATE_UINT32(clkvclr, ssys_state),
         VMSTATE_UINT32(ldoarst, ssys_state),
+        /* No field for sysclk -- handled in post-load instead */
         VMSTATE_END_OF_LIST()
     }
 };
@@ -XXX,XX +XXX,XX @@ static void stellaris_sys_instance_init(Object *obj)
     memory_region_init_io(&s->iomem, obj, &ssys_ops, s, "ssys", 0x00001000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq);
+    s->sysclk = qdev_init_clock_out(DEVICE(s), "SYSCLK");
 }
 
-static int stellaris_sys_init(uint32_t base, qemu_irq irq,
-                              stellaris_board_info * board,
-                              uint8_t *macaddr)
+static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
+                                       stellaris_board_info *board,
+                                       uint8_t *macaddr)
 {
     DeviceState *dev = qdev_new(TYPE_STELLARIS_SYS);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static int stellaris_sys_init(uint32_t base, qemu_irq irq,
      */
     device_cold_reset(dev);
 
-    return 0;
+    return dev;
 }
 
 /* I2C controller.  */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     int flash_size;
     I2CBus *i2c;
     DeviceState *dev;
+    DeviceState *ssys_dev;
     int i;
     int j;
 
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
-                       board, nd_table[0].macaddr.a);
+    ssys_dev = stellaris_sys_init(0x400fe000, qdev_get_gpio_in(nvic, 28),
+                                  board, nd_table[0].macaddr.a);
 
 
     if (board->dc1 & (1 << 3)) { /* watchdog present */
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         /* system_clock_scale is valid now */
         uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
         qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
+        qdev_connect_clock_in(dev, "WDOGCLK",
+                              qdev_get_clock_out(ssys_dev, "SYSCLK"));
 
         sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
         sysbus_mmio_map(SYS_BUS_DEVICE(dev),
-- 
2.20.1

Switch the CMSDK APB timer device over to using its Clock input; the
pclk-frq property is now ignored.

diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev)
     ptimer_transaction_commit(s->timer);
 }
 
+static void cmsdk_apb_timer_clk_update(void *opaque)
+{
+    CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque);
+
+    ptimer_transaction_begin(s->timer);
+    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
+    ptimer_transaction_commit(s->timer);
+}
+
 static void cmsdk_apb_timer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj)
                           s, "cmsdk-apb-timer", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->timerint);
-    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", NULL, NULL);
+    s->pclk = qdev_init_clock_in(DEVICE(s), "pclk",
+                                 cmsdk_apb_timer_clk_update, s);
 }
 
 static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBTimer *s = CMSDK_APB_TIMER(dev);
 
-    if (s->pclk_frq == 0) {
-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+    if (!clock_has_source(s->pclk)) {
+        error_setg(errp, "CMSDK APB timer: pclk clock must be connected");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     ptimer_transaction_begin(s->timer);
-    ptimer_set_freq(s->timer, s->pclk_frq);
+    ptimer_set_period_from_clock(s->timer, s->pclk, 1);
     ptimer_transaction_commit(s->timer);
 }
 
-- 
2.20.1

Switch the CMSDK APB dualtimer device over to using its Clock input;
the pclk-frq property is now ignored.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-20-peter.maydell@linaro.org
Message-id: 20210121190622.22000-20-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/timer/cmsdk-apb-dualtimer.c | 42 ++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 5 deletions(-)

diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_update(CMSDKAPBDualTimer *s)
     qemu_set_irq(s->timerintc, timintc);
 }
 
+static int cmsdk_dualtimermod_divisor(CMSDKAPBDualTimerModule *m)
+{
+    /* Return the divisor set by the current CONTROL.PRESCALE value */
+    switch (FIELD_EX32(m->control, CONTROL, PRESCALE)) {
+    case 0:
+        return 1;
+    case 1:
+        return 16;
+    case 2:
+    case 3: /* UNDEFINED, we treat like 2 (and complained when it was set) */
+        return 256;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
                                              uint32_t newctrl)
 {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_write_control(CMSDKAPBDualTimerModule *m,
         default:
             g_assert_not_reached();
         }
-        ptimer_set_freq(m->timer, m->parent->pclk_frq / divisor);
+        ptimer_set_period_from_clock(m->timer, m->parent->timclk, divisor);
     }
 
     if (changed & R_CONTROL_MODE_MASK) {
@@ -XXX,XX +XXX,XX @@ static void cmsdk_dualtimermod_reset(CMSDKAPBDualTimerModule *m)
      * limit must both be set to 0xffff, so we wrap at 16 bits.
      */
     ptimer_set_limit(m->timer, 0xffff, 1);
-    ptimer_set_freq(m->timer, m->parent->pclk_frq);
+    ptimer_set_period_from_clock(m->timer, m->parent->timclk,
+                                 cmsdk_dualtimermod_divisor(m));
     ptimer_transaction_commit(m->timer);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_reset(DeviceState *dev)
     s->timeritop = 0;
 }
 
+static void cmsdk_apb_dualtimer_clk_update(void *opaque)
+{
+    CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(opaque);
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
+        CMSDKAPBDualTimerModule *m = &s->timermod[i];
+        ptimer_transaction_begin(m->timer);
+        ptimer_set_period_from_clock(m->timer, m->parent->timclk,
+                                     cmsdk_dualtimermod_divisor(m));
+        ptimer_transaction_commit(m->timer);
+    }
+}
+
 static void cmsdk_apb_dualtimer_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj)
     for (i = 0; i < ARRAY_SIZE(s->timermod); i++) {
         sysbus_init_irq(sbd, &s->timermod[i].timerint);
     }
-    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", NULL, NULL);
+    s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK",
+                                   cmsdk_apb_dualtimer_clk_update, s);
 }
 
 static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp)
     CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(dev);
     int i;
 
-    if (s->pclk_frq == 0) {
-        error_setg(errp, "CMSDK APB timer: pclk-frq property must be set");
+    if (!clock_has_source(s->timclk)) {
+        error_setg(errp, "CMSDK APB dualtimer: TIMCLK clock must be connected");
         return;
     }
 
-- 
2.20.1

Switch the CMSDK APB watchdog device over to using its Clock input;
the wdogclk_frq property is now ignored.

diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev)
     ptimer_transaction_commit(s->timer);
 }
 
+static void cmsdk_apb_watchdog_clk_update(void *opaque)
+{
+    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
+
+    ptimer_transaction_begin(s->timer);
+    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
+    ptimer_transaction_commit(s->timer);
+}
+
 static void cmsdk_apb_watchdog_init(Object *obj)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj)
                           s, "cmsdk-apb-watchdog", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->wdogint);
-    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", NULL, NULL);
+    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK",
+                                    cmsdk_apb_watchdog_clk_update, s);
 
     s->is_luminary = false;
     s->id = cmsdk_apb_watchdog_id;
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
 {
     CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
 
-    if (s->wdogclk_frq == 0) {
+    if (!clock_has_source(s->wdogclk)) {
         error_setg(errp,
-                   "CMSDK APB watchdog: wdogclk-frq property must be set");
+                   "CMSDK APB watchdog: WDOGCLK clock must be connected");
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
     ptimer_transaction_begin(s->timer);
-    ptimer_set_freq(s->timer, s->wdogclk_frq);
+    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
     ptimer_transaction_commit(s->timer);
 }
 
-- 
2.20.1

Now that the CMSDK APB watchdog uses its Clock input, it will
correctly respond when the system clock frequency is changed using
the RCC register on in the Stellaris board system registers.  Test
that when the RCC register is written it causes the watchdog timer to
change speed.

diff --git a/tests/qtest/cmsdk-apb-watchdog-test.c b/tests/qtest/cmsdk-apb-watchdog-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/cmsdk-apb-watchdog-test.c
+++ b/tests/qtest/cmsdk-apb-watchdog-test.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "libqtest-single.h"
 
 /*
@@ -XXX,XX +XXX,XX @@
 #define WDOGMIS 0x14
 #define WDOGLOCK 0xc00
 
+#define SSYS_BASE 0x400fe000
+#define RCC 0x60
+#define SYSDIV_SHIFT 23
+#define SYSDIV_LENGTH 4
+
 static void test_watchdog(void)
 {
     g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
@@ -XXX,XX +XXX,XX @@ static void test_watchdog(void)
     g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
 }
 
+static void test_clock_change(void)
+{
+    uint32_t rcc;
+
+    /*
+     * Test that writing to the stellaris board's RCC register to
+     * change the system clock frequency causes the watchdog
+     * to change the speed it counts at.
+     */
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+
+    writel(WDOG_BASE + WDOGCONTROL, 1);
+    writel(WDOG_BASE + WDOGLOAD, 1000);
+
+    /* Step to just past the 500th tick */
+    clock_step(80 * 500 + 1);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+
+    /* Rewrite RCC.SYSDIV from 16 to 8, so the clock is now 40ns per tick */
+    rcc = readl(SSYS_BASE + RCC);
+    g_assert_cmpuint(extract32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH), ==, 0xf);
+    rcc = deposit32(rcc, SYSDIV_SHIFT, SYSDIV_LENGTH, 7);
+    writel(SSYS_BASE + RCC, rcc);
+
+    /* Just past the 1000th tick: timer should have fired */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 0);
+
+    /* VALUE reloads at following tick */
+    clock_step(41);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+
+    /* Writing any value to WDOGINTCLR clears the interrupt and reloads */
+    clock_step(40 * 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 500);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 1);
+    writel(WDOG_BASE + WDOGINTCLR, 0);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGVALUE), ==, 1000);
+    g_assert_cmpuint(readl(WDOG_BASE + WDOGRIS), ==, 0);
+}
+
 int main(int argc, char **argv)
 {
     int r;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_start("-machine lm3s811evb");
 
     qtest_add_func("/cmsdk-apb-watchdog/watchdog", test_watchdog);
+    qtest_add_func("/cmsdk-apb-watchdog/watchdog_clock_change",
+                   test_clock_change);
 
     r = g_test_run();
 
-- 
2.20.1

Use the MAINCLK Clock input to set the system_clock_scale variable
rather than using the mainclk_frq property.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20210128114145.20536-23-peter.maydell@linaro.org
Message-id: 20210121190622.22000-23-peter.maydell@linaro.org
---
 hw/arm/armsse.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_forward_sec_resp_cfg(ARMSSE *s)
     qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in);
 }
 
+static void armsse_mainclk_update(void *opaque)
+{
+    ARMSSE *s = ARM_SSE(opaque);
+    /*
+     * Set system_clock_scale from our Clock input; this is what
+     * controls the tick rate of the CPU SysTick timer.
+     */
+    system_clock_scale = clock_ticks_to_ns(s->mainclk, 1);
+}
+
 static void armsse_init(Object *obj)
 {
     ARMSSE *s = ARM_SSE(obj);
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
     assert(info->sram_banks <= MAX_SRAM_BANKS);
     assert(info->num_cpus <= SSE_MAX_CPUS);
 
-    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", NULL, NULL);
+    s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK",
+                                    armsse_mainclk_update, s);
     s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL);
 
     memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    if (!s->mainclk_frq) {
-        error_setg(errp, "MAINCLK_FRQ property was not set");
-        return;
+    if (!clock_has_source(s->mainclk)) {
+        error_setg(errp, "MAINCLK clock was not connected");
+    }
+    if (!clock_has_source(s->s32kclk)) {
+        error_setg(errp, "S32KCLK clock was not connected");
     }
 
     assert(info->num_cpus <= SSE_MAX_CPUS);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      */
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container);
 
-    system_clock_scale = NANOSECONDS_PER_SECOND / s->mainclk_frq;
+    /* Set initial system_clock_scale from MAINCLK */
+    armsse_mainclk_update(s);
 }
 
 static void armsse_idau_check(IDAUInterface *ii, uint32_t address,
-- 
2.20.1

Remove all the code that sets frequency properties on the CMSDK
timer, dualtimer and watchdog devices and on the ARMSSE SoC device:
these properties are unused now that the devices rely on their Clock
inputs instead.

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      * it to the appropriate PPC port; then we can realize the PPC and
      * map its upstream ends to the right place in the container.
      */
-    qdev_prop_set_uint32(DEVICE(&s->timer0), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     object_property_set_link(OBJECT(&s->apb_ppc0), "port[0]", OBJECT(mr),
                              &error_abort);
 
-    qdev_prop_set_uint32(DEVICE(&s->timer1), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     object_property_set_link(OBJECT(&s->apb_ppc0), "port[1]", OBJECT(mr),
                              &error_abort);
 
-    qdev_prop_set_uint32(DEVICE(&s->dualtimer), "pclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* Devices behind APB PPC1:
      *   0x4002f000: S32K timer
      */
-    qdev_prop_set_uint32(DEVICE(&s->s32ktimer), "pclk-frq", S32KCLK);
     qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
                           qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
 
-    qdev_prop_set_uint32(DEVICE(&s->s32kwatchdog), "wdogclk-frq", S32KCLK);
     qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
 
     /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */
 
-    qdev_prop_set_uint32(DEVICE(&s->nswatchdog), "wdogclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                        armsse_get_common_irq_in(s, 1));
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000);
 
-    qdev_prop_set_uint32(DEVICE(&s->swatchdog), "wdogclk-frq", s->mainclk_frq);
     qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) {
         return;
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
     object_property_set_link(OBJECT(&mms->iotkit), "memory",
                              OBJECT(system_memory), &error_abort);
     qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", MPS2TZ_NUMIRQ);
-    qdev_prop_set_uint32(iotkitdev, "MAINCLK_FRQ", SYSCLK_FRQ);
     qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk);
     qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal);
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
         object_initialize_child(OBJECT(mms), name, &mms->timer[i],
                                 TYPE_CMSDK_APB_TIMER);
         sbd = SYS_BUS_DEVICE(&mms->timer[i]);
-        qdev_prop_set_uint32(DEVICE(&mms->timer[i]), "pclk-frq", SYSCLK_FRQ);
         qdev_connect_clock_in(DEVICE(&mms->timer[i]), "pclk", mms->sysclk);
         sysbus_realize_and_unref(sbd, &error_fatal);
         sysbus_mmio_map(sbd, 0, base);
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
 
     object_initialize_child(OBJECT(mms), "dualtimer", &mms->dualtimer,
                             TYPE_CMSDK_APB_DUALTIMER);
-    qdev_prop_set_uint32(DEVICE(&mms->dualtimer), "pclk-frq", SYSCLK_FRQ);
     qdev_connect_clock_in(DEVICE(&mms->dualtimer), "TIMCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->dualtimer), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->dualtimer), 0,
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
     sysbus_mmio_map(SYS_BUS_DEVICE(&mms->dualtimer), 0, 0x40002000);
     object_initialize_child(OBJECT(mms), "watchdog", &mms->watchdog,
                             TYPE_CMSDK_APB_WATCHDOG);
-    qdev_prop_set_uint32(DEVICE(&mms->watchdog), "wdogclk-frq", SYSCLK_FRQ);
     qdev_connect_clock_in(DEVICE(&mms->watchdog), "WDOGCLK", mms->sysclk);
     sysbus_realize(SYS_BUS_DEVICE(&mms->watchdog), &error_fatal);
     sysbus_connect_irq(SYS_BUS_DEVICE(&mms->watchdog), 0,
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "EXP_NUMIRQ", mmc->num_irqs);
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
-    qdev_prop_set_uint32(ssedev, "MAINCLK_FRQ", SYSCLK_FRQ);
     qdev_connect_clock_in(ssedev, "MAINCLK", mms->sysclk);
     qdev_connect_clock_in(ssedev, "S32KCLK", mms->s32kclk);
     /*
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     if (board->dc1 & (1 << 3)) { /* watchdog present */
         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
 
-        /* system_clock_scale is valid now */
-        uint32_t mainclk = NANOSECONDS_PER_SECOND / system_clock_scale;
-        qdev_prop_set_uint32(dev, "wdogclk-frq", mainclk);
         qdev_connect_clock_in(dev, "WDOGCLK",
                               qdev_get_clock_out(ssys_dev, "SYSCLK"));
 
-- 
2.20.1

Now no users are setting the frq properties on the CMSDK timer,
dualtimer, watchdog or ARMSSE SoC devices, we can remove the
properties and the struct fields that back them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-25-peter.maydell@linaro.org
Message-id: 20210121190622.22000-25-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h                  | 2 --
 include/hw/timer/cmsdk-apb-dualtimer.h   | 2 --
 include/hw/timer/cmsdk-apb-timer.h       | 2 --
 include/hw/watchdog/cmsdk-apb-watchdog.h | 2 --
 hw/arm/armsse.c                          | 2 --
 hw/timer/cmsdk-apb-dualtimer.c           | 6 ------
 hw/timer/cmsdk-apb-timer.c               | 6 ------
 hw/watchdog/cmsdk-apb-watchdog.c         | 6 ------
 8 files changed, 28 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *  + Clock input "S32KCLK": slow 32KHz clock used for a few peripherals
  *  + QOM property "memory" is a MemoryRegion containing the devices provided
  *    by the board model.
- *  + QOM property "MAINCLK_FRQ" is the frequency of the main system clock
  *  + QOM property "EXP_NUMIRQ" sets the number of expansion interrupts.
  *    (In hardware, the SSE-200 permits the number of expansion interrupts
  *    for the two CPUs to be configured separately, but we restrict it to
@@ -XXX,XX +XXX,XX @@ struct ARMSSE {
     /* Properties */
     MemoryRegion *board_memory;
     uint32_t exp_numirq;
-    uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
     bool cpu_fpu[SSE_MAX_CPUS];
diff --git a/include/hw/timer/cmsdk-apb-dualtimer.h b/include/hw/timer/cmsdk-apb-dualtimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-dualtimer.h
+++ b/include/hw/timer/cmsdk-apb-dualtimer.h
@@ -XXX,XX +XXX,XX @@
  * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
  *
  * QEMU interface:
- *  + QOM property "pclk-frq": frequency at which the timer is clocked
  *  + Clock input "TIMCLK": clock (for both timers)
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: combined timer interrupt TIMINTC
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBDualTimer {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq timerintc;
-    uint32_t pclk_frq;
     Clock *timclk;
 
     CMSDKAPBDualTimerModule timermod[CMSDK_APB_DUALTIMER_NUM_MODULES];
diff --git a/include/hw/timer/cmsdk-apb-timer.h b/include/hw/timer/cmsdk-apb-timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/cmsdk-apb-timer.h
+++ b/include/hw/timer/cmsdk-apb-timer.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(CMSDKAPBTimer, CMSDK_APB_TIMER)
 
 /*
  * QEMU interface:
- *  + QOM property "pclk-frq": frequency at which the timer is clocked
  *  + Clock input "pclk": clock for the timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: timer interrupt TIMERINT
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBTimer {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq timerint;
-    uint32_t pclk_frq;
     struct ptimer_state *timer;
     Clock *pclk;
 
diff --git a/include/hw/watchdog/cmsdk-apb-watchdog.h b/include/hw/watchdog/cmsdk-apb-watchdog.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/watchdog/cmsdk-apb-watchdog.h
+++ b/include/hw/watchdog/cmsdk-apb-watchdog.h
@@ -XXX,XX +XXX,XX @@
  * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
  *
  * QEMU interface:
- *  + QOM property "wdogclk-frq": frequency at which the watchdog is clocked
  *  + Clock input "WDOGCLK": clock for the watchdog's timer
  *  + sysbus MMIO region 0: the register bank
  *  + sysbus IRQ 0: watchdog interrupt
@@ -XXX,XX +XXX,XX @@ struct CMSDKAPBWatchdog {
     /*< public >*/
     MemoryRegion iomem;
     qemu_irq wdogint;
-    uint32_t wdogclk_frq;
     bool is_luminary;
     struct ptimer_state *timer;
     Clock *wdogclk;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static Property iotkit_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
@@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = {
     DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
                      MemoryRegion *),
     DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK_FRQ", ARMSSE, mainclk_frq, 0),
     DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
     DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
     DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-dualtimer.c
+++ b/hw/timer/cmsdk-apb-dualtimer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_dualtimer_vmstate = {
     }
 };
 
-static Property cmsdk_apb_dualtimer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBDualTimer, pclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_dualtimer_realize;
     dc->vmsd = &cmsdk_apb_dualtimer_vmstate;
     dc->reset = cmsdk_apb_dualtimer_reset;
-    device_class_set_props(dc, cmsdk_apb_dualtimer_properties);
 }
 
 static const TypeInfo cmsdk_apb_dualtimer_info = {
diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_timer_vmstate = {
     }
 };
 
-static Property cmsdk_apb_timer_properties[] = {
-    DEFINE_PROP_UINT32("pclk-frq", CMSDKAPBTimer, pclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_timer_realize;
     dc->vmsd = &cmsdk_apb_timer_vmstate;
     dc->reset = cmsdk_apb_timer_reset;
-    device_class_set_props(dc, cmsdk_apb_timer_properties);
 }
 
 static const TypeInfo cmsdk_apb_timer_info = {
diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/cmsdk-apb-watchdog.c
+++ b/hw/watchdog/cmsdk-apb-watchdog.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
     }
 };
 
-static Property cmsdk_apb_watchdog_properties[] = {
-    DEFINE_PROP_UINT32("wdogclk-frq", CMSDKAPBWatchdog, wdogclk_frq, 0),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
 static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
     dc->realize = cmsdk_apb_watchdog_realize;
     dc->vmsd = &cmsdk_apb_watchdog_vmstate;
     dc->reset = cmsdk_apb_watchdog_reset;
-    device_class_set_props(dc, cmsdk_apb_watchdog_properties);
 }
 
 static const TypeInfo cmsdk_apb_watchdog_info = {
-- 
2.20.1

Now that the watchdog device uses its Clock input rather than being
passed the value of system_clock_scale at creation time, we can
remove the hack where we reset the STELLARIS_SYS at board creation
time to force it to set system_clock_scale.  Instead it will be reset
at the usual point in startup and will inform the watchdog of the
clock frequency at that point.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210128114145.20536-26-peter.maydell@linaro.org
Message-id: 20210121190622.22000-26-peter.maydell@linaro.org
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/stellaris.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *stellaris_sys_init(uint32_t base, qemu_irq irq,
     sysbus_mmio_map(sbd, 0, base);
     sysbus_connect_irq(sbd, 0, irq);
 
-    /*
-     * Normally we should not be resetting devices like this during
-     * board creation. For the moment we need to do so, because
-     * system_clock_scale will only get set when the STELLARIS_SYS
-     * device is reset, and we need its initial value to pass to
-     * the watchdog device. This hack can be removed once the
-     * watchdog has been converted to use a Clock input instead.
-     */
-    device_cold_reset(dev);
-
     return dev;
 }
 
-- 
2.20.1