Series comparison

-[PULL 00/23] target-arm queue
+[PULL 00/21] target-arm queue
-The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:
+Arm queue; not huge but I figured I might as well send it out since
 I've been doing code review today and there's no queue of unprocessed
 pullreqs...
-  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)
+thanks
 -- PMM
 The following changes since commit b3f846c59d8405bb87c551187721fc92ff2f1b92:
   Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2021-01-11v2' into staging (2021-01-11 15:15:35 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210112
-for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:
+for you to fetch changes up to 19d131395ccaf503db21dadd8257e6dc9fc1d7de:
-  hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)
+  ui/cocoa: Fix openFile: deprecation on Big Sur (2021-01-12 11:38:37 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
+ * arm: Support emulation of ARMv8.4-TTST extension
-   line user-created devices are not plugged into them
+ * arm: Update cpu.h ID register field definitions
- * Take an exception if PSTATE.IL is set
+ * arm: Fix breakage of XScale instruction emulation
- * Support an emulated ITS in the virt board
+ * hw/net/lan9118: Fix RX Status FIFO PEEK value
- * Add support for kudo-bmc board
+ * npcm7xx: Add ADC and PWM emulation
- * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
+ * ui/cocoa: Make "open docs" help menu entry work again when binary
- * cadence_uart: Fix clock handling issues that prevented
+   is run from the build tree
-   u-boot from running
+ * ui/cocoa: Fix openFile: deprecation on Big Sur
  * docs: Add qemu-storage-daemon(1) manpage to meson.build
  * docs: Build and install all the docs in a single manual
 ----------------------------------------------------------------
-Bin Meng (6):
+Hao Wu (6):
-      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
+      hw/misc: Add clock converter in NPCM7XX CLK module
-      hw/char: cadence_uart: Disable transmit when input clock is disabled
+      hw/timer: Refactor NPCM7XX Timer to use CLK clock
-      hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
+      hw/adc: Add an ADC module for NPCM7XX
-      hw/char: cadence_uart: Convert to memop_with_attrs() ops
+      hw/misc: Add a PWM module for NPCM7XX
-      hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
+      hw/misc: Add QTest for NPCM7XX PWM Module
-      hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
+      hw/*: Use type casting for SysBusDevice in NPCM7XX
-Chris Rauer (1):
+Leif Lindholm (6):
-      hw/arm: Add support for kudo-bmc board.
+      target/arm: fix typo in cpu.h ID_AA64PFR1 field name
+      target/arm: make ARMCPU.clidr 64-bit
-Marc Zyngier (1):
+      target/arm: make ARMCPU.ctr 64-bit
-      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
+      target/arm: add descriptions of CLIDR_EL1, CCSIDR_EL1, CTR_EL0 to cpu.h
       target/arm: add aarch64 ID register fields to cpu.h
       target/arm: add aarch32 ID register fields to cpu.h
 Peter Maydell (5):
-      target/arm: Take an exception if PSTATE.IL is set
+      docs: Add qemu-storage-daemon(1) manpage to meson.build
-      qdev: Support marking individual buses as 'full'
+      docs: Build and install all the docs in a single manual
-      hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
+      target/arm: Don't decode insns in the XScale/iWMMXt space as cp insns
-      hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
+      hw/net/lan9118: Fix RX Status FIFO PEEK value
-      hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
+      hw/net/lan9118: Add symbolic constants for register offsets
-Richard Henderson (1):
+Roman Bolshakov (2):
-      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
+      ui/cocoa: Update path to docs in build tree
       ui/cocoa: Fix openFile: deprecation on Big Sur
-Shashi Mallela (9):
+Rémi Denis-Courmont (2):
-      hw/intc: GICv3 ITS initial framework
+      target/arm: ARMv8.4-TTST extension
-      hw/intc: GICv3 ITS register definitions added
+      target/arm: enable Small Translation tables in max CPU
       hw/intc: GICv3 ITS command queue framework
       hw/intc: GICv3 ITS Command processing
       hw/intc: GICv3 ITS Feature enablement
       hw/intc: GICv3 redistributor ITS processing
       tests/data/acpi/virt: Add IORT files for ITS
       hw/arm/virt: add ITS support in virt GIC
       tests/data/acpi/virt: Update IORT files for ITS
- docs/system/arm/nuvoton.rst            |    1 +
+ docs/conf.py                     |  46 ++-
- hw/intc/gicv3_internal.h               |  188 ++++-
+ docs/devel/conf.py               |  15 -
- include/hw/arm/virt.h                  |    2 +
+ docs/index.html.in               |  17 -
- include/hw/intc/arm_gicv3_common.h     |   13 +
+ docs/interop/conf.py             |  28 --
- include/hw/intc/arm_gicv3_its_common.h |   32 +-
+ docs/meson.build                 |  65 ++--
- include/hw/qdev-core.h                 |   24 +
+ docs/specs/conf.py               |  16 -
- target/arm/cpu.h                       |    1 +
+ docs/system/arm/nuvoton.rst      |   4 +-
- target/arm/kvm_arm.h                   |    4 +-
+ docs/system/conf.py              |  28 --
- target/arm/syndrome.h                  |    5 +
+ docs/tools/conf.py               |  37 --
- target/arm/translate.h                 |    2 +
+ docs/user/conf.py                |  15 -
- hw/arm/mps2-tz.c                       |   92 ++-
+ meson.build                      |   1 +
- hw/arm/mps2.c                          |   12 +-
+ hw/adc/trace.h                   |   1 +
- hw/arm/npcm7xx_boards.c                |   34 +
+ include/hw/adc/npcm7xx_adc.h     |  69 ++++
- hw/arm/virt.c                          |   29 +-
+ include/hw/arm/npcm7xx.h         |   4 +
- hw/char/cadence_uart.c                 |   61 +-
+ include/hw/misc/npcm7xx_clk.h    | 146 ++++++-
- hw/intc/arm_gicv3.c                    |   14 +
+ include/hw/misc/npcm7xx_pwm.h    | 105 +++++
- hw/intc/arm_gicv3_common.c             |   13 +
+ include/hw/timer/npcm7xx_timer.h |   1 +
- hw/intc/arm_gicv3_cpuif.c              |    7 +-
+ target/arm/cpu.h                 |  85 ++++-
- hw/intc/arm_gicv3_dist.c               |    5 +-
+ hw/adc/npcm7xx_adc.c             | 301 +++++++++++++++
- hw/intc/arm_gicv3_its.c                | 1322 ++++++++++++++++++++++++++++++++
+ hw/arm/npcm7xx.c                 |  55 ++-
- hw/intc/arm_gicv3_its_common.c         |    7 +-
+ hw/arm/npcm7xx_boards.c          |   2 +-
- hw/intc/arm_gicv3_its_kvm.c            |    2 +-
+ hw/mem/npcm7xx_mc.c              |   2 +-
- hw/intc/arm_gicv3_redist.c             |  153 +++-
+ hw/misc/npcm7xx_clk.c            | 807 ++++++++++++++++++++++++++++++++++++++-
- hw/misc/zynq_slcr.c                    |   31 +-
+ hw/misc/npcm7xx_gcr.c            |   2 +-
- softmmu/qdev-monitor.c                 |    7 +-
+ hw/misc/npcm7xx_pwm.c            | 550 ++++++++++++++++++++++++++
- target/arm/helper-a64.c                |    1 +
+ hw/misc/npcm7xx_rng.c            |   2 +-
- target/arm/helper.c                    |    8 +
+ hw/net/lan9118.c                 |  26 +-
- target/arm/kvm.c                       |    7 +-
+ hw/nvram/npcm7xx_otp.c           |   2 +-
- target/arm/translate-a64.c             |  255 +++---
+ hw/ssi/npcm7xx_fiu.c             |   2 +-
- target/arm/translate.c                 |   21 +
+ hw/timer/npcm7xx_timer.c         |  39 +-
- hw/intc/meson.build                    |    1 +
+ target/arm/cpu64.c               |   1 +
- tests/data/acpi/virt/IORT              |  Bin 0 -> 124 bytes
+ target/arm/helper.c              |  15 +-
- tests/data/acpi/virt/IORT.memhp        |  Bin 0 -> 124 bytes
+ target/arm/translate.c           |   7 +
- tests/data/acpi/virt/IORT.numamem      |  Bin 0 -> 124 bytes
+ tests/qtest/npcm7xx_adc-test.c   | 377 ++++++++++++++++++
- tests/data/acpi/virt/IORT.pxb          |  Bin 0 -> 124 bytes
+ tests/qtest/npcm7xx_pwm-test.c   | 490 ++++++++++++++++++++++++
-files changed, 2144 insertions(+), 210 deletions(-)
+ hw/adc/meson.build               |   1 +
- create mode 100644 hw/intc/arm_gicv3_its.c
+ hw/adc/trace-events              |   5 +
- create mode 100644 tests/data/acpi/virt/IORT
+ hw/misc/meson.build              |   1 +
- create mode 100644 tests/data/acpi/virt/IORT.memhp
+ hw/misc/trace-events             |   6 +
- create mode 100644 tests/data/acpi/virt/IORT.numamem
+ tests/qtest/meson.build          |   4 +-
- create mode 100644 tests/data/acpi/virt/IORT.pxb
+ ui/cocoa.m                       |   7 +-
 files changed, 3124 insertions(+), 263 deletions(-)
  delete mode 100644 docs/devel/conf.py
  delete mode 100644 docs/index.html.in
  delete mode 100644 docs/interop/conf.py
  delete mode 100644 docs/specs/conf.py
  delete mode 100644 docs/system/conf.py
  delete mode 100644 docs/tools/conf.py
  delete mode 100644 docs/user/conf.py
  create mode 100644 hw/adc/trace.h
  create mode 100644 include/hw/adc/npcm7xx_adc.h
  create mode 100644 include/hw/misc/npcm7xx_pwm.h
  create mode 100644 hw/adc/npcm7xx_adc.c
  create mode 100644 hw/misc/npcm7xx_pwm.c
  create mode 100644 tests/qtest/npcm7xx_adc-test.c
  create mode 100644 tests/qtest/npcm7xx_pwm-test.c
  create mode 100644 hw/adc/trace-events

-[PULL 18/23] target/arm: Take an exception if PSTATE.IL is set
+[PULL 01/21] target/arm: ARMv8.4-TTST extension
-In v8A, the PSTATE.IL bit is set for various kinds of illegal
+From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
 exception return or mode-change attempts.  We already set PSTATE.IL
 (or its AArch32 equivalent CPSR.IL) in all those cases, but we
 weren't implementing the part of the behaviour where attempting to
 execute an instruction with PSTATE.IL takes an immediate exception
 with an appropriate syndrome value.
-Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
+This adds for the Small Translation tables extension in AArch64 state.
 to take an exception instead of whatever the instruction would have
 been.
-PSTATE.IL and CPSR.IL change only on exception entry, attempted
+Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-exception exit, and various AArch32 mode changes via cpsr_write().
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 These places generally already rebuild the hflags, so the only place
 we need an extra rebuild_hflags call is in the illegal-return
 codepath of the AArch64 exception_return helper.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
-Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[rth: Added missing returns; set IL bit in syndrome]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/cpu.h           |  1 +
+ target/arm/cpu.h    |  5 +++++
- target/arm/syndrome.h      |  5 +++++
+ target/arm/helper.c | 15 +++++++++++++--
- target/arm/translate.h     |  2 ++
+files changed, 18 insertions(+), 2 deletions(-)
  target/arm/helper-a64.c    |  1 +
  target/arm/helper.c        |  8 ++++++++
  target/arm/translate-a64.c | 11 +++++++++++
  target/arm/translate.c     | 21 +++++++++++++++++++++
 files changed, 49 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_uao(const ARMISARegisters *id)
- FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
+     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, UAO) != 0;
  /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
  FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
 +FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
  /*
   * Bit usage when in AArch32 state, both A- and M-profile.
 diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/syndrome.h
 +++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
             (cv << 24) | (cond << 20) | ti;
  }
-+static inline uint32_t syn_illegalstate(void)
++static inline bool isar_feature_aa64_st(const ARMISARegisters *id)
 +{
-+    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
++    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, ST) != 0;
 +}
 +
- #endif /* TARGET_ARM_SYNDROME_H */
+ static inline bool isar_feature_aa64_bti(const ARMISARegisters *id)
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+ {
-index XXXXXXX..XXXXXXX 100644
+     return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, BT) != 0;
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool hstr_active;
      /* True if memory operations require alignment */
      bool align_mem;
 +    /* True if PSTATE.IL is set */
 +    bool pstate_il;
      /*
       * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
       *  < 0, set by the current instruction.
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ illegal_return:
      if (!arm_singlestep_active(env)) {
          env->pstate &= ~PSTATE_SS;
      }
 +    helper_rebuild_hflags_a64(env, cur_el);
      qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                    "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
  }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
+ {
      uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
      bool epd, hpd, using16k, using64k;
 -    int select, tsz, tbi;
 +    int select, tsz, tbi, max_tsz;
      if (!regime_has_2_ranges(mmu_idx)) {
          select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              hpd = extract64(tcr, 42, 1);
          }
      }
+-    tsz = MIN(tsz, 39);  /* TODO: ARMv8.4-TTST */
-+    if (env->uncached_cpsr & CPSR_IL) {
++
-+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
++    if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
 +        max_tsz = 48 - using64k;
 +    } else {
 +        max_tsz = 39;
 +    }
 +
-     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
++    tsz = MIN(tsz, max_tsz);
- }
+     tsz = MAX(tsz, 16);  /* TODO: ARMv8.2-LVA  */
-@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+     /* Present TBI as a composite with TBID.  */
-         }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-     }
+         if (!aarch64 || stride == 9) {
+             /* AArch32 or 4KB pages */
-+    if (env->pstate & PSTATE_IL) {
+             startlevel = 2 - sl0;
 +        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
 +    }
 +
-     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
++            if (cpu_isar_feature(aa64_st, cpu)) {
-         /*
++                startlevel &= 3;
-          * Set MTE_ACTIVE if any access may be Checked, and leave clear
++            }
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+         } else {
-index XXXXXXX..XXXXXXX 100644
+             /* 16KB or 64KB pages */
---- a/target/arm/translate-a64.c
+             startlevel = 3 - sl0;
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
      s->fp_access_checked = false;
      s->sve_access_checked = false;
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
      if (dc_isar_feature(aa64_bti, s)) {
          if (s->base.num_insns == 1) {
              /*
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
  #endif
      dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
      dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
 +    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
      dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
      dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
      dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
          return;
      }
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
      if (cond == 0xf) {
          /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
           * choose to UNDEF. In ARMv5 and above the space is used
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
  #endif
      dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
      dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
 +    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
      if (arm_feature(env, ARM_FEATURE_M)) {
          dc->vfp_enabled = 1;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      }
      dc->insn = insn;
 +    if (dc->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(dc));
 +        return;
 +    }
 +
      if (dc->eci) {
          /*
           * For M-profile continuable instructions, ECI/ICI handling
 --
 .20.1

-[PULL 19/23] target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
+[PULL 02/21] target/arm: enable Small Translation tables in max CPU
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-It is confusing to have different exits from translation
+Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-for various conditions in separate functions.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Merge disas_a64_insn into its only caller.  Standardize
 on the "s" name for the DisasContext, as the code from
 disas_a64_insn had more instances.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
+ target/arm/cpu64.c | 1 +
-file changed, 109 insertions(+), 115 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/cpu64.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     return false;
+         t = cpu->isar.id_aa64mmfr2;
- }
+         t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);
+         t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1); /* TTCNP */
--/* C3.1 A64 instruction index by encoding */
++        t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1); /* TTST */
--static void disas_a64_insn(CPUARMState *env, DisasContext *s)
+         cpu->isar.id_aa64mmfr2 = t;
--{
--    uint32_t insn;
+         /* Replicate the same data to the 32-bit id registers.  */
 -
 -    s->pc_curr = s->base.pc_next;
 -    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 -    s->insn = insn;
 -    s->base.pc_next += 4;
 -
 -    s->fp_access_checked = false;
 -    s->sve_access_checked = false;
 -
 -    if (s->pstate_il) {
 -        /*
 -         * Illegal execution state. This has priority over BTI
 -         * exceptions, but comes after instruction abort exceptions.
 -         */
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_illegalstate(), default_exception_el(s));
 -        return;
 -    }
 -
 -    if (dc_isar_feature(aa64_bti, s)) {
 -        if (s->base.num_insns == 1) {
 -            /*
 -             * At the first insn of the TB, compute s->guarded_page.
 -             * We delayed computing this until successfully reading
 -             * the first insn of the TB, above.  This (mostly) ensures
 -             * that the softmmu tlb entry has been populated, and the
 -             * page table GP bit is available.
 -             *
 -             * Note that we need to compute this even if btype == 0,
 -             * because this value is used for BR instructions later
 -             * where ENV is not available.
 -             */
 -            s->guarded_page = is_guarded_page(env, s);
 -
 -            /* First insn can have btype set to non-zero.  */
 -            tcg_debug_assert(s->btype >= 0);
 -
 -            /*
 -             * Note that the Branch Target Exception has fairly high
 -             * priority -- below debugging exceptions but above most
 -             * everything else.  This allows us to handle this now
 -             * instead of waiting until the insn is otherwise decoded.
 -             */
 -            if (s->btype != 0
 -                && s->guarded_page
 -                && !btype_destination_ok(insn, s->bt, s->btype)) {
 -                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                                   syn_btitrap(s->btype),
 -                                   default_exception_el(s));
 -                return;
 -            }
 -        } else {
 -            /* Not the first insn: btype must be 0.  */
 -            tcg_debug_assert(s->btype == 0);
 -        }
 -    }
 -
 -    switch (extract32(insn, 25, 4)) {
 -    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
 -        unallocated_encoding(s);
 -        break;
 -    case 0x2:
 -        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
 -            unallocated_encoding(s);
 -        }
 -        break;
 -    case 0x8: case 0x9: /* Data processing - immediate */
 -        disas_data_proc_imm(s, insn);
 -        break;
 -    case 0xa: case 0xb: /* Branch, exception generation and system insns */
 -        disas_b_exc_sys(s, insn);
 -        break;
 -    case 0x4:
 -    case 0x6:
 -    case 0xc:
 -    case 0xe:      /* Loads and stores */
 -        disas_ldst(s, insn);
 -        break;
 -    case 0x5:
 -    case 0xd:      /* Data processing - register */
 -        disas_data_proc_reg(s, insn);
 -        break;
 -    case 0x7:
 -    case 0xf:      /* Data processing - SIMD and floating point */
 -        disas_data_proc_simd_fp(s, insn);
 -        break;
 -    default:
 -        assert(FALSE); /* all 15 cases should be handled above */
 -        break;
 -    }
 -
 -    /* if we allocated any temporaries, free them here */
 -    free_tmp_a64(s);
 -
 -    /*
 -     * After execution of most insns, btype is reset to 0.
 -     * Note that we set btype == -1 when the insn sets btype.
 -     */
 -    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 -        reset_btype(s);
 -    }
 -}
 -
  static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                            CPUState *cpu)
  {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
  static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
  {
 -    DisasContext *dc = container_of(dcbase, DisasContext, base);
 +    DisasContext *s = container_of(dcbase, DisasContext, base);
      CPUARMState *env = cpu->env_ptr;
 +    uint32_t insn;
 -    if (dc->ss_active && !dc->pstate_ss) {
 +    if (s->ss_active && !s->pstate_ss) {
          /* Singlestep state is Active-pending.
           * If we're in this state at the start of a TB then either
           *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
           * "did not step an insn" case, and so the syndrome ISV and EX
           * bits should be zero.
           */
 -        assert(dc->base.num_insns == 1);
 -        gen_swstep_exception(dc, 0, 0);
 -        dc->base.is_jmp = DISAS_NORETURN;
 -    } else {
 -        disas_a64_insn(env, dc);
 +        assert(s->base.num_insns == 1);
 +        gen_swstep_exception(s, 0, 0);
 +        s->base.is_jmp = DISAS_NORETURN;
 +        return;
      }
 -    translator_loop_temp_check(&dc->base);
 +    s->pc_curr = s->base.pc_next;
 +    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 +    s->insn = insn;
 +    s->base.pc_next += 4;
 +
 +    s->fp_access_checked = false;
 +    s->sve_access_checked = false;
 +
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
 +    if (dc_isar_feature(aa64_bti, s)) {
 +        if (s->base.num_insns == 1) {
 +            /*
 +             * At the first insn of the TB, compute s->guarded_page.
 +             * We delayed computing this until successfully reading
 +             * the first insn of the TB, above.  This (mostly) ensures
 +             * that the softmmu tlb entry has been populated, and the
 +             * page table GP bit is available.
 +             *
 +             * Note that we need to compute this even if btype == 0,
 +             * because this value is used for BR instructions later
 +             * where ENV is not available.
 +             */
 +            s->guarded_page = is_guarded_page(env, s);
 +
 +            /* First insn can have btype set to non-zero.  */
 +            tcg_debug_assert(s->btype >= 0);
 +
 +            /*
 +             * Note that the Branch Target Exception has fairly high
 +             * priority -- below debugging exceptions but above most
 +             * everything else.  This allows us to handle this now
 +             * instead of waiting until the insn is otherwise decoded.
 +             */
 +            if (s->btype != 0
 +                && s->guarded_page
 +                && !btype_destination_ok(insn, s->bt, s->btype)) {
 +                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                                   syn_btitrap(s->btype),
 +                                   default_exception_el(s));
 +                return;
 +            }
 +        } else {
 +            /* Not the first insn: btype must be 0.  */
 +            tcg_debug_assert(s->btype == 0);
 +        }
 +    }
 +
 +    switch (extract32(insn, 25, 4)) {
 +    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
 +        unallocated_encoding(s);
 +        break;
 +    case 0x2:
 +        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
 +            unallocated_encoding(s);
 +        }
 +        break;
 +    case 0x8: case 0x9: /* Data processing - immediate */
 +        disas_data_proc_imm(s, insn);
 +        break;
 +    case 0xa: case 0xb: /* Branch, exception generation and system insns */
 +        disas_b_exc_sys(s, insn);
 +        break;
 +    case 0x4:
 +    case 0x6:
 +    case 0xc:
 +    case 0xe:      /* Loads and stores */
 +        disas_ldst(s, insn);
 +        break;
 +    case 0x5:
 +    case 0xd:      /* Data processing - register */
 +        disas_data_proc_reg(s, insn);
 +        break;
 +    case 0x7:
 +    case 0xf:      /* Data processing - SIMD and floating point */
 +        disas_data_proc_simd_fp(s, insn);
 +        break;
 +    default:
 +        assert(FALSE); /* all 15 cases should be handled above */
 +        break;
 +    }
 +
 +    /* if we allocated any temporaries, free them here */
 +    free_tmp_a64(s);
 +
 +    /*
 +     * After execution of most insns, btype is reset to 0.
 +     * Note that we set btype == -1 when the insn sets btype.
 +     */
 +    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 +        reset_btype(s);
 +    }
 +
 +    translator_loop_temp_check(&s->base);
  }
  static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 --
 .20.1

-[PULL 16/23] hw/arm/virt: add ITS support in virt GIC
+[PULL 03/21] target/arm: fix typo in cpu.h ID_AA64PFR1 field name
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Included creation of ITS as part of virt platform GIC
+SBSS -> SSBS
 initialization. This Emulated ITS model now co-exists with kvm
 ITS and is enabled in absence of kvm irq kernel support in a
 platform.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Message-id: 20210108185154.8108-2-leif@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h |  2 ++
+ target/arm/cpu.h | 2 +-
- target/arm/kvm_arm.h  |  4 ++--
+file changed, 1 insertion(+), 1 deletion(-)
  hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 files changed, 31 insertions(+), 4 deletions(-)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/arm/virt.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, RAS, 28, 4)
-     MachineClass parent;
+ FIELD(ID_AA64PFR0, SVE, 32, 4)
-     bool disallow_affinity_adjustment;
-     bool no_its;
+ FIELD(ID_AA64PFR1, BT, 0, 4)
-+    bool no_tcg_its;
+-FIELD(ID_AA64PFR1, SBSS, 4, 4)
-     bool no_pmu;
++FIELD(ID_AA64PFR1, SSBS, 4, 4)
-     bool claim_edge_triggered_timers;
+ FIELD(ID_AA64PFR1, MTE, 8, 4)
-     bool smbios_old_sys_ver;
+ FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
      bool highmem;
      bool highmem_ecam;
      bool its;
 +    bool tcg_its;
      bool virt;
      bool ras;
      bool mte;
 diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
          /* KVM implementation requires this capability */
          return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
      } else {
 -        /* Software emulation is not implemented yet */
 -        return NULL;
 +        /* Software emulation based model */
 +        return "arm-gicv3-its";
      }
  }
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
      const char *itsclass = its_class_name();
      DeviceState *dev;
 +    if (!strcmp(itsclass, "arm-gicv3-its")) {
 +        if (!vms->tcg_its) {
 +            itsclass = NULL;
 +        }
 +    }
 +
      if (!itsclass) {
          /* Do nothing if not supported */
          return;
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
      vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
  }
 -static void create_gic(VirtMachineState *vms)
 +static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
  {
      MachineState *ms = MACHINE(vms);
      /* We create a standalone GIC */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
                               nb_redist_regions);
          qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
 +        if (!kvm_irqchip_in_kernel()) {
 +            if (vms->tcg_its) {
 +                object_property_set_link(OBJECT(vms->gic), "sysmem",
 +                                         OBJECT(mem), &error_fatal);
 +                qdev_prop_set_bit(vms->gic, "has-lpi", true);
 +            }
 +        }
 +
          if (nb_redist_regions == 2) {
              uint32_t redist1_capacity =
                      vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 -    create_gic(vms);
 +    create_gic(vms, sysmem);
      virt_cpu_post_init(vms, sysmem);
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
      } else {
          /* Default allows ITS instantiation */
          vms->its = true;
 +
 +        if (vmc->no_tcg_its) {
 +            vms->tcg_its = false;
 +        } else {
 +            vms->tcg_its = true;
 +        }
      }
      /* Default disallows iommu instantiation */
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
  static void virt_machine_6_1_options(MachineClass *mc)
  {
 +    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
 +
      virt_machine_6_2_options(mc);
      compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
 +
 +    /* qemu ITS was introduced with 6.2 */
 +    vmc->no_tcg_its = true;
  }
  DEFINE_VIRT_MACHINE(6, 1)
 --
 .20.1

-[PULL 17/23] tests/data/acpi/virt: Update IORT files for ITS
+[PULL 04/21] target/arm: make ARMCPU.clidr 64-bit
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Updated expected IORT files applicable with latest GICv3
+The AArch64 view of CLIDR_EL1 extends the ICB field to include also bit
-ITS changes.
+, as well as adding a Ttype<n> field when FEAT_MTE is implemented.
 Extend the clidr field to be able to hold this context.
-Full diff of new file disassembly:
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 /*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20180629 (64-bit version)
  * Copyright (c) 2000 - 2018 Intel Corporation
  *
  * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
  *
  * ACPI Data Table [IORT]
  *
  * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
  */
 [000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
 [004h 0004   4]                 Table Length : 0000007C
 [008h 0008   1]                     Revision : 00
 [009h 0009   1]                     Checksum : 07
 [00Ah 0010   6]                       Oem ID : "BOCHS "
 [010h 0016   8]                 Oem Table ID : "BXPC    "
 [018h 0024   4]                 Oem Revision : 00000001
 [01Ch 0028   4]              Asl Compiler ID : "BXPC"
 [020h 0032   4]        Asl Compiler Revision : 00000001
 [024h 0036   4]                   Node Count : 00000002
 [028h 0040   4]                  Node Offset : 00000030
 [02Ch 0044   4]                     Reserved : 00000000
 [030h 0048   1]                         Type : 00
 [031h 0049   2]                       Length : 0018
 [033h 0051   1]                     Revision : 00
 [034h 0052   4]                     Reserved : 00000000
 [038h 0056   4]                Mapping Count : 00000000
 [03Ch 0060   4]               Mapping Offset : 00000000
 [040h 0064   4]                     ItsCount : 00000001
 [044h 0068   4]                  Identifiers : 00000000
 [048h 0072   1]                         Type : 02
 [049h 0073   2]                       Length : 0034
 [04Bh 0075   1]                     Revision : 00
 [04Ch 0076   4]                     Reserved : 00000000
 [050h 0080   4]                Mapping Count : 00000001
 [054h 0084   4]               Mapping Offset : 00000020
 [058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
 [058h 0088   4]              Cache Coherency : 00000001
 [05Ch 0092   1]        Hints (decoded below) : 00
                                    Transient : 0
                               Write Allocate : 0
                                Read Allocate : 0
                                     Override : 0
 [05Dh 0093   2]                     Reserved : 0000
 [05Fh 0095   1] Memory Flags (decoded below) : 03
                                    Coherency : 1
                             Device Attribute : 1
 [060h 0096   4]                ATS Attribute : 00000000
 [064h 0100   4]           PCI Segment Number : 00000000
 [068h 0104   1]            Memory Size Limit : 00
 [069h 0105   3]                     Reserved : 000000
 [068h 0104   4]                   Input base : 00000000
 [06Ch 0108   4]                     ID Count : 0000FFFF
 [070h 0112   4]                  Output Base : 00000000
 [074h 0116   4]             Output Reference : 00000030
 [078h 0120   4]        Flags (decoded below) : 00000000
                               Single Mapping : 0
 Raw Table Data: Length 124 (0x7C)
 : 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
 : 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
 : 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
 : 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
 : 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
 : 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
 : 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
 : 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Acked-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Message-id: 20210108185154.8108-3-leif@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
+ target/arm/cpu.h | 2 +-
- tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
+file changed, 1 insertion(+), 1 deletion(-)
  tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
  tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
  tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
 files changed, 4 deletions(-)
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
+--- a/target/arm/cpu.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
++++ b/target/arm/cpu.h
-@@ -1,5 +1 @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- /* List of comma-separated changed AML files to ignore */
+     uint32_t id_afr0;
--"tests/data/acpi/virt/IORT",
+     uint64_t id_aa64afr0;
--"tests/data/acpi/virt/IORT.memhp",
+     uint64_t id_aa64afr1;
--"tests/data/acpi/virt/IORT.numamem",
+-    uint32_t clidr;
--"tests/data/acpi/virt/IORT.pxb",
++    uint64_t clidr;
-diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
+     uint64_t mp_affinity; /* MP ID without feature bits */
-index XXXXXXX..XXXXXXX 100644
+     /* The elements of this array are the CCSIDR values for each cache,
-GIT binary patch
+      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
 index XXXXXXX..XXXXXXX 100644
 GIT binary patch
 literal 124
 zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
 QRGb+i3L*dhhtM#y0PN=p0RR91
 literal 0
 HcmV?d00001
 --
 .20.1

-[PULL 15/23] tests/data/acpi/virt: Add IORT files for ITS
+[PULL 05/21] target/arm: make ARMCPU.ctr 64-bit
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Added expected IORT files applicable with latest GICv3
+When FEAT_MTE is implemented, the AArch64 view of CTR_EL0 adds the
-ITS changes.Temporarily differences in these files are
+TminLine field in bits [37:32].
-okay.
+Extend the ctr field to be able to hold this context.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
-Acked-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
 Message-id: 20210108185154.8108-4-leif@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
+ target/arm/cpu.h | 2 +-
- tests/data/acpi/virt/IORT                   | 0
+file changed, 1 insertion(+), 1 deletion(-)
  tests/data/acpi/virt/IORT.memhp             | 0
  tests/data/acpi/virt/IORT.numamem           | 0
  tests/data/acpi/virt/IORT.pxb               | 0
 files changed, 4 insertions(+)
  create mode 100644 tests/data/acpi/virt/IORT
  create mode 100644 tests/data/acpi/virt/IORT.memhp
  create mode 100644 tests/data/acpi/virt/IORT.numamem
  create mode 100644 tests/data/acpi/virt/IORT.pxb
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
+--- a/target/arm/cpu.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
++++ b/target/arm/cpu.h
-@@ -1 +1,5 @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- /* List of comma-separated changed AML files to ignore */
+     uint64_t midr;
-+"tests/data/acpi/virt/IORT",
+     uint32_t revidr;
-+"tests/data/acpi/virt/IORT.memhp",
+     uint32_t reset_fpsid;
-+"tests/data/acpi/virt/IORT.numamem",
+-    uint32_t ctr;
-+"tests/data/acpi/virt/IORT.pxb",
++    uint64_t ctr;
-diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
+     uint32_t reset_sctlr;
-new file mode 100644
+     uint64_t pmceid0;
-index XXXXXXX..XXXXXXX
+     uint64_t pmceid1;
 diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
 new file mode 100644
 index XXXXXXX..XXXXXXX
 diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
 new file mode 100644
 index XXXXXXX..XXXXXXX
 diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --
 .20.1

-[PULL 14/23] hw/intc: GICv3 redistributor ITS processing
+[PULL 06/21] target/arm: add descriptions of CLIDR_EL1, CCSIDR_EL1, CTR_EL0 to cpu.h
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Implemented lpi processing at redistributor to get lpi config info
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
-from lpi configuration table,determine priority,set pending state in
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
-lpi pending table and forward the lpi to cpuif.Added logic to invoke
+Message-id: 20210108185154.8108-5-leif@nuviainc.com
 redistributor lpi processing with translated LPI which set/clear LPI
 from ITS device as part of ITS INT,CLEAR,DISCARD command and
 GITS_TRANSLATER processing.
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h           |   9 ++
+ target/arm/cpu.h | 31 +++++++++++++++++++++++++++++++
- include/hw/intc/arm_gicv3_common.h |   7 ++
+file changed, 31 insertions(+)
  hw/intc/arm_gicv3.c                |  14 +++
  hw/intc/arm_gicv3_common.c         |   1 +
  hw/intc/arm_gicv3_cpuif.c          |   7 +-
  hw/intc/arm_gicv3_its.c            |  23 +++++
  hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
 files changed, 200 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/cpu.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
+@@ -XXX,XX +XXX,XX @@ FIELD(V7M_FPCCR, ASPEN, 31, 1)
- FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
+ /*
- FIELD(GICR_PENDBASER, PTZ, 62, 1)
+  * System register ID fields.
+  */
-+#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
++FIELD(CLIDR_EL1, CTYPE1, 0, 3)
 +FIELD(CLIDR_EL1, CTYPE2, 3, 3)
 +FIELD(CLIDR_EL1, CTYPE3, 6, 3)
 +FIELD(CLIDR_EL1, CTYPE4, 9, 3)
 +FIELD(CLIDR_EL1, CTYPE5, 12, 3)
 +FIELD(CLIDR_EL1, CTYPE6, 15, 3)
 +FIELD(CLIDR_EL1, CTYPE7, 18, 3)
 +FIELD(CLIDR_EL1, LOUIS, 21, 3)
 +FIELD(CLIDR_EL1, LOC, 24, 3)
 +FIELD(CLIDR_EL1, LOUU, 27, 3)
 +FIELD(CLIDR_EL1, ICB, 30, 3)
 +
- #define ICC_CTLR_EL1_CBPR           (1U << 0)
++/* When FEAT_CCIDX is implemented */
- #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
++FIELD(CCSIDR_EL1, CCIDX_LINESIZE, 0, 3)
- #define ICC_CTLR_EL1_PMHE           (1U << 6)
++FIELD(CCSIDR_EL1, CCIDX_ASSOCIATIVITY, 3, 21)
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
++FIELD(CCSIDR_EL1, CCIDX_NUMSETS, 32, 24)
  #define L1TABLE_ENTRY_SIZE         8
 +#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
 +#define LPI_PRIORITY_MASK         0xfc
 +
- #define GITS_CMDQ_ENTRY_SIZE               32
++/* When FEAT_CCIDX is not implemented */
- #define NUM_BYTES_IN_DW                     8
++FIELD(CCSIDR_EL1, LINESIZE, 0, 3)
++FIELD(CCSIDR_EL1, ASSOCIATIVITY, 3, 10)
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
++FIELD(CCSIDR_EL1, NUMSETS, 13, 15)
   * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
   */
  #define GITS_CTE_SIZE                 (0x8ULL)
 +#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
  /* Special interrupt IDs */
  #define INTID_SECURE 1020
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                 unsigned size, MemTxAttrs attrs);
  void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
  void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
 +void gicv3_redist_update_lpi(GICv3CPUState *cs);
  void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
  void gicv3_init_cpuif(GICv3State *s);
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_common.h
 +++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
       * real state above; it doesn't need to be migrated.
       */
      PendingIrq hppi;
 +
-+    /*
++FIELD(CTR_EL0,  IMINLINE, 0, 4)
-+     * Cached information recalculated from LPI tables
++FIELD(CTR_EL0,  L1IP, 14, 2)
-+     * in guest memory
++FIELD(CTR_EL0,  DMINLINE, 16, 4)
-+     */
++FIELD(CTR_EL0,  ERG, 20, 4)
-+    PendingIrq hpplpi;
++FIELD(CTR_EL0,  CWG, 24, 4)
 +FIELD(CTR_EL0,  IDC, 28, 1)
 +FIELD(CTR_EL0,  DIC, 29, 1)
 +FIELD(CTR_EL0,  TMINLINE, 32, 6)
 +
-     /* This is temporary working state, to avoid a malloc in gicv3_update() */
+ FIELD(MIDR_EL1, REVISION, 0, 4)
-     bool seenbetter;
+ FIELD(MIDR_EL1, PARTNUM, 4, 12)
- };
+ FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
 diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3.c
 +++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
          cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
      }
 +    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
 +        (cs->hpplpi.prio != 0xff)) {
 +        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
 +            cs->hppi.irq = cs->hpplpi.irq;
 +            cs->hppi.prio = cs->hpplpi.prio;
 +            cs->hppi.grp = cs->hpplpi.grp;
 +            seenbetter = true;
 +        }
 +    }
 +
      /* If the best interrupt we just found would preempt whatever
       * was the previous best interrupt before this update, then
       * we know it's definitely the best one now.
@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
  static void arm_gicv3_post_load(GICv3State *s)
  {
 +    int i;
      /* Recalculate our cached idea of the current highest priority
       * pending interrupt, but don't set IRQ or FIQ lines.
       */
 +    for (i = 0; i < s->num_cpu; i++) {
 +        gicv3_redist_update_lpi(&s->cpu[i]);
 +    }
      gicv3_full_update_noirqset(s);
      /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
      gicv3_cache_all_target_cpustates(s);
 diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_common.c
 +++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
          memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
          cs->hppi.prio = 0xff;
 +        cs->hpplpi.prio = 0xff;
          /* State in the CPU interface must *not* be reset here, because it
           * is part of the CPU's reset domain, not the GIC device's.
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
          cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
          cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
          gicv3_redist_update(cs);
 -    } else {
 +    } else if (irq < GICV3_LPI_INTID_START) {
          gicv3_gicd_active_set(cs->gic, irq);
          gicv3_gicd_pending_clear(cs->gic, irq);
          gicv3_update(cs->gic, irq, 1);
 +    } else {
 +        gicv3_redist_lpi_pending(cs, irq, 0);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
      trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
                                 gicv3_redist_affid(cs), value);
 -    if (irq >= cs->gic->num_irq) {
 +    if ((irq >= cs->gic->num_irq) &&
 +        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
          /* This handles two cases:
           * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
           * to the GICC_EOIR, the GIC ignores that write.
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
      uint64_t cte = 0;
      bool cte_valid = false;
      bool result = false;
 +    uint64_t rdbase;
      if (cmd == NONE) {
          devid = offset;
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
           * Current implementation only supports rdbase == procnum
           * Hence rdbase physical address is ignored
           */
 +        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
 +
 +        if (rdbase > s->gicv3->num_cpu) {
 +            return result;
 +        }
 +
 +        if ((cmd == CLEAR) || (cmd == DISCARD)) {
 +            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
 +        } else {
 +            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
 +        }
 +
          if (cmd == DISCARD) {
              IteEntry ite = {};
              /* remove mapping from interrupt translation table */
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
      MemTxResult res = MEMTX_OK;
      bool result = true;
      uint8_t cmd;
 +    int i;
      if (!(s->ctlr & ITS_CTLR_ENABLED)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
              break;
          case GITS_CMD_INV:
          case GITS_CMD_INVALL:
 +            /*
 +             * Current implementation doesn't cache any ITS tables,
 +             * but the calculated lpi priority information. We only
 +             * need to trigger lpi priority re-calculation to be in
 +             * sync with LPI config table or pending table changes.
 +             */
 +            for (i = 0; i < s->gicv3->num_cpu; i++) {
 +                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
 +            }
              break;
          default:
              break;
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
          if (cs->gicr_typer & GICR_TYPER_PLPIS) {
              if (value & GICR_CTLR_ENABLE_LPIS) {
                  cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
 +                /* Check for any pending interr in pending table */
 +                gicv3_redist_update_lpi(cs);
 +                gicv3_redist_update(cs);
              } else {
                  cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
              }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
      return r;
  }
 +static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
 +{
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpict_baddr;
 +    uint8_t lpite;
 +    uint8_t prio;
 +
 +    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
 +
 +    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
 +                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
 +                       sizeof(lpite));
 +
 +    if (!(lpite & LPI_CTE_ENABLED)) {
 +        return;
 +    }
 +
 +    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
 +        prio = lpite & LPI_PRIORITY_MASK;
 +    } else {
 +        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
 +    }
 +
 +    if ((prio < cs->hpplpi.prio) ||
 +        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
 +        cs->hpplpi.irq = irq;
 +        cs->hpplpi.prio = prio;
 +        /* LPIs are always non-secure Grp1 interrupts */
 +        cs->hpplpi.grp = GICV3_G1NS;
 +    }
 +}
 +
 +void gicv3_redist_update_lpi(GICv3CPUState *cs)
 +{
 +    /*
 +     * This function scans the LPI pending table and for each pending
 +     * LPI, reads the corresponding entry from LPI configuration table
 +     * to extract the priority info and determine if the current LPI
 +     * priority is lower than the last computed high priority lpi interrupt.
 +     * If yes, replace current LPI as the new high priority lpi interrupt.
 +     */
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpipt_baddr;
 +    uint32_t pendt_size = 0;
 +    uint8_t pend;
 +    int i, bit;
 +    uint64_t idbits;
 +
 +    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 GICD_TYPER_IDBITS);
 +
 +    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
 +        !cs->gicr_pendbaser) {
 +        return;
 +    }
 +
 +    cs->hpplpi.prio = 0xff;
 +
 +    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +
 +    /* Determine the highest priority pending interrupt among LPIs */
 +    pendt_size = (1ULL << (idbits + 1));
 +
 +    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
 +        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
 +                           sizeof(pend));
 +
 +        while (pend) {
 +            bit = ctz32(pend);
 +            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
 +            pend &= ~(1 << bit);
 +        }
 +    }
 +}
 +
 +void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
 +{
 +    /*
 +     * This function updates the pending bit in lpi pending table for
 +     * the irq being activated or deactivated.
 +     */
 +    AddressSpace *as = &cs->gic->dma_as;
 +    uint64_t lpipt_baddr;
 +    bool ispend = false;
 +    uint8_t pend;
 +
 +    /*
 +     * get the bit value corresponding to this irq in the
 +     * lpi pending table
 +     */
 +    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +
 +    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
 +                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
 +
 +    ispend = extract32(pend, irq % 8, 1);
 +
 +    /* no change in the value of pending bit, return */
 +    if (ispend == level) {
 +        return;
 +    }
 +    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
 +
 +    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
 +                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
 +
 +    /*
 +     * check if this LPI is better than the current hpplpi, if yes
 +     * just set hpplpi.prio and .irq without doing a full rescan
 +     */
 +    if (level) {
 +        gicv3_redist_check_lpi_priority(cs, irq);
 +    } else {
 +        if (irq == cs->hpplpi.irq) {
 +            gicv3_redist_update_lpi(cs);
 +        }
 +    }
 +}
 +
 +void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
 +{
 +    uint64_t idbits;
 +
 +    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 GICD_TYPER_IDBITS);
 +
 +    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
 +         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
 +         irq < GICV3_LPI_INTID_START) {
 +        return;
 +    }
 +
 +    /* set/clear the pending bit for this irq */
 +    gicv3_redist_lpi_pending(cs, irq, level);
 +
 +    gicv3_redist_update(cs);
 +}
 +
  void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
  {
      /* Update redistributor state for a change in an external PPI input line */
 --
 .20.1

-[PULL 13/23] hw/intc: GICv3 ITS Feature enablement
+[PULL 07/21] target/arm: add aarch64 ID register fields to cpu.h
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Added properties to enable ITS feature and define qemu system
+Add entries present in ARM DDI 0487F.c (August 2020).
 address space memory in gicv3 common,setup distributor and
 redistributor registers to indicate LPI support.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
-Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
+Message-id: 20210108185154.8108-6-leif@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h           |  2 ++
+ target/arm/cpu.h | 15 +++++++++++++++
- include/hw/intc/arm_gicv3_common.h |  1 +
+file changed, 15 insertions(+)
  hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
  hw/intc/arm_gicv3_dist.c           |  5 ++++-
  hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
 files changed, 28 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/cpu.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR1, GPI, 28, 4)
- #define GICD_CTLR_E1NWF             (1U << 7)
+ FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
- #define GICD_CTLR_RWP               (1U << 31)
+ FIELD(ID_AA64ISAR1, SB, 36, 4)
+ FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
-+#define GICD_TYPER_LPIS_SHIFT          17
++FIELD(ID_AA64ISAR1, BF16, 44, 4)
-+
++FIELD(ID_AA64ISAR1, DGH, 48, 4)
- /* 16 bits EventId */
++FIELD(ID_AA64ISAR1, I8MM, 52, 4)
- #define GICD_TYPER_IDBITS            0xf
+ FIELD(ID_AA64PFR0, EL0, 0, 4)
-diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
+ FIELD(ID_AA64PFR0, EL1, 4, 4)
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, ADVSIMD, 20, 4)
---- a/include/hw/intc/arm_gicv3_common.h
+ FIELD(ID_AA64PFR0, GIC, 24, 4)
-+++ b/include/hw/intc/arm_gicv3_common.h
+ FIELD(ID_AA64PFR0, RAS, 28, 4)
-@@ -XXX,XX +XXX,XX @@ struct GICv3State {
+ FIELD(ID_AA64PFR0, SVE, 32, 4)
-     uint32_t num_cpu;
++FIELD(ID_AA64PFR0, SEL2, 36, 4)
-     uint32_t num_irq;
++FIELD(ID_AA64PFR0, MPAM, 40, 4)
-     uint32_t revision;
++FIELD(ID_AA64PFR0, AMU, 44, 4)
-+    bool lpi_enable;
++FIELD(ID_AA64PFR0, DIT, 48, 4)
-     bool security_extn;
++FIELD(ID_AA64PFR0, CSV2, 56, 4)
-     bool irq_reset_nonsecure;
++FIELD(ID_AA64PFR0, CSV3, 60, 4)
-     bool gicd_no_migration_shift_bug;
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
+ FIELD(ID_AA64PFR1, BT, 0, 4)
-index XXXXXXX..XXXXXXX 100644
+ FIELD(ID_AA64PFR1, SSBS, 4, 4)
---- a/hw/intc/arm_gicv3_common.c
+ FIELD(ID_AA64PFR1, MTE, 8, 4)
-+++ b/hw/intc/arm_gicv3_common.c
+ FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
++FIELD(ID_AA64PFR1, MPAM_FRAC, 16, 4)
-         return;
-     }
+ FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
+ FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
-+    if (s->lpi_enable && !s->dma) {
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR0, TGRAN16_2, 32, 4)
-+        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
+ FIELD(ID_AA64MMFR0, TGRAN64_2, 36, 4)
-+        return;
+ FIELD(ID_AA64MMFR0, TGRAN4_2, 40, 4)
-+    }
+ FIELD(ID_AA64MMFR0, EXS, 44, 4)
-+
++FIELD(ID_AA64MMFR0, FGT, 56, 4)
-     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
++FIELD(ID_AA64MMFR0, ECV, 60, 4)
-     for (i = 0; i < s->num_cpu; i++) {
+ FIELD(ID_AA64MMFR1, HAFDBS, 0, 4)
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
+ FIELD(ID_AA64MMFR1, VMIDBITS, 4, 4)
-             (1 << 24) |
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR1, LO, 16, 4)
-             (i << 8) |
+ FIELD(ID_AA64MMFR1, PAN, 20, 4)
-             (last << 4);
+ FIELD(ID_AA64MMFR1, SPECSEI, 24, 4)
-+
+ FIELD(ID_AA64MMFR1, XNX, 28, 4)
-+        if (s->lpi_enable) {
++FIELD(ID_AA64MMFR1, TWED, 32, 4)
-+            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
++FIELD(ID_AA64MMFR1, ETS, 36, 4)
-+        }
-     }
+ FIELD(ID_AA64MMFR2, CNP, 0, 4)
- }
+ FIELD(ID_AA64MMFR2, UAO, 4, 4)
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)
-@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
+ FIELD(ID_AA64DFR0, PMSVER, 32, 4)
-     DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
+ FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)
-     DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
+ FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)
-     DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
++FIELD(ID_AA64DFR0, MTPMU, 48, 4)
-+    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
-     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
+ FIELD(ID_DFR0, COPDBG, 0, 4)
-     DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
+ FIELD(ID_DFR0, COPSDBG, 4, 4)
                        redist_region_count, qdev_prop_uint32, uint32_t),
 +    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
 +                     MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_dist.c
 +++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
           * A3V == 1 (non-zero values of Affinity level 3 supported)
           * IDbits == 0xf (we support 16-bit interrupt identifiers)
           * DVIS == 0 (Direct virtual LPI injection not supported)
 -         * LPIS == 0 (LPIs not supported)
 +         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
 +         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
 +         *                      by GICD_TYPER.IDbits)
           * MBIS == 0 (message-based SPIs not supported)
           * SecurityExtn == 1 if security extns supported
           * CPUNumber == 0 since for us ARE is always 1
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
          bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
          *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
 +            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
              (0xf << 19) | itlinesnumber;
          return true;
      }
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
      case GICR_CTLR:
          /* For our implementation, GICR_TYPER.DPGS is 0 and so all
           * the DPG bits are RAZ/WI. We don't do anything asynchronously,
 -         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
 -         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
 -         * bits for us.
 +         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
 +         * implement LPIs) so Enable_LPIs is programmable.
           */
 +        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
 +            if (value & GICR_CTLR_ENABLE_LPIS) {
 +                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
 +            } else {
 +                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
 +            }
 +        }
          return MEMTX_OK;
      case GICR_STATUSR:
          /* RAZ/WI for our implementation */
 --
 .20.1

-[PULL 11/23] hw/intc: GICv3 ITS command queue framework
+[PULL 08/21] target/arm: add aarch32 ID register fields to cpu.h
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Leif Lindholm <leif@nuviainc.com>
-Added functionality to trigger ITS command queue processing on
+Add entries present in ARM DDI 0487F.c (August 2020).
 write to CWRITE register and process each command queue entry to
 identify the command type and handle commands like MAPD,MAPC,SYNC.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Signed-off-by: Leif Lindholm <leif@nuviainc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Message-id: 20210108185154.8108-7-leif@nuviainc.com
 Message-id: 20210910143951.92242-4-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h |  40 +++++
+ target/arm/cpu.h | 28 ++++++++++++++++++++++++++++
- hw/intc/arm_gicv3_its.c  | 319 +++++++++++++++++++++++++++++++++++++++
+file changed, 28 insertions(+)
 files changed, 359 insertions(+)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/cpu.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, DP, 4, 4)
- #define L1TABLE_ENTRY_SIZE         8
+ FIELD(ID_ISAR6, FHM, 8, 4)
+ FIELD(ID_ISAR6, SB, 12, 4)
- #define GITS_CMDQ_ENTRY_SIZE               32
+ FIELD(ID_ISAR6, SPECRES, 16, 4)
-+#define NUM_BYTES_IN_DW                     8
++FIELD(ID_ISAR6, BF16, 20, 4)
 +FIELD(ID_ISAR6, I8MM, 24, 4)
  FIELD(ID_MMFR0, VMSA, 0, 4)
  FIELD(ID_MMFR0, PMSA, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR0, AUXREG, 20, 4)
  FIELD(ID_MMFR0, FCSE, 24, 4)
  FIELD(ID_MMFR0, INNERSHR, 28, 4)
 +FIELD(ID_MMFR1, L1HVDVA, 0, 4)
 +FIELD(ID_MMFR1, L1UNIVA, 4, 4)
 +FIELD(ID_MMFR1, L1HVDSW, 8, 4)
 +FIELD(ID_MMFR1, L1UNISW, 12, 4)
 +FIELD(ID_MMFR1, L1HVD, 16, 4)
 +FIELD(ID_MMFR1, L1UNI, 20, 4)
 +FIELD(ID_MMFR1, L1TSTCLN, 24, 4)
 +FIELD(ID_MMFR1, BPRED, 28, 4)
 +
-+#define CMD_MASK                  0xff
++FIELD(ID_MMFR2, L1HVDFG, 0, 4)
 +FIELD(ID_MMFR2, L1HVDBG, 4, 4)
 +FIELD(ID_MMFR2, L1HVDRNG, 8, 4)
 +FIELD(ID_MMFR2, HVDTLB, 12, 4)
 +FIELD(ID_MMFR2, UNITLB, 16, 4)
 +FIELD(ID_MMFR2, MEMBARR, 20, 4)
 +FIELD(ID_MMFR2, WFISTALL, 24, 4)
 +FIELD(ID_MMFR2, HWACCFLG, 28, 4)
 +
-+/* ITS Commands */
+ FIELD(ID_MMFR3, CMAINTVA, 0, 4)
-+#define GITS_CMD_CLEAR            0x04
+ FIELD(ID_MMFR3, CMAINTSW, 4, 4)
-+#define GITS_CMD_DISCARD          0x0F
+ FIELD(ID_MMFR3, BPMAINT, 8, 4)
-+#define GITS_CMD_INT              0x03
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
-+#define GITS_CMD_MAPC             0x09
+ FIELD(ID_MMFR4, CCIDX, 24, 4)
-+#define GITS_CMD_MAPD             0x08
+ FIELD(ID_MMFR4, EVT, 28, 4)
-+#define GITS_CMD_MAPI             0x0B
-+#define GITS_CMD_MAPTI            0x0A
++FIELD(ID_MMFR5, ETS, 0, 4)
 +#define GITS_CMD_INV              0x0C
 +#define GITS_CMD_INVALL           0x0D
 +#define GITS_CMD_SYNC             0x05
 +
-+/* MAPC command fields */
+ FIELD(ID_PFR0, STATE0, 0, 4)
-+#define ICID_LENGTH                  16
+ FIELD(ID_PFR0, STATE1, 4, 4)
-+#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
+ FIELD(ID_PFR0, STATE2, 8, 4)
-+FIELD(MAPC, RDBASE, 16, 32)
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_PFR1, SEC_FRAC, 20, 4)
  FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
  FIELD(ID_PFR1, GIC, 28, 4)
 +FIELD(ID_PFR2, CSV3, 0, 4)
 +FIELD(ID_PFR2, SSBS, 4, 4)
 +FIELD(ID_PFR2, RAS_FRAC, 8, 4)
 +
-+#define RDBASE_PROCNUM_LENGTH        16
+ FIELD(ID_AA64ISAR0, AES, 4, 4)
-+#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
+ FIELD(ID_AA64ISAR0, SHA1, 8, 4)
  FIELD(ID_AA64ISAR0, SHA2, 12, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_DFR0, MPROFDBG, 20, 4)
  FIELD(ID_DFR0, PERFMON, 24, 4)
  FIELD(ID_DFR0, TRACEFILT, 28, 4)
 +FIELD(ID_DFR1, MTPMU, 0, 4)
 +
-+/* MAPD command fields */
+ FIELD(DBGDIDR, SE_IMP, 12, 1)
-+#define ITTADDR_LENGTH               44
+ FIELD(DBGDIDR, NSUHD_IMP, 14, 1)
-+#define ITTADDR_SHIFT                 8
+ FIELD(DBGDIDR, VERSION, 16, 4)
 +#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 +#define SIZE_MASK                 0x1f
 +
 +#define DEVID_SHIFT                  32
 +#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 +
 +#define VALID_SHIFT               63
 +#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
 +#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
 +#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
  /**
   * Default features advertised by this version of ITS
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
   * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
   */
  #define GITS_DTE_SIZE                 (0x8ULL)
 +#define GITS_DTE_ITTADDR_SHIFT           6
 +#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
 +                                                      ITTADDR_LENGTH)
  /*
   * 8 bytes Collection Table Entry size
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
      return result;
  }
 +static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
 +                       uint64_t rdbase)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t value;
 +    uint64_t l2t_addr;
 +    bool valid_l2t;
 +    uint32_t l2t_id;
 +    uint32_t max_l2_entries;
 +    uint64_t cte = 0;
 +    MemTxResult res = MEMTX_OK;
 +
 +    if (!s->ct.valid) {
 +        return true;
 +    }
 +
 +    if (valid) {
 +        /* add mapping entry to collection table */
 +        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
 +    }
 +
 +    /*
 +     * The specification defines the format of level 1 entries of a
 +     * 2-level table, but the format of level 2 entries and the format
 +     * of flat-mapped tables is IMPDEF.
 +     */
 +    if (s->ct.indirect) {
 +        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->ct.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return false;
 +        }
 +
 +        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +        if (valid_l2t) {
 +            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
 +
 +            l2t_addr = value & ((1ULL << 51) - 1);
 +
 +            address_space_stq_le(as, l2t_addr +
 +                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
 +                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
 +        }
 +    } else {
 +        /* Flat level table */
 +        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
 +                             cte, MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +    if (res != MEMTX_OK) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
 +static bool process_mapc(GICv3ITSState *s, uint32_t offset)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint16_t icid;
 +    uint64_t rdbase;
 +    bool valid;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = false;
 +    uint64_t value;
 +
 +    offset += NUM_BYTES_IN_DW;
 +    offset += NUM_BYTES_IN_DW;
 +
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    icid = value & ICID_MASK;
 +
 +    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
 +    rdbase &= RDBASE_PROCNUM_MASK;
 +
 +    valid = (value & CMD_FIELD_VALID_MASK);
 +
 +    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "ITS MAPC: invalid collection table attributes "
 +                      "icid %d rdbase %lu\n",  icid, rdbase);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        result = update_cte(s, icid, valid, rdbase);
 +    }
 +
 +    return result;
 +}
 +
 +static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
 +                       uint8_t size, uint64_t itt_addr)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t value;
 +    uint64_t l2t_addr;
 +    bool valid_l2t;
 +    uint32_t l2t_id;
 +    uint32_t max_l2_entries;
 +    uint64_t dte = 0;
 +    MemTxResult res = MEMTX_OK;
 +
 +    if (s->dt.valid) {
 +        if (valid) {
 +            /* add mapping entry to device table */
 +            dte = (valid & TABLE_ENTRY_VALID_MASK) |
 +                  ((size & SIZE_MASK) << 1U) |
 +                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
 +        }
 +    } else {
 +        return true;
 +    }
 +
 +    /*
 +     * The specification defines the format of level 1 entries of a
 +     * 2-level table, but the format of level 2 entries and the format
 +     * of flat-mapped tables is IMPDEF.
 +     */
 +    if (s->dt.indirect) {
 +        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->dt.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return false;
 +        }
 +
 +        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +        if (valid_l2t) {
 +            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
 +
 +            l2t_addr = value & ((1ULL << 51) - 1);
 +
 +            address_space_stq_le(as, l2t_addr +
 +                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
 +                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
 +        }
 +    } else {
 +        /* Flat level table */
 +        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
 +                             dte, MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +    if (res != MEMTX_OK) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
 +static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint32_t devid;
 +    uint8_t size;
 +    uint64_t itt_addr;
 +    bool valid;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = false;
 +
 +    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    size = (value & SIZE_MASK);
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
 +
 +    valid = (value & CMD_FIELD_VALID_MASK);
 +
 +    if ((devid > s->dt.maxids.max_devids) ||
 +        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "ITS MAPD: invalid device table attributes "
 +                      "devid %d or size %d\n", devid, size);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        result = update_dte(s, devid, valid, size, itt_addr);
 +    }
 +
 +    return result;
 +}
 +
 +/*
 + * Current implementation blocks until all
 + * commands are processed
 + */
 +static void process_cmdq(GICv3ITSState *s)
 +{
 +    uint32_t wr_offset = 0;
 +    uint32_t rd_offset = 0;
 +    uint32_t cq_offset = 0;
 +    uint64_t data;
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = true;
 +    uint8_t cmd;
 +
 +    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +        return;
 +    }
 +
 +    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
 +
 +    if (wr_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid write offset "
 +                      "%d\n", __func__, wr_offset);
 +        return;
 +    }
 +
 +    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
 +
 +    if (rd_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid read offset "
 +                      "%d\n", __func__, rd_offset);
 +        return;
 +    }
 +
 +    while (wr_offset != rd_offset) {
 +        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
 +        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
 +                                    MEMTXATTRS_UNSPECIFIED, &res);
 +        if (res != MEMTX_OK) {
 +            result = false;
 +        }
 +        cmd = (data & CMD_MASK);
 +
 +        switch (cmd) {
 +        case GITS_CMD_INT:
 +            break;
 +        case GITS_CMD_CLEAR:
 +            break;
 +        case GITS_CMD_SYNC:
 +            /*
 +             * Current implementation makes a blocking synchronous call
 +             * for every command issued earlier, hence the internal state
 +             * is already consistent by the time SYNC command is executed.
 +             * Hence no further processing is required for SYNC command.
 +             */
 +            break;
 +        case GITS_CMD_MAPD:
 +            result = process_mapd(s, data, cq_offset);
 +            break;
 +        case GITS_CMD_MAPC:
 +            result = process_mapc(s, cq_offset);
 +            break;
 +        case GITS_CMD_MAPTI:
 +            break;
 +        case GITS_CMD_MAPI:
 +            break;
 +        case GITS_CMD_DISCARD:
 +            break;
 +        case GITS_CMD_INV:
 +        case GITS_CMD_INVALL:
 +            break;
 +        default:
 +            break;
 +        }
 +        if (result) {
 +            rd_offset++;
 +            rd_offset %= s->cq.max_entries;
 +            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
 +        } else {
 +            /*
 +             * in this implementation, in case of dma read/write error
 +             * we stall the command processing
 +             */
 +            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: %x cmd processing failed\n", __func__, cmd);
 +            break;
 +        }
 +    }
 +}
 +
  /*
   * This function extracts the ITS Device and Collection table specific
   * parameters (like base_addr, size etc) from GITS_BASER register.
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
              extract_table_params(s);
              extract_cmdq_params(s);
              s->creadr = 0;
 +            process_cmdq(s);
          }
          break;
      case GITS_CBASER:
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
      case GITS_CWRITER:
          s->cwriter = deposit64(s->cwriter, 0, 32,
                                 (value & ~R_GITS_CWRITER_RETRY_MASK));
 +        if (s->cwriter != s->creadr) {
 +            process_cmdq(s);
 +        }
          break;
      case GITS_CWRITER + 4:
          s->cwriter = deposit64(s->cwriter, 32, 32, value);
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
          break;
      case GITS_CWRITER:
          s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
 +        if (s->cwriter != s->creadr) {
 +            process_cmdq(s);
 +        }
          break;
      case GITS_CREADR:
          if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 --
 .20.1

-[PULL 06/23] hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
+[PULL 09/21] ui/cocoa: Update path to docs in build tree
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Roman Bolshakov <r.bolshakov@yadro.com>
-We've got SW that expects FSBL (Bootlooader) to setup clocks and
+QEMU documentation can't be opened if QEMU is run from build tree
-resets. It's quite common that users run that SW on QEMU without
+because executables are placed in the top of build tree after conversion
-FSBL (FSBL typically requires the Xilinx tools installed). That's
+to meson.
 fine, since users can stil use -device loader to enable clocks etc.
-To help folks understand what's going, a log (guest-error) message
+Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
-would be helpful here. In particular with the serial port since
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
-things will go very quiet if they get things wrong.
+Message-id: 20210108213815.64678-1-r.bolshakov@yadro.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/cadence_uart.c | 8 ++++++++
+ ui/cocoa.m | 2 +-
-file changed, 8 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
+diff --git a/ui/cocoa.m b/ui/cocoa.m
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
+--- a/ui/cocoa.m
-+++ b/hw/char/cadence_uart.c
++++ b/ui/cocoa.m
-@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
+@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
+ - (void) openDocumentation: (NSString *) filename
-     /* ignore characters when unclocked or in reset */
+ {
-     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+     /* Where to look for local files */
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+-    NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"../docs/"};
-+                      __func__);
++    NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"docs/"};
-         return 0;
+     NSString *full_file_path;
-     }
+     /* iterate thru the possible paths until the file is found */
@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
      /* ignore characters when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
      /* ignore access when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return MEMTX_ERROR;
      }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
      /* ignore access when unclocked or in reset */
      if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
 +                      __func__);
          return MEMTX_ERROR;
      }
 --
 .20.1

-[PULL 23/23] hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
+[PULL 10/21] docs: Add qemu-storage-daemon(1) manpage to meson.build
-The various MPS2 boards implemented in mps2.c have multiple I2C
+In commit 1982e1602d15 we added a new qemu-storage-daemon(1) manpage.
-buses: a bus dedicated to the audio configuration, one for the LCD
+At the moment new manpages have to be listed both in the conf.py for
-touchscreen controller, and two which are connected to the external
+Sphinx and also in docs/meson.build for Meson. We forgot the second
-Shield expansion connector.  Mark the buses which are used only for
+of those -- correct the omission.
 board-internal devices as 'full' so that if the user creates i2c
 devices on the commandline without specifying a bus name then they
 will be connected to the I2C controller used for the Shield
 connector, where guest software will expect them.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20210108161416.21129-2-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 12 +++++++++++-
+ docs/meson.build | 1 +
-file changed, 11 insertions(+), 1 deletion(-)
+file changed, 1 insertion(+)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/docs/meson.build b/docs/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/docs/meson.build
-+++ b/hw/arm/mps2.c
++++ b/docs/meson.build
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ if build_docs
-x40023000,    /* Audio */
+         'qemu-img.1': (have_tools ? 'man1' : ''),
-x40029000,    /* Shield0 */
+         'qemu-nbd.8': (have_tools ? 'man8' : ''),
-x4002a000};   /* Shield1 */
+         'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
--        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
++        'qemu-storage-daemon.1': (have_tools ? 'man1' : ''),
-+        DeviceState *dev;
+         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
-+
+         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
-+        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
 +        if (i < 2) {
 +            /*
 +             * internal-only bus: mark it full to avoid user-created
 +             * i2c devices being plugged into it.
 +             */
 +            BusState *qbus = qdev_get_child_bus(dev, "i2c");
 +            qbus_mark_full(qbus);
 +        }
      }
      create_unimplemented_device("i2s", 0x40024000, 0x400);
 --
 .20.1

-[PULL 21/23] hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
+[PULL 11/21] docs: Build and install all the docs in a single manual
-The mps2-tz boards use a data-driven structure to create the devices
+When we first converted our documentation to Sphinx, we split it into
-that sit behind peripheral protection controllers.  Currently the
+multiple manuals (system, interop, tools, etc), which are all built
-functions which create these devices are passed an 'opaque' pointer
+separately.  The primary driver for this was wanting to be able to
-which is always the address within the machine struct of the device
+avoid shipping the 'devel' manual to end-users.  However, this is
-to create, and some "all devices need this" information like irqs and
+working against the grain of the way Sphinx wants to be used and
-addresses.
+causes some annoyances:
+ * Cross-references between documents become much harder or
-If a specific device needs more information than this, it is
+   possibly impossible
-currently not possible to pass that through from the PPCInfo
+ * There is no single index to the whole documentation
-data structure. Add support for passing an extra data parameter,
+ * Within one manual there's no links or table-of-contents info
-so that we can more flexibly handle the needs of specific
+   that lets you easily navigate to the others
-device types. To provide some type-safety we make this extra
+ * The devel manual doesn't get published on the QEMU website
-parameter a pointer to a union (which initially has no members).
+   (it would be nice to able to refer to it there)
-In particular, we would like to be able to indicate which of the
+Merely hiding our developer documentation from end users seems like
-i2c controllers are for on-board devices only and which are
+it's not enough benefit for these costs.  Combine all the
-connected to the external 'shield' expansion port; a subsequent
+documentation into a single manual (the same way that the readthedocs
-patch will use this mechanism for that purpose.
+site builds it) and install the whole thing.  The previous manual
 divisions remain as the new top level sections in the manual.
  * The per-manual conf.py files are no longer needed
  * The man_pages[] specifications previously in each per-manual
    conf.py move to the top level conf.py
  * docs/meson.build logic is simplified as we now only need to run
    Sphinx once for the HTML and then once for the manpages5B
  * The old index.html.in that produced the top-level page with
    links to each manual is no longer needed
 Unfortunately this means that we now have to build the HTML
 documentation into docs/manual in the build tree rather than directly
 into docs/; otherwise it is too awkward to ensure we install only the
 built manual and not also the dependency info, stamp file, etc.  The
 manual still ends up in the same place in the final installed
 directory, but anybody who was consulting documentation from within
 the build tree will have to adjust where they're looking.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
+Message-id: 20210108161416.21129-3-peter.maydell@linaro.org
 ---
- hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
+ docs/conf.py         | 46 ++++++++++++++++++++++++++++++-
-file changed, 22 insertions(+), 13 deletions(-)
+ docs/devel/conf.py   | 15 -----------
+ docs/index.html.in   | 17 ------------
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+ docs/interop/conf.py | 28 -------------------
  docs/meson.build     | 64 +++++++++++++++++---------------------------
  docs/specs/conf.py   | 16 -----------
  docs/system/conf.py  | 28 -------------------
  docs/tools/conf.py   | 37 -------------------------
  docs/user/conf.py    | 15 -----------
 files changed, 70 insertions(+), 196 deletions(-)
  delete mode 100644 docs/devel/conf.py
  delete mode 100644 docs/index.html.in
  delete mode 100644 docs/interop/conf.py
  delete mode 100644 docs/specs/conf.py
  delete mode 100644 docs/system/conf.py
  delete mode 100644 docs/tools/conf.py
  delete mode 100644 docs/user/conf.py
 diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2-tz.c
+--- a/docs/conf.py
-+++ b/hw/arm/mps2-tz.c
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+@@ -XXX,XX +XXX,XX @@ latex_documents = [
-     }
- }
+ # -- Options for manual page output ---------------------------------------
+ # Individual manual/conf.py can override this to create man pages
-+/* Union describing the device-specific extra data we pass to the devfn. */
+-man_pages = []
-+typedef union PPCExtraData {
++man_pages = [
-+} PPCExtraData;
++    ('interop/qemu-ga', 'qemu-ga',
 +     'QEMU Guest Agent',
 +     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
 +    ('interop/qemu-ga-ref', 'qemu-ga-ref',
 +     'QEMU Guest Agent Protocol Reference',
 +     [], 7),
 +    ('interop/qemu-qmp-ref', 'qemu-qmp-ref',
 +     'QEMU QMP Reference Manual',
 +     [], 7),
 +    ('interop/qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
 +     'QEMU Storage Daemon QMP Reference Manual',
 +     [], 7),
 +    ('system/qemu-manpage', 'qemu',
 +     'QEMU User Documentation',
 +     ['Fabrice Bellard'], 1),
 +    ('system/qemu-block-drivers', 'qemu-block-drivers',
 +     'QEMU block drivers reference',
 +     ['Fabrice Bellard and the QEMU Project developers'], 7),
 +    ('system/qemu-cpu-models', 'qemu-cpu-models',
 +     'QEMU CPU Models',
 +     ['The QEMU Project developers'], 7),
 +    ('tools/qemu-img', 'qemu-img',
 +     'QEMU disk image utility',
 +     ['Fabrice Bellard'], 1),
 +    ('tools/qemu-nbd', 'qemu-nbd',
 +     'QEMU Disk Network Block Device Server',
 +     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
 +    ('tools/qemu-pr-helper', 'qemu-pr-helper',
 +     'QEMU persistent reservation helper',
 +     [], 8),
 +    ('tools/qemu-storage-daemon', 'qemu-storage-daemon',
 +     'QEMU storage daemon',
 +     [], 1),
 +    ('tools/qemu-trace-stap', 'qemu-trace-stap',
 +     'QEMU SystemTap trace tool',
 +     [], 1),
 +    ('tools/virtfs-proxy-helper', 'virtfs-proxy-helper',
 +     'QEMU 9p virtfs proxy filesystem helper',
 +     ['M. Mohan Kumar'], 1),
 +    ('tools/virtiofsd', 'virtiofsd',
 +     'QEMU virtio-fs shared file system daemon',
 +     ['Stefan Hajnoczi <stefanha@redhat.com>',
 +      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
 +]
  # -- Options for Texinfo output -------------------------------------------
 diff --git a/docs/devel/conf.py b/docs/devel/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/devel/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'devel' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'Developer''s Guide'
 diff --git a/docs/index.html.in b/docs/index.html.in
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/index.html.in
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -<!DOCTYPE html>
 -<html lang="en">
 -    <head>
 -        <meta charset="UTF-8">
 -        <title>QEMU @VERSION@ Documentation</title>
 -    </head>
 -    <body>
 -        <h1>QEMU @VERSION@ Documentation</h1>
 -        <ul>
 -            <li><a href="system/index.html">System Emulation User's Guide</a></li>
 -            <li><a href="user/index.html">User Mode Emulation User's Guide</a></li>
 -            <li><a href="tools/index.html">Tools Guide</a></li>
 -            <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
 -            <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
 -        </ul>
 -    </body>
 -</html>
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/interop/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'interop' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
 -     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
 -    ('qemu-ga-ref', 'qemu-ga-ref', 'QEMU Guest Agent Protocol Reference',
 -     [], 7),
 -    ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
 -     [], 7),
 -    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
 -     'QEMU Storage Daemon QMP Reference Manual', [], 7),
 -]
 diff --git a/docs/meson.build b/docs/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
                            meson.source_root() / 'docs/sphinx/qmp_lexer.py',
                            qapi_gen_depends ]
 -  configure_file(output: 'index.html',
 -                 input: files('index.html.in'),
 -                 configuration: {'VERSION': meson.project_version()},
 -                 install_dir: qemu_docdir)
 -  manuals = [ 'devel', 'interop', 'tools', 'specs', 'system', 'user' ]
    man_pages = {
 -    'interop' : {
          'qemu-ga.8': (have_tools ? 'man8' : ''),
          'qemu-ga-ref.7': 'man7',
          'qemu-qmp-ref.7': 'man7',
          'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
 -    },
 -    'tools': {
          'qemu-img.1': (have_tools ? 'man1' : ''),
          'qemu-nbd.8': (have_tools ? 'man8' : ''),
          'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
@@ -XXX,XX +XXX,XX @@ if build_docs
          'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
          'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
          'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
 -    },
 -    'system': {
          'qemu.1': 'man1',
          'qemu-block-drivers.7': 'man7',
          'qemu-cpu-models.7': 'man7'
 -    },
    }
    sphinxdocs = []
    sphinxmans = []
 -  foreach manual : manuals
 -    private_dir = meson.current_build_dir() / (manual + '.p')
 -    output_dir = meson.current_build_dir() / manual
 -    input_dir = meson.current_source_dir() / manual
 -    this_manual = custom_target(manual + ' manual',
 +  private_dir = meson.current_build_dir() / 'manual.p'
 +  output_dir = meson.current_build_dir() / 'manual'
 +  input_dir = meson.current_source_dir()
 +
- /* Most of the devices in the AN505 FPGA image sit behind
++  this_manual = custom_target('QEMU manual',
-  * Peripheral Protection Controllers. These data structures
+                 build_by_default: build_docs,
-  * define the layout of which devices sit behind which PPCs.
+-                output: [manual + '.stamp'],
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+-                input: [files('conf.py'), files(manual / 'conf.py')],
-  */
+-                depfile: manual + '.d',
- typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
++                output: 'docs.stamp',
-                                 const char *name, hwaddr size,
++                input: files('conf.py'),
--                                const int *irqs);
++                depfile: 'docs.d',
-+                                const int *irqs,
+                 depend_files: sphinx_extn_depends,
-+                                const PPCExtraData *extradata);
+                 command: [SPHINX_ARGS, '-Ddepfile=@DEPFILE@',
+                           '-Ddepfile_stamp=@OUTPUT0@',
- typedef struct PPCPortInfo {
+                           '-b', 'html', '-d', private_dir,
-     const char *name;
+                           input_dir, output_dir])
-@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
+-    sphinxdocs += this_manual
-     hwaddr addr;
+-    if build_docs and manual != 'devel'
-     hwaddr size;
+-      install_subdir(output_dir, install_dir: qemu_docdir)
-     int irqs[3]; /* currently no device needs more IRQ lines than this */
+-    endif
-+    PPCExtraData extradata; /* to pass device-specific info to the devfn */
++  sphinxdocs += this_manual
- } PPCPortInfo;
++  install_subdir(output_dir, install_dir: qemu_docdir, strip_directory: true)
- typedef struct PPCInfo {
+-    these_man_pages = []
-@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
+-    install_dirs = []
- static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
+-    foreach page, section : man_pages.get(manual, {})
-                                     void *opaque,
+-      these_man_pages += page
-                                     const char *name, hwaddr size,
+-      install_dirs += section == '' ? false : get_option('mandir') / section
--                                    const int *irqs)
+-    endforeach
-+                                    const int *irqs,
+-    if these_man_pages.length() > 0
-+                                    const PPCExtraData *extradata)
+-      sphinxmans += custom_target(manual + ' man pages',
- {
+-                         build_by_default: build_docs,
-     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
+-                         output: these_man_pages,
-      * and return a pointer to its MemoryRegion.
+-                         input: this_manual,
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
+-                         install: build_docs,
+-                         install_dir: install_dirs,
- static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
+-                         command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
-                                const char *name, hwaddr size,
+-                                   input_dir, meson.current_build_dir()])
--                               const int *irqs)
+-    endif
-+                               const int *irqs, const PPCExtraData *extradata)
++  these_man_pages = []
- {
++  install_dirs = []
-     /* The irq[] array is tx, rx, combined, in that order */
++  foreach page, section : man_pages
-     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
++    these_man_pages += page
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
++    install_dirs += section == '' ? false : get_option('mandir') / section
+   endforeach
- static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
++
-                               const char *name, hwaddr size,
++  sphinxmans += custom_target('QEMU man pages',
--                              const int *irqs)
++                              build_by_default: build_docs,
-+                              const int *irqs, const PPCExtraData *extradata)
++                              output: these_man_pages,
- {
++                              input: this_manual,
-     MPS2SCC *scc = opaque;
++                              install: build_docs,
-     DeviceState *sccdev;
++                              install_dir: install_dirs,
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
++                              command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
++                                        input_dir, meson.current_build_dir()])
- static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
++
-                                  const char *name, hwaddr size,
+   alias_target('sphinxdocs', sphinxdocs)
--                                 const int *irqs)
+   alias_target('html', sphinxdocs)
-+                                 const int *irqs, const PPCExtraData *extradata)
+   alias_target('man', sphinxmans)
- {
+diff --git a/docs/specs/conf.py b/docs/specs/conf.py
-     MPS2FPGAIO *fpgaio = opaque;
+deleted file mode 100644
-     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
+index XXXXXXX..XXXXXXX
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
+--- a/docs/specs/conf.py
++++ /dev/null
- static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
+@@ -XXX,XX +XXX,XX @@
-                                   const char *name, hwaddr size,
+-# -*- coding: utf-8 -*-
--                                  const int *irqs)
+-#
-+                                  const int *irqs,
+-# QEMU documentation build configuration file for the 'specs' manual.
-+                                  const PPCExtraData *extradata)
+-#
- {
+-# This includes the top level conf file and then makes any necessary tweaks.
-     SysBusDevice *s;
+-import sys
-     NICInfo *nd = &nd_table[0];
+-import os
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
+-
+-qemu_docdir = os.path.abspath("..")
- static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
+-parent_config = os.path.join(qemu_docdir, "conf.py")
-                                   const char *name, hwaddr size,
+-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
--                                  const int *irqs)
+-
-+                                  const int *irqs,
+-# This slightly misuses the 'description', but is the best way to get
-+                                  const PPCExtraData *extradata)
+-# the manual title to appear in the sidebar.
- {
+-html_theme_options['description'] = \
-     /*
+-    u'System Emulation Guest Hardware Specifications'
-      * The AN524 makes the ethernet and USB share a PPC port.
+diff --git a/docs/system/conf.py b/docs/system/conf.py
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
+deleted file mode 100644
+index XXXXXXX..XXXXXXX
- static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
+--- a/docs/system/conf.py
-                               const char *name, hwaddr size,
++++ /dev/null
--                              const int *irqs)
+@@ -XXX,XX +XXX,XX @@
-+                              const int *irqs, const PPCExtraData *extradata)
+-# -*- coding: utf-8 -*-
- {
+-#
-     TZMPC *mpc = opaque;
+-# QEMU documentation build configuration file for the 'system' manual.
-     int i = mpc - &mms->mpc[0];
+-#
-@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
+-# This includes the top level conf file and then makes any necessary tweaks.
+-import sys
- static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
+-import os
-                               const char *name, hwaddr size,
+-
--                              const int *irqs)
+-qemu_docdir = os.path.abspath("..")
-+                              const int *irqs, const PPCExtraData *extradata)
+-parent_config = os.path.join(qemu_docdir, "conf.py")
- {
+-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
+-
-     PL080State *dma = opaque;
+-# This slightly misuses the 'description', but is the best way to get
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
+-# the manual title to appear in the sidebar.
+-html_theme_options['description'] = u'System Emulation User''s Guide'
- static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
+-
-                               const char *name, hwaddr size,
+-# One entry per manual page. List of tuples
--                              const int *irqs)
+-# (source start file, name, description, authors, manual section).
-+                              const int *irqs, const PPCExtraData *extradata)
+-man_pages = [
- {
+-    ('qemu-manpage', 'qemu', u'QEMU User Documentation',
-     /*
+-     ['Fabrice Bellard'], 1),
-      * The AN505 has five PL022 SPI controllers.
+-    ('qemu-block-drivers', 'qemu-block-drivers',
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
+-     u'QEMU block drivers reference',
+-     ['Fabrice Bellard and the QEMU Project developers'], 7),
- static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
+-    ('qemu-cpu-models', 'qemu-cpu-models',
-                               const char *name, hwaddr size,
+-     u'QEMU CPU Models',
--                              const int *irqs)
+-     ['The QEMU Project developers'], 7)
-+                              const int *irqs, const PPCExtraData *extradata)
+-]
- {
+diff --git a/docs/tools/conf.py b/docs/tools/conf.py
-     ArmSbconI2CState *i2c = opaque;
+deleted file mode 100644
-     SysBusDevice *s;
+index XXXXXXX..XXXXXXX
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
+--- a/docs/tools/conf.py
++++ /dev/null
- static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
+@@ -XXX,XX +XXX,XX @@
-                               const char *name, hwaddr size,
+-# -*- coding: utf-8 -*-
--                              const int *irqs)
+-#
-+                              const int *irqs, const PPCExtraData *extradata)
+-# QEMU documentation build configuration file for the 'tools' manual.
- {
+-#
-     PL031State *pl031 = opaque;
+-# This includes the top level conf file and then makes any necessary tweaks.
-     SysBusDevice *s;
+-import sys
-@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+-import os
-             }
+-
+-qemu_docdir = os.path.abspath("..")
-             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
+-parent_config = os.path.join(qemu_docdir, "conf.py")
--                              pinfo->irqs);
+-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-+                              pinfo->irqs, &pinfo->extradata);
+-
-             portname = g_strdup_printf("port[%d]", port);
+-# This slightly misuses the 'description', but is the best way to get
-             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
+-# the manual title to appear in the sidebar.
-                                      &error_fatal);
+-html_theme_options['description'] = \
 -    u'Tools Guide'
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    ('qemu-img', 'qemu-img', u'QEMU disk image utility',
 -     ['Fabrice Bellard'], 1),
 -    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
 -     [], 1),
 -    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
 -     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
 -    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
 -     [], 8),
 -    ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
 -     [], 1),
 -    ('virtfs-proxy-helper', 'virtfs-proxy-helper',
 -     u'QEMU 9p virtfs proxy filesystem helper',
 -     ['M. Mohan Kumar'], 1),
 -    ('virtiofsd', 'virtiofsd', u'QEMU virtio-fs shared file system daemon',
 -     ['Stefan Hajnoczi <stefanha@redhat.com>',
 -      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
 -]
 diff --git a/docs/user/conf.py b/docs/user/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/user/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'user' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'User Mode Emulation User''s Guide'
 --
 .20.1

-[PULL 22/23] hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
+[PULL 12/21] target/arm: Don't decode insns in the XScale/iWMMXt space as cp insns
-The various MPS2 boards have multiple I2C buses: typically a bus
+In commit cd8be50e58f63413c0 we converted the A32 coprocessor
-dedicated to the audio configuration, one for the LCD touchscreen
+insns to decodetree. This accidentally broke XScale/iWMMXt insns,
-controller, one for a DDR4 EEPROM, and two which are connected to the
+because it moved the handling of "cp insns which are handled
-external Shield expansion connector.  Mark the buses which are used
+by looking up the cp register in the hashtable" from after the
-only for board-internal devices as 'full' so that if the user creates
+call to the legacy disas_xscale_insn() decode to before it,
-i2c devices on the commandline without specifying a bus name then
+with the result that all XScale/iWMMXt insns now UNDEF.
 they will be connected to the I2C controller used for the Shield
 connector, where guest software will expect them.
+Update valid_cp() so that it knows that on XScale cp 0 and 1
+are not standard coprocessor instructions; this will cause
+the decodetree trans_ functions to ignore them, so that
+execution will correctly get through to the legacy decode again.
+Cc: qemu-stable@nongnu.org
+Reported-by: Guenter Roeck <linux@roeck-us.net>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
+Tested-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 20210108195157.32067-1-peter.maydell@linaro.org
 ---
- hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
+ target/arm/translate.c | 7 +++++++
-file changed, 43 insertions(+), 14 deletions(-)
+file changed, 7 insertions(+)
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2-tz.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/mps2-tz.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
+@@ -XXX,XX +XXX,XX @@ static bool valid_cp(DisasContext *s, int cp)
+      * only cp14 and cp15 are valid, and other values aren't considered
- /* Union describing the device-specific extra data we pass to the devfn. */
+      * to be in the coprocessor-instruction space at all. v8M still
- typedef union PPCExtraData {
+      * permits coprocessors 0..7.
-+    bool i2c_internal;
++     * For XScale, we must not decode the XScale cp0, cp1 space as
- } PPCExtraData;
++     * a standard coprocessor insn, because we want to fall through to
++     * the legacy disas_xscale_insn() decoder after decodetree is done.
- /* Most of the devices in the AN505 FPGA image sit behind
+      */
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
++    if (arm_dc_feature(s, ARM_FEATURE_XSCALE) && (cp == 0 || cp == 1)) {
-     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
++        return false;
      s = SYS_BUS_DEVICE(i2c);
      sysbus_realize(s, &error_fatal);
 +
 +    /*
 +     * If this is an internal-use-only i2c bus, mark it full
 +     * so that user-created i2c devices are not plugged into it.
 +     * If we implement models of any on-board i2c devices that
 +     * plug in to one of the internal-use-only buses, then we will
 +     * need to create and plugging those in here before we mark the
 +     * bus as full.
 +     */
 +    if (extradata->i2c_internal) {
 +        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
 +        qbus_mark_full(qbus);
 +    }
 +
-     return sysbus_mmio_get_region(s, 0);
+     if (arm_dc_feature(s, ARM_FEATURE_V8) &&
- }
+         !arm_dc_feature(s, ARM_FEATURE_M)) {
+         return cp >= 14;
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                  { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
                  { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
                  { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
 -                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
 -                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
 -                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
 -                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
 +                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
 +                  { .i2c_internal = true /* touchscreen */ } },
 +                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
 +                  { .i2c_internal = true /* audio conf */ } },
 +                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 0 */ } },
 +                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 1 */ } },
              },
          }, {
              .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
          }, {
              .name = "apb_ppcexp1",
              .ports = {
 -                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
 -                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
 +                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
 +                  { .i2c_internal = true /* touchscreen */ } },
 +                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
 +                  { .i2c_internal = true /* audio conf */ } },
                  { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
                  { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
                  { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
 -                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
 -                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
 +                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 0 */ } },
 +                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 1 */ } },
                  { /* port 7 reserved */ },
 -                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
 +                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
 +                  { .i2c_internal = true /* DDR4 EEPROM */ } },
              },
          }, {
              .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
          }, {
              .name = "apb_ppcexp1",
              .ports = {
 -                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
 -                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
 +                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
 +                  { .i2c_internal = true /* touchscreen */ } },
 +                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
 +                  { .i2c_internal = true /* audio conf */ } },
                  { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
                  { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
                  { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
 -                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
 -                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
 +                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 0 */ } },
 +                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
 +                  { .i2c_internal = false /* shield 1 */ } },
                  { /* port 7 reserved */ },
 -                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
 +                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
 +                  { .i2c_internal = true /* DDR4 EEPROM */ } },
              },
          }, {
              .name = "apb_ppcexp2",
 --
 .20.1

-[PULL 07/23] hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
+[PULL 13/21] hw/net/lan9118: Fix RX Status FIFO PEEK value
-From: Marc Zyngier <maz@kernel.org>
+A copy-and-paste error meant that the return value for register offset 0x44
 (the RX Status FIFO PEEK register) returned a byte from a bogus offset in
 the rx status FIFO. Fix the typo.
-Although we probe for the IPA limits imposed by KVM (and the hardware)
+Cc: qemu-stable@nongnu.org
-when computing the memory map, we still use the old style '0' when
+Fixes: https://bugs.launchpad.net/qemu/+bug/1904954
-creating a scratch VM in kvm_arm_create_scratch_host_vcpu().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210108180401.2263-2-peter.maydell@linaro.org
 ---
  hw/net/lan9118.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-On systems that are severely IPA challenged (such as the Apple M1),
+diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
 this results in a failure as KVM cannot use the default 40bit that
 '0' represents.
 Instead, probe for the extension and use the reported IPA limit
 if available.
 Cc: Andrew Jones <drjones@redhat.com>
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20210822144441.1290891-2-maz@kernel.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/kvm.c | 7 ++++++-
 file changed, 6 insertions(+), 1 deletion(-)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
+--- a/hw/net/lan9118.c
-+++ b/target/arm/kvm.c
++++ b/hw/net/lan9118.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
+@@ -XXX,XX +XXX,XX @@ static uint64_t lan9118_readl(void *opaque, hwaddr offset,
-                                       struct kvm_vcpu_init *init)
+     case 0x40:
- {
+         return rx_status_fifo_pop(s);
-     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
+     case 0x44:
-+    int max_vm_pa_size;
+-        return s->rx_status_fifo[s->tx_status_fifo_head];
++        return s->rx_status_fifo[s->rx_status_fifo_head];
-     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+     case 0x48:
-     if (kvmfd < 0) {
+         return tx_status_fifo_pop(s);
-         goto err;
+     case 0x4c:
      }
 -    vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
 +    max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
 +    if (max_vm_pa_size < 0) {
 +        max_vm_pa_size = 0;
 +    }
 +    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
      if (vmfd < 0) {
          goto err;
      }
 --
 .20.1

-[PULL 20/23] qdev: Support marking individual buses as 'full'
+[PULL 14/21] hw/net/lan9118: Add symbolic constants for register offsets
-By default, QEMU will allow devices to be plugged into a bus up to
+The lan9118 code mostly uses symbolic constants for register offsets;
-the bus class's device count limit.  If the user creates a device on
+the exceptions are those which the datasheet doesn't give an official
-the command line or via the monitor and doesn't explicitly specify
+symbolic name to.
 the bus to plug it in, QEMU will plug it into the first non-full bus
 that it finds.
-This is fine in most cases, but some machines have multiple buses of
+Add some names for the registers which don't already have them, based
-a given type, some of which are dedicated to on-board devices and
+on the longer names they are given in the memory map.
 some of which have an externally exposed connector for user-pluggable
 devices. One example is I2C buses.
 Provide a new function qbus_mark_full() so that a machine model can
 mark this kind of "internal only" bus as 'full' after it has created
 all the devices that should be plugged into that bus. The "find a
 non-full bus" algorithm will then skip the internal-only bus when
 looking for a place to plug in user-created devices.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
+Message-id: 20210108180401.2263-3-peter.maydell@linaro.org
 ---
- include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
+ hw/net/lan9118.c | 24 ++++++++++++++++++------
- softmmu/qdev-monitor.c |  7 ++++++-
+file changed, 18 insertions(+), 6 deletions(-)
 files changed, 30 insertions(+), 1 deletion(-)
-diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
+diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-core.h
+--- a/hw/net/lan9118.c
-+++ b/include/hw/qdev-core.h
++++ b/hw/net/lan9118.c
-@@ -XXX,XX +XXX,XX @@ struct BusState {
+@@ -XXX,XX +XXX,XX @@ do { hw_error("lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
-     HotplugHandler *hotplug_handler;
+ do { fprintf(stderr, "lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
-     int max_index;
+ #endif
-     bool realized;
-+    bool full;
++/* The tx and rx fifo ports are a range of aliased 32-bit registers */
-     int num_children;
++#define RX_DATA_FIFO_PORT_FIRST 0x00
++#define RX_DATA_FIFO_PORT_LAST 0x1f
-     /*
++#define TX_DATA_FIFO_PORT_FIRST 0x20
-@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
++#define TX_DATA_FIFO_PORT_LAST 0x3f
     return bus->hotplug_handler;
  }
 +/**
 + * qbus_mark_full: Mark this bus as full, so no more devices can be attached
 + * @bus: Bus to mark as full
 + *
 + * By default, QEMU will allow devices to be plugged into a bus up
 + * to the bus class's device count limit. Calling this function
 + * marks a particular bus as full, so that no more devices can be
 + * plugged into it. In particular this means that the bus will not
 + * be considered as a candidate for plugging in devices created by
 + * the user on the commandline or via the monitor.
 + * If a machine has multiple buses of a given type, such as I2C,
 + * where some of those buses in the real hardware are used only for
 + * internal devices and some are exposed via expansion ports, you
 + * can use this function to mark the internal-only buses as full
 + * after you have created all their internal devices. Then user
 + * created devices will appear on the expansion-port bus where
 + * guest software expects them.
 + */
 +static inline void qbus_mark_full(BusState *bus)
 +{
 +    bus->full = true;
 +}
 +
- void device_listener_register(DeviceListener *listener);
++#define RX_STATUS_FIFO_PORT 0x40
- void device_listener_unregister(DeviceListener *listener);
++#define RX_STATUS_FIFO_PEEK 0x44
++#define TX_STATUS_FIFO_PORT 0x48
-diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
++#define TX_STATUS_FIFO_PEEK 0x4c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/qdev-monitor.c
 +++ b/softmmu/qdev-monitor.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
  static inline bool qbus_is_full(BusState *bus)
  {
 -    BusClass *bus_class = BUS_GET_CLASS(bus);
 +    BusClass *bus_class;
 +
-+    if (bus->full) {
+ #define CSR_ID_REV      0x50
-+        return true;
+ #define CSR_IRQ_CFG     0x54
-+    }
+ #define CSR_INT_STS     0x58
-+    bus_class = BUS_GET_CLASS(bus);
+@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
-     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
+     offset &= 0xff;
- }
+     //DPRINTF("Write reg 0x%02x = 0x%08x\n", (int)offset, val);
 -    if (offset >= 0x20 && offset < 0x40) {
 +    if (offset >= TX_DATA_FIFO_PORT_FIRST &&
 +        offset <= TX_DATA_FIFO_PORT_LAST) {
          /* TX FIFO */
          tx_fifo_push(s, val);
          return;
@@ -XXX,XX +XXX,XX @@ static uint64_t lan9118_readl(void *opaque, hwaddr offset,
      lan9118_state *s = (lan9118_state *)opaque;
      //DPRINTF("Read reg 0x%02x\n", (int)offset);
 -    if (offset < 0x20) {
 +    if (offset <= RX_DATA_FIFO_PORT_LAST) {
          /* RX FIFO */
          return rx_fifo_pop(s);
      }
      switch (offset) {
 -    case 0x40:
 +    case RX_STATUS_FIFO_PORT:
          return rx_status_fifo_pop(s);
 -    case 0x44:
 +    case RX_STATUS_FIFO_PEEK:
          return s->rx_status_fifo[s->rx_status_fifo_head];
 -    case 0x48:
 +    case TX_STATUS_FIFO_PORT:
          return tx_status_fifo_pop(s);
 -    case 0x4c:
 +    case TX_STATUS_FIFO_PEEK:
          return s->tx_status_fifo[s->tx_status_fifo_head];
      case CSR_ID_REV:
          return 0x01180001;
 --
 .20.1

-[PULL 10/23] hw/intc: GICv3 ITS register definitions added
+[PULL 15/21] hw/misc: Add clock converter in NPCM7XX CLK module
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Hao Wu <wuhaotsh@google.com>
-Defined descriptors for ITS device table,collection table and ITS
+This patch allows NPCM7XX CLK module to compute clocks that are used by
-command queue entities.Implemented register read/write functions,
+other NPCM7XX modules.
 extract ITS table parameters and command queue parameters,extended
 gicv3 common to capture qemu address space(which host the ITS table
 platform memories required for subsequent ITS processing) and
 initialize the same in ITS device.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Add a new struct NPCM7xxClockConverterState which represents a
 single converter.  Each clock converter in CLK module represents one
 converter in NPCM7XX CLK Module(PLL, SEL or Divider). Each converter
 takes one or more input clocks and converts them into one output clock.
 They form a clock hierarchy in the CLK module and are responsible for
 outputing clocks for various other modules in an NPCM7XX SoC.
 Each converter has a function pointer called "convert" which represents
 the unique logic for that converter.
 The clock contains two initialization information: ConverterInitInfo and
 ConverterConnectionInfo. They represent the vertices and edges in the
 clock diagram respectively.
 Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20210108190945.949196-2-wuhaotsh@google.com
 Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h               |  29 ++
+ include/hw/misc/npcm7xx_clk.h | 140 +++++-
- include/hw/intc/arm_gicv3_common.h     |   3 +
+ hw/misc/npcm7xx_clk.c         | 805 +++++++++++++++++++++++++++++++++-
- include/hw/intc/arm_gicv3_its_common.h |  23 ++
+files changed, 932 insertions(+), 13 deletions(-)
  hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
 files changed, 431 insertions(+)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/include/hw/misc/npcm7xx_clk.h b/include/hw/misc/npcm7xx_clk.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/include/hw/misc/npcm7xx_clk.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/include/hw/misc/npcm7xx_clk.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
+@@ -XXX,XX +XXX,XX @@
- FIELD(GITS_BASER, INDIRECT, 62, 1)
+ #define NPCM7XX_CLK_H
- FIELD(GITS_BASER, VALID, 63, 1)
+ #include "exec/memory.h"
-+FIELD(GITS_CBASER, SIZE, 0, 8)
++#include "hw/clock.h"
-+FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
+ #include "hw/sysbus.h"
-+FIELD(GITS_CBASER, PHYADDR, 12, 40)
-+FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
+ /*
-+FIELD(GITS_CBASER, INNERCACHE, 59, 3)
+@@ -XXX,XX +XXX,XX @@
-+FIELD(GITS_CBASER, VALID, 63, 1)
-+
+ #define NPCM7XX_WATCHDOG_RESET_GPIO_IN "npcm7xx-clk-watchdog-reset-gpio-in"
-+FIELD(GITS_CREADR, STALLED, 0, 1)
-+FIELD(GITS_CREADR, OFFSET, 5, 15)
+-typedef struct NPCM7xxCLKState {
-+
++/* Maximum amount of clock inputs in a SEL module. */
-+FIELD(GITS_CWRITER, RETRY, 0, 1)
++#define NPCM7XX_CLK_SEL_MAX_INPUT 5
-+FIELD(GITS_CWRITER, OFFSET, 5, 15)
++
-+
++/* PLLs in CLK module. */
-+FIELD(GITS_CTLR, ENABLED, 0, 1)
++typedef enum NPCM7xxClockPLL {
- FIELD(GITS_CTLR, QUIESCENT, 31, 1)
++    NPCM7XX_CLOCK_PLL0,
++    NPCM7XX_CLOCK_PLL1,
- FIELD(GITS_TYPER, PHYSICAL, 0, 1)
++    NPCM7XX_CLOCK_PLL2,
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
++    NPCM7XX_CLOCK_PLLG,
- FIELD(GITS_TYPER, CIDBITS, 32, 4)
++    NPCM7XX_CLOCK_NR_PLLS,
- FIELD(GITS_TYPER, CIL, 36, 1)
++} NPCM7xxClockPLL;
++
-+#define GITS_IDREGS           0xFFD0
++/* SEL/MUX in CLK module. */
-+
++typedef enum NPCM7xxClockSEL {
-+#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
++    NPCM7XX_CLOCK_PIXCKSEL,
-+
++    NPCM7XX_CLOCK_MCCKSEL,
-+#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
++    NPCM7XX_CLOCK_CPUCKSEL,
-+                                              R_GITS_BASER_TYPE_MASK)
++    NPCM7XX_CLOCK_CLKOUTSEL,
-+
++    NPCM7XX_CLOCK_UARTCKSEL,
- #define GITS_BASER_PAGESIZE_4K                0
++    NPCM7XX_CLOCK_TIMCKSEL,
- #define GITS_BASER_PAGESIZE_16K               1
++    NPCM7XX_CLOCK_SDCKSEL,
- #define GITS_BASER_PAGESIZE_64K               2
++    NPCM7XX_CLOCK_GFXMSEL,
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
++    NPCM7XX_CLOCK_SUCKSEL,
- #define GITS_BASER_TYPE_DEVICE               1ULL
++    NPCM7XX_CLOCK_NR_SELS,
- #define GITS_BASER_TYPE_COLLECTION           4ULL
++} NPCM7xxClockSEL;
++
-+#define GITS_PAGE_SIZE_4K       0x1000
++/* Dividers in CLK module. */
-+#define GITS_PAGE_SIZE_16K      0x4000
++typedef enum NPCM7xxClockDivider {
-+#define GITS_PAGE_SIZE_64K      0x10000
++    NPCM7XX_CLOCK_PLL1D2, /* PLL1/2 */
-+
++    NPCM7XX_CLOCK_PLL2D2, /* PLL2/2 */
-+#define L1TABLE_ENTRY_SIZE         8
++    NPCM7XX_CLOCK_MC_DIVIDER,
-+
++    NPCM7XX_CLOCK_AXI_DIVIDER,
-+#define GITS_CMDQ_ENTRY_SIZE               32
++    NPCM7XX_CLOCK_AHB_DIVIDER,
-+
++    NPCM7XX_CLOCK_AHB3_DIVIDER,
- /**
++    NPCM7XX_CLOCK_SPI0_DIVIDER,
-  * Default features advertised by this version of ITS
++    NPCM7XX_CLOCK_SPIX_DIVIDER,
-  */
++    NPCM7XX_CLOCK_APB1_DIVIDER,
-diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
++    NPCM7XX_CLOCK_APB2_DIVIDER,
 +    NPCM7XX_CLOCK_APB3_DIVIDER,
 +    NPCM7XX_CLOCK_APB4_DIVIDER,
 +    NPCM7XX_CLOCK_APB5_DIVIDER,
 +    NPCM7XX_CLOCK_CLKOUT_DIVIDER,
 +    NPCM7XX_CLOCK_UART_DIVIDER,
 +    NPCM7XX_CLOCK_TIMER_DIVIDER,
 +    NPCM7XX_CLOCK_ADC_DIVIDER,
 +    NPCM7XX_CLOCK_MMC_DIVIDER,
 +    NPCM7XX_CLOCK_SDHC_DIVIDER,
 +    NPCM7XX_CLOCK_GFXM_DIVIDER, /* divide by 3 */
 +    NPCM7XX_CLOCK_UTMI_DIVIDER,
 +    NPCM7XX_CLOCK_NR_DIVIDERS,
 +} NPCM7xxClockConverter;
 +
 +typedef struct NPCM7xxCLKState NPCM7xxCLKState;
 +
 +/**
 + * struct NPCM7xxClockPLLState - A PLL module in CLK module.
 + * @name: The name of the module.
 + * @clk: The CLK module that owns this module.
 + * @clock_in: The input clock of this module.
 + * @clock_out: The output clock of this module.
 + * @reg: The control registers for this PLL module.
 + */
 +typedef struct NPCM7xxClockPLLState {
 +    DeviceState parent;
 +
 +    const char *name;
 +    NPCM7xxCLKState *clk;
 +    Clock *clock_in;
 +    Clock *clock_out;
 +
 +    int reg;
 +} NPCM7xxClockPLLState;
 +
 +/**
 + * struct NPCM7xxClockSELState - A SEL module in CLK module.
 + * @name: The name of the module.
 + * @clk: The CLK module that owns this module.
 + * @input_size: The size of inputs of this module.
 + * @clock_in: The input clocks of this module.
 + * @clock_out: The output clocks of this module.
 + * @offset: The offset of this module in the control register.
 + * @len: The length of this module in the control register.
 + */
 +typedef struct NPCM7xxClockSELState {
 +    DeviceState parent;
 +
 +    const char *name;
 +    NPCM7xxCLKState *clk;
 +    uint8_t input_size;
 +    Clock *clock_in[NPCM7XX_CLK_SEL_MAX_INPUT];
 +    Clock *clock_out;
 +
 +    int offset;
 +    int len;
 +} NPCM7xxClockSELState;
 +
 +/**
 + * struct NPCM7xxClockDividerState - A Divider module in CLK module.
 + * @name: The name of the module.
 + * @clk: The CLK module that owns this module.
 + * @clock_in: The input clock of this module.
 + * @clock_out: The output clock of this module.
 + * @divide: The function the divider uses to divide the input.
 + * @reg: The index of the control register that contains the divisor.
 + * @offset: The offset of the divisor in the control register.
 + * @len: The length of the divisor in the control register.
 + * @divisor: The divisor for a constant divisor
 + */
 +typedef struct NPCM7xxClockDividerState {
 +    DeviceState parent;
 +
 +    const char *name;
 +    NPCM7xxCLKState *clk;
 +    Clock *clock_in;
 +    Clock *clock_out;
 +
 +    uint32_t (*divide)(struct NPCM7xxClockDividerState *s);
 +    union {
 +        struct {
 +            int reg;
 +            int offset;
 +            int len;
 +        };
 +        int divisor;
 +    };
 +} NPCM7xxClockDividerState;
 +
 +struct NPCM7xxCLKState {
      SysBusDevice parent;
      MemoryRegion iomem;
 +    /* Clock converters */
 +    NPCM7xxClockPLLState plls[NPCM7XX_CLOCK_NR_PLLS];
 +    NPCM7xxClockSELState sels[NPCM7XX_CLOCK_NR_SELS];
 +    NPCM7xxClockDividerState dividers[NPCM7XX_CLOCK_NR_DIVIDERS];
 +
      uint32_t regs[NPCM7XX_CLK_NR_REGS];
      /* Time reference for SECCNT and CNTR25M, initialized by power on reset */
      int64_t ref_ns;
 -} NPCM7xxCLKState;
 +
 +    /* The incoming reference clock. */
 +    Clock *clkref;
 +};
  #define TYPE_NPCM7XX_CLK "npcm7xx-clk"
  #define NPCM7XX_CLK(obj) OBJECT_CHECK(NPCM7xxCLKState, (obj), TYPE_NPCM7XX_CLK)
 diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_common.h
+--- a/hw/misc/npcm7xx_clk.c
-+++ b/include/hw/intc/arm_gicv3_common.h
++++ b/hw/misc/npcm7xx_clk.c
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
      int dev_fd; /* kvm device fd if backed by kvm vgic support */
      Error *migration_blocker;
 +    MemoryRegion *dma;
 +    AddressSpace dma_as;
 +
      /* Distributor */
      /* for a GIC with the security extensions the NS banked version of this
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
 @@ -XXX,XX +XXX,XX @@
- #define GITS_TRANSLATER  0x0040
+ #include "hw/misc/npcm7xx_clk.h"
+ #include "hw/timer/npcm7xx_timer.h"
-+typedef struct {
++#include "hw/qdev-clock.h"
-+    bool valid;
+ #include "migration/vmstate.h"
-+    bool indirect;
+ #include "qemu/error-report.h"
-+    uint16_t entry_sz;
+ #include "qemu/log.h"
-+    uint32_t page_sz;
+@@ -XXX,XX +XXX,XX @@
-+    uint32_t max_entries;
+ #include "trace.h"
-+    union {
+ #include "sysemu/watchdog.h"
-+        uint32_t max_devids;
-+        uint32_t max_collids;
++/*
-+    } maxids;
++ * The reference clock hz, and the SECCNT and CNTR25M registers in this module,
-+    uint64_t base_addr;
++ * is always 25 MHz.
-+} TableDesc;
++ */
-+
++#define NPCM7XX_CLOCK_REF_HZ            (25000000)
-+typedef struct {
++
-+    bool valid;
++/* Register Field Definitions */
-+    uint32_t max_entries;
++#define NPCM7XX_CLK_WDRCR_CA9C  BIT(0) /* Cortex A9 Cores */
-+    uint64_t base_addr;
++
-+} CmdQDesc;
+ #define PLLCON_LOKI     BIT(31)
-+
+ #define PLLCON_LOKS     BIT(30)
- struct GICv3ITSState {
+ #define PLLCON_PWDEN    BIT(12)
-     SysBusDevice parent_obj;
++#define PLLCON_FBDV(con) extract32((con), 16, 12)
++#define PLLCON_OTDV2(con) extract32((con), 13, 3)
-@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
++#define PLLCON_OTDV1(con) extract32((con), 8, 3)
-     uint64_t creadr;
++#define PLLCON_INDV(con) extract32((con), 0, 6)
-     uint64_t baser[8];
+ enum NPCM7xxCLKRegisters {
-+    TableDesc  dt;
+     NPCM7XX_CLK_CLKEN1,
-+    TableDesc  ct;
+@@ -XXX,XX +XXX,XX @@ static const uint32_t cold_reset_values[NPCM7XX_CLK_NR_REGS] = {
-+    CmdQDesc   cq;
+     [NPCM7XX_CLK_AHBCKFI]       = 0x000000c8,
 +
      Error *migration_blocker;
  };
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+-/* Register Field Definitions */
-index XXXXXXX..XXXXXXX 100644
+-#define NPCM7XX_CLK_WDRCR_CA9C  BIT(0) /* Cortex A9 Cores */
---- a/hw/intc/arm_gicv3_its.c
+-
-+++ b/hw/intc/arm_gicv3_its.c
+ /* The number of watchdogs that can trigger a reset. */
-@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
+ #define NPCM7XX_NR_WATCHDOGS    (3)
-     void (*parent_reset)(DeviceState *dev);
- };
++/* Clock converter functions */
++
-+static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
++#define TYPE_NPCM7XX_CLOCK_PLL "npcm7xx-clock-pll"
-+{
++#define NPCM7XX_CLOCK_PLL(obj) OBJECT_CHECK(NPCM7xxClockPLLState, \
-+    uint64_t result = 0;
++        (obj), TYPE_NPCM7XX_CLOCK_PLL)
-+
++#define TYPE_NPCM7XX_CLOCK_SEL "npcm7xx-clock-sel"
-+    switch (page_sz) {
++#define NPCM7XX_CLOCK_SEL(obj) OBJECT_CHECK(NPCM7xxClockSELState, \
-+    case GITS_PAGE_SIZE_4K:
++        (obj), TYPE_NPCM7XX_CLOCK_SEL)
-+    case GITS_PAGE_SIZE_16K:
++#define TYPE_NPCM7XX_CLOCK_DIVIDER "npcm7xx-clock-divider"
-+        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
++#define NPCM7XX_CLOCK_DIVIDER(obj) OBJECT_CHECK(NPCM7xxClockDividerState, \
-+        break;
++        (obj), TYPE_NPCM7XX_CLOCK_DIVIDER)
 +
-+    case GITS_PAGE_SIZE_64K:
++static void npcm7xx_clk_update_pll(void *opaque)
-+        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
++{
-+        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
++    NPCM7xxClockPLLState *s = opaque;
-+        break;
++    uint32_t con = s->clk->regs[s->reg];
-+
++    uint64_t freq;
 +
 +    /* The PLL is grounded if it is not locked yet. */
 +    if (con & PLLCON_LOKI) {
 +        freq = clock_get_hz(s->clock_in);
 +        freq *= PLLCON_FBDV(con);
 +        freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
 +    } else {
 +        freq = 0;
 +    }
 +
 +    clock_update_hz(s->clock_out, freq);
 +}
 +
 +static void npcm7xx_clk_update_sel(void *opaque)
 +{
 +    NPCM7xxClockSELState *s = opaque;
 +    uint32_t index = extract32(s->clk->regs[NPCM7XX_CLK_CLKSEL], s->offset,
 +            s->len);
 +
 +    if (index >= s->input_size) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: SEL index: %u out of range\n",
 +                      __func__, index);
 +        index = 0;
 +    }
 +    clock_update_hz(s->clock_out, clock_get_hz(s->clock_in[index]));
 +}
 +
 +static void npcm7xx_clk_update_divider(void *opaque)
 +{
 +    NPCM7xxClockDividerState *s = opaque;
 +    uint32_t freq;
 +
 +    freq = s->divide(s);
 +    clock_update_hz(s->clock_out, freq);
 +}
 +
 +static uint32_t divide_by_constant(NPCM7xxClockDividerState *s)
 +{
 +    return clock_get_hz(s->clock_in) / s->divisor;
 +}
 +
 +static uint32_t divide_by_reg_divisor(NPCM7xxClockDividerState *s)
 +{
 +    return clock_get_hz(s->clock_in) /
 +            (extract32(s->clk->regs[s->reg], s->offset, s->len) + 1);
 +}
 +
 +static uint32_t divide_by_reg_divisor_times_2(NPCM7xxClockDividerState *s)
 +{
 +    return divide_by_reg_divisor(s) / 2;
 +}
 +
 +static uint32_t shift_by_reg_divisor(NPCM7xxClockDividerState *s)
 +{
 +    return clock_get_hz(s->clock_in) >>
 +        extract32(s->clk->regs[s->reg], s->offset, s->len);
 +}
 +
 +static NPCM7xxClockPLL find_pll_by_reg(enum NPCM7xxCLKRegisters reg)
 +{
 +    switch (reg) {
 +    case NPCM7XX_CLK_PLLCON0:
 +        return NPCM7XX_CLOCK_PLL0;
 +    case NPCM7XX_CLK_PLLCON1:
 +        return NPCM7XX_CLOCK_PLL1;
 +    case NPCM7XX_CLK_PLLCON2:
 +        return NPCM7XX_CLOCK_PLL2;
 +    case NPCM7XX_CLK_PLLCONG:
 +        return NPCM7XX_CLOCK_PLLG;
 +    default:
-+        break;
++        g_assert_not_reached();
 +    }
-+    return result;
++}
-+}
++
-+
++static void npcm7xx_clk_update_all_plls(NPCM7xxCLKState *clk)
-+/*
++{
-+ * This function extracts the ITS Device and Collection table specific
++    int i;
-+ * parameters (like base_addr, size etc) from GITS_BASER register.
++
-+ * It is called during ITS enable and also during post_load migration
++    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
-+ */
++        npcm7xx_clk_update_pll(&clk->plls[i]);
-+static void extract_table_params(GICv3ITSState *s)
++    }
-+{
++}
-+    uint16_t num_pages = 0;
++
-+    uint8_t  page_sz_type;
++static void npcm7xx_clk_update_all_sels(NPCM7xxCLKState *clk)
-+    uint8_t type;
++{
-+    uint32_t page_sz = 0;
++    int i;
-+    uint64_t value;
++
-+
++    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
-+    for (int i = 0; i < 8; i++) {
++        npcm7xx_clk_update_sel(&clk->sels[i]);
-+        value = s->baser[i];
++    }
-+
++}
-+        if (!value) {
++
-+            continue;
++static void npcm7xx_clk_update_all_dividers(NPCM7xxCLKState *clk)
 +{
 +    int i;
 +
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
 +        npcm7xx_clk_update_divider(&clk->dividers[i]);
 +    }
 +}
 +
 +static void npcm7xx_clk_update_all_clocks(NPCM7xxCLKState *clk)
 +{
 +    clock_update_hz(clk->clkref, NPCM7XX_CLOCK_REF_HZ);
 +    npcm7xx_clk_update_all_plls(clk);
 +    npcm7xx_clk_update_all_sels(clk);
 +    npcm7xx_clk_update_all_dividers(clk);
 +}
 +
 +/* Types of clock sources. */
 +typedef enum ClockSrcType {
 +    CLKSRC_REF,
 +    CLKSRC_PLL,
 +    CLKSRC_SEL,
 +    CLKSRC_DIV,
 +} ClockSrcType;
 +
 +typedef struct PLLInitInfo {
 +    const char *name;
 +    ClockSrcType src_type;
 +    int src_index;
 +    int reg;
 +    const char *public_name;
 +} PLLInitInfo;
 +
 +typedef struct SELInitInfo {
 +    const char *name;
 +    uint8_t input_size;
 +    ClockSrcType src_type[NPCM7XX_CLK_SEL_MAX_INPUT];
 +    int src_index[NPCM7XX_CLK_SEL_MAX_INPUT];
 +    int offset;
 +    int len;
 +    const char *public_name;
 +} SELInitInfo;
 +
 +typedef struct DividerInitInfo {
 +    const char *name;
 +    ClockSrcType src_type;
 +    int src_index;
 +    uint32_t (*divide)(NPCM7xxClockDividerState *s);
 +    int reg; /* not used when type == CONSTANT */
 +    int offset; /* not used when type == CONSTANT */
 +    int len; /* not used when type == CONSTANT */
 +    int divisor; /* used only when type == CONSTANT */
 +    const char *public_name;
 +} DividerInitInfo;
 +
 +static const PLLInitInfo pll_init_info_list[] = {
 +    [NPCM7XX_CLOCK_PLL0] = {
 +        .name = "pll0",
 +        .src_type = CLKSRC_REF,
 +        .reg = NPCM7XX_CLK_PLLCON0,
 +    },
 +    [NPCM7XX_CLOCK_PLL1] = {
 +        .name = "pll1",
 +        .src_type = CLKSRC_REF,
 +        .reg = NPCM7XX_CLK_PLLCON1,
 +    },
 +    [NPCM7XX_CLOCK_PLL2] = {
 +        .name = "pll2",
 +        .src_type = CLKSRC_REF,
 +        .reg = NPCM7XX_CLK_PLLCON2,
 +    },
 +    [NPCM7XX_CLOCK_PLLG] = {
 +        .name = "pllg",
 +        .src_type = CLKSRC_REF,
 +        .reg = NPCM7XX_CLK_PLLCONG,
 +    },
 +};
 +
 +static const SELInitInfo sel_init_info_list[] = {
 +    [NPCM7XX_CLOCK_PIXCKSEL] = {
 +        .name = "pixcksel",
 +        .input_size = 2,
 +        .src_type = {CLKSRC_PLL, CLKSRC_REF},
 +        .src_index = {NPCM7XX_CLOCK_PLLG, 0},
 +        .offset = 5,
 +        .len = 1,
 +        .public_name = "pixel-clock",
 +    },
 +    [NPCM7XX_CLOCK_MCCKSEL] = {
 +        .name = "mccksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_DIV, CLKSRC_REF, CLKSRC_REF,
 +            /*MCBPCK, shouldn't be used in normal operation*/
 +            CLKSRC_REF},
 +        .src_index = {NPCM7XX_CLOCK_PLL1D2, 0, 0, 0},
 +        .offset = 12,
 +        .len = 2,
 +        .public_name = "mc-phy-clock",
 +    },
 +    [NPCM7XX_CLOCK_CPUCKSEL] = {
 +        .name = "cpucksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF,
 +            /*SYSBPCK, shouldn't be used in normal operation*/
 +            CLKSRC_REF},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0, 0},
 +        .offset = 0,
 +        .len = 2,
 +        .public_name = "system-clock",
 +    },
 +    [NPCM7XX_CLOCK_CLKOUTSEL] = {
 +        .name = "clkoutsel",
 +        .input_size = 5,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF,
 +            CLKSRC_PLL, CLKSRC_DIV},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
 +            NPCM7XX_CLOCK_PLLG, NPCM7XX_CLOCK_PLL2D2},
 +        .offset = 18,
 +        .len = 3,
 +        .public_name = "tock",
 +    },
 +    [NPCM7XX_CLOCK_UARTCKSEL] = {
 +        .name = "uartcksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
 +            NPCM7XX_CLOCK_PLL2D2},
 +        .offset = 8,
 +        .len = 2,
 +    },
 +    [NPCM7XX_CLOCK_TIMCKSEL] = {
 +        .name = "timcksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
 +            NPCM7XX_CLOCK_PLL2D2},
 +        .offset = 14,
 +        .len = 2,
 +    },
 +    [NPCM7XX_CLOCK_SDCKSEL] = {
 +        .name = "sdcksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
 +            NPCM7XX_CLOCK_PLL2D2},
 +        .offset = 6,
 +        .len = 2,
 +    },
 +    [NPCM7XX_CLOCK_GFXMSEL] = {
 +        .name = "gfxmksel",
 +        .input_size = 2,
 +        .src_type = {CLKSRC_REF, CLKSRC_PLL},
 +        .src_index = {0, NPCM7XX_CLOCK_PLL2},
 +        .offset = 21,
 +        .len = 1,
 +    },
 +    [NPCM7XX_CLOCK_SUCKSEL] = {
 +        .name = "sucksel",
 +        .input_size = 4,
 +        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
 +        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
 +            NPCM7XX_CLOCK_PLL2D2},
 +        .offset = 10,
 +        .len = 2,
 +    },
 +};
 +
 +static const DividerInitInfo divider_init_info_list[] = {
 +    [NPCM7XX_CLOCK_PLL1D2] = {
 +        .name = "pll1d2",
 +        .src_type = CLKSRC_PLL,
 +        .src_index = NPCM7XX_CLOCK_PLL1,
 +        .divide = divide_by_constant,
 +        .divisor = 2,
 +    },
 +    [NPCM7XX_CLOCK_PLL2D2] = {
 +        .name = "pll2d2",
 +        .src_type = CLKSRC_PLL,
 +        .src_index = NPCM7XX_CLOCK_PLL2,
 +        .divide = divide_by_constant,
 +        .divisor = 2,
 +    },
 +    [NPCM7XX_CLOCK_MC_DIVIDER] = {
 +        .name = "mc-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_MCCKSEL,
 +        .divide = divide_by_constant,
 +        .divisor = 2,
 +        .public_name = "mc-clock"
 +    },
 +    [NPCM7XX_CLOCK_AXI_DIVIDER] = {
 +        .name = "axi-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_CPUCKSEL,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 0,
 +        .len = 1,
 +        .public_name = "clk2"
 +    },
 +    [NPCM7XX_CLOCK_AHB_DIVIDER] = {
 +        .name = "ahb-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AXI_DIVIDER,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 26,
 +        .len = 2,
 +        .public_name = "clk4"
 +    },
 +    [NPCM7XX_CLOCK_AHB3_DIVIDER] = {
 +        .name = "ahb3-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 6,
 +        .len = 5,
 +        .public_name = "ahb3-spi3-clock"
 +    },
 +    [NPCM7XX_CLOCK_SPI0_DIVIDER] = {
 +        .name = "spi0-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV3,
 +        .offset = 6,
 +        .len = 5,
 +        .public_name = "spi0-clock",
 +    },
 +    [NPCM7XX_CLOCK_SPIX_DIVIDER] = {
 +        .name = "spix-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV3,
 +        .offset = 1,
 +        .len = 5,
 +        .public_name = "spix-clock",
 +    },
 +    [NPCM7XX_CLOCK_APB1_DIVIDER] = {
 +        .name = "apb1-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 24,
 +        .len = 2,
 +        .public_name = "apb1-clock",
 +    },
 +    [NPCM7XX_CLOCK_APB2_DIVIDER] = {
 +        .name = "apb2-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 26,
 +        .len = 2,
 +        .public_name = "apb2-clock",
 +    },
 +    [NPCM7XX_CLOCK_APB3_DIVIDER] = {
 +        .name = "apb3-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 28,
 +        .len = 2,
 +        .public_name = "apb3-clock",
 +    },
 +    [NPCM7XX_CLOCK_APB4_DIVIDER] = {
 +        .name = "apb4-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 30,
 +        .len = 2,
 +        .public_name = "apb4-clock",
 +    },
 +    [NPCM7XX_CLOCK_APB5_DIVIDER] = {
 +        .name = "apb5-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 22,
 +        .len = 2,
 +        .public_name = "apb5-clock",
 +    },
 +    [NPCM7XX_CLOCK_CLKOUT_DIVIDER] = {
 +        .name = "clkout-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_CLKOUTSEL,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 16,
 +        .len = 5,
 +        .public_name = "clkout",
 +    },
 +    [NPCM7XX_CLOCK_UART_DIVIDER] = {
 +        .name = "uart-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_UARTCKSEL,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 16,
 +        .len = 5,
 +        .public_name = "uart-clock",
 +    },
 +    [NPCM7XX_CLOCK_TIMER_DIVIDER] = {
 +        .name = "timer-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_TIMCKSEL,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 21,
 +        .len = 5,
 +        .public_name = "timer-clock",
 +    },
 +    [NPCM7XX_CLOCK_ADC_DIVIDER] = {
 +        .name = "adc-divider",
 +        .src_type = CLKSRC_DIV,
 +        .src_index = NPCM7XX_CLOCK_TIMER_DIVIDER,
 +        .divide = shift_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 28,
 +        .len = 3,
 +        .public_name = "adc-clock",
 +    },
 +    [NPCM7XX_CLOCK_MMC_DIVIDER] = {
 +        .name = "mmc-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_SDCKSEL,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV1,
 +        .offset = 11,
 +        .len = 5,
 +        .public_name = "mmc-clock",
 +    },
 +    [NPCM7XX_CLOCK_SDHC_DIVIDER] = {
 +        .name = "sdhc-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_SDCKSEL,
 +        .divide = divide_by_reg_divisor_times_2,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 0,
 +        .len = 4,
 +        .public_name = "sdhc-clock",
 +    },
 +    [NPCM7XX_CLOCK_GFXM_DIVIDER] = {
 +        .name = "gfxm-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_GFXMSEL,
 +        .divide = divide_by_constant,
 +        .divisor = 3,
 +        .public_name = "gfxm-clock",
 +    },
 +    [NPCM7XX_CLOCK_UTMI_DIVIDER] = {
 +        .name = "utmi-divider",
 +        .src_type = CLKSRC_SEL,
 +        .src_index = NPCM7XX_CLOCK_SUCKSEL,
 +        .divide = divide_by_reg_divisor,
 +        .reg = NPCM7XX_CLK_CLKDIV2,
 +        .offset = 8,
 +        .len = 5,
 +        .public_name = "utmi-clock",
 +    },
 +};
 +
 +static void npcm7xx_clk_pll_init(Object *obj)
 +{
 +    NPCM7xxClockPLLState *pll = NPCM7XX_CLOCK_PLL(obj);
 +
 +    pll->clock_in = qdev_init_clock_in(DEVICE(pll), "clock-in",
 +            npcm7xx_clk_update_pll, pll);
 +    pll->clock_out = qdev_init_clock_out(DEVICE(pll), "clock-out");
 +}
 +
 +static void npcm7xx_clk_sel_init(Object *obj)
 +{
 +    int i;
 +    NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
 +
 +    for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
 +        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
 +                g_strdup_printf("clock-in[%d]", i),
 +                npcm7xx_clk_update_sel, sel);
 +    }
 +    sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
 +}
 +static void npcm7xx_clk_divider_init(Object *obj)
 +{
 +    NPCM7xxClockDividerState *div = NPCM7XX_CLOCK_DIVIDER(obj);
 +
 +    div->clock_in = qdev_init_clock_in(DEVICE(div), "clock-in",
 +            npcm7xx_clk_update_divider, div);
 +    div->clock_out = qdev_init_clock_out(DEVICE(div), "clock-out");
 +}
 +
 +static void npcm7xx_init_clock_pll(NPCM7xxClockPLLState *pll,
 +        NPCM7xxCLKState *clk, const PLLInitInfo *init_info)
 +{
 +    pll->name = init_info->name;
 +    pll->clk = clk;
 +    pll->reg = init_info->reg;
 +    if (init_info->public_name != NULL) {
 +        qdev_alias_clock(DEVICE(pll), "clock-out", DEVICE(clk),
 +                init_info->public_name);
 +    }
 +}
 +
 +static void npcm7xx_init_clock_sel(NPCM7xxClockSELState *sel,
 +        NPCM7xxCLKState *clk, const SELInitInfo *init_info)
 +{
 +    int input_size = init_info->input_size;
 +
 +    sel->name = init_info->name;
 +    sel->clk = clk;
 +    sel->input_size = init_info->input_size;
 +    g_assert(input_size <= NPCM7XX_CLK_SEL_MAX_INPUT);
 +    sel->offset = init_info->offset;
 +    sel->len = init_info->len;
 +    if (init_info->public_name != NULL) {
 +        qdev_alias_clock(DEVICE(sel), "clock-out", DEVICE(clk),
 +                init_info->public_name);
 +    }
 +}
 +
 +static void npcm7xx_init_clock_divider(NPCM7xxClockDividerState *div,
 +        NPCM7xxCLKState *clk, const DividerInitInfo *init_info)
 +{
 +    div->name = init_info->name;
 +    div->clk = clk;
 +
 +    div->divide = init_info->divide;
 +    if (div->divide == divide_by_constant) {
 +        div->divisor = init_info->divisor;
 +    } else {
 +        div->reg = init_info->reg;
 +        div->offset = init_info->offset;
 +        div->len = init_info->len;
 +    }
 +    if (init_info->public_name != NULL) {
 +        qdev_alias_clock(DEVICE(div), "clock-out", DEVICE(clk),
 +                init_info->public_name);
 +    }
 +}
 +
 +static Clock *npcm7xx_get_clock(NPCM7xxCLKState *clk, ClockSrcType type,
 +        int index)
 +{
 +    switch (type) {
 +    case CLKSRC_REF:
 +        return clk->clkref;
 +    case CLKSRC_PLL:
 +        return clk->plls[index].clock_out;
 +    case CLKSRC_SEL:
 +        return clk->sels[index].clock_out;
 +    case CLKSRC_DIV:
 +        return clk->dividers[index].clock_out;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static void npcm7xx_connect_clocks(NPCM7xxCLKState *clk)
 +{
 +    int i, j;
 +    Clock *src;
 +
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
 +        src = npcm7xx_get_clock(clk, pll_init_info_list[i].src_type,
 +                pll_init_info_list[i].src_index);
 +        clock_set_source(clk->plls[i].clock_in, src);
 +    }
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
 +        for (j = 0; j < sel_init_info_list[i].input_size; ++j) {
 +            src = npcm7xx_get_clock(clk, sel_init_info_list[i].src_type[j],
 +                    sel_init_info_list[i].src_index[j]);
 +            clock_set_source(clk->sels[i].clock_in[j], src);
 +        }
-+
++    }
-+        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
++    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
-+
++        src = npcm7xx_get_clock(clk, divider_init_info_list[i].src_type,
-+        switch (page_sz_type) {
++                divider_init_info_list[i].src_index);
-+        case 0:
++        clock_set_source(clk->dividers[i].clock_in, src);
-+            page_sz = GITS_PAGE_SIZE_4K;
++    }
-+            break;
++}
 +
-+        case 1:
+ static uint64_t npcm7xx_clk_read(void *opaque, hwaddr offset, unsigned size)
 +            page_sz = GITS_PAGE_SIZE_16K;
 +            break;
 +
 +        case 2:
 +        case 3:
 +            page_sz = GITS_PAGE_SIZE_64K;
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
 +        }
 +
 +        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
 +
 +        type = FIELD_EX64(value, GITS_BASER, TYPE);
 +
 +        switch (type) {
 +
 +        case GITS_BASER_TYPE_DEVICE:
 +            memset(&s->dt, 0 , sizeof(s->dt));
 +            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
 +
 +            if (!s->dt.valid) {
 +                return;
 +            }
 +
 +            s->dt.page_sz = page_sz;
 +            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
 +            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
 +
 +            if (!s->dt.indirect) {
 +                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
 +            } else {
 +                s->dt.max_entries = (((num_pages * page_sz) /
 +                                     L1TABLE_ENTRY_SIZE) *
 +                                     (page_sz / s->dt.entry_sz));
 +            }
 +
 +            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
 +                                       DEVBITS) + 1));
 +
 +            s->dt.base_addr = baser_base_addr(value, page_sz);
 +
 +            break;
 +
 +        case GITS_BASER_TYPE_COLLECTION:
 +            memset(&s->ct, 0 , sizeof(s->ct));
 +            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
 +
 +            /*
 +             * GITS_TYPER.HCC is 0 for this implementation
 +             * hence writes are discarded if ct.valid is 0
 +             */
 +            if (!s->ct.valid) {
 +                return;
 +            }
 +
 +            s->ct.page_sz = page_sz;
 +            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
 +            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
 +
 +            if (!s->ct.indirect) {
 +                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
 +            } else {
 +                s->ct.max_entries = (((num_pages * page_sz) /
 +                                     L1TABLE_ENTRY_SIZE) *
 +                                     (page_sz / s->ct.entry_sz));
 +            }
 +
 +            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
 +                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
 +                                            GITS_TYPER, CIDBITS) + 1));
 +            } else {
 +                /* 16-bit CollectionId supported when CIL == 0 */
 +                s->ct.maxids.max_collids = (1UL << 16);
 +            }
 +
 +            s->ct.base_addr = baser_base_addr(value, page_sz);
 +
 +            break;
 +
 +        default:
 +            break;
 +        }
 +    }
 +}
 +
 +static void extract_cmdq_params(GICv3ITSState *s)
 +{
 +    uint16_t num_pages = 0;
 +    uint64_t value = s->cbaser;
 +
 +    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
 +
 +    memset(&s->cq, 0 , sizeof(s->cq));
 +    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
 +
 +    if (s->cq.valid) {
 +        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
 +                             GITS_CMDQ_ENTRY_SIZE;
 +        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
 +        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
 +    }
 +}
 +
  static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                 uint64_t data, unsigned size,
                                                 MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
                                uint64_t value, MemTxAttrs attrs)
  {
-     bool result = true;
+     uint32_t reg = offset / sizeof(uint32_t);
-+    int index;
+@@ -XXX,XX +XXX,XX @@ static uint64_t npcm7xx_clk_read(void *opaque, hwaddr offset, unsigned size)
+          *
-+    switch (offset) {
+          * The 4 LSBs are always zero: (1e9 / 640) << 4 = 25000000.
-+    case GITS_CTLR:
+          */
-+        s->ctlr |= (value & ~(s->ctlr));
+-        value = (((now_ns - s->ref_ns) / 640) << 4) % NPCM7XX_TIMER_REF_HZ;
-+
++        value = (((now_ns - s->ref_ns) / 640) << 4) % NPCM7XX_CLOCK_REF_HZ;
-+        if (s->ctlr & ITS_CTLR_ENABLED) {
+         break;
-+            extract_table_params(s);
-+            extract_cmdq_params(s);
+     default:
-+            s->creadr = 0;
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_write(void *opaque, hwaddr offset,
                  value |= (value & PLLCON_LOKS);
              }
          }
 +        /* Only update PLL when it is locked. */
 +        if (value & PLLCON_LOKI) {
 +            npcm7xx_clk_update_pll(&s->plls[find_pll_by_reg(reg)]);
 +        }
 +        break;
-+    case GITS_CBASER:
++
-+        /*
++    case NPCM7XX_CLK_CLKSEL:
-+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
++        npcm7xx_clk_update_all_sels(s);
-+         *                 already enabled
++        break;
-+         */
++
-+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
++    case NPCM7XX_CLK_CLKDIV1:
-+            s->cbaser = deposit64(s->cbaser, 0, 32, value);
++    case NPCM7XX_CLK_CLKDIV2:
-+            s->creadr = 0;
++    case NPCM7XX_CLK_CLKDIV3:
-+            s->cwriter = s->creadr;
++        npcm7xx_clk_update_all_dividers(s);
          break;
      case NPCM7XX_CLK_CNTR25M:
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_enter_reset(Object *obj, ResetType type)
      case RESET_TYPE_COLD:
          memcpy(s->regs, cold_reset_values, sizeof(cold_reset_values));
          s->ref_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +        npcm7xx_clk_update_all_clocks(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_enter_reset(Object *obj, ResetType type)
                    __func__, type);
  }
 +static void npcm7xx_clk_init_clock_hierarchy(NPCM7xxCLKState *s)
 +{
 +    int i;
 +
 +    s->clkref = qdev_init_clock_in(DEVICE(s), "clkref", NULL, NULL);
 +
 +    /* First pass: init all converter modules */
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(pll_init_info_list) != NPCM7XX_CLOCK_NR_PLLS);
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(sel_init_info_list) != NPCM7XX_CLOCK_NR_SELS);
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(divider_init_info_list)
 +            != NPCM7XX_CLOCK_NR_DIVIDERS);
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
 +        object_initialize_child(OBJECT(s), pll_init_info_list[i].name,
 +                &s->plls[i], TYPE_NPCM7XX_CLOCK_PLL);
 +        npcm7xx_init_clock_pll(&s->plls[i], s,
 +                &pll_init_info_list[i]);
 +    }
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
 +        object_initialize_child(OBJECT(s), sel_init_info_list[i].name,
 +                &s->sels[i], TYPE_NPCM7XX_CLOCK_SEL);
 +        npcm7xx_init_clock_sel(&s->sels[i], s,
 +                &sel_init_info_list[i]);
 +    }
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
 +        object_initialize_child(OBJECT(s), divider_init_info_list[i].name,
 +                &s->dividers[i], TYPE_NPCM7XX_CLOCK_DIVIDER);
 +        npcm7xx_init_clock_divider(&s->dividers[i], s,
 +                &divider_init_info_list[i]);
 +    }
 +
 +    /* Second pass: connect converter modules */
 +    npcm7xx_connect_clocks(s);
 +
 +    clock_update_hz(s->clkref, NPCM7XX_CLOCK_REF_HZ);
 +}
 +
  static void npcm7xx_clk_init(Object *obj)
  {
      NPCM7xxCLKState *s = NPCM7XX_CLK(obj);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_init(Object *obj)
      memory_region_init_io(&s->iomem, obj, &npcm7xx_clk_ops, s,
                            TYPE_NPCM7XX_CLK, 4 * KiB);
      sysbus_init_mmio(&s->parent, &s->iomem);
 -    qdev_init_gpio_in_named(DEVICE(s), npcm7xx_clk_perform_watchdog_reset,
 -            NPCM7XX_WATCHDOG_RESET_GPIO_IN, NPCM7XX_NR_WATCHDOGS);
  }
 -static const VMStateDescription vmstate_npcm7xx_clk = {
 -    .name = "npcm7xx-clk",
 +static int npcm7xx_clk_post_load(void *opaque, int version_id)
 +{
 +    if (version_id >= 1) {
 +        NPCM7xxCLKState *clk = opaque;
 +
 +        npcm7xx_clk_update_all_clocks(clk);
 +    }
 +
 +    return 0;
 +}
 +
 +static void npcm7xx_clk_realize(DeviceState *dev, Error **errp)
 +{
 +    int i;
 +    NPCM7xxCLKState *s = NPCM7XX_CLK(dev);
 +
 +    qdev_init_gpio_in_named(DEVICE(s), npcm7xx_clk_perform_watchdog_reset,
 +            NPCM7XX_WATCHDOG_RESET_GPIO_IN, NPCM7XX_NR_WATCHDOGS);
 +    npcm7xx_clk_init_clock_hierarchy(s);
 +
 +    /* Realize child devices */
 +    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
 +        if (!qdev_realize(DEVICE(&s->plls[i]), NULL, errp)) {
 +            return;
 +        }
-+        break;
++    }
-+    case GITS_CBASER + 4:
++    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
-+        /*
++        if (!qdev_realize(DEVICE(&s->sels[i]), NULL, errp)) {
-+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
++            return;
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = deposit64(s->cbaser, 32, 32, value);
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
-+        break;
++    }
-+    case GITS_CWRITER:
++    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
-+        s->cwriter = deposit64(s->cwriter, 0, 32,
++        if (!qdev_realize(DEVICE(&s->dividers[i]), NULL, errp)) {
-+                               (value & ~R_GITS_CWRITER_RETRY_MASK));
++            return;
 +        break;
 +    case GITS_CWRITER + 4:
 +        s->cwriter = deposit64(s->cwriter, 32, 32, value);
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = deposit64(s->creadr, 0, 32,
 +                                  (value & ~R_GITS_CREADR_STALLED_MASK));
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
-+        break;
++    }
-+    case GITS_CREADR + 4:
++}
-+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
++
-+            s->creadr = deposit64(s->creadr, 32, 32, value);
++static const VMStateDescription vmstate_npcm7xx_clk_pll = {
-+        } else {
++    .name = "npcm7xx-clock-pll",
-+            /* RO register, ignore the write */
+     .version_id = 0,
-+            qemu_log_mask(LOG_GUEST_ERROR,
+     .minimum_version_id = 0,
-+                          "%s: invalid guest write to RO register at offset "
+-    .fields = (VMStateField[]) {
-+                          TARGET_FMT_plx "\n", __func__, offset);
+-        VMSTATE_UINT32_ARRAY(regs, NPCM7xxCLKState, NPCM7XX_CLK_NR_REGS),
-+        }
+-        VMSTATE_INT64(ref_ns, NPCM7xxCLKState),
-+        break;
++    .fields =  (VMStateField[]) {
-+    case GITS_BASER ... GITS_BASER + 0x3f:
++        VMSTATE_CLOCK(clock_in, NPCM7xxClockPLLState),
-+        /*
+         VMSTATE_END_OF_LIST(),
-+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+     },
-+         *                 already enabled
+ };
-+         */
-+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
++static const VMStateDescription vmstate_npcm7xx_clk_sel = {
-+            index = (offset - GITS_BASER) / 8;
++    .name = "npcm7xx-clock-sel",
-+
++    .version_id = 0,
-+            if (offset & 7) {
++    .minimum_version_id = 0,
-+                value <<= 32;
++    .fields =  (VMStateField[]) {
-+                value &= ~GITS_BASER_RO_MASK;
++        VMSTATE_ARRAY_OF_POINTER_TO_STRUCT(clock_in, NPCM7xxClockSELState,
-+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
++                NPCM7XX_CLK_SEL_MAX_INPUT, 0, vmstate_clock, Clock),
-+                s->baser[index] |= value;
++        VMSTATE_END_OF_LIST(),
-+            } else {
++    },
-+                value &= ~GITS_BASER_RO_MASK;
++};
-+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
++
-+                s->baser[index] |= value;
++static const VMStateDescription vmstate_npcm7xx_clk_divider = {
-+            }
++    .name = "npcm7xx-clock-divider",
-+        }
++    .version_id = 0,
-+        break;
++    .minimum_version_id = 0,
-+    case GITS_IIDR:
++    .fields =  (VMStateField[]) {
-+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
++        VMSTATE_CLOCK(clock_in, NPCM7xxClockDividerState),
-+        /* RO registers, ignore the write */
++        VMSTATE_END_OF_LIST(),
-+        qemu_log_mask(LOG_GUEST_ERROR,
++    },
-+                      "%s: invalid guest write to RO register at offset "
++};
-+                      TARGET_FMT_plx "\n", __func__, offset);
++
-+        break;
++static const VMStateDescription vmstate_npcm7xx_clk = {
-+    default:
++    .name = "npcm7xx-clk",
-+        result = false;
++    .version_id = 1,
-+        break;
++    .minimum_version_id = 1,
-+    }
++    .post_load = npcm7xx_clk_post_load,
-     return result;
++    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, NPCM7xxCLKState, NPCM7XX_CLK_NR_REGS),
 +        VMSTATE_INT64(ref_ns, NPCM7xxCLKState),
 +        VMSTATE_CLOCK(clkref, NPCM7xxCLKState),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void npcm7xx_clk_pll_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx Clock PLL Module";
 +    dc->vmsd = &vmstate_npcm7xx_clk_pll;
 +}
 +
 +static void npcm7xx_clk_sel_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx Clock SEL Module";
 +    dc->vmsd = &vmstate_npcm7xx_clk_sel;
 +}
 +
 +static void npcm7xx_clk_divider_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx Clock Divider Module";
 +    dc->vmsd = &vmstate_npcm7xx_clk_divider;
 +}
 +
  static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
  {
      ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
      dc->desc = "NPCM7xx Clock Control Registers";
      dc->vmsd = &vmstate_npcm7xx_clk;
 +    dc->realize = npcm7xx_clk_realize;
      rc->phases.enter = npcm7xx_clk_enter_reset;
  }
-@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
++static const TypeInfo npcm7xx_clk_pll_info = {
-                              uint64_t *data, MemTxAttrs attrs)
++    .name               = TYPE_NPCM7XX_CLOCK_PLL,
 +    .parent             = TYPE_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxClockPLLState),
 +    .instance_init      = npcm7xx_clk_pll_init,
 +    .class_init         = npcm7xx_clk_pll_class_init,
 +};
 +
 +static const TypeInfo npcm7xx_clk_sel_info = {
 +    .name               = TYPE_NPCM7XX_CLOCK_SEL,
 +    .parent             = TYPE_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxClockSELState),
 +    .instance_init      = npcm7xx_clk_sel_init,
 +    .class_init         = npcm7xx_clk_sel_class_init,
 +};
 +
 +static const TypeInfo npcm7xx_clk_divider_info = {
 +    .name               = TYPE_NPCM7XX_CLOCK_DIVIDER,
 +    .parent             = TYPE_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxClockDividerState),
 +    .instance_init      = npcm7xx_clk_divider_init,
 +    .class_init         = npcm7xx_clk_divider_class_init,
 +};
 +
  static const TypeInfo npcm7xx_clk_info = {
      .name               = TYPE_NPCM7XX_CLK,
      .parent             = TYPE_SYS_BUS_DEVICE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_clk_info = {
  static void npcm7xx_clk_register_type(void)
  {
-     bool result = true;
++    type_register_static(&npcm7xx_clk_pll_info);
-+    int index;
++    type_register_static(&npcm7xx_clk_sel_info);
++    type_register_static(&npcm7xx_clk_divider_info);
-+    switch (offset) {
+     type_register_static(&npcm7xx_clk_info);
 +    case GITS_CTLR:
 +        *data = s->ctlr;
 +        break;
 +    case GITS_IIDR:
 +        *data = gicv3_iidr();
 +        break;
 +    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
 +        /* ID registers */
 +        *data = gicv3_idreg(offset - GITS_IDREGS);
 +        break;
 +    case GITS_TYPER:
 +        *data = extract64(s->typer, 0, 32);
 +        break;
 +    case GITS_TYPER + 4:
 +        *data = extract64(s->typer, 32, 32);
 +        break;
 +    case GITS_CBASER:
 +        *data = extract64(s->cbaser, 0, 32);
 +        break;
 +    case GITS_CBASER + 4:
 +        *data = extract64(s->cbaser, 32, 32);
 +        break;
 +    case GITS_CREADR:
 +        *data = extract64(s->creadr, 0, 32);
 +        break;
 +    case GITS_CREADR + 4:
 +        *data = extract64(s->creadr, 32, 32);
 +        break;
 +    case GITS_CWRITER:
 +        *data = extract64(s->cwriter, 0, 32);
 +        break;
 +    case GITS_CWRITER + 4:
 +        *data = extract64(s->cwriter, 32, 32);
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        if (offset & 7) {
 +            *data = extract64(s->baser[index], 32, 32);
 +        } else {
 +            *data = extract64(s->baser[index], 0, 32);
 +        }
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
+ type_init(npcm7xx_clk_register_type);
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
                                 uint64_t value, MemTxAttrs attrs)
  {
      bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        /*
 +         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            index = (offset - GITS_BASER) / 8;
 +            s->baser[index] &= GITS_BASER_RO_MASK;
 +            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
 +        }
 +        break;
 +    case GITS_CBASER:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = value;
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CWRITER:
 +        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_TYPER:
 +        /* RO registers, ignore the write */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write to RO register at offset "
 +                      TARGET_FMT_plx "\n", __func__, offset);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
                                uint64_t *data, MemTxAttrs attrs)
  {
      bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_TYPER:
 +        *data = s->typer;
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        *data = s->baser[index];
 +        break;
 +    case GITS_CBASER:
 +        *data = s->cbaser;
 +        break;
 +    case GITS_CREADR:
 +        *data = s->creadr;
 +        break;
 +    case GITS_CWRITER:
 +        *data = s->cwriter;
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
      gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 +    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
 +                       "gicv3-its-sysmem");
 +
      /* set the ITS default features supported */
      s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                            GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                               GITS_CTE_SIZE - 1);
  }
 +static void gicv3_its_post_load(GICv3ITSState *s)
 +{
 +    if (s->ctlr & ITS_CTLR_ENABLED) {
 +        extract_table_params(s);
 +        extract_cmdq_params(s);
 +    }
 +}
 +
  static Property gicv3_its_props[] = {
      DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                       GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
 +    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
      dc->realize = gicv3_arm_its_realize;
      device_class_set_props(dc, gicv3_its_props);
      device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
 +    icc->post_load = gicv3_its_post_load;
  }
  static const TypeInfo gicv3_its_info = {
 --
 .20.1

-[PULL 04/23] hw/char: cadence_uart: Convert to memop_with_attrs() ops
+[PULL 16/21] hw/timer: Refactor NPCM7XX Timer to use CLK clock
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Hao Wu <wuhaotsh@google.com>
-This converts uart_read() and uart_write() to memop_with_attrs() ops.
+This patch makes NPCM7XX Timer to use a the timer clock generated by the
 CLK module instead of the magic number TIMER_REF_HZ.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
+Message-id: 20210108190945.949196-3-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/cadence_uart.c | 26 +++++++++++++++-----------
+ include/hw/misc/npcm7xx_clk.h    |  6 -----
-file changed, 15 insertions(+), 11 deletions(-)
+ include/hw/timer/npcm7xx_timer.h |  1 +
  hw/arm/npcm7xx.c                 |  5 ++++
  hw/timer/npcm7xx_timer.c         | 39 +++++++++++++++-----------------
 files changed, 24 insertions(+), 27 deletions(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
+diff --git a/include/hw/misc/npcm7xx_clk.h b/include/hw/misc/npcm7xx_clk.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
+--- a/include/hw/misc/npcm7xx_clk.h
-+++ b/hw/char/cadence_uart.c
++++ b/include/hw/misc/npcm7xx_clk.h
-@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
+@@ -XXX,XX +XXX,XX @@
-     uart_update_status(s);
+ #include "hw/clock.h"
  #include "hw/sysbus.h"
 -/*
 - * The reference clock frequency for the timer modules, and the SECCNT and
 - * CNTR25M registers in this module, is always 25 MHz.
 - */
 -#define NPCM7XX_TIMER_REF_HZ            (25000000)
 -
  /*
   * Number of registers in our device state structure. Don't change this without
   * incrementing the version_id in the vmstate.
 diff --git a/include/hw/timer/npcm7xx_timer.h b/include/hw/timer/npcm7xx_timer.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/timer/npcm7xx_timer.h
 +++ b/include/hw/timer/npcm7xx_timer.h
@@ -XXX,XX +XXX,XX @@ struct NPCM7xxTimerCtrlState {
      uint32_t    tisr;
 +    Clock       *clock;
      NPCM7xxTimer timer[NPCM7XX_TIMERS_PER_CTRL];
      NPCM7xxWatchdogTimer watchdog_timer;
  };
 diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx.c
 +++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/char/serial.h"
  #include "hw/loader.h"
  #include "hw/misc/unimp.h"
 +#include "hw/qdev-clock.h"
  #include "hw/qdev-properties.h"
  #include "qapi/error.h"
  #include "qemu/units.h"
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
          int first_irq;
          int j;
 +        /* Connect the timer clock. */
 +        qdev_connect_clock_in(DEVICE(&s->tim[i]), "clock", qdev_get_clock_out(
 +                    DEVICE(&s->clk), "timer-clock"));
 +
          sysbus_realize(sbd, &error_abort);
          sysbus_mmio_map(sbd, 0, npcm7xx_tim_addr[i]);
 diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/npcm7xx_timer.c
 +++ b/hw/timer/npcm7xx_timer.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/irq.h"
 +#include "hw/qdev-clock.h"
  #include "hw/qdev-properties.h"
 -#include "hw/misc/npcm7xx_clk.h"
  #include "hw/timer/npcm7xx_timer.h"
  #include "migration/vmstate.h"
  #include "qemu/bitops.h"
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_tcsr_prescaler(uint32_t tcsr)
  /* Convert a timer cycle count to a time interval in nanoseconds. */
  static int64_t npcm7xx_timer_count_to_ns(NPCM7xxTimer *t, uint32_t count)
  {
 -    int64_t ns = count;
 +    int64_t ticks = count;
 -    ns *= NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ;
 -    ns *= npcm7xx_tcsr_prescaler(t->tcsr);
 +    ticks *= npcm7xx_tcsr_prescaler(t->tcsr);
 -    return ns;
 +    return clock_ticks_to_ns(t->ctrl->clock, ticks);
  }
--static void uart_write(void *opaque, hwaddr offset,
+ /* Convert a time interval in nanoseconds to a timer cycle count. */
--                          uint64_t value, unsigned size)
+ static uint32_t npcm7xx_timer_ns_to_count(NPCM7xxTimer *t, int64_t ns)
 +static MemTxResult uart_write(void *opaque, hwaddr offset,
 +                              uint64_t value, unsigned size, MemTxAttrs attrs)
  {
-     CadenceUARTState *s = opaque;
+-    int64_t count;
+-
-     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
+-    count = ns / (NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ);
-     offset >>= 2;
+-    count /= npcm7xx_tcsr_prescaler(t->tcsr);
-     if (offset >= CADENCE_UART_R_MAX) {
+-
--        return;
+-    return count;
-+        return MEMTX_DECODE_ERROR;
++    return ns / clock_ticks_to_ns(t->ctrl->clock,
-     }
++                                  npcm7xx_tcsr_prescaler(t->tcsr));
      switch (offset) {
      case R_IER: /* ier (wts imr) */
@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
          break;
      }
      uart_update_status(s);
 +
 +    return MEMTX_OK;
  }
--static uint64_t uart_read(void *opaque, hwaddr offset,
+ static uint32_t npcm7xx_watchdog_timer_prescaler(const NPCM7xxWatchdogTimer *t)
--        unsigned size)
+@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_watchdog_timer_prescaler(const NPCM7xxWatchdogTimer *t)
-+static MemTxResult uart_read(void *opaque, hwaddr offset,
+ static void npcm7xx_watchdog_timer_reset_cycles(NPCM7xxWatchdogTimer *t,
-+                             uint64_t *value, unsigned size, MemTxAttrs attrs)
+         int64_t cycles)
  {
-     CadenceUARTState *s = opaque;
+-    uint32_t prescaler = npcm7xx_watchdog_timer_prescaler(t);
-     uint32_t c = 0;
+-    int64_t ns = (NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ) * cycles;
++    int64_t ticks = cycles * npcm7xx_watchdog_timer_prescaler(t);
-     offset >>= 2;
++    int64_t ns = clock_ticks_to_ns(t->ctrl->clock, ticks);
-     if (offset >= CADENCE_UART_R_MAX) {
--        c = 0;
+     /*
--    } else if (offset == R_TX_RX) {
+      * The reset function always clears the current timer. The caller of the
-+        return MEMTX_DECODE_ERROR;
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_watchdog_timer_reset_cycles(NPCM7xxWatchdogTimer *t,
-+    }
+      */
-+    if (offset == R_TX_RX) {
+     npcm7xx_timer_clear(&t->base_timer);
-         uart_read_rx_fifo(s, &c);
-     } else {
+-    ns *= prescaler;
--       c = s->r[offset];
+     t->base_timer.remaining_ns = ns;
 +        c = s->r[offset];
      }
      DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
 -    return c;
 +    *value = c;
 +    return MEMTX_OK;
  }
- static const MemoryRegionOps uart_ops = {
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_hold_reset(Object *obj)
--    .read = uart_read,
+     qemu_irq_lower(s->watchdog_timer.irq);
--    .write = uart_write,
+ }
-+    .read_with_attrs = uart_read,
-+    .write_with_attrs = uart_write,
+-static void npcm7xx_timer_realize(DeviceState *dev, Error **errp)
-     .endianness = DEVICE_NATIVE_ENDIAN,
++static void npcm7xx_timer_init(Object *obj)
  {
 -    NPCM7xxTimerCtrlState *s = NPCM7XX_TIMER(dev);
 -    SysBusDevice *sbd = &s->parent;
 +    NPCM7xxTimerCtrlState *s = NPCM7XX_TIMER(obj);
 +    DeviceState *dev = DEVICE(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
      int i;
      NPCM7xxWatchdogTimer *w;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_realize(DeviceState *dev, Error **errp)
              npcm7xx_watchdog_timer_expired, w);
      sysbus_init_irq(sbd, &w->irq);
 -    memory_region_init_io(&s->iomem, OBJECT(s), &npcm7xx_timer_ops, s,
 +    memory_region_init_io(&s->iomem, obj, &npcm7xx_timer_ops, s,
                            TYPE_NPCM7XX_TIMER, 4 * KiB);
      sysbus_init_mmio(sbd, &s->iomem);
      qdev_init_gpio_out_named(dev, &w->reset_signal,
              NPCM7XX_WATCHDOG_RESET_GPIO_OUT, 1);
 +    s->clock = qdev_init_clock_in(dev, "clock", NULL, NULL);
  }
  static const VMStateDescription vmstate_npcm7xx_base_timer = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_npcm7xx_watchdog_timer = {
  static const VMStateDescription vmstate_npcm7xx_timer_ctrl = {
      .name = "npcm7xx-timer-ctrl",
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32(tisr, NPCM7xxTimerCtrlState),
 +        VMSTATE_CLOCK(clock, NPCM7xxTimerCtrlState),
          VMSTATE_STRUCT_ARRAY(timer, NPCM7xxTimerCtrlState,
                               NPCM7XX_TIMERS_PER_CTRL, 0, vmstate_npcm7xx_timer,
                               NPCM7xxTimer),
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_class_init(ObjectClass *klass, void *data)
      QEMU_BUILD_BUG_ON(NPCM7XX_TIMER_REGS_END > NPCM7XX_TIMER_NR_REGS);
      dc->desc = "NPCM7xx Timer Controller";
 -    dc->realize = npcm7xx_timer_realize;
      dc->vmsd = &vmstate_npcm7xx_timer_ctrl;
      rc->phases.enter = npcm7xx_timer_enter_reset;
      rc->phases.hold = npcm7xx_timer_hold_reset;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_timer_info = {
      .parent             = TYPE_SYS_BUS_DEVICE,
      .instance_size      = sizeof(NPCM7xxTimerCtrlState),
      .class_init         = npcm7xx_timer_class_init,
 +    .instance_init      = npcm7xx_timer_init,
  };
+ static void npcm7xx_timer_register_type(void)
 --
 .20.1

-[PULL 08/23] hw/arm: Add support for kudo-bmc board.
+[PULL 17/21] hw/adc: Add an ADC module for NPCM7XX
-From: Chris Rauer <crauer@google.com>
+From: Hao Wu <wuhaotsh@google.com>
-kudo-bmc is a board supported by OpenBMC.
+The ADC is part of NPCM7XX Module. Its behavior is controled by the
-https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo
+ADC_CON register. It converts one of the eight analog inputs into a
 digital input and stores it in the ADC_DATA register when enabled.
-Since v1:
+Users can alter input value by using qom-set QMP command.
 - hyphenated Cortex-A9
-Tested: Booted kudo firmware.
+Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
-Signed-off-by: Chris Rauer <crauer@google.com>
+Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
-Reviewed-by: Patrick Venture <venture@google.com>
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-Message-id: 20210907223234.1165705-1-crauer@google.com
+Message-id: 20210108190945.949196-4-wuhaotsh@google.com
 [PMM: Added missing hw/adc/trace.h file]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/nuvoton.rst |  1 +
+ docs/system/arm/nuvoton.rst    |   2 +-
- hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
+ meson.build                    |   1 +
-files changed, 35 insertions(+)
+ hw/adc/trace.h                 |   1 +
  include/hw/adc/npcm7xx_adc.h   |  69 ++++++
  include/hw/arm/npcm7xx.h       |   2 +
  hw/adc/npcm7xx_adc.c           | 301 ++++++++++++++++++++++++++
  hw/arm/npcm7xx.c               |  24 ++-
  tests/qtest/npcm7xx_adc-test.c | 377 +++++++++++++++++++++++++++++++++
  hw/adc/meson.build             |   1 +
  hw/adc/trace-events            |   5 +
  tests/qtest/meson.build        |   3 +-
 files changed, 783 insertions(+), 3 deletions(-)
  create mode 100644 hw/adc/trace.h
  create mode 100644 include/hw/adc/npcm7xx_adc.h
  create mode 100644 hw/adc/npcm7xx_adc.c
  create mode 100644 tests/qtest/npcm7xx_adc-test.c
  create mode 100644 hw/adc/trace-events
 diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/nuvoton.rst
 +++ b/docs/system/arm/nuvoton.rst
-@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
+@@ -XXX,XX +XXX,XX @@ Supported devices
+  * Random Number Generator (RNG)
- - ``quanta-gbs-bmc``    Quanta GBS server BMC
+  * USB host (USBH)
- - ``quanta-gsj``        Quanta GSJ server BMC
+  * GPIO controller
-+- ``kudo-bmc``          Fii USA Kudo server BMC
++ * Analog to Digital Converter (ADC)
- There are also two more SoCs, NPCM710 and NPCM705, which are single-core
+ Missing devices
- variants of NPCM750 and NPCM730, respectively. These are currently not
+ ---------------
-diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
+@@ -XXX,XX +XXX,XX @@ Missing devices
   * USB device (USBD)
   * SMBus controller (SMBF)
   * Peripheral SPI controller (PSPI)
 - * Analog to Digital Converter (ADC)
   * SD/MMC host
   * PECI interface
   * Pulse Width Modulation (PWM)
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/npcm7xx_boards.c
+--- a/meson.build
-+++ b/hw/arm/npcm7xx_boards.c
++++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if have_system
      'chardev',
      'hw/9pfs',
      'hw/acpi',
 +    'hw/adc',
      'hw/alpha',
      'hw/arm',
      'hw/audio',
 diff --git a/hw/adc/trace.h b/hw/adc/trace.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/adc/trace.h
@@ -0,0 +1 @@
 +#include "trace/trace-hw_adc.h"
 diff --git a/include/hw/adc/npcm7xx_adc.h b/include/hw/adc/npcm7xx_adc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/adc/npcm7xx_adc.h
 @@ -XXX,XX +XXX,XX @@
- #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
++/*
- #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
++ * Nuvoton NPCM7xx ADC Module
- #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
++ *
-+#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
++ * Copyright 2020 Google LLC
++ *
- static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
-@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
++ * Free Software Foundation; either version 2 of the License, or
-     npcm7xx_load_kernel(machine, soc);
++ * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +#ifndef NPCM7XX_ADC_H
 +#define NPCM7XX_ADC_H
 +
 +#include "hw/clock.h"
 +#include "hw/irq.h"
 +#include "hw/sysbus.h"
 +#include "qemu/timer.h"
 +
 +#define NPCM7XX_ADC_NUM_INPUTS      8
 +/**
 + * This value should not be changed unless write_adc_calibration function in
 + * hw/arm/npcm7xx.c is also changed.
 + */
 +#define NPCM7XX_ADC_NUM_CALIB       2
 +
 +/**
 + * struct NPCM7xxADCState - Analog to Digital Converter Module device state.
 + * @parent: System bus device.
 + * @iomem: Memory region through which registers are accessed.
 + * @conv_timer: The timer counts down remaining cycles for the conversion.
 + * @irq: GIC interrupt line to fire on expiration (if enabled).
 + * @con: The Control Register.
 + * @data: The Data Buffer.
 + * @clock: The ADC Clock.
 + * @adci: The input voltage in units of uV. 1uv = 1e-6V.
 + * @vref: The external reference voltage.
 + * @iref: The internal reference voltage, initialized at launch time.
 + * @rv: The calibrated output values of 0.5V and 1.5V for the ADC.
 + */
 +typedef struct {
 +    SysBusDevice parent;
 +
 +    MemoryRegion iomem;
 +
 +    QEMUTimer    conv_timer;
 +
 +    qemu_irq     irq;
 +    uint32_t     con;
 +    uint32_t     data;
 +    Clock       *clock;
 +
 +    /* Voltages are in unit of uV. 1V = 1000000uV. */
 +    uint32_t     adci[NPCM7XX_ADC_NUM_INPUTS];
 +    uint32_t     vref;
 +    uint32_t     iref;
 +
 +    uint16_t     calibration_r_values[NPCM7XX_ADC_NUM_CALIB];
 +} NPCM7xxADCState;
 +
 +#define TYPE_NPCM7XX_ADC "npcm7xx-adc"
 +#define NPCM7XX_ADC(obj) \
 +    OBJECT_CHECK(NPCM7xxADCState, (obj), TYPE_NPCM7XX_ADC)
 +
 +#endif /* NPCM7XX_ADC_H */
 diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/npcm7xx.h
 +++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
  #define NPCM7XX_H
  #include "hw/boards.h"
 +#include "hw/adc/npcm7xx_adc.h"
  #include "hw/cpu/a9mpcore.h"
  #include "hw/gpio/npcm7xx_gpio.h"
  #include "hw/mem/npcm7xx_mc.h"
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
      NPCM7xxGCRState     gcr;
      NPCM7xxCLKState     clk;
      NPCM7xxTimerCtrlState tim[3];
 +    NPCM7xxADCState     adc;
      NPCM7xxOTPState     key_storage;
      NPCM7xxOTPState     fuse_array;
      NPCM7xxMCState      mc;
 diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/adc/npcm7xx_adc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Nuvoton NPCM7xx ADC Module
 + *
 + * Copyright 2020 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/adc/npcm7xx_adc.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/registerfields.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "qemu/timer.h"
 +#include "qemu/units.h"
 +#include "trace.h"
 +
 +REG32(NPCM7XX_ADC_CON, 0x0)
 +REG32(NPCM7XX_ADC_DATA, 0x4)
 +
 +/* Register field definitions. */
 +#define NPCM7XX_ADC_CON_MUX(rv) extract32(rv, 24, 4)
 +#define NPCM7XX_ADC_CON_INT_EN  BIT(21)
 +#define NPCM7XX_ADC_CON_REFSEL  BIT(19)
 +#define NPCM7XX_ADC_CON_INT     BIT(18)
 +#define NPCM7XX_ADC_CON_EN      BIT(17)
 +#define NPCM7XX_ADC_CON_RST     BIT(16)
 +#define NPCM7XX_ADC_CON_CONV    BIT(14)
 +#define NPCM7XX_ADC_CON_DIV(rv) extract32(rv, 1, 8)
 +
 +#define NPCM7XX_ADC_MAX_RESULT      1023
 +#define NPCM7XX_ADC_DEFAULT_IREF    2000000
 +#define NPCM7XX_ADC_CONV_CYCLES     20
 +#define NPCM7XX_ADC_RESET_CYCLES    10
 +#define NPCM7XX_ADC_R0_INPUT        500000
 +#define NPCM7XX_ADC_R1_INPUT        1500000
 +
 +static void npcm7xx_adc_reset(NPCM7xxADCState *s)
 +{
 +    timer_del(&s->conv_timer);
 +    s->con = 0x000c0001;
 +    s->data = 0x00000000;
 +}
 +
 +static uint32_t npcm7xx_adc_convert(uint32_t input, uint32_t ref)
 +{
 +    uint32_t result;
 +
 +    result = input * (NPCM7XX_ADC_MAX_RESULT + 1) / ref;
 +    if (result > NPCM7XX_ADC_MAX_RESULT) {
 +        result = NPCM7XX_ADC_MAX_RESULT;
 +    }
 +
 +    return result;
 +}
 +
 +static uint32_t npcm7xx_adc_prescaler(NPCM7xxADCState *s)
 +{
 +    return 2 * (NPCM7XX_ADC_CON_DIV(s->con) + 1);
 +}
 +
 +static void npcm7xx_adc_start_timer(Clock *clk, QEMUTimer *timer,
 +        uint32_t cycles, uint32_t prescaler)
 +{
 +    int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
 +    int64_t ticks = cycles;
 +    int64_t ns;
 +
 +    ticks *= prescaler;
 +    ns = clock_ticks_to_ns(clk, ticks);
 +    ns += now;
 +    timer_mod(timer, ns);
 +}
 +
 +static void npcm7xx_adc_start_convert(NPCM7xxADCState *s)
 +{
 +    uint32_t prescaler = npcm7xx_adc_prescaler(s);
 +
 +    npcm7xx_adc_start_timer(s->clock, &s->conv_timer, NPCM7XX_ADC_CONV_CYCLES,
 +            prescaler);
 +}
 +
 +static void npcm7xx_adc_convert_done(void *opaque)
 +{
 +    NPCM7xxADCState *s = opaque;
 +    uint32_t input = NPCM7XX_ADC_CON_MUX(s->con);
 +    uint32_t ref = (s->con & NPCM7XX_ADC_CON_REFSEL)
 +        ? s->iref : s->vref;
 +
 +    if (input >= NPCM7XX_ADC_NUM_INPUTS) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid input: %u\n",
 +                      __func__, input);
 +        return;
 +    }
 +    s->data = npcm7xx_adc_convert(s->adci[input], ref);
 +    if (s->con & NPCM7XX_ADC_CON_INT_EN) {
 +        s->con |= NPCM7XX_ADC_CON_INT;
 +        qemu_irq_raise(s->irq);
 +    }
 +    s->con &= ~NPCM7XX_ADC_CON_CONV;
 +}
 +
 +static void npcm7xx_adc_calibrate(NPCM7xxADCState *adc)
 +{
 +    adc->calibration_r_values[0] = npcm7xx_adc_convert(NPCM7XX_ADC_R0_INPUT,
 +            adc->iref);
 +    adc->calibration_r_values[1] = npcm7xx_adc_convert(NPCM7XX_ADC_R1_INPUT,
 +            adc->iref);
 +}
 +
 +static void npcm7xx_adc_write_con(NPCM7xxADCState *s, uint32_t new_con)
 +{
 +    uint32_t old_con = s->con;
 +
 +    /* Write ADC_INT to 1 to clear it */
 +    if (new_con & NPCM7XX_ADC_CON_INT) {
 +        new_con &= ~NPCM7XX_ADC_CON_INT;
 +        qemu_irq_lower(s->irq);
 +    } else if (old_con & NPCM7XX_ADC_CON_INT) {
 +        new_con |= NPCM7XX_ADC_CON_INT;
 +    }
 +
 +    s->con = new_con;
 +
 +    if (s->con & NPCM7XX_ADC_CON_RST) {
 +        npcm7xx_adc_reset(s);
 +        return;
 +    }
 +
 +    if ((s->con & NPCM7XX_ADC_CON_EN)) {
 +        if (s->con & NPCM7XX_ADC_CON_CONV) {
 +            if (!(old_con & NPCM7XX_ADC_CON_CONV)) {
 +                npcm7xx_adc_start_convert(s);
 +            }
 +        } else {
 +            timer_del(&s->conv_timer);
 +        }
 +    }
 +}
 +
 +static uint64_t npcm7xx_adc_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    uint64_t value = 0;
 +    NPCM7xxADCState *s = opaque;
 +
 +    switch (offset) {
 +    case A_NPCM7XX_ADC_CON:
 +        value = s->con;
 +        break;
 +
 +    case A_NPCM7XX_ADC_DATA:
 +        value = s->data;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        break;
 +    }
 +
 +    trace_npcm7xx_adc_read(DEVICE(s)->canonical_path, offset, value);
 +    return value;
 +}
 +
 +static void npcm7xx_adc_write(void *opaque, hwaddr offset, uint64_t v,
 +        unsigned size)
 +{
 +    NPCM7xxADCState *s = opaque;
 +
 +    trace_npcm7xx_adc_write(DEVICE(s)->canonical_path, offset, v);
 +    switch (offset) {
 +    case A_NPCM7XX_ADC_CON:
 +        npcm7xx_adc_write_con(s, v);
 +        break;
 +
 +    case A_NPCM7XX_ADC_DATA:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: register @ 0x%04" HWADDR_PRIx " is read-only\n",
 +                      __func__, offset);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        break;
 +    }
 +
 +}
 +
 +static const struct MemoryRegionOps npcm7xx_adc_ops = {
 +    .read       = npcm7xx_adc_read,
 +    .write      = npcm7xx_adc_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid      = {
 +        .min_access_size        = 4,
 +        .max_access_size        = 4,
 +        .unaligned              = false,
 +    },
 +};
 +
 +static void npcm7xx_adc_enter_reset(Object *obj, ResetType type)
 +{
 +    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
 +
 +    npcm7xx_adc_reset(s);
 +}
 +
 +static void npcm7xx_adc_hold_reset(Object *obj)
 +{
 +    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
 +
 +    qemu_irq_lower(s->irq);
 +}
 +
 +static void npcm7xx_adc_init(Object *obj)
 +{
 +    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    int i;
 +
 +    sysbus_init_irq(sbd, &s->irq);
 +
 +    timer_init_ns(&s->conv_timer, QEMU_CLOCK_VIRTUAL,
 +            npcm7xx_adc_convert_done, s);
 +    memory_region_init_io(&s->iomem, obj, &npcm7xx_adc_ops, s,
 +                          TYPE_NPCM7XX_ADC, 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL);
 +
 +    for (i = 0; i < NPCM7XX_ADC_NUM_INPUTS; ++i) {
 +        object_property_add_uint32_ptr(obj, "adci[*]",
 +                &s->adci[i], OBJ_PROP_FLAG_WRITE);
 +    }
 +    object_property_add_uint32_ptr(obj, "vref",
 +            &s->vref, OBJ_PROP_FLAG_WRITE);
 +    npcm7xx_adc_calibrate(s);
 +}
 +
 +static const VMStateDescription vmstate_npcm7xx_adc = {
 +    .name = "npcm7xx-adc",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_TIMER(conv_timer, NPCM7xxADCState),
 +        VMSTATE_UINT32(con, NPCM7xxADCState),
 +        VMSTATE_UINT32(data, NPCM7xxADCState),
 +        VMSTATE_CLOCK(clock, NPCM7xxADCState),
 +        VMSTATE_UINT32_ARRAY(adci, NPCM7xxADCState, NPCM7XX_ADC_NUM_INPUTS),
 +        VMSTATE_UINT32(vref, NPCM7xxADCState),
 +        VMSTATE_UINT32(iref, NPCM7xxADCState),
 +        VMSTATE_UINT16_ARRAY(calibration_r_values, NPCM7xxADCState,
 +                NPCM7XX_ADC_NUM_CALIB),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static Property npcm7xx_timer_properties[] = {
 +    DEFINE_PROP_UINT32("iref", NPCM7xxADCState, iref, NPCM7XX_ADC_DEFAULT_IREF),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void npcm7xx_adc_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx ADC Module";
 +    dc->vmsd = &vmstate_npcm7xx_adc;
 +    rc->phases.enter = npcm7xx_adc_enter_reset;
 +    rc->phases.hold = npcm7xx_adc_hold_reset;
 +
 +    device_class_set_props(dc, npcm7xx_timer_properties);
 +}
 +
 +static const TypeInfo npcm7xx_adc_info = {
 +    .name               = TYPE_NPCM7XX_ADC,
 +    .parent             = TYPE_SYS_BUS_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxADCState),
 +    .class_init         = npcm7xx_adc_class_init,
 +    .instance_init      = npcm7xx_adc_init,
 +};
 +
 +static void npcm7xx_adc_register_types(void)
 +{
 +    type_register_static(&npcm7xx_adc_info);
 +}
 +
 +type_init(npcm7xx_adc_register_types);
 diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx.c
 +++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@
  #define NPCM7XX_EHCI_BA         (0xf0806000)
  #define NPCM7XX_OHCI_BA         (0xf0807000)
 +/* ADC Module */
 +#define NPCM7XX_ADC_BA          (0xf000c000)
 +
  /* Internal AHB SRAM */
  #define NPCM7XX_RAM3_BA         (0xc0008000)
  #define NPCM7XX_RAM3_SZ         (4 * KiB)
@@ -XXX,XX +XXX,XX @@
  #define NPCM7XX_ROM_BA          (0xffff0000)
  #define NPCM7XX_ROM_SZ          (64 * KiB)
 +
  /* Clock configuration values to be fixed up when bypassing bootloader */
  /* Run PLL1 at 1600 MHz */
@@ -XXX,XX +XXX,XX @@
   * interrupts.
   */
  enum NPCM7xxInterrupt {
 +    NPCM7XX_ADC_IRQ             = 0,
      NPCM7XX_UART0_IRQ           = 2,
      NPCM7XX_UART1_IRQ,
      NPCM7XX_UART2_IRQ,
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init_fuses(NPCM7xxState *s)
                              sizeof(value));
  }
-+static void kudo_bmc_init(MachineState *machine)
++static void npcm7xx_write_adc_calibration(NPCM7xxState *s)
 +{
-+    NPCM7xxState *soc;
++    /* Both ADC and the fuse array must have realized. */
-+
++    QEMU_BUILD_BUG_ON(sizeof(s->adc.calibration_r_values) != 4);
-+    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
++    npcm7xx_otp_array_write(&s->fuse_array, s->adc.calibration_r_values,
-+    npcm7xx_connect_dram(soc, machine->ram);
++            NPCM7XX_FUSE_ADC_CALIB, sizeof(s->adc.calibration_r_values));
-+    qdev_realize(DEVICE(soc), NULL, &error_fatal);
++}
 +
-+    npcm7xx_load_bootrom(machine, soc);
+ static qemu_irq npcm7xx_irq(NPCM7xxState *s, int n)
 +    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 0, 0));
 +    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 3, 0));
 +
 +    npcm7xx_load_kernel(machine, soc);
 +}
 +
  static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
  {
-     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
+     return qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
-@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
-     mc->default_ram_size = 1 * GiB;
+                             TYPE_NPCM7XX_FUSE_ARRAY);
- }
+     object_initialize_child(obj, "mc", &s->mc, TYPE_NPCM7XX_MC);
+     object_initialize_child(obj, "rng", &s->rng, TYPE_NPCM7XX_RNG);
-+static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
++    object_initialize_child(obj, "adc", &s->adc, TYPE_NPCM7XX_ADC);
-+{
-+    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
+     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
-+    MachineClass *mc = MACHINE_CLASS(oc);
+         object_initialize_child(obj, "tim[*]", &s->tim[i], TYPE_NPCM7XX_TIMER);
-+
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
-+    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
+     sysbus_realize(SYS_BUS_DEVICE(&s->mc), &error_abort);
-+
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->mc), 0, NPCM7XX_MC_BA);
-+    mc->desc = "Kudo BMC (Cortex-A9)";
-+    mc->init = kudo_bmc_init;
++    /* ADC Modules. Cannot fail. */
-+    mc->default_ram_size = 1 * GiB;
++    qdev_connect_clock_in(DEVICE(&s->adc), "clock", qdev_get_clock_out(
 +                          DEVICE(&s->clk), "adc-clock"));
 +    sysbus_realize(SYS_BUS_DEVICE(&s->adc), &error_abort);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, NPCM7XX_ADC_BA);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
 +            npcm7xx_irq(s, NPCM7XX_ADC_IRQ));
 +    npcm7xx_write_adc_calibration(s);
 +
      /* Timer Modules (TIM). Cannot fail. */
      QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_tim_addr) != ARRAY_SIZE(s->tim));
      for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
      create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
      create_unimplemented_device("npcm7xx.kcs",          0xf0007000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.adc",          0xf000c000,   4 * KiB);
      create_unimplemented_device("npcm7xx.gfxi",         0xf000e000,   4 * KiB);
      create_unimplemented_device("npcm7xx.gpio[0]",      0xf0010000,   4 * KiB);
      create_unimplemented_device("npcm7xx.gpio[1]",      0xf0011000,   4 * KiB);
 diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/npcm7xx_adc-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTests for Nuvoton NPCM7xx ADCModules.
 + *
 + * Copyright 2020 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/bitops.h"
 +#include "qemu/timer.h"
 +#include "libqos/libqtest.h"
 +#include "qapi/qmp/qdict.h"
 +
 +#define REF_HZ          (25000000)
 +
 +#define CON_OFFSET      0x0
 +#define DATA_OFFSET     0x4
 +
 +#define NUM_INPUTS      8
 +#define DEFAULT_IREF    2000000
 +#define CONV_CYCLES     20
 +#define RESET_CYCLES    10
 +#define R0_INPUT        500000
 +#define R1_INPUT        1500000
 +#define MAX_RESULT      1023
 +
 +#define DEFAULT_CLKDIV  5
 +
 +#define FUSE_ARRAY_BA   0xf018a000
 +#define FCTL_OFFSET     0x14
 +#define FST_OFFSET      0x0
 +#define FADDR_OFFSET    0x4
 +#define FDATA_OFFSET    0x8
 +#define ADC_CALIB_ADDR  24
 +#define FUSE_READ       0x2
 +
 +/* Register field definitions. */
 +#define CON_MUX(rv) ((rv) << 24)
 +#define CON_INT_EN  BIT(21)
 +#define CON_REFSEL  BIT(19)
 +#define CON_INT     BIT(18)
 +#define CON_EN      BIT(17)
 +#define CON_RST     BIT(16)
 +#define CON_CONV    BIT(14)
 +#define CON_DIV(rv) extract32(rv, 1, 8)
 +
 +#define FST_RDST    BIT(1)
 +#define FDATA_MASK  0xff
 +
 +#define MAX_ERROR   10000
 +#define MIN_CALIB_INPUT 100000
 +#define MAX_CALIB_INPUT 1800000
 +
 +static const uint32_t input_list[] = {
 +    100000,
 +    500000,
 +    1000000,
 +    1500000,
 +    1800000,
 +    2000000,
 +};
 +
- static const TypeInfo npcm7xx_machine_types[] = {
++static const uint32_t vref_list[] = {
-     {
++    2000000,
-         .name           = TYPE_NPCM7XX_MACHINE,
++    2200000,
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
++    2500000,
-         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
++};
-         .parent         = TYPE_NPCM7XX_MACHINE,
++
-         .class_init     = gbs_bmc_machine_class_init,
++static const uint32_t iref_list[] = {
-+    }, {
++    1800000,
-+        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
++    1900000,
-+        .parent         = TYPE_NPCM7XX_MACHINE,
++    2000000,
-+        .class_init     = kudo_bmc_machine_class_init,
++    2100000,
-     },
++    2200000,
- };
++};
++
 +static const uint32_t div_list[] = {0, 1, 3, 7, 15};
 +
 +typedef struct ADC {
 +    int irq;
 +    uint64_t base_addr;
 +} ADC;
 +
 +ADC adc = {
 +    .irq        = 0,
 +    .base_addr  = 0xf000c000
 +};
 +
 +static uint32_t adc_read_con(QTestState *qts, const ADC *adc)
 +{
 +    return qtest_readl(qts, adc->base_addr + CON_OFFSET);
 +}
 +
 +static void adc_write_con(QTestState *qts, const ADC *adc, uint32_t value)
 +{
 +    qtest_writel(qts, adc->base_addr + CON_OFFSET, value);
 +}
 +
 +static uint32_t adc_read_data(QTestState *qts, const ADC *adc)
 +{
 +    return qtest_readl(qts, adc->base_addr + DATA_OFFSET);
 +}
 +
 +static uint32_t adc_calibrate(uint32_t measured, uint32_t *rv)
 +{
 +    return R0_INPUT + (R1_INPUT - R0_INPUT) * (int32_t)(measured - rv[0])
 +        / (int32_t)(rv[1] - rv[0]);
 +}
 +
 +static void adc_qom_set(QTestState *qts, const ADC *adc,
 +        const char *name, uint32_t value)
 +{
 +    QDict *response;
 +    const char *path = "/machine/soc/adc";
 +
 +    g_test_message("Setting properties %s of %s with value %u",
 +            name, path, value);
 +    response = qtest_qmp(qts, "{ 'execute': 'qom-set',"
 +            " 'arguments': { 'path': %s, 'property': %s, 'value': %u}}",
 +            path, name, value);
 +    /* The qom set message returns successfully. */
 +    g_assert_true(qdict_haskey(response, "return"));
 +}
 +
 +static void adc_write_input(QTestState *qts, const ADC *adc,
 +        uint32_t index, uint32_t value)
 +{
 +    char name[100];
 +
 +    sprintf(name, "adci[%u]", index);
 +    adc_qom_set(qts, adc, name, value);
 +}
 +
 +static void adc_write_vref(QTestState *qts, const ADC *adc, uint32_t value)
 +{
 +    adc_qom_set(qts, adc, "vref", value);
 +}
 +
 +static uint32_t adc_calculate_output(uint32_t input, uint32_t ref)
 +{
 +    uint32_t output;
 +
 +    g_assert_cmpuint(input, <=, ref);
 +    output = (input * (MAX_RESULT + 1)) / ref;
 +    if (output > MAX_RESULT) {
 +        output = MAX_RESULT;
 +    }
 +
 +    return output;
 +}
 +
 +static uint32_t adc_prescaler(QTestState *qts, const ADC *adc)
 +{
 +    uint32_t div = extract32(adc_read_con(qts, adc), 1, 8);
 +
 +    return 2 * (div + 1);
 +}
 +
 +static int64_t adc_calculate_steps(uint32_t cycles, uint32_t prescale,
 +        uint32_t clkdiv)
 +{
 +    return (NANOSECONDS_PER_SECOND / (REF_HZ >> clkdiv)) * cycles * prescale;
 +}
 +
 +static void adc_wait_conv_finished(QTestState *qts, const ADC *adc,
 +        uint32_t clkdiv)
 +{
 +    uint32_t prescaler = adc_prescaler(qts, adc);
 +
 +    /*
 +     * ADC should takes roughly 20 cycles to convert one sample. So we assert it
 +     * should take 10~30 cycles here.
 +     */
 +    qtest_clock_step(qts, adc_calculate_steps(CONV_CYCLES / 2, prescaler,
 +                clkdiv));
 +    /* ADC is still converting. */
 +    g_assert_true(adc_read_con(qts, adc) & CON_CONV);
 +    qtest_clock_step(qts, adc_calculate_steps(CONV_CYCLES, prescaler, clkdiv));
 +    /* ADC has finished conversion. */
 +    g_assert_false(adc_read_con(qts, adc) & CON_CONV);
 +}
 +
 +/* Check ADC can be reset to default value. */
 +static void test_init(gconstpointer adc_p)
 +{
 +    const ADC *adc = adc_p;
 +
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    adc_write_con(qts, adc, CON_REFSEL | CON_INT);
 +    g_assert_cmphex(adc_read_con(qts, adc), ==, CON_REFSEL);
 +    qtest_quit(qts);
 +}
 +
 +/* Check ADC can convert from an internal reference. */
 +static void test_convert_internal(gconstpointer adc_p)
 +{
 +    const ADC *adc = adc_p;
 +    uint32_t index, input, output, expected_output;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
 +
 +    for (index = 0; index < NUM_INPUTS; ++index) {
 +        for (size_t i = 0; i < ARRAY_SIZE(input_list); ++i) {
 +            input = input_list[i];
 +            expected_output = adc_calculate_output(input, DEFAULT_IREF);
 +
 +            adc_write_input(qts, adc, index, input);
 +            adc_write_con(qts, adc, CON_MUX(index) | CON_REFSEL | CON_INT |
 +                    CON_EN | CON_CONV);
 +            adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
 +            g_assert_cmphex(adc_read_con(qts, adc), ==, CON_MUX(index) |
 +                    CON_REFSEL | CON_EN);
 +            g_assert_false(qtest_get_irq(qts, adc->irq));
 +            output = adc_read_data(qts, adc);
 +            g_assert_cmpuint(output, ==, expected_output);
 +        }
 +    }
 +
 +    qtest_quit(qts);
 +}
 +
 +/* Check ADC can convert from an external reference. */
 +static void test_convert_external(gconstpointer adc_p)
 +{
 +    const ADC *adc = adc_p;
 +    uint32_t index, input, vref, output, expected_output;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
 +
 +    for (index = 0; index < NUM_INPUTS; ++index) {
 +        for (size_t i = 0; i < ARRAY_SIZE(input_list); ++i) {
 +            for (size_t j = 0; j < ARRAY_SIZE(vref_list); ++j) {
 +                input = input_list[i];
 +                vref = vref_list[j];
 +                expected_output = adc_calculate_output(input, vref);
 +
 +                adc_write_input(qts, adc, index, input);
 +                adc_write_vref(qts, adc, vref);
 +                adc_write_con(qts, adc, CON_MUX(index) | CON_INT | CON_EN |
 +                        CON_CONV);
 +                adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
 +                g_assert_cmphex(adc_read_con(qts, adc), ==,
 +                        CON_MUX(index) | CON_EN);
 +                g_assert_false(qtest_get_irq(qts, adc->irq));
 +                output = adc_read_data(qts, adc);
 +                g_assert_cmpuint(output, ==, expected_output);
 +            }
 +        }
 +    }
 +
 +    qtest_quit(qts);
 +}
 +
 +/* Check ADC interrupt files if and only if CON_INT_EN is set. */
 +static void test_interrupt(gconstpointer adc_p)
 +{
 +    const ADC *adc = adc_p;
 +    uint32_t index, input, output, expected_output;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +
 +    index = 1;
 +    input = input_list[1];
 +    expected_output = adc_calculate_output(input, DEFAULT_IREF);
 +
 +    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
 +    adc_write_input(qts, adc, index, input);
 +    g_assert_false(qtest_get_irq(qts, adc->irq));
 +    adc_write_con(qts, adc, CON_MUX(index) | CON_INT_EN | CON_REFSEL | CON_INT
 +            | CON_EN | CON_CONV);
 +    adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
 +    g_assert_cmphex(adc_read_con(qts, adc), ==, CON_MUX(index) | CON_INT_EN
 +            | CON_REFSEL | CON_INT | CON_EN);
 +    g_assert_true(qtest_get_irq(qts, adc->irq));
 +    output = adc_read_data(qts, adc);
 +    g_assert_cmpuint(output, ==, expected_output);
 +
 +    qtest_quit(qts);
 +}
 +
 +/* Check ADC is reset after setting ADC_RST for 10 ADC cycles. */
 +static void test_reset(gconstpointer adc_p)
 +{
 +    const ADC *adc = adc_p;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +
 +    for (size_t i = 0; i < ARRAY_SIZE(div_list); ++i) {
 +        uint32_t div = div_list[i];
 +
 +        adc_write_con(qts, adc, CON_INT | CON_EN | CON_RST | CON_DIV(div));
 +        qtest_clock_step(qts, adc_calculate_steps(RESET_CYCLES,
 +                    adc_prescaler(qts, adc), DEFAULT_CLKDIV));
 +        g_assert_false(adc_read_con(qts, adc) & CON_EN);
 +    }
 +    qtest_quit(qts);
 +}
 +
 +/* Check ADC Calibration works as desired. */
 +static void test_calibrate(gconstpointer adc_p)
 +{
 +    int i, j;
 +    const ADC *adc = adc_p;
 +
 +    for (j = 0; j < ARRAY_SIZE(iref_list); ++j) {
 +        uint32_t iref = iref_list[j];
 +        uint32_t expected_rv[] = {
 +            adc_calculate_output(R0_INPUT, iref),
 +            adc_calculate_output(R1_INPUT, iref),
 +        };
 +        char buf[100];
 +        QTestState *qts;
 +
 +        sprintf(buf, "-machine quanta-gsj -global npcm7xx-adc.iref=%u", iref);
 +        qts = qtest_init(buf);
 +
 +        /* Check the converted value is correct using the calibration value. */
 +        for (i = 0; i < ARRAY_SIZE(input_list); ++i) {
 +            uint32_t input;
 +            uint32_t output;
 +            uint32_t expected_output;
 +            uint32_t calibrated_voltage;
 +            uint32_t index = 0;
 +
 +            input = input_list[i];
 +            /* Calibration only works for input range 0.1V ~ 1.8V. */
 +            if (input < MIN_CALIB_INPUT || input > MAX_CALIB_INPUT) {
 +                continue;
 +            }
 +            expected_output = adc_calculate_output(input, iref);
 +
 +            adc_write_input(qts, adc, index, input);
 +            adc_write_con(qts, adc, CON_MUX(index) | CON_REFSEL | CON_INT |
 +                    CON_EN | CON_CONV);
 +            adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
 +            g_assert_cmphex(adc_read_con(qts, adc), ==,
 +                    CON_REFSEL | CON_MUX(index) | CON_EN);
 +            output = adc_read_data(qts, adc);
 +            g_assert_cmpuint(output, ==, expected_output);
 +
 +            calibrated_voltage = adc_calibrate(output, expected_rv);
 +            g_assert_cmpuint(calibrated_voltage, >, input - MAX_ERROR);
 +            g_assert_cmpuint(calibrated_voltage, <, input + MAX_ERROR);
 +        }
 +
 +        qtest_quit(qts);
 +    }
 +}
 +
 +static void adc_add_test(const char *name, const ADC* wd,
 +        GTestDataFunc fn)
 +{
 +    g_autofree char *full_name = g_strdup_printf("npcm7xx_adc/%s",  name);
 +    qtest_add_data_func(full_name, wd, fn);
 +}
 +#define add_test(name, td) adc_add_test(#name, td, test_##name)
 +
 +int main(int argc, char **argv)
 +{
 +    g_test_init(&argc, &argv, NULL);
 +
 +    add_test(init, &adc);
 +    add_test(convert_internal, &adc);
 +    add_test(convert_external, &adc);
 +    add_test(interrupt, &adc);
 +    add_test(reset, &adc);
 +    add_test(calibrate, &adc);
 +
 +    return g_test_run();
 +}
 diff --git a/hw/adc/meson.build b/hw/adc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/adc/meson.build
 +++ b/hw/adc/meson.build
@@ -1 +1,2 @@
  softmmu_ss.add(when: 'CONFIG_STM32F2XX_ADC', if_true: files('stm32f2xx_adc.c'))
 +softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_adc.c'))
 diff --git a/hw/adc/trace-events b/hw/adc/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/adc/trace-events
@@ -XXX,XX +XXX,XX @@
 +# See docs/devel/tracing.txt for syntax documentation.
 +
 +# npcm7xx_adc.c
 +npcm7xx_adc_read(const char *id, uint64_t offset, uint32_t value) " %s offset: 0x%04" PRIx64 " value 0x%04" PRIx32
 +npcm7xx_adc_write(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value 0x%04" PRIx32
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_sparc64 = \
    ['prom-env-test', 'boot-serial-test']
  qtests_npcm7xx = \
 -  ['npcm7xx_gpio-test',
 +  ['npcm7xx_adc-test',
 +   'npcm7xx_gpio-test',
     'npcm7xx_rng-test',
     'npcm7xx_timer-test',
     'npcm7xx_watchdog_timer-test']
 --
 .20.1

-[PULL 12/23] hw/intc: GICv3 ITS Command processing
+[PULL 18/21] hw/misc: Add a PWM module for NPCM7XX
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Hao Wu <wuhaotsh@google.com>
-Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
+The PWM module is part of NPCM7XX module. Each NPCM7XX module has two
-translation which triggers an LPI via INT command as well as write
+identical PWM modules. Each module contains 4 PWM entries. Each PWM has
-to GITS_TRANSLATER register,defined enum to differentiate between ITS
+two outputs: frequency and duty_cycle. Both are computed using inputs
-command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
+from software side.
 Each of these commands make use of other functionalities implemented to
 get device table entry,collection table entry or interrupt translation
 table entry required for their processing.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+This module does not model detail pulse signals since it is expensive.
 It also does not model interrupts and watchdogs that are dependant on
 the detail models. The interfaces for these are left in the module so
 that anyone in need for these functionalities can implement on their
 own.
 The user can read the duty cycle and frequency using qom-get command.
 Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210108190945.949196-5-wuhaotsh@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h           |  12 +
+ docs/system/arm/nuvoton.rst   |   2 +-
- include/hw/intc/arm_gicv3_common.h |   2 +
+ include/hw/arm/npcm7xx.h      |   2 +
- hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
+ include/hw/misc/npcm7xx_pwm.h | 105 +++++++
-files changed, 378 insertions(+), 1 deletion(-)
+ hw/arm/npcm7xx.c              |  26 +-
  hw/misc/npcm7xx_pwm.c         | 550 ++++++++++++++++++++++++++++++++++
  hw/misc/meson.build           |   1 +
  hw/misc/trace-events          |   6 +
 files changed, 689 insertions(+), 3 deletions(-)
  create mode 100644 include/hw/misc/npcm7xx_pwm.h
  create mode 100644 hw/misc/npcm7xx_pwm.c
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/docs/system/arm/nuvoton.rst
-+++ b/hw/intc/gicv3_internal.h
++++ b/docs/system/arm/nuvoton.rst
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
+@@ -XXX,XX +XXX,XX @@ Supported devices
- #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
+  * USB host (USBH)
- #define SIZE_MASK                 0x1f
+  * GPIO controller
+  * Analog to Digital Converter (ADC)
-+/* MAPI command fields */
++ * Pulse Width Modulation (PWM)
-+#define EVENTID_MASK              ((1ULL << 32) - 1)
-+
+ Missing devices
-+/* MAPTI command fields */
+ ---------------
-+#define pINTID_SHIFT                 32
+@@ -XXX,XX +XXX,XX @@ Missing devices
-+#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
+  * Peripheral SPI controller (PSPI)
-+
+  * SD/MMC host
- #define DEVID_SHIFT                  32
+  * PECI interface
- #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
+- * Pulse Width Modulation (PWM)
+  * Tachometer
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
+  * PCI and PCIe root complex and bridges
-  *   Values:  |  vPEID    |  ICID   |
+  * VDM and MCTP support
-  */
+diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
  #define ITS_ITT_ENTRY_SIZE            0xC
 +#define ITE_ENTRY_INTTYPE_SHIFT        1
 +#define ITE_ENTRY_INTID_SHIFT          2
 +#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
 +#define ITE_ENTRY_INTSP_SHIFT          26
 +#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
  /* 16 bits EventId */
  #define ITS_IDBITS                   GICD_TYPER_IDBITS
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_common.h
+--- a/include/hw/arm/npcm7xx.h
-+++ b/include/hw/intc/arm_gicv3_common.h
++++ b/include/hw/arm/npcm7xx.h
 @@ -XXX,XX +XXX,XX @@
- #define GICV3_MAXIRQ 1020
+ #include "hw/mem/npcm7xx_mc.h"
- #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
+ #include "hw/misc/npcm7xx_clk.h"
+ #include "hw/misc/npcm7xx_gcr.h"
-+#define GICV3_LPI_INTID_START 8192
++#include "hw/misc/npcm7xx_pwm.h"
-+
+ #include "hw/misc/npcm7xx_rng.h"
- #define GICV3_REDIST_SIZE 0x20000
+ #include "hw/nvram/npcm7xx_otp.h"
+ #include "hw/timer/npcm7xx_timer.h"
- /* Number of SGI target-list bits */
+@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+     NPCM7xxCLKState     clk;
      NPCM7xxTimerCtrlState tim[3];
      NPCM7xxADCState     adc;
 +    NPCM7xxPWMState     pwm[2];
      NPCM7xxOTPState     key_storage;
      NPCM7xxOTPState     fuse_array;
      NPCM7xxMCState      mc;
 diff --git a/include/hw/misc/npcm7xx_pwm.h b/include/hw/misc/npcm7xx_pwm.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/npcm7xx_pwm.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Nuvoton NPCM7xx PWM Module
 + *
 + * Copyright 2020 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +#ifndef NPCM7XX_PWM_H
 +#define NPCM7XX_PWM_H
 +
 +#include "hw/clock.h"
 +#include "hw/sysbus.h"
 +#include "hw/irq.h"
 +
 +/* Each PWM module holds 4 PWM channels. */
 +#define NPCM7XX_PWM_PER_MODULE 4
 +
 +/*
 + * Number of registers in one pwm module. Don't change this without increasing
 + * the version_id in vmstate.
 + */
 +#define NPCM7XX_PWM_NR_REGS (0x54 / sizeof(uint32_t))
 +
 +/*
 + * The maximum duty values. Each duty unit represents 1/NPCM7XX_PWM_MAX_DUTY
 + * cycles. For example, if NPCM7XX_PWM_MAX_DUTY=1,000,000 and a PWM has a duty
 + * value of 100,000 the duty cycle for that PWM is 10%.
 + */
 +#define NPCM7XX_PWM_MAX_DUTY 1000000
 +
 +typedef struct NPCM7xxPWMState NPCM7xxPWMState;
 +
 +/**
 + * struct NPCM7xxPWM - The state of a single PWM channel.
 + * @module: The PWM module that contains this channel.
 + * @irq: GIC interrupt line to fire on expiration if enabled.
 + * @running: Whether this PWM channel is generating output.
 + * @inverted: Whether this PWM channel is inverted.
 + * @index: The index of this PWM channel.
 + * @cnr: The counter register.
 + * @cmr: The comparator register.
 + * @pdr: The data register.
 + * @pwdr: The watchdog register.
 + * @freq: The frequency of this PWM channel.
 + * @duty: The duty cycle of this PWM channel. One unit represents
 + *   1/NPCM7XX_MAX_DUTY cycles.
 + */
 +typedef struct NPCM7xxPWM {
 +    NPCM7xxPWMState         *module;
 +
 +    qemu_irq                irq;
 +
 +    bool                    running;
 +    bool                    inverted;
 +
 +    uint8_t                 index;
 +    uint32_t                cnr;
 +    uint32_t                cmr;
 +    uint32_t                pdr;
 +    uint32_t                pwdr;
 +
 +    uint32_t                freq;
 +    uint32_t                duty;
 +} NPCM7xxPWM;
 +
 +/**
 + * struct NPCM7xxPWMState - Pulse Width Modulation device state.
 + * @parent: System bus device.
 + * @iomem: Memory region through which registers are accessed.
 + * @clock: The PWM clock.
 + * @pwm: The PWM channels owned by this module.
 + * @ppr: The prescaler register.
 + * @csr: The clock selector register.
 + * @pcr: The control register.
 + * @pier: The interrupt enable register.
 + * @piir: The interrupt indication register.
 + */
 +struct NPCM7xxPWMState {
 +    SysBusDevice parent;
 +
 +    MemoryRegion iomem;
 +
 +    Clock       *clock;
 +    NPCM7xxPWM pwm[NPCM7XX_PWM_PER_MODULE];
 +
 +    uint32_t    ppr;
 +    uint32_t    csr;
 +    uint32_t    pcr;
 +    uint32_t    pier;
 +    uint32_t    piir;
 +};
 +
 +#define TYPE_NPCM7XX_PWM "npcm7xx-pwm"
 +#define NPCM7XX_PWM(obj) \
 +    OBJECT_CHECK(NPCM7xxPWMState, (obj), TYPE_NPCM7XX_PWM)
 +
 +#endif /* NPCM7XX_PWM_H */
 diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/hw/arm/npcm7xx.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/hw/arm/npcm7xx.c
-@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
+@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
-     void (*parent_reset)(DeviceState *dev);
+     NPCM7XX_WDG2_IRQ,                   /* Timer Module 2 Watchdog */
      NPCM7XX_EHCI_IRQ            = 61,
      NPCM7XX_OHCI_IRQ            = 62,
 +    NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
 +    NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
      NPCM7XX_GPIO0_IRQ           = 116,
      NPCM7XX_GPIO1_IRQ,
      NPCM7XX_GPIO2_IRQ,
@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_fiu3_flash_addr[] = {
 xb8000000, /* CS3 */
  };
++/* Register base address for each PWM Module */
++static const hwaddr npcm7xx_pwm_addr[] = {
++    0xf0103000,
++    0xf0104000,
++};
++
+ static const struct {
+     hwaddr regs_addr;
+     uint32_t unconnected_pins;
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
+         object_initialize_child(obj, npcm7xx_fiu[i].name, &s->fiu[i],
+                                 TYPE_NPCM7XX_FIU);
+     }
++
++    for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
++        object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
++    }
+ }
+ static void npcm7xx_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ohci), 0,
+                        npcm7xx_irq(s, NPCM7XX_OHCI_IRQ));
++    /* PWM Modules. Cannot fail. */
++    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pwm_addr) != ARRAY_SIZE(s->pwm));
++    for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
++        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pwm[i]);
++
++        qdev_connect_clock_in(DEVICE(&s->pwm[i]), "clock", qdev_get_clock_out(
++                    DEVICE(&s->clk), "apb3-clock"));
++        sysbus_realize(sbd, &error_abort);
++        sysbus_mmio_map(sbd, 0, npcm7xx_pwm_addr[i]);
++        sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
++    }
++
+     /*
+      * Flash Interface Unit (FIU). Can fail if incorrect number of chip selects
+      * specified, but this is a programming error.
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
+     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
+     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
+     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
+-    create_unimplemented_device("npcm7xx.pwm[0]",       0xf0103000,   4 * KiB);
+-    create_unimplemented_device("npcm7xx.pwm[1]",       0xf0104000,   4 * KiB);
+     create_unimplemented_device("npcm7xx.mft[0]",       0xf0180000,   4 * KiB);
+     create_unimplemented_device("npcm7xx.mft[1]",       0xf0181000,   4 * KiB);
+     create_unimplemented_device("npcm7xx.mft[2]",       0xf0182000,   4 * KiB);
+diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/misc/npcm7xx_pwm.c
+@@ -XXX,XX +XXX,XX @@
 +/*
-+ * This is an internal enum used to distinguish between LPI triggered
++ * Nuvoton NPCM7xx PWM Module
-+ * via command queue and LPI triggered via gits_translater write.
++ *
 + * Copyright 2020 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
-+typedef enum ItsCmdType {
++
-+    NONE = 0, /* internal indication for GITS_TRANSLATER write */
++#include "qemu/osdep.h"
-+    CLEAR = 1,
++#include "hw/irq.h"
-+    DISCARD = 2,
++#include "hw/qdev-clock.h"
-+    INT = 3,
++#include "hw/qdev-properties.h"
-+} ItsCmdType;
++#include "hw/misc/npcm7xx_pwm.h"
-+
++#include "hw/registerfields.h"
-+typedef struct {
++#include "migration/vmstate.h"
-+    uint32_t iteh;
++#include "qemu/bitops.h"
-+    uint64_t itel;
++#include "qemu/error-report.h"
-+} IteEntry;
++#include "qemu/log.h"
-+
++#include "qemu/module.h"
- static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
++#include "qemu/units.h"
- {
++#include "trace.h"
-     uint64_t result = 0;
++
-@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
++REG32(NPCM7XX_PWM_PPR, 0x00);
-     return result;
++REG32(NPCM7XX_PWM_CSR, 0x04);
- }
++REG32(NPCM7XX_PWM_PCR, 0x08);
++REG32(NPCM7XX_PWM_CNR0, 0x0c);
-+static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
++REG32(NPCM7XX_PWM_CMR0, 0x10);
-+                    MemTxResult *res)
++REG32(NPCM7XX_PWM_PDR0, 0x14);
-+{
++REG32(NPCM7XX_PWM_CNR1, 0x18);
-+    AddressSpace *as = &s->gicv3->dma_as;
++REG32(NPCM7XX_PWM_CMR1, 0x1c);
-+    uint64_t l2t_addr;
++REG32(NPCM7XX_PWM_PDR1, 0x20);
-+    uint64_t value;
++REG32(NPCM7XX_PWM_CNR2, 0x24);
-+    bool valid_l2t;
++REG32(NPCM7XX_PWM_CMR2, 0x28);
-+    uint32_t l2t_id;
++REG32(NPCM7XX_PWM_PDR2, 0x2c);
-+    uint32_t max_l2_entries;
++REG32(NPCM7XX_PWM_CNR3, 0x30);
-+
++REG32(NPCM7XX_PWM_CMR3, 0x34);
-+    if (s->ct.indirect) {
++REG32(NPCM7XX_PWM_PDR3, 0x38);
-+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
++REG32(NPCM7XX_PWM_PIER, 0x3c);
-+
++REG32(NPCM7XX_PWM_PIIR, 0x40);
-+        value = address_space_ldq_le(as,
++REG32(NPCM7XX_PWM_PWDR0, 0x44);
-+                                     s->ct.base_addr +
++REG32(NPCM7XX_PWM_PWDR1, 0x48);
-+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
++REG32(NPCM7XX_PWM_PWDR2, 0x4c);
-+                                     MEMTXATTRS_UNSPECIFIED, res);
++REG32(NPCM7XX_PWM_PWDR3, 0x50);
 +
-+        if (*res == MEMTX_OK) {
++/* Register field definitions. */
-+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
++#define NPCM7XX_PPR(rv, index)      extract32((rv), npcm7xx_ppr_base[index], 8)
-+
++#define NPCM7XX_CSR(rv, index)      extract32((rv), npcm7xx_csr_base[index], 3)
-+            if (valid_l2t) {
++#define NPCM7XX_CH(rv, index)       extract32((rv), npcm7xx_ch_base[index], 4)
-+                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
++#define NPCM7XX_CH_EN               BIT(0)
-+
++#define NPCM7XX_CH_INV              BIT(2)
-+                l2t_addr = value & ((1ULL << 51) - 1);
++#define NPCM7XX_CH_MOD              BIT(3)
 +
-+                *cte =  address_space_ldq_le(as, l2t_addr +
++/* Offset of each PWM channel's prescaler in the PPR register. */
-+                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
++static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
-+                                    MEMTXATTRS_UNSPECIFIED, res);
++/* Offset of each PWM channel's clock selector in the CSR register. */
-+           }
++static const int npcm7xx_csr_base[] = { 0, 4, 8, 12 };
-+       }
++/* Offset of each PWM channel's control variable in the PCR register. */
-+    } else {
++static const int npcm7xx_ch_base[] = { 0, 8, 12, 16 };
-+        /* Flat level table */
++
-+        *cte =  address_space_ldq_le(as, s->ct.base_addr +
++static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
-+                                     (icid * GITS_CTE_SIZE),
++{
-+                                      MEMTXATTRS_UNSPECIFIED, res);
++    uint32_t ppr;
-+    }
++    uint32_t csr;
-+
++    uint32_t freq;
-+    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
++
-+}
++    if (!p->running) {
-+
++        return 0;
-+static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
++    }
-+                       IteEntry ite)
++
-+{
++    csr = NPCM7XX_CSR(p->module->csr, p->index);
-+    AddressSpace *as = &s->gicv3->dma_as;
++    ppr = NPCM7XX_PPR(p->module->ppr, p->index);
-+    uint64_t itt_addr;
++    freq = clock_get_hz(p->module->clock);
-+    MemTxResult res = MEMTX_OK;
++    freq /= ppr + 1;
-+
++    /* csr can only be 0~4 */
-+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
++    if (csr > 4) {
-+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
++        qemu_log_mask(LOG_GUEST_ERROR,
-+
++                      "%s: invalid csr value %u\n",
-+    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
++                      __func__, csr);
-+                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
++        csr = 4;
-+                         &res);
++    }
-+
++    /* freq won't be changed if csr == 4. */
-+    if (res == MEMTX_OK) {
++    if (csr < 4) {
-+        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
++        freq >>= csr + 1;
-+                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
++    }
-+                             MEMTXATTRS_UNSPECIFIED, &res);
++
-+    }
++    return freq / (p->cnr + 1);
-+    if (res != MEMTX_OK) {
++}
-+        return false;
++
-+    } else {
++static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
-+        return true;
++{
-+    }
++    uint64_t duty;
-+}
++
-+
++    if (p->running) {
-+static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
++        if (p->cnr == 0) {
-+                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
++            duty = 0;
-+{
++        } else if (p->cmr >= p->cnr) {
-+    AddressSpace *as = &s->gicv3->dma_as;
++            duty = NPCM7XX_PWM_MAX_DUTY;
-+    uint64_t itt_addr;
++        } else {
-+    bool status = false;
++            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
 +    IteEntry ite = {};
 +
 +    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
 +    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
 +
 +    ite.itel = address_space_ldq_le(as, itt_addr +
 +                                    (eventid * (sizeof(uint64_t) +
 +                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
 +                                    res);
 +
 +    if (*res == MEMTX_OK) {
 +        ite.iteh = address_space_ldl_le(as, itt_addr +
 +                                        (eventid * (sizeof(uint64_t) +
 +                                        sizeof(uint32_t))) + sizeof(uint32_t),
 +                                        MEMTXATTRS_UNSPECIFIED, res);
 +
 +        if (*res == MEMTX_OK) {
 +            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
 +                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
 +                    GITS_TYPE_PHYSICAL) {
 +                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
 +                               ITE_ENTRY_INTID_SHIFT;
 +                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
 +                    status = true;
 +                }
 +            }
 +        }
 +    }
 +    return status;
 +}
 +
 +static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
 +{
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    uint64_t l2t_addr;
 +    uint64_t value;
 +    bool valid_l2t;
 +    uint32_t l2t_id;
 +    uint32_t max_l2_entries;
 +
 +    if (s->dt.indirect) {
 +        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
 +
 +        value = address_space_ldq_le(as,
 +                                     s->dt.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, res);
 +
 +        if (*res == MEMTX_OK) {
 +            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +            if (valid_l2t) {
 +                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
 +
 +                l2t_addr = value & ((1ULL << 51) - 1);
 +
 +                value =  address_space_ldq_le(as, l2t_addr +
 +                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
 +                                   MEMTXATTRS_UNSPECIFIED, res);
 +            }
 +        }
 +    } else {
-+        /* Flat level table */
++        duty = 0;
-+        value = address_space_ldq_le(as, s->dt.base_addr +
++    }
-+                                     (devid * GITS_DTE_SIZE),
++
-+                                     MEMTXATTRS_UNSPECIFIED, res);
++    if (p->inverted) {
-+    }
++        duty = NPCM7XX_PWM_MAX_DUTY - duty;
-+
++    }
 +
 +    return duty;
 +}
 +
 +static void npcm7xx_pwm_update_freq(NPCM7xxPWM *p)
 +{
 +    uint32_t freq = npcm7xx_pwm_calculate_freq(p);
 +
 +    if (freq != p->freq) {
 +        trace_npcm7xx_pwm_update_freq(DEVICE(p->module)->canonical_path,
 +                                      p->index, p->freq, freq);
 +        p->freq = freq;
 +    }
 +}
 +
 +static void npcm7xx_pwm_update_duty(NPCM7xxPWM *p)
 +{
 +    uint32_t duty = npcm7xx_pwm_calculate_duty(p);
 +
 +    if (duty != p->duty) {
 +        trace_npcm7xx_pwm_update_duty(DEVICE(p->module)->canonical_path,
 +                                      p->index, p->duty, duty);
 +        p->duty = duty;
 +    }
 +}
 +
 +static void npcm7xx_pwm_update_output(NPCM7xxPWM *p)
 +{
 +    npcm7xx_pwm_update_freq(p);
 +    npcm7xx_pwm_update_duty(p);
 +}
 +
 +static void npcm7xx_pwm_write_ppr(NPCM7xxPWMState *s, uint32_t new_ppr)
 +{
 +    int i;
 +    uint32_t old_ppr = s->ppr;
 +
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_ppr_base) != NPCM7XX_PWM_PER_MODULE);
 +    s->ppr = new_ppr;
 +    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
 +        if (NPCM7XX_PPR(old_ppr, i) != NPCM7XX_PPR(new_ppr, i)) {
 +            npcm7xx_pwm_update_freq(&s->pwm[i]);
 +        }
 +    }
 +}
 +
 +static void npcm7xx_pwm_write_csr(NPCM7xxPWMState *s, uint32_t new_csr)
 +{
 +    int i;
 +    uint32_t old_csr = s->csr;
 +
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_csr_base) != NPCM7XX_PWM_PER_MODULE);
 +    s->csr = new_csr;
 +    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
 +        if (NPCM7XX_CSR(old_csr, i) != NPCM7XX_CSR(new_csr, i)) {
 +            npcm7xx_pwm_update_freq(&s->pwm[i]);
 +        }
 +    }
 +}
 +
 +static void npcm7xx_pwm_write_pcr(NPCM7xxPWMState *s, uint32_t new_pcr)
 +{
 +    int i;
 +    bool inverted;
 +    uint32_t pcr;
 +    NPCM7xxPWM *p;
 +
 +    s->pcr = new_pcr;
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_ch_base) != NPCM7XX_PWM_PER_MODULE);
 +    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
 +        p = &s->pwm[i];
 +        pcr = NPCM7XX_CH(new_pcr, i);
 +        inverted = pcr & NPCM7XX_CH_INV;
 +
 +        /*
 +         * We only run a PWM channel with toggle mode. Single-shot mode does not
 +         * generate frequency and duty-cycle values.
 +         */
 +        if ((pcr & NPCM7XX_CH_EN) && (pcr & NPCM7XX_CH_MOD)) {
 +            if (p->running) {
 +                /* Re-run this PWM channel if inverted changed. */
 +                if (p->inverted ^ inverted) {
 +                    p->inverted = inverted;
 +                    npcm7xx_pwm_update_duty(p);
 +                }
 +            } else {
 +                /* Run this PWM channel. */
 +                p->running = true;
 +                p->inverted = inverted;
 +                npcm7xx_pwm_update_output(p);
 +            }
 +        } else {
 +            /* Clear this PWM channel. */
 +            p->running = false;
 +            p->inverted = inverted;
 +            npcm7xx_pwm_update_output(p);
 +        }
 +    }
 +
 +}
 +
 +static hwaddr npcm7xx_cnr_index(hwaddr offset)
 +{
 +    switch (offset) {
 +    case A_NPCM7XX_PWM_CNR0:
 +        return 0;
 +    case A_NPCM7XX_PWM_CNR1:
 +        return 1;
 +    case A_NPCM7XX_PWM_CNR2:
 +        return 2;
 +    case A_NPCM7XX_PWM_CNR3:
 +        return 3;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static hwaddr npcm7xx_cmr_index(hwaddr offset)
 +{
 +    switch (offset) {
 +    case A_NPCM7XX_PWM_CMR0:
 +        return 0;
 +    case A_NPCM7XX_PWM_CMR1:
 +        return 1;
 +    case A_NPCM7XX_PWM_CMR2:
 +        return 2;
 +    case A_NPCM7XX_PWM_CMR3:
 +        return 3;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static hwaddr npcm7xx_pdr_index(hwaddr offset)
 +{
 +    switch (offset) {
 +    case A_NPCM7XX_PWM_PDR0:
 +        return 0;
 +    case A_NPCM7XX_PWM_PDR1:
 +        return 1;
 +    case A_NPCM7XX_PWM_PDR2:
 +        return 2;
 +    case A_NPCM7XX_PWM_PDR3:
 +        return 3;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static hwaddr npcm7xx_pwdr_index(hwaddr offset)
 +{
 +    switch (offset) {
 +    case A_NPCM7XX_PWM_PWDR0:
 +        return 0;
 +    case A_NPCM7XX_PWM_PWDR1:
 +        return 1;
 +    case A_NPCM7XX_PWM_PWDR2:
 +        return 2;
 +    case A_NPCM7XX_PWM_PWDR3:
 +        return 3;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
 +static uint64_t npcm7xx_pwm_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    NPCM7xxPWMState *s = opaque;
 +    uint64_t value = 0;
 +
 +    switch (offset) {
 +    case A_NPCM7XX_PWM_CNR0:
 +    case A_NPCM7XX_PWM_CNR1:
 +    case A_NPCM7XX_PWM_CNR2:
 +    case A_NPCM7XX_PWM_CNR3:
 +        value = s->pwm[npcm7xx_cnr_index(offset)].cnr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_CMR0:
 +    case A_NPCM7XX_PWM_CMR1:
 +    case A_NPCM7XX_PWM_CMR2:
 +    case A_NPCM7XX_PWM_CMR3:
 +        value = s->pwm[npcm7xx_cmr_index(offset)].cmr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PDR0:
 +    case A_NPCM7XX_PWM_PDR1:
 +    case A_NPCM7XX_PWM_PDR2:
 +    case A_NPCM7XX_PWM_PDR3:
 +        value = s->pwm[npcm7xx_pdr_index(offset)].pdr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PWDR0:
 +    case A_NPCM7XX_PWM_PWDR1:
 +    case A_NPCM7XX_PWM_PWDR2:
 +    case A_NPCM7XX_PWM_PWDR3:
 +        value = s->pwm[npcm7xx_pwdr_index(offset)].pwdr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PPR:
 +        value = s->ppr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_CSR:
 +        value = s->csr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PCR:
 +        value = s->pcr;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PIER:
 +        value = s->pier;
 +        break;
 +
 +    case A_NPCM7XX_PWM_PIIR:
 +        value = s->piir;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +        break;
 +    }
 +
 +    trace_npcm7xx_pwm_read(DEVICE(s)->canonical_path, offset, value);
 +    return value;
 +}
 +
-+/*
++static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
-+ * This function handles the processing of following commands based on
++                                uint64_t v, unsigned size)
-+ * the ItsCmdType parameter passed:-
++{
-+ * 1. triggering of lpi interrupt translation via ITS INT command
++    NPCM7xxPWMState *s = opaque;
-+ * 2. triggering of lpi interrupt translation via gits_translater register
++    NPCM7xxPWM *p;
-+ * 3. handling of ITS CLEAR command
++    uint32_t value = v;
-+ * 4. handling of ITS DISCARD command
++
-+ */
++    trace_npcm7xx_pwm_write(DEVICE(s)->canonical_path, offset, value);
-+static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
++    switch (offset) {
-+                            ItsCmdType cmd)
++    case A_NPCM7XX_PWM_CNR0:
-+{
++    case A_NPCM7XX_PWM_CNR1:
-+    AddressSpace *as = &s->gicv3->dma_as;
++    case A_NPCM7XX_PWM_CNR2:
-+    uint32_t devid, eventid;
++    case A_NPCM7XX_PWM_CNR3:
-+    MemTxResult res = MEMTX_OK;
++        p = &s->pwm[npcm7xx_cnr_index(offset)];
-+    bool dte_valid;
++        p->cnr = value;
-+    uint64_t dte = 0;
++        npcm7xx_pwm_update_output(p);
-+    uint32_t max_eventid;
++        break;
-+    uint16_t icid = 0;
++
-+    uint32_t pIntid = 0;
++    case A_NPCM7XX_PWM_CMR0:
-+    bool ite_valid = false;
++    case A_NPCM7XX_PWM_CMR1:
-+    uint64_t cte = 0;
++    case A_NPCM7XX_PWM_CMR2:
-+    bool cte_valid = false;
++    case A_NPCM7XX_PWM_CMR3:
-+    bool result = false;
++        p = &s->pwm[npcm7xx_cmr_index(offset)];
-+
++        p->cmr = value;
-+    if (cmd == NONE) {
++        npcm7xx_pwm_update_output(p);
-+        devid = offset;
++        break;
-+    } else {
++
-+        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
++    case A_NPCM7XX_PWM_PDR0:
-+
++    case A_NPCM7XX_PWM_PDR1:
-+        offset += NUM_BYTES_IN_DW;
++    case A_NPCM7XX_PWM_PDR2:
-+        value = address_space_ldq_le(as, s->cq.base_addr + offset,
++    case A_NPCM7XX_PWM_PDR3:
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    eventid = (value & EVENTID_MASK);
 +
 +    dte = get_dte(s, devid, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
 +
 +    if (dte_valid) {
 +        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
 +
 +        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return result;
 +        }
 +
 +        if (ite_valid) {
 +            cte_valid = get_cte(s, icid, &cte, &res);
 +        }
 +
 +        if (res != MEMTX_OK) {
 +            return result;
 +        }
 +    }
 +
 +    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
 +            !cte_valid || (eventid > max_eventid)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: invalid command attributes "
++                      "%s: register @ 0x%04" HWADDR_PRIx " is read-only\n",
-+                      "devid %d or eventid %d or invalid dte %d or"
++                      __func__, offset);
-+                      "invalid cte %d or invalid ite %d\n",
++        break;
-+                      __func__, devid, eventid, dte_valid, cte_valid,
++
-+                      ite_valid);
++    case A_NPCM7XX_PWM_PWDR0:
-+        /*
++    case A_NPCM7XX_PWM_PWDR1:
-+         * in this implementation, in case of error
++    case A_NPCM7XX_PWM_PWDR2:
-+         * we ignore this command and move onto the next
++    case A_NPCM7XX_PWM_PWDR3:
-+         * command in the queue
++        qemu_log_mask(LOG_UNIMP,
-+         */
++                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
-+    } else {
++                     __func__, offset);
-+        /*
++        break;
-+         * Current implementation only supports rdbase == procnum
++
-+         * Hence rdbase physical address is ignored
++    case A_NPCM7XX_PWM_PPR:
-+         */
++        npcm7xx_pwm_write_ppr(s, value);
-+        if (cmd == DISCARD) {
++        break;
-+            IteEntry ite = {};
++
-+            /* remove mapping from interrupt translation table */
++    case A_NPCM7XX_PWM_CSR:
-+            result = update_ite(s, eventid, dte, ite);
++        npcm7xx_pwm_write_csr(s, value);
-+        }
++        break;
-+    }
++
-+
++    case A_NPCM7XX_PWM_PCR:
-+    return result;
++        npcm7xx_pwm_write_pcr(s, value);
-+}
++        break;
 +
-+static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
++    case A_NPCM7XX_PWM_PIER:
-+                          bool ignore_pInt)
++        qemu_log_mask(LOG_UNIMP,
-+{
++                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
-+    AddressSpace *as = &s->gicv3->dma_as;
++                     __func__, offset);
-+    uint32_t devid, eventid;
++        break;
-+    uint32_t pIntid = 0;
++
-+    uint32_t max_eventid, max_Intid;
++    case A_NPCM7XX_PWM_PIIR:
-+    bool dte_valid;
++        qemu_log_mask(LOG_UNIMP,
-+    MemTxResult res = MEMTX_OK;
++                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
-+    uint16_t icid = 0;
++                     __func__, offset);
-+    uint64_t dte = 0;
++        break;
-+    IteEntry ite;
++
-+    uint32_t int_spurious = INTID_SPURIOUS;
++    default:
 +    bool result = false;
 +
 +    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    eventid = (value & EVENTID_MASK);
 +
 +    if (!ignore_pInt) {
 +        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
 +    }
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    icid = value & ICID_MASK;
 +
 +    dte = get_dte(s, devid, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
 +
 +    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
 +
 +    if (!ignore_pInt) {
 +        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
 +    }
 +
 +    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
 +            || !dte_valid || (eventid > max_eventid) ||
 +            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
 +            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
-+                      "%s: invalid command attributes "
++                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
-+                      "devid %d or icid %d or eventid %d or pIntid %d or"
++                      __func__, offset);
-+                      "unmapped dte %d\n", __func__, devid, icid, eventid,
++        break;
-+                      pIntid, dte_valid);
++    }
-+        /*
++}
-+         * in this implementation, in case of error
++
-+         * we ignore this command and move onto the next
++static const struct MemoryRegionOps npcm7xx_pwm_ops = {
-+         * command in the queue
++    .read       = npcm7xx_pwm_read,
-+         */
++    .write      = npcm7xx_pwm_write,
-+    } else {
++    .endianness = DEVICE_LITTLE_ENDIAN,
-+        /* add ite entry to interrupt translation table */
++    .valid      = {
-+        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
++        .min_access_size        = 4,
-+                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
++        .max_access_size        = 4,
-+
++        .unaligned              = false,
-+        if (ignore_pInt) {
++    },
-+            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
++};
-+        } else {
++
-+            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
++static void npcm7xx_pwm_enter_reset(Object *obj, ResetType type)
-+        }
++{
-+        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
++    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
-+        ite.iteh = icid;
++    int i;
 +
-+        result = update_ite(s, eventid, dte, ite);
++    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
-+    }
++        NPCM7xxPWM *p = &s->pwm[i];
 +
-+    return result;
++        p->cnr = 0x00000000;
-+}
++        p->cmr = 0x00000000;
-+
++        p->pdr = 0x00000000;
- static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
++        p->pwdr = 0x00000000;
-                        uint64_t rdbase)
++    }
- {
++
-@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
++    s->ppr = 0x00000000;
++    s->csr = 0x00000000;
-         switch (cmd) {
++    s->pcr = 0x00000000;
-         case GITS_CMD_INT:
++    s->pier = 0x00000000;
-+            res = process_its_cmd(s, data, cq_offset, INT);
++    s->piir = 0x00000000;
-             break;
++}
-         case GITS_CMD_CLEAR:
++
-+            res = process_its_cmd(s, data, cq_offset, CLEAR);
++static void npcm7xx_pwm_hold_reset(Object *obj)
-             break;
++{
-         case GITS_CMD_SYNC:
++    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
-             /*
++    int i;
-@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
++
-             result = process_mapc(s, cq_offset);
++    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
-             break;
++        qemu_irq_lower(s->pwm[i].irq);
-         case GITS_CMD_MAPTI:
++    }
-+            result = process_mapti(s, data, cq_offset, false);
++}
-             break;
++
-         case GITS_CMD_MAPI:
++static void npcm7xx_pwm_init(Object *obj)
-+            result = process_mapti(s, data, cq_offset, true);
++{
-             break;
++    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
-         case GITS_CMD_DISCARD:
++    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-+            result = process_its_cmd(s, data, cq_offset, DISCARD);
++    int i;
-             break;
++
-         case GITS_CMD_INV:
++    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
-         case GITS_CMD_INVALL:
++        NPCM7xxPWM *p = &s->pwm[i];
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
++        p->module = s;
-                                                uint64_t data, unsigned size,
++        p->index = i;
-                                                MemTxAttrs attrs)
++        sysbus_init_irq(sbd, &p->irq);
- {
++    }
--    return MEMTX_OK;
++
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
++    memory_region_init_io(&s->iomem, obj, &npcm7xx_pwm_ops, s,
-+    bool result = true;
++                          TYPE_NPCM7XX_PWM, 4 * KiB);
-+    uint32_t devid = 0;
++    sysbus_init_mmio(sbd, &s->iomem);
-+
++    s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL);
-+    switch (offset) {
++
-+    case GITS_TRANSLATER:
++    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
-+        if (s->ctlr & ITS_CTLR_ENABLED) {
++        object_property_add_uint32_ptr(obj, "freq[*]",
-+            devid = attrs.requester_id;
++                &s->pwm[i].freq, OBJ_PROP_FLAG_READ);
-+            result = process_its_cmd(s, data, devid, NONE);
++        object_property_add_uint32_ptr(obj, "duty[*]",
-+        }
++                &s->pwm[i].duty, OBJ_PROP_FLAG_READ);
-+        break;
++    }
-+    default:
++}
-+        break;
++
-+    }
++static const VMStateDescription vmstate_npcm7xx_pwm = {
-+
++    .name = "npcm7xx-pwm",
-+    if (result) {
++    .version_id = 0,
-+        return MEMTX_OK;
++    .minimum_version_id = 0,
-+    } else {
++    .fields = (VMStateField[]) {
-+        return MEMTX_ERROR;
++        VMSTATE_BOOL(running, NPCM7xxPWM),
-+    }
++        VMSTATE_BOOL(inverted, NPCM7xxPWM),
- }
++        VMSTATE_UINT8(index, NPCM7xxPWM),
++        VMSTATE_UINT32(cnr, NPCM7xxPWM),
- static bool its_writel(GICv3ITSState *s, hwaddr offset,
++        VMSTATE_UINT32(cmr, NPCM7xxPWM),
 +        VMSTATE_UINT32(pdr, NPCM7xxPWM),
 +        VMSTATE_UINT32(pwdr, NPCM7xxPWM),
 +        VMSTATE_UINT32(freq, NPCM7xxPWM),
 +        VMSTATE_UINT32(duty, NPCM7xxPWM),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static const VMStateDescription vmstate_npcm7xx_pwm_module = {
 +    .name = "npcm7xx-pwm-module",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_CLOCK(clock, NPCM7xxPWMState),
 +        VMSTATE_STRUCT_ARRAY(pwm, NPCM7xxPWMState,
 +                             NPCM7XX_PWM_PER_MODULE, 0, vmstate_npcm7xx_pwm,
 +                             NPCM7xxPWM),
 +        VMSTATE_UINT32(ppr, NPCM7xxPWMState),
 +        VMSTATE_UINT32(csr, NPCM7xxPWMState),
 +        VMSTATE_UINT32(pcr, NPCM7xxPWMState),
 +        VMSTATE_UINT32(pier, NPCM7xxPWMState),
 +        VMSTATE_UINT32(piir, NPCM7xxPWMState),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +static void npcm7xx_pwm_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM7xx PWM Controller";
 +    dc->vmsd = &vmstate_npcm7xx_pwm_module;
 +    rc->phases.enter = npcm7xx_pwm_enter_reset;
 +    rc->phases.hold = npcm7xx_pwm_hold_reset;
 +}
 +
 +static const TypeInfo npcm7xx_pwm_info = {
 +    .name               = TYPE_NPCM7XX_PWM,
 +    .parent             = TYPE_SYS_BUS_DEVICE,
 +    .instance_size      = sizeof(NPCM7xxPWMState),
 +    .class_init         = npcm7xx_pwm_class_init,
 +    .instance_init      = npcm7xx_pwm_init,
 +};
 +
 +static void npcm7xx_pwm_register_type(void)
 +{
 +    type_register_static(&npcm7xx_pwm_info);
 +}
 +type_init(npcm7xx_pwm_register_type);
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MAINSTONE', if_true: files('mst_fpga.c'))
  softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
    'npcm7xx_clk.c',
    'npcm7xx_gcr.c',
 +  'npcm7xx_pwm.c',
    'npcm7xx_rng.c',
  ))
  softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files(
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_gcr_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " valu
  npcm7xx_rng_read(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
  npcm7xx_rng_write(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
 +# npcm7xx_pwm.c
 +npcm7xx_pwm_read(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 +npcm7xx_pwm_write(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 +npcm7xx_pwm_update_freq(const char *id, uint8_t index, uint32_t old_value, uint32_t new_value) "%s pwm[%u] Update Freq: old_freq: %u, new_freq: %u"
 +npcm7xx_pwm_update_duty(const char *id, uint8_t index, uint32_t old_value, uint32_t new_value) "%s pwm[%u] Update Duty: old_duty: %u, new_duty: %u"
 +
  # stm32f4xx_syscfg.c
  stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
  stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
 --
 .20.1

-[PULL 09/23] hw/intc: GICv3 ITS initial framework
+[PULL 19/21] hw/misc: Add QTest for NPCM7XX PWM Module
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Hao Wu <wuhaotsh@google.com>
-Added register definitions relevant to ITS,implemented overall
+We add a qtest for the PWM in the previous patch. It proves it works as
-ITS device framework with stubs for ITS control and translater
+expected.
 regions read/write,extended ITS common to handle mmio init between
 existing kvm device and newer qemu device.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
 Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
 Signed-off-by: Hao Wu <wuhaotsh@google.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20210108190945.949196-6-wuhaotsh@google.com
 Tested-by: Neil Armstrong <narmstrong@baylibre.com>
 Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h               |  96 +++++++++-
+ tests/qtest/npcm7xx_pwm-test.c | 490 +++++++++++++++++++++++++++++++++
- include/hw/intc/arm_gicv3_its_common.h |   9 +-
+ tests/qtest/meson.build        |   1 +
- hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
+files changed, 491 insertions(+)
- hw/intc/arm_gicv3_its_common.c         |   7 +-
+ create mode 100644 tests/qtest/npcm7xx_pwm-test.c
  hw/intc/arm_gicv3_its_kvm.c            |   2 +-
  hw/intc/meson.build                    |   1 +
 files changed, 342 insertions(+), 14 deletions(-)
  create mode 100644 hw/intc/arm_gicv3_its.c
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/gicv3_internal.h
 +++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
  #ifndef QEMU_ARM_GICV3_INTERNAL_H
  #define QEMU_ARM_GICV3_INTERNAL_H
 +#include "hw/registerfields.h"
  #include "hw/intc/arm_gicv3_common.h"
  /* Distributor registers, as offsets from the distributor base address */
@@ -XXX,XX +XXX,XX @@
  #define GICD_CTLR_E1NWF             (1U << 7)
  #define GICD_CTLR_RWP               (1U << 31)
 +/* 16 bits EventId */
 +#define GICD_TYPER_IDBITS            0xf
 +
  /*
   * Redistributor frame offsets from RD_base
   */
@@ -XXX,XX +XXX,XX @@
  #define GICR_WAKER_ProcessorSleep    (1U << 1)
  #define GICR_WAKER_ChildrenAsleep    (1U << 2)
 -#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
 -#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
 -#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
 -#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
 -#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
 +FIELD(GICR_PROPBASER, IDBITS, 0, 5)
 +FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
 +FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 -#define GICR_PENDBASER_PTZ                     (1ULL << 62)
 -#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
 -#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
 -#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
 -#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
 +FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 +FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 +FIELD(GICR_PENDBASER, PTZ, 62, 1)
  #define ICC_CTLR_EL1_CBPR           (1U << 0)
  #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
  #define ICH_VTR_EL2_PREBITS_SHIFT 26
  #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 +/* ITS Registers */
 +
 +FIELD(GITS_BASER, SIZE, 0, 8)
 +FIELD(GITS_BASER, PAGESIZE, 8, 2)
 +FIELD(GITS_BASER, SHAREABILITY, 10, 2)
 +FIELD(GITS_BASER, PHYADDR, 12, 36)
 +FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
 +FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
 +FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
 +FIELD(GITS_BASER, OUTERCACHE, 53, 3)
 +FIELD(GITS_BASER, TYPE, 56, 3)
 +FIELD(GITS_BASER, INNERCACHE, 59, 3)
 +FIELD(GITS_BASER, INDIRECT, 62, 1)
 +FIELD(GITS_BASER, VALID, 63, 1)
 +
 +FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 +
 +FIELD(GITS_TYPER, PHYSICAL, 0, 1)
 +FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
 +FIELD(GITS_TYPER, IDBITS, 8, 5)
 +FIELD(GITS_TYPER, DEVBITS, 13, 5)
 +FIELD(GITS_TYPER, SEIS, 18, 1)
 +FIELD(GITS_TYPER, PTA, 19, 1)
 +FIELD(GITS_TYPER, CIDBITS, 32, 4)
 +FIELD(GITS_TYPER, CIL, 36, 1)
 +
 +#define GITS_BASER_PAGESIZE_4K                0
 +#define GITS_BASER_PAGESIZE_16K               1
 +#define GITS_BASER_PAGESIZE_64K               2
 +
 +#define GITS_BASER_TYPE_DEVICE               1ULL
 +#define GITS_BASER_TYPE_COLLECTION           4ULL
 +
 +/**
 + * Default features advertised by this version of ITS
 + */
 +/* Physical LPIs supported */
 +#define GITS_TYPE_PHYSICAL           (1U << 0)
 +
 +/*
 + * 12 bytes Interrupt translation Table Entry size
 + * as per Table 5.3 in GICv3 spec
 + * ITE Lower 8 Bytes
 + *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
 + *   Values:  |    1023   |  IntNum  | IntType |  Valid |
 + * ITE Higher 4 Bytes
 + *   Bits:    | 31 ... 16 | 15 ...0 |
 + *   Values:  |  vPEID    |  ICID   |
 + */
 +#define ITS_ITT_ENTRY_SIZE            0xC
 +
 +/* 16 bits EventId */
 +#define ITS_IDBITS                   GICD_TYPER_IDBITS
 +
 +/* 16 bits DeviceId */
 +#define ITS_DEVBITS                   0xF
 +
 +/* 16 bits CollectionId */
 +#define ITS_CIDBITS                  0xF
 +
 +/*
 + * 8 bytes Device Table Entry size
 + * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
 + */
 +#define GITS_DTE_SIZE                 (0x8ULL)
 +
 +/*
 + * 8 bytes Collection Table Entry size
 + * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
 + */
 +#define GITS_CTE_SIZE                 (0x8ULL)
 +
  /* Special interrupt IDs */
  #define INTID_SECURE 1020
  #define INTID_NONSECURE 1021
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/intc/arm_gicv3_common.h"
  #include "qom/object.h"
 +#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
 +
  #define ITS_CONTROL_SIZE 0x10000
  #define ITS_TRANS_SIZE   0x10000
  #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
  #define GITS_CTLR        0x0
  #define GITS_IIDR        0x4
 +#define GITS_TYPER       0x8
  #define GITS_CBASER      0x80
  #define GITS_CWRITER     0x88
  #define GITS_CREADR      0x90
  #define GITS_BASER       0x100
 +#define GITS_TRANSLATER  0x0040
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      /* Registers */
      uint32_t ctlr;
      uint32_t iidr;
 +    uint64_t typer;
      uint64_t cbaser;
      uint64_t cwriter;
      uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
  typedef struct GICv3ITSState GICv3ITSState;
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                   const MemoryRegionOps *tops);
  #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
  typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/tests/qtest/npcm7xx_pwm-test.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ITS emulation for a GICv3-based system
++ * QTests for Nuvoton NPCM7xx PWM Modules.
 + *
-+ * Copyright Linaro.org 2021
++ * Copyright 2020 Google LLC
 + *
-+ * Authors:
++ * This program is free software; you can redistribute it and/or modify it
-+ *  Shashi Mallela <shashi.mallela@linaro.org>
++ * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or (at your
++ * This program is distributed in the hope that it will be useful, but WITHOUT
-+ * option) any later version.  See the COPYING file in the top-level directory.
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ *
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
 +#include "qemu/osdep.h"
-+#include "qemu/log.h"
++#include "qemu/bitops.h"
-+#include "hw/qdev-properties.h"
++#include "libqos/libqtest.h"
-+#include "hw/intc/arm_gicv3_its_common.h"
++#include "qapi/qmp/qdict.h"
-+#include "gicv3_internal.h"
++#include "qapi/qmp/qnum.h"
-+#include "qom/object.h"
++
-+#include "qapi/error.h"
++#define REF_HZ          25000000
 +
-+typedef struct GICv3ITSClass GICv3ITSClass;
++/* Register field definitions. */
-+/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
++#define CH_EN           BIT(0)
-+DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
++#define CH_INV          BIT(2)
-+                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
++#define CH_MOD          BIT(3)
 +
-+struct GICv3ITSClass {
++/* Registers shared between all PWMs in a module */
-+    GICv3ITSCommonClass parent_class;
++#define PPR             0x00
-+    void (*parent_reset)(DeviceState *dev);
++#define CSR             0x04
 +#define PCR             0x08
 +#define PIER            0x3c
 +#define PIIR            0x40
 +
 +/* CLK module related */
 +#define CLK_BA          0xf0801000
 +#define CLKSEL          0x04
 +#define CLKDIV1         0x08
 +#define CLKDIV2         0x2c
 +#define PLLCON0         0x0c
 +#define PLLCON1         0x10
 +#define PLL_INDV(rv)    extract32((rv), 0, 6)
 +#define PLL_FBDV(rv)    extract32((rv), 16, 12)
 +#define PLL_OTDV1(rv)   extract32((rv), 8, 3)
 +#define PLL_OTDV2(rv)   extract32((rv), 13, 3)
 +#define APB3CKDIV(rv)   extract32((rv), 28, 2)
 +#define CLK2CKDIV(rv)   extract32((rv), 0, 1)
 +#define CLK4CKDIV(rv)   extract32((rv), 26, 2)
 +#define CPUCKSEL(rv)    extract32((rv), 0, 2)
 +
 +#define MAX_DUTY        1000000
 +
 +typedef struct PWMModule {
 +    int irq;
 +    uint64_t base_addr;
 +} PWMModule;
 +
 +typedef struct PWM {
 +    uint32_t cnr_offset;
 +    uint32_t cmr_offset;
 +    uint32_t pdr_offset;
 +    uint32_t pwdr_offset;
 +} PWM;
 +
 +typedef struct TestData {
 +    const PWMModule *module;
 +    const PWM *pwm;
 +} TestData;
 +
 +static const PWMModule pwm_module_list[] = {
 +    {
 +        .irq        = 93,
 +        .base_addr  = 0xf0103000
 +    },
 +    {
 +        .irq        = 94,
 +        .base_addr  = 0xf0104000
 +    }
 +};
 +
-+static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
++static const PWM pwm_list[] = {
-+                                               uint64_t data, unsigned size,
++    {
-+                                               MemTxAttrs attrs)
++        .cnr_offset     = 0x0c,
-+{
++        .cmr_offset     = 0x10,
-+    return MEMTX_OK;
++        .pdr_offset     = 0x14,
-+}
++        .pwdr_offset    = 0x44,
-+
++    },
-+static bool its_writel(GICv3ITSState *s, hwaddr offset,
++    {
-+                              uint64_t value, MemTxAttrs attrs)
++        .cnr_offset     = 0x18,
-+{
++        .cmr_offset     = 0x1c,
-+    bool result = true;
++        .pdr_offset     = 0x20,
-+
++        .pwdr_offset    = 0x48,
-+    return result;
++    },
-+}
++    {
-+
++        .cnr_offset     = 0x24,
-+static bool its_readl(GICv3ITSState *s, hwaddr offset,
++        .cmr_offset     = 0x28,
-+                             uint64_t *data, MemTxAttrs attrs)
++        .pdr_offset     = 0x2c,
-+{
++        .pwdr_offset    = 0x4c,
-+    bool result = true;
++    },
-+
++    {
-+    return result;
++        .cnr_offset     = 0x30,
-+}
++        .cmr_offset     = 0x34,
-+
++        .pdr_offset     = 0x38,
-+static bool its_writell(GICv3ITSState *s, hwaddr offset,
++        .pwdr_offset    = 0x50,
-+                               uint64_t value, MemTxAttrs attrs)
++    },
-+{
++};
-+    bool result = true;
++
-+
++static const int ppr_base[] = { 0, 0, 8, 8 };
-+    return result;
++static const int csr_base[] = { 0, 4, 8, 12 };
-+}
++static const int pcr_base[] = { 0, 8, 12, 16 };
 +
-+static bool its_readll(GICv3ITSState *s, hwaddr offset,
++static const uint32_t ppr_list[] = {
-+                              uint64_t *data, MemTxAttrs attrs)
++    0,
-+{
++    1,
-+    bool result = true;
++    10,
-+
++    100,
-+    return result;
++    255, /* Max possible value. */
-+}
++};
 +
-+static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
++static const uint32_t csr_list[] = {
-+                                  unsigned size, MemTxAttrs attrs)
++    0,
-+{
++    1,
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
++    2,
-+    bool result;
++    3,
-+
++    4, /* Max possible value. */
-+    switch (size) {
++};
-+    case 4:
++
-+        result = its_readl(s, offset, data, attrs);
++static const uint32_t cnr_list[] = {
 +    0,
 +    1,
 +    50,
 +    100,
 +    150,
 +    200,
 +    1000,
 +    10000,
 +    65535, /* Max possible value. */
 +};
 +
 +static const uint32_t cmr_list[] = {
 +    0,
 +    1,
 +    10,
 +    50,
 +    100,
 +    150,
 +    200,
 +    1000,
 +    10000,
 +    65535, /* Max possible value. */
 +};
 +
 +/* Returns the index of the PWM module. */
 +static int pwm_module_index(const PWMModule *module)
 +{
 +    ptrdiff_t diff = module - pwm_module_list;
 +
 +    g_assert_true(diff >= 0 && diff < ARRAY_SIZE(pwm_module_list));
 +
 +    return diff;
 +}
 +
 +/* Returns the index of the PWM entry. */
 +static int pwm_index(const PWM *pwm)
 +{
 +    ptrdiff_t diff = pwm - pwm_list;
 +
 +    g_assert_true(diff >= 0 && diff < ARRAY_SIZE(pwm_list));
 +
 +    return diff;
 +}
 +
 +static uint64_t pwm_qom_get(QTestState *qts, const char *path, const char *name)
 +{
 +    QDict *response;
 +
 +    g_test_message("Getting properties %s from %s", name, path);
 +    response = qtest_qmp(qts, "{ 'execute': 'qom-get',"
 +            " 'arguments': { 'path': %s, 'property': %s}}",
 +            path, name);
 +    /* The qom set message returns successfully. */
 +    g_assert_true(qdict_haskey(response, "return"));
 +    return qnum_get_uint(qobject_to(QNum, qdict_get(response, "return")));
 +}
 +
 +static uint64_t pwm_get_freq(QTestState *qts, int module_index, int pwm_index)
 +{
 +    char path[100];
 +    char name[100];
 +
 +    sprintf(path, "/machine/soc/pwm[%d]", module_index);
 +    sprintf(name, "freq[%d]", pwm_index);
 +
 +    return pwm_qom_get(qts, path, name);
 +}
 +
 +static uint64_t pwm_get_duty(QTestState *qts, int module_index, int pwm_index)
 +{
 +    char path[100];
 +    char name[100];
 +
 +    sprintf(path, "/machine/soc/pwm[%d]", module_index);
 +    sprintf(name, "duty[%d]", pwm_index);
 +
 +    return pwm_qom_get(qts, path, name);
 +}
 +
 +static uint32_t get_pll(uint32_t con)
 +{
 +    return REF_HZ * PLL_FBDV(con) / (PLL_INDV(con) * PLL_OTDV1(con)
 +            * PLL_OTDV2(con));
 +}
 +
 +static uint64_t read_pclk(QTestState *qts)
 +{
 +    uint64_t freq = REF_HZ;
 +    uint32_t clksel = qtest_readl(qts, CLK_BA + CLKSEL);
 +    uint32_t pllcon;
 +    uint32_t clkdiv1 = qtest_readl(qts, CLK_BA + CLKDIV1);
 +    uint32_t clkdiv2 = qtest_readl(qts, CLK_BA + CLKDIV2);
 +
 +    switch (CPUCKSEL(clksel)) {
 +    case 0:
 +        pllcon = qtest_readl(qts, CLK_BA + PLLCON0);
 +        freq = get_pll(pllcon);
 +        break;
-+    case 8:
++    case 1:
-+        result = its_readll(s, offset, data, attrs);
++        pllcon = qtest_readl(qts, CLK_BA + PLLCON1);
 +        freq = get_pll(pllcon);
 +        break;
 +    case 2:
 +        break;
 +    case 3:
 +        break;
 +    default:
-+        result = false;
++        g_assert_not_reached();
-+        break;
++    }
-+    }
++
-+
++    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + APB3CKDIV(clkdiv2));
-+    if (!result) {
++
-+        qemu_log_mask(LOG_GUEST_ERROR,
++    return freq;
-+                      "%s: invalid guest read at offset " TARGET_FMT_plx
++}
-+                      "size %u\n", __func__, offset, size);
++
-+        /*
++static uint32_t pwm_selector(uint32_t csr)
-+         * The spec requires that reserved registers are RAZ/WI;
++{
-+         * so use false returns from leaf functions as a way to
++    switch (csr) {
-+         * trigger the guest-error logging but don't return it to
++    case 0:
-+         * the caller, or we'll cause a spurious guest data abort.
++        return 2;
-+         */
++    case 1:
-+        *data = 0;
++        return 4;
-+    }
++    case 2:
-+    return MEMTX_OK;
++        return 8;
-+}
++    case 3:
-+
++        return 16;
 +static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
 +                                   unsigned size, MemTxAttrs attrs)
 +{
 +    GICv3ITSState *s = (GICv3ITSState *)opaque;
 +    bool result;
 +
 +    switch (size) {
 +    case 4:
-+        result = its_writel(s, offset, data, attrs);
++        return 1;
 +        break;
 +    case 8:
 +        result = its_writell(s, offset, data, attrs);
 +        break;
 +    default:
-+        result = false;
++        g_assert_not_reached();
-+        break;
++    }
-+    }
++}
 +
-+    if (!result) {
++static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
-+        qemu_log_mask(LOG_GUEST_ERROR,
++        uint32_t cnr)
-+                      "%s: invalid guest write at offset " TARGET_FMT_plx
++{
-+                      "size %u\n", __func__, offset, size);
++    return read_pclk(qts) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
-+        /*
++}
-+         * The spec requires that reserved registers are RAZ/WI;
++
-+         * so use false returns from leaf functions as a way to
++static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
-+         * trigger the guest-error logging but don't return it to
++{
-+         * the caller, or we'll cause a spurious guest data abort.
++    uint64_t duty;
-+         */
++
-+    }
++    if (cnr == 0) {
-+    return MEMTX_OK;
++        /* PWM is stopped. */
-+}
++        duty = 0;
-+
++    } else if (cmr >= cnr) {
-+static const MemoryRegionOps gicv3_its_control_ops = {
++        duty = MAX_DUTY;
-+    .read_with_attrs = gicv3_its_read,
++    } else {
-+    .write_with_attrs = gicv3_its_write,
++        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
-+    .valid.min_access_size = 4,
++    }
-+    .valid.max_access_size = 8,
++
-+    .impl.min_access_size = 4,
++    if (inverted) {
-+    .impl.max_access_size = 8,
++        duty = MAX_DUTY - duty;
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++    }
-+};
++
-+
++    return duty;
-+static const MemoryRegionOps gicv3_its_translation_ops = {
++}
-+    .write_with_attrs = gicv3_its_translation_write,
++
-+    .valid.min_access_size = 2,
++static uint32_t pwm_read(QTestState *qts, const TestData *td, unsigned offset)
-+    .valid.max_access_size = 4,
++{
-+    .impl.min_access_size = 2,
++    return qtest_readl(qts, td->module->base_addr + offset);
-+    .impl.max_access_size = 4,
++}
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++
-+};
++static void pwm_write(QTestState *qts, const TestData *td, unsigned offset,
-+
++        uint32_t value)
-+static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
++{
-+{
++    qtest_writel(qts, td->module->base_addr + offset, value);
-+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
++}
-+    int i;
++
-+
++static uint32_t pwm_read_ppr(QTestState *qts, const TestData *td)
-+    for (i = 0; i < s->gicv3->num_cpu; i++) {
++{
-+        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
++    return extract32(pwm_read(qts, td, PPR), ppr_base[pwm_index(td->pwm)], 8);
-+            error_setg(errp, "Physical LPI not supported by CPU %d", i);
++}
-+            return;
++
 +static void pwm_write_ppr(QTestState *qts, const TestData *td, uint32_t value)
 +{
 +    pwm_write(qts, td, PPR, value << ppr_base[pwm_index(td->pwm)]);
 +}
 +
 +static uint32_t pwm_read_csr(QTestState *qts, const TestData *td)
 +{
 +    return extract32(pwm_read(qts, td, CSR), csr_base[pwm_index(td->pwm)], 3);
 +}
 +
 +static void pwm_write_csr(QTestState *qts, const TestData *td, uint32_t value)
 +{
 +    pwm_write(qts, td, CSR, value << csr_base[pwm_index(td->pwm)]);
 +}
 +
 +static uint32_t pwm_read_pcr(QTestState *qts, const TestData *td)
 +{
 +    return extract32(pwm_read(qts, td, PCR), pcr_base[pwm_index(td->pwm)], 4);
 +}
 +
 +static void pwm_write_pcr(QTestState *qts, const TestData *td, uint32_t value)
 +{
 +    pwm_write(qts, td, PCR, value << pcr_base[pwm_index(td->pwm)]);
 +}
 +
 +static uint32_t pwm_read_cnr(QTestState *qts, const TestData *td)
 +{
 +    return pwm_read(qts, td, td->pwm->cnr_offset);
 +}
 +
 +static void pwm_write_cnr(QTestState *qts, const TestData *td, uint32_t value)
 +{
 +    pwm_write(qts, td, td->pwm->cnr_offset, value);
 +}
 +
 +static uint32_t pwm_read_cmr(QTestState *qts, const TestData *td)
 +{
 +    return pwm_read(qts, td, td->pwm->cmr_offset);
 +}
 +
 +static void pwm_write_cmr(QTestState *qts, const TestData *td, uint32_t value)
 +{
 +    pwm_write(qts, td, td->pwm->cmr_offset, value);
 +}
 +
 +/* Check pwm registers can be reset to default value */
 +static void test_init(gconstpointer test_data)
 +{
 +    const TestData *td = test_data;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    int module = pwm_module_index(td->module);
 +    int pwm = pwm_index(td->pwm);
 +
 +    g_assert_cmpuint(pwm_get_freq(qts, module, pwm), ==, 0);
 +    g_assert_cmpuint(pwm_get_duty(qts, module, pwm), ==, 0);
 +
 +    qtest_quit(qts);
 +}
 +
 +/* One-shot mode should not change frequency and duty cycle. */
 +static void test_oneshot(gconstpointer test_data)
 +{
 +    const TestData *td = test_data;
 +    QTestState *qts = qtest_init("-machine quanta-gsj");
 +    int module = pwm_module_index(td->module);
 +    int pwm = pwm_index(td->pwm);
 +    uint32_t ppr, csr, pcr;
 +    int i, j;
 +
 +    pcr = CH_EN;
 +    for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
 +        ppr = ppr_list[i];
 +        pwm_write_ppr(qts, td, ppr);
 +
 +        for (j = 0; j < ARRAY_SIZE(csr_list); ++j) {
 +            csr = csr_list[j];
 +            pwm_write_csr(qts, td, csr);
 +            pwm_write_pcr(qts, td, pcr);
 +
 +            g_assert_cmpuint(pwm_read_ppr(qts, td), ==, ppr);
 +            g_assert_cmpuint(pwm_read_csr(qts, td), ==, csr);
 +            g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr);
 +            g_assert_cmpuint(pwm_get_freq(qts, module, pwm), ==, 0);
 +            g_assert_cmpuint(pwm_get_duty(qts, module, pwm), ==, 0);
 +        }
 +    }
 +
-+    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
++    qtest_quit(qts);
-+
++}
-+    /* set the ITS default features supported */
++
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
++/* In toggle mode, the PWM generates correct outputs. */
-+                          GITS_TYPE_PHYSICAL);
++static void test_toggle(gconstpointer test_data)
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
++{
-+                          ITS_ITT_ENTRY_SIZE - 1);
++    const TestData *td = test_data;
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
++    QTestState *qts = qtest_init("-machine quanta-gsj");
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
++    int module = pwm_module_index(td->module);
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
++    int pwm = pwm_index(td->pwm);
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
++    uint32_t ppr, csr, pcr, cnr, cmr;
-+}
++    int i, j, k, l;
-+
++    uint64_t expected_freq, expected_duty;
-+static void gicv3_its_reset(DeviceState *dev)
++
-+{
++    pcr = CH_EN | CH_MOD;
-+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
++    for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
-+    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
++        ppr = ppr_list[i];
-+
++        pwm_write_ppr(qts, td, ppr);
-+    c->parent_reset(dev);
++
-+
++        for (j = 0; j < ARRAY_SIZE(csr_list); ++j) {
-+    /* Quiescent bit reset to 1 */
++            csr = csr_list[j];
-+    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
++            pwm_write_csr(qts, td, csr);
 +
-+    /*
++            for (k = 0; k < ARRAY_SIZE(cnr_list); ++k) {
-+     * setting GITS_BASER0.Type = 0b001 (Device)
++                cnr = cnr_list[k];
-+     *         GITS_BASER1.Type = 0b100 (Collection Table)
++                pwm_write_cnr(qts, td, cnr);
-+     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
++
-+     *         GITS_BASER<0,1>.Page_Size = 64KB
++                for (l = 0; l < ARRAY_SIZE(cmr_list); ++l) {
-+     * and default translation table entry size to 16 bytes
++                    cmr = cmr_list[l];
-+     */
++                    pwm_write_cmr(qts, td, cmr);
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
++                    expected_freq = pwm_compute_freq(qts, ppr, csr, cnr);
-+                             GITS_BASER_TYPE_DEVICE);
++                    expected_duty = pwm_compute_duty(cnr, cmr, false);
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
++
-+                             GITS_BASER_PAGESIZE_64K);
++                    pwm_write_pcr(qts, td, pcr);
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
++                    g_assert_cmpuint(pwm_read_ppr(qts, td), ==, ppr);
-+                             GITS_DTE_SIZE - 1);
++                    g_assert_cmpuint(pwm_read_csr(qts, td), ==, csr);
-+
++                    g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr);
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
++                    g_assert_cmpuint(pwm_read_cnr(qts, td), ==, cnr);
-+                             GITS_BASER_TYPE_COLLECTION);
++                    g_assert_cmpuint(pwm_read_cmr(qts, td), ==, cmr);
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
++                    g_assert_cmpuint(pwm_get_duty(qts, module, pwm),
-+                             GITS_BASER_PAGESIZE_64K);
++                            ==, expected_duty);
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
++                    if (expected_duty != 0 && expected_duty != 100) {
-+                             GITS_CTE_SIZE - 1);
++                        /* Duty cycle with 0 or 100 doesn't need frequency. */
-+}
++                        g_assert_cmpuint(pwm_get_freq(qts, module, pwm),
-+
++                                ==, expected_freq);
-+static Property gicv3_its_props[] = {
++                    }
-+    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
++
-+                     GICv3State *),
++                    /* Test inverted mode */
-+    DEFINE_PROP_END_OF_LIST(),
++                    expected_duty = pwm_compute_duty(cnr, cmr, true);
-+};
++                    pwm_write_pcr(qts, td, pcr | CH_INV);
-+
++                    g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr | CH_INV);
-+static void gicv3_its_class_init(ObjectClass *klass, void *data)
++                    g_assert_cmpuint(pwm_get_duty(qts, module, pwm),
-+{
++                            ==, expected_duty);
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++                    if (expected_duty != 0 && expected_duty != 100) {
-+    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
++                        /* Duty cycle with 0 or 100 doesn't need frequency. */
-+
++                        g_assert_cmpuint(pwm_get_freq(qts, module, pwm),
-+    dc->realize = gicv3_arm_its_realize;
++                                ==, expected_freq);
-+    device_class_set_props(dc, gicv3_its_props);
++                    }
-+    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
++
-+}
++                }
-+
++            }
-+static const TypeInfo gicv3_its_info = {
++        }
-+    .name = TYPE_ARM_GICV3_ITS,
++    }
-+    .parent = TYPE_ARM_GICV3_ITS_COMMON,
++
-+    .instance_size = sizeof(GICv3ITSState),
++    qtest_quit(qts);
-+    .class_init = gicv3_its_class_init,
++}
-+    .class_size = sizeof(GICv3ITSClass),
++
-+};
++static void pwm_add_test(const char *name, const TestData* td,
-+
++        GTestDataFunc fn)
-+static void gicv3_its_register_types(void)
++{
-+{
++    g_autofree char *full_name = g_strdup_printf(
-+    type_register_static(&gicv3_its_info);
++            "npcm7xx_pwm/module[%d]/pwm[%d]/%s", pwm_module_index(td->module),
-+}
++            pwm_index(td->pwm), name);
-+
++    qtest_add_data_func(full_name, td, fn);
-+type_init(gicv3_its_register_types)
++}
-diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
++#define add_test(name, td) pwm_add_test(#name, td, test_##name)
 +
 +int main(int argc, char **argv)
 +{
 +    TestData test_data_list[ARRAY_SIZE(pwm_module_list) * ARRAY_SIZE(pwm_list)];
 +
 +    g_test_init(&argc, &argv, NULL);
 +
 +    for (int i = 0; i < ARRAY_SIZE(pwm_module_list); ++i) {
 +        for (int j = 0; j < ARRAY_SIZE(pwm_list); ++j) {
 +            TestData *td = &test_data_list[i * ARRAY_SIZE(pwm_list) + j];
 +
 +            td->module = &pwm_module_list[i];
 +            td->pwm = &pwm_list[j];
 +
 +            add_test(init, td);
 +            add_test(oneshot, td);
 +            add_test(toggle, td);
 +        }
 +    }
 +
 +    return g_test_run();
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_common.c
+--- a/tests/qtest/meson.build
-+++ b/hw/intc/arm_gicv3_its_common.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
+@@ -XXX,XX +XXX,XX @@ qtests_sparc64 = \
+ qtests_npcm7xx = \
- static const VMStateDescription vmstate_its = {
+   ['npcm7xx_adc-test',
-     .name = "arm_gicv3_its",
+    'npcm7xx_gpio-test',
-+    .version_id = 1,
++   'npcm7xx_pwm-test',
-+    .minimum_version_id = 1,
+    'npcm7xx_rng-test',
-     .pre_save = gicv3_its_pre_save,
+    'npcm7xx_timer-test',
-     .post_load = gicv3_its_post_load,
+    'npcm7xx_watchdog_timer-test']
      .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                         const MemoryRegionOps *tops)
  {
      SysBusDevice *sbd = SYS_BUS_DEVICE(s);
      memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                            "control", ITS_CONTROL_SIZE);
      memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
 -                          &gicv3_its_trans_ops, s,
 +                          tops ? tops : &gicv3_its_trans_ops, s,
                            "translation", ITS_TRANS_SIZE);
      /* Our two regions are always adjacent, therefore we now combine them
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                              KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 -    gicv3_its_init_mmio(s, NULL);
 +    gicv3_its_init_mmio(s, NULL, NULL);
      if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
          GITS_CTLR)) {
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
    'arm_gicv3_dist.c',
    'arm_gicv3_its_common.c',
    'arm_gicv3_redist.c',
 +  'arm_gicv3_its.c',
  ))
  softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
  softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
 --
 .20.1

-[PULL 01/23] hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
+[PULL 20/21] hw/*: Use type casting for SysBusDevice in NPCM7XX
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Hao Wu <wuhaotsh@google.com>
-As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
+A device shouldn't access its parent object which is QOM internal.
-does not receive anything. Debugging shows that the UART input clock
+Instead it should use type cast for this purporse. This patch fixes this
-frequency is zero which prevents the UART from receiving anything as
+issue for all NPCM7XX Devices.
 per the logic in uart_receive().
-From zynq_slcr_reset_exit() comment, it intends to compute output
+Signed-off-by: Hao Wu <wuhaotsh@google.com>
-clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-is called to accomplish the task, inside which device_is_in_reset()
+Message-id: 20210108190945.949196-7-wuhaotsh@google.com
 is called to actually make the attempt in vain.
 Rework reset_hold() and reset_exit() so that in the reset exit phase,
 the logic can really compute output clocks in reset_exit().
 With this change, upstream U-Boot boots properly again with:
 $ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
     -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0
 Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
 Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
+ hw/arm/npcm7xx_boards.c | 2 +-
-file changed, 18 insertions(+), 13 deletions(-)
+ hw/mem/npcm7xx_mc.c     | 2 +-
  hw/misc/npcm7xx_clk.c   | 2 +-
  hw/misc/npcm7xx_gcr.c   | 2 +-
  hw/misc/npcm7xx_rng.c   | 2 +-
  hw/nvram/npcm7xx_otp.c  | 2 +-
  hw/ssi/npcm7xx_fiu.c    | 2 +-
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
+diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/zynq_slcr.c
+--- a/hw/arm/npcm7xx_boards.c
-+++ b/hw/misc/zynq_slcr.c
++++ b/hw/arm/npcm7xx_boards.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
+@@ -XXX,XX +XXX,XX @@ static NPCM7xxState *npcm7xx_create_soc(MachineState *machine,
-     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
+                                         uint32_t hw_straps)
-                             reg ## _ ## enable_field ## _SHIFT)
+ {
+     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_GET_CLASS(machine);
-+static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
+-    MachineClass *mc = &nmc->parent;
-+{
++    MachineClass *mc = MACHINE_CLASS(nmc);
-+    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
+     Object *obj;
-+    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
-+    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
+     if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
-+
+diff --git a/hw/mem/npcm7xx_mc.c b/hw/mem/npcm7xx_mc.c
-+    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/hw/mem/npcm7xx_mc.c
-+    /* compute uartX reference clocks */
++++ b/hw/mem/npcm7xx_mc.c
-+    clock_set(s->uart0_ref_clk,
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_mc_realize(DeviceState *dev, Error **errp)
-+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
-+    clock_set(s->uart1_ref_clk,
+     memory_region_init_io(&s->mmio, OBJECT(s), &npcm7xx_mc_ops, s, "regs",
-+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+                           NPCM7XX_MC_REGS_SIZE);
-+}
+-    sysbus_init_mmio(&s->parent, &s->mmio);
-+
++    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->mmio);
  /**
   * Compute and set the ouputs clocks periods.
   * But do not propagate them further. Connected clocks
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
          ps_clk = 0;
      }
 -    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
 -    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
 -    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
 -
 -    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
 -
 -    /* compute uartX reference clocks */
 -    clock_set(s->uart0_ref_clk,
 -              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
 -    clock_set(s->uart1_ref_clk,
 -              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
 +    zynq_slcr_compute_clocks_internal(s, ps_clk);
  }
- /**
+ static void npcm7xx_mc_class_init(ObjectClass *klass, void *data)
-@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
+diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
-     ZynqSLCRState *s = ZYNQ_SLCR(obj);
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/npcm7xx_clk.c
-     /* will disable all output clocks */
++++ b/hw/misc/npcm7xx_clk.c
--    zynq_slcr_compute_clocks(s);
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_init(Object *obj)
-+    zynq_slcr_compute_clocks_internal(s, 0);
-     zynq_slcr_propagate_clocks(s);
+     memory_region_init_io(&s->iomem, obj, &npcm7xx_clk_ops, s,
                            TYPE_NPCM7XX_CLK, 4 * KiB);
 -    sysbus_init_mmio(&s->parent, &s->iomem);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
  }
-@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
+ static int npcm7xx_clk_post_load(void *opaque, int version_id)
-     ZynqSLCRState *s = ZYNQ_SLCR(obj);
+diff --git a/hw/misc/npcm7xx_gcr.c b/hw/misc/npcm7xx_gcr.c
+index XXXXXXX..XXXXXXX 100644
-     /* will compute output clocks according to ps_clk and registers */
+--- a/hw/misc/npcm7xx_gcr.c
--    zynq_slcr_compute_clocks(s);
++++ b/hw/misc/npcm7xx_gcr.c
-+    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_gcr_init(Object *obj)
-     zynq_slcr_propagate_clocks(s);
      memory_region_init_io(&s->iomem, obj, &npcm7xx_gcr_ops, s,
                            TYPE_NPCM7XX_GCR, 4 * KiB);
 -    sysbus_init_mmio(&s->parent, &s->iomem);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
  }
+ static const VMStateDescription vmstate_npcm7xx_gcr = {
+diff --git a/hw/misc/npcm7xx_rng.c b/hw/misc/npcm7xx_rng.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/npcm7xx_rng.c
++++ b/hw/misc/npcm7xx_rng.c
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_rng_init(Object *obj)
+     memory_region_init_io(&s->iomem, obj, &npcm7xx_rng_ops, s, "regs",
+                           NPCM7XX_RNG_REGS_SIZE);
+-    sysbus_init_mmio(&s->parent, &s->iomem);
++    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+ }
+ static const VMStateDescription vmstate_npcm7xx_rng = {
+diff --git a/hw/nvram/npcm7xx_otp.c b/hw/nvram/npcm7xx_otp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/nvram/npcm7xx_otp.c
++++ b/hw/nvram/npcm7xx_otp.c
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_otp_realize(DeviceState *dev, Error **errp)
+ {
+     NPCM7xxOTPClass *oc = NPCM7XX_OTP_GET_CLASS(dev);
+     NPCM7xxOTPState *s = NPCM7XX_OTP(dev);
+-    SysBusDevice *sbd = &s->parent;
++    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+     memset(s->array, 0, sizeof(s->array));
+diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/npcm7xx_fiu.c
++++ b/hw/ssi/npcm7xx_fiu.c
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_hold_reset(Object *obj)
+ static void npcm7xx_fiu_realize(DeviceState *dev, Error **errp)
+ {
+     NPCM7xxFIUState *s = NPCM7XX_FIU(dev);
+-    SysBusDevice *sbd = &s->parent;
++    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+     int i;
+     if (s->cs_count <= 0) {
 --
 .20.1

-[PULL 02/23] hw/char: cadence_uart: Disable transmit when input clock is disabled
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-At present when input clock is disabled, any character transmitted
-to tx fifo can still show on the serial line, which is wrong.
-Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
- static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
-                                int size)
- {
-+    /* ignore characters when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return;
-+    }
-+
-     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
-         return;
-     }
---
-.20.1

-[PULL 03/23] hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
+[PULL 21/21] ui/cocoa: Fix openFile: deprecation on Big Sur
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Roman Bolshakov <r.bolshakov@yadro.com>
-Currently the clock/reset check is done in uart_receive(), but we
+ui/cocoa.m:1188:44: warning: 'openFile:' is deprecated: first deprecated in macOS 11.0 - Use -[NSWorkspace openURL:] instead.
-can move the check to uart_can_receive() which is earlier.
+      [-Wdeprecated-declarations]
         if ([[NSWorkspace sharedWorkspace] openFile: full_file_path] == YES) {
                                            ^
 /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/AppKit.framework/Headers/NSWorkspace.h:350:1: note:
       'openFile:' has been explicitly marked deprecated here
 - (BOOL)openFile:(NSString *)fullPath API_DEPRECATED("Use -[NSWorkspace openURL:] instead.", macos(10.0, 11.0));
 ^
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20210102150718.47618-1-r.bolshakov@yadro.com
 Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/cadence_uart.c | 17 ++++++++++-------
+ ui/cocoa.m | 5 ++++-
-file changed, 10 insertions(+), 7 deletions(-)
+file changed, 4 insertions(+), 1 deletion(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
+diff --git a/ui/cocoa.m b/ui/cocoa.m
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
+--- a/ui/cocoa.m
-+++ b/hw/char/cadence_uart.c
++++ b/ui/cocoa.m
-@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
+@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
- static int uart_can_receive(void *opaque)
+     /* Where to look for local files */
- {
+     NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"docs/"};
-     CadenceUARTState *s = opaque;
+     NSString *full_file_path;
--    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
++    NSURL *full_file_url;
--    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
-+    int ret;
+     /* iterate thru the possible paths until the file is found */
-+    uint32_t ch_mode;
+     int index;
-+
+@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
-+    /* ignore characters when unclocked or in reset */
+         full_file_path = [full_file_path stringByDeletingLastPathComponent];
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+         full_file_path = [NSString stringWithFormat: @"%@/%@%@", full_file_path,
-+        return 0;
+                           path_array[index], filename];
-+    }
+-        if ([[NSWorkspace sharedWorkspace] openFile: full_file_path] == YES) {
-+
++        full_file_url = [NSURL fileURLWithPath: full_file_path
-+    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
++                                   isDirectory: false];
-+    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
++        if ([[NSWorkspace sharedWorkspace] openURL: full_file_url] == YES) {
+             return;
-     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
+         }
          ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
      CadenceUARTState *s = opaque;
      uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 -    /* ignore characters when unclocked or in reset */
 -    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 -        return;
 -    }
 -
      if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
          uart_write_rx_fifo(opaque, buf, size);
      }
 --
 .20.1

-[PULL 05/23] hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-Read or write to uart registers when unclocked or in reset should be
-ignored. Add the check there, and as a result of this, the check in
-uart_write_tx_fifo() is now unnecessary.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 15 ++++++++++-----
-file changed, 10 insertions(+), 5 deletions(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
- static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
-                                int size)
- {
--    /* ignore characters when unclocked or in reset */
--    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
--        return;
--    }
--
-     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
- {
-     CadenceUARTState *s = opaque;
-+    /* ignore access when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return MEMTX_ERROR;
-+    }
-+
-     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
-     CadenceUARTState *s = opaque;
-     uint32_t c = 0;
-+    /* ignore access when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return MEMTX_ERROR;
-+    }
-+
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
-         return MEMTX_DECODE_ERROR;
---
-.20.1

The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913

for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:

hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)

----------------------------------------------------------------
target-arm queue:
 * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
   line user-created devices are not plugged into them
 * Take an exception if PSTATE.IL is set
 * Support an emulated ITS in the virt board
 * Add support for kudo-bmc board
 * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
 * cadence_uart: Fix clock handling issues that prevented
   u-boot from running

----------------------------------------------------------------
Bin Meng (6):
      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
      hw/char: cadence_uart: Disable transmit when input clock is disabled
      hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
      hw/char: cadence_uart: Convert to memop_with_attrs() ops
      hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
      hw/char: cadence_uart: Log a guest error when device is unclocked or in reset

Chris Rauer (1):
      hw/arm: Add support for kudo-bmc board.

Marc Zyngier (1):
      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM

Peter Maydell (5):
      target/arm: Take an exception if PSTATE.IL is set
      qdev: Support marking individual buses as 'full'
      hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
      hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
      hw/arm/mps2.c: Mark internal-only I2C buses as 'full'

Richard Henderson (1):
      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn

Shashi Mallela (9):
      hw/intc: GICv3 ITS initial framework
      hw/intc: GICv3 ITS register definitions added
      hw/intc: GICv3 ITS command queue framework
      hw/intc: GICv3 ITS Command processing
      hw/intc: GICv3 ITS Feature enablement
      hw/intc: GICv3 redistributor ITS processing
      tests/data/acpi/virt: Add IORT files for ITS
      hw/arm/virt: add ITS support in virt GIC
      tests/data/acpi/virt: Update IORT files for ITS

From: Bin Meng <bmeng.cn@gmail.com>

As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
does not receive anything. Debugging shows that the UART input clock
frequency is zero which prevents the UART from receiving anything as
per the logic in uart_receive().

From zynq_slcr_reset_exit() comment, it intends to compute output
clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
is called to accomplish the task, inside which device_is_in_reset()
is called to actually make the attempt in vain.

Rework reset_hold() and reset_exit() so that in the reset exit phase,
the logic can really compute output clocks in reset_exit().

With this change, upstream U-Boot boots properly again with:

$ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
    -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0

Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
                             reg ## _ ## enable_field ## _SHIFT)
 
+static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
+{
+    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
+    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
+    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
+
+    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
+
+    /* compute uartX reference clocks */
+    clock_set(s->uart0_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
+    clock_set(s->uart1_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+}
+
 /**
  * Compute and set the ouputs clocks periods.
  * But do not propagate them further. Connected clocks
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
         ps_clk = 0;
     }
 
-    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
-    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
-    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
-
-    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
-
-    /* compute uartX reference clocks */
-    clock_set(s->uart0_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
-    clock_set(s->uart1_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+    zynq_slcr_compute_clocks_internal(s, ps_clk);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will disable all output clocks */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, 0);
     zynq_slcr_propagate_clocks(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will compute output clocks according to ps_clk and registers */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
     zynq_slcr_propagate_clocks(s);
 }
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

At present when input clock is disabled, any character transmitted
to tx fifo can still show on the serial line, which is wrong.

Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return;
+    }
+
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Currently the clock/reset check is done in uart_receive(), but we
can move the check to uart_can_receive() which is earlier.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
 static int uart_can_receive(void *opaque)
 {
     CadenceUARTState *s = opaque;
-    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
-    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
+    int ret;
+    uint32_t ch_mode;
+
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return 0;
+    }
+
+    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
+    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
     CadenceUARTState *s = opaque;
     uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         uart_write_rx_fifo(opaque, buf, size);
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

This converts uart_read() and uart_write() to memop_with_attrs() ops.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
     uart_update_status(s);
 }
 
-static void uart_write(void *opaque, hwaddr offset,
-                          uint64_t value, unsigned size)
+static MemTxResult uart_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        return;
+        return MEMTX_DECODE_ERROR;
     }
     switch (offset) {
     case R_IER: /* ier (wts imr) */
@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
         break;
     }
     uart_update_status(s);
+
+    return MEMTX_OK;
 }
 
-static uint64_t uart_read(void *opaque, hwaddr offset,
-        unsigned size)
+static MemTxResult uart_read(void *opaque, hwaddr offset,
+                             uint64_t *value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        c = 0;
-    } else if (offset == R_TX_RX) {
+        return MEMTX_DECODE_ERROR;
+    }
+    if (offset == R_TX_RX) {
         uart_read_rx_fifo(s, &c);
     } else {
-       c = s->r[offset];
+        c = s->r[offset];
     }
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
-    return c;
+    *value = c;
+    return MEMTX_OK;
 }
 
 static const MemoryRegionOps uart_ops = {
-    .read = uart_read,
-    .write = uart_write,
+    .read_with_attrs = uart_read,
+    .write_with_attrs = uart_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Read or write to uart registers when unclocked or in reset should be
ignored. Add the check there, and as a result of this, the check in
uart_write_tx_fifo() is now unnecessary.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 {
     CadenceUARTState *s = opaque;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
         return MEMTX_DECODE_ERROR;
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

We've got SW that expects FSBL (Bootlooader) to setup clocks and
resets. It's quite common that users run that SW on QEMU without
FSBL (FSBL typically requires the Xilinx tools installed). That's
fine, since users can stil use -device loader to enable clocks etc.

To help folks understand what's going, a log (guest-error) message
would be helpful here. In particular with the serial port since
things will go very quiet if they get things wrong.

Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

Although we probe for the IPA limits imposed by KVM (and the hardware)
when computing the memory map, we still use the old style '0' when
creating a scratch VM in kvm_arm_create_scratch_host_vcpu().

On systems that are severely IPA challenged (such as the Apple M1),
this results in a failure as KVM cannot use the default 40bit that
'0' represents.

Instead, probe for the extension and use the reported IPA limit
if available.

Cc: Andrew Jones <drjones@redhat.com>
Cc: Eric Auger <eric.auger@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20210822144441.1290891-2-maz@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
                                       struct kvm_vcpu_init *init)
 {
     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
+    int max_vm_pa_size;
 
     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
     if (kvmfd < 0) {
         goto err;
     }
-    vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
+    max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
+    if (max_vm_pa_size < 0) {
+        max_vm_pa_size = 0;
+    }
+    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
     if (vmfd < 0) {
         goto err;
     }
-- 
2.20.1

From: Chris Rauer <crauer@google.com>

kudo-bmc is a board supported by OpenBMC.
https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo

Since v1:
- hyphenated Cortex-A9

Tested: Booted kudo firmware.
Signed-off-by: Chris Rauer <crauer@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20210907223234.1165705-1-crauer@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst |  1 +
 hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
 
 - ``quanta-gbs-bmc``    Quanta GBS server BMC
 - ``quanta-gsj``        Quanta GSJ server BMC
+- ``kudo-bmc``          Fii USA Kudo server BMC
 
 There are also two more SoCs, NPCM710 and NPCM705, which are single-core
 variants of NPCM750 and NPCM730, respectively. These are currently not
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
 #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
 #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
+#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
 
 static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 
@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
     npcm7xx_load_kernel(machine, soc);
 }
 
+static void kudo_bmc_init(MachineState *machine)
+{
+    NPCM7xxState *soc;
+
+    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
+    npcm7xx_connect_dram(soc, machine->ram);
+    qdev_realize(DEVICE(soc), NULL, &error_fatal);
+
+    npcm7xx_load_bootrom(machine, soc);
+    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 0, 0));
+    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 3, 0));
+
+    npcm7xx_load_kernel(machine, soc);
+}
+
 static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
 {
     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 1 * GiB;
 }
 
+static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
+{
+    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
+
+    mc->desc = "Kudo BMC (Cortex-A9)";
+    mc->init = kudo_bmc_init;
+    mc->default_ram_size = 1 * GiB;
+};
+
 static const TypeInfo npcm7xx_machine_types[] = {
     {
         .name           = TYPE_NPCM7XX_MACHINE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = gbs_bmc_machine_class_init,
+    }, {
+        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
+        .parent         = TYPE_NPCM7XX_MACHINE,
+        .class_init     = kudo_bmc_machine_class_init,
     },
 };
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added register definitions relevant to ITS,implemented overall
ITS device framework with stubs for ITS control and translater
regions read/write,extended ITS common to handle mmio init between
existing kvm device and newer qemu device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  96 +++++++++-
 include/hw/intc/arm_gicv3_its_common.h |   9 +-
 hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
 hw/intc/arm_gicv3_its_common.c         |   7 +-
 hw/intc/arm_gicv3_its_kvm.c            |   2 +-
 hw/intc/meson.build                    |   1 +
 6 files changed, 342 insertions(+), 14 deletions(-)
 create mode 100644 hw/intc/arm_gicv3_its.c

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_ARM_GICV3_INTERNAL_H
 #define QEMU_ARM_GICV3_INTERNAL_H
 
+#include "hw/registerfields.h"
 #include "hw/intc/arm_gicv3_common.h"
 
 /* Distributor registers, as offsets from the distributor base address */
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+/* 16 bits EventId */
+#define GICD_TYPER_IDBITS            0xf
+
 /*
  * Redistributor frame offsets from RD_base
  */
@@ -XXX,XX +XXX,XX @@
 #define GICR_WAKER_ProcessorSleep    (1U << 1)
 #define GICR_WAKER_ChildrenAsleep    (1U << 2)
 
-#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
-#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
-#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
+FIELD(GICR_PROPBASER, IDBITS, 0, 5)
+FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
+FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 
-#define GICR_PENDBASER_PTZ                     (1ULL << 62)
-#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
-#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
+FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
+FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
+FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
 #define ICH_VTR_EL2_PREBITS_SHIFT 26
 #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 
+/* ITS Registers */
+
+FIELD(GITS_BASER, SIZE, 0, 8)
+FIELD(GITS_BASER, PAGESIZE, 8, 2)
+FIELD(GITS_BASER, SHAREABILITY, 10, 2)
+FIELD(GITS_BASER, PHYADDR, 12, 36)
+FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
+FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
+FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
+FIELD(GITS_BASER, OUTERCACHE, 53, 3)
+FIELD(GITS_BASER, TYPE, 56, 3)
+FIELD(GITS_BASER, INNERCACHE, 59, 3)
+FIELD(GITS_BASER, INDIRECT, 62, 1)
+FIELD(GITS_BASER, VALID, 63, 1)
+
+FIELD(GITS_CTLR, QUIESCENT, 31, 1)
+
+FIELD(GITS_TYPER, PHYSICAL, 0, 1)
+FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
+FIELD(GITS_TYPER, IDBITS, 8, 5)
+FIELD(GITS_TYPER, DEVBITS, 13, 5)
+FIELD(GITS_TYPER, SEIS, 18, 1)
+FIELD(GITS_TYPER, PTA, 19, 1)
+FIELD(GITS_TYPER, CIDBITS, 32, 4)
+FIELD(GITS_TYPER, CIL, 36, 1)
+
+#define GITS_BASER_PAGESIZE_4K                0
+#define GITS_BASER_PAGESIZE_16K               1
+#define GITS_BASER_PAGESIZE_64K               2
+
+#define GITS_BASER_TYPE_DEVICE               1ULL
+#define GITS_BASER_TYPE_COLLECTION           4ULL
+
+/**
+ * Default features advertised by this version of ITS
+ */
+/* Physical LPIs supported */
+#define GITS_TYPE_PHYSICAL           (1U << 0)
+
+/*
+ * 12 bytes Interrupt translation Table Entry size
+ * as per Table 5.3 in GICv3 spec
+ * ITE Lower 8 Bytes
+ *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
+ *   Values:  |    1023   |  IntNum  | IntType |  Valid |
+ * ITE Higher 4 Bytes
+ *   Bits:    | 31 ... 16 | 15 ...0 |
+ *   Values:  |  vPEID    |  ICID   |
+ */
+#define ITS_ITT_ENTRY_SIZE            0xC
+
+/* 16 bits EventId */
+#define ITS_IDBITS                   GICD_TYPER_IDBITS
+
+/* 16 bits DeviceId */
+#define ITS_DEVBITS                   0xF
+
+/* 16 bits CollectionId */
+#define ITS_CIDBITS                  0xF
+
+/*
+ * 8 bytes Device Table Entry size
+ * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
+ */
+#define GITS_DTE_SIZE                 (0x8ULL)
+
+/*
+ * 8 bytes Collection Table Entry size
+ * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
+ */
+#define GITS_CTE_SIZE                 (0x8ULL)
+
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
 #define INTID_NONSECURE 1021
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gicv3_common.h"
 #include "qom/object.h"
 
+#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
+
 #define ITS_CONTROL_SIZE 0x10000
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
 #define GITS_CTLR        0x0
 #define GITS_IIDR        0x4
+#define GITS_TYPER       0x8
 #define GITS_CBASER      0x80
 #define GITS_CWRITER     0x88
 #define GITS_CREADR      0x90
 #define GITS_BASER       0x100
 
+#define GITS_TRANSLATER  0x0040
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     /* Registers */
     uint32_t ctlr;
     uint32_t iidr;
+    uint64_t typer;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
 typedef struct GICv3ITSState GICv3ITSState;
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                   const MemoryRegionOps *tops);
 
 #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
 typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ITS emulation for a GICv3-based system
+ *
+ * Copyright Linaro.org 2021
+ *
+ * Authors:
+ *  Shashi Mallela <shashi.mallela@linaro.org>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at your
+ * option) any later version.  See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/arm_gicv3_its_common.h"
+#include "gicv3_internal.h"
+#include "qom/object.h"
+#include "qapi/error.h"
+
+typedef struct GICv3ITSClass GICv3ITSClass;
+/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
+DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
+                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
+
+struct GICv3ITSClass {
+    GICv3ITSCommonClass parent_class;
+    void (*parent_reset)(DeviceState *dev);
+};
+
+static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
+                                               uint64_t data, unsigned size,
+                                               MemTxAttrs attrs)
+{
+    return MEMTX_OK;
+}
+
+static bool its_writel(GICv3ITSState *s, hwaddr offset,
+                              uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readl(GICv3ITSState *s, hwaddr offset,
+                             uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_writell(GICv3ITSState *s, hwaddr offset,
+                               uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readll(GICv3ITSState *s, hwaddr offset,
+                              uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
+                                  unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_readl(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_readll(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest read at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        *data = 0;
+    }
+    return MEMTX_OK;
+}
+
+static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
+                                   unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_writel(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_writell(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+    }
+    return MEMTX_OK;
+}
+
+static const MemoryRegionOps gicv3_its_control_ops = {
+    .read_with_attrs = gicv3_its_read,
+    .write_with_attrs = gicv3_its_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const MemoryRegionOps gicv3_its_translation_ops = {
+    .write_with_attrs = gicv3_its_translation_write,
+    .valid.min_access_size = 2,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 2,
+    .impl.max_access_size = 4,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    int i;
+
+    for (i = 0; i < s->gicv3->num_cpu; i++) {
+        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
+            error_setg(errp, "Physical LPI not supported by CPU %d", i);
+            return;
+        }
+    }
+
+    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
+
+    /* set the ITS default features supported */
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
+                          GITS_TYPE_PHYSICAL);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
+                          ITS_ITT_ENTRY_SIZE - 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
+}
+
+static void gicv3_its_reset(DeviceState *dev)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
+
+    c->parent_reset(dev);
+
+    /* Quiescent bit reset to 1 */
+    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
+
+    /*
+     * setting GITS_BASER0.Type = 0b001 (Device)
+     *         GITS_BASER1.Type = 0b100 (Collection Table)
+     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
+     *         GITS_BASER<0,1>.Page_Size = 64KB
+     * and default translation table entry size to 16 bytes
+     */
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_DEVICE);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
+                             GITS_DTE_SIZE - 1);
+
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_COLLECTION);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
+                             GITS_CTE_SIZE - 1);
+}
+
+static Property gicv3_its_props[] = {
+    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
+                     GICv3State *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void gicv3_its_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+
+    dc->realize = gicv3_arm_its_realize;
+    device_class_set_props(dc, gicv3_its_props);
+    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+}
+
+static const TypeInfo gicv3_its_info = {
+    .name = TYPE_ARM_GICV3_ITS,
+    .parent = TYPE_ARM_GICV3_ITS_COMMON,
+    .instance_size = sizeof(GICv3ITSState),
+    .class_init = gicv3_its_class_init,
+    .class_size = sizeof(GICv3ITSClass),
+};
+
+static void gicv3_its_register_types(void)
+{
+    type_register_static(&gicv3_its_info);
+}
+
+type_init(gicv3_its_register_types)
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
 
 static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
+    .version_id = 1,
+    .minimum_version_id = 1,
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                         const MemoryRegionOps *tops)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(s);
 
     memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                           "control", ITS_CONTROL_SIZE);
     memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
-                          &gicv3_its_trans_ops, s,
+                          tops ? tops : &gicv3_its_trans_ops, s,
                           "translation", ITS_TRANS_SIZE);
 
     /* Our two regions are always adjacent, therefore we now combine them
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 
-    gicv3_its_init_mmio(s, NULL);
+    gicv3_its_init_mmio(s, NULL, NULL);
 
     if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
         GITS_CTLR)) {
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gicv3_dist.c',
   'arm_gicv3_its_common.c',
   'arm_gicv3_redist.c',
+  'arm_gicv3_its.c',
 ))
 softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
 softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Defined descriptors for ITS device table,collection table and ITS
command queue entities.Implemented register read/write functions,
extract ITS table parameters and command queue parameters,extended
gicv3 common to capture qemu address space(which host the ITS table
platform memories required for subsequent ITS processing) and
initialize the same in ITS device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  29 ++
 include/hw/intc/arm_gicv3_common.h     |   3 +
 include/hw/intc/arm_gicv3_its_common.h |  23 ++
 hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
 4 files changed, 431 insertions(+)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
 FIELD(GITS_BASER, INDIRECT, 62, 1)
 FIELD(GITS_BASER, VALID, 63, 1)
 
+FIELD(GITS_CBASER, SIZE, 0, 8)
+FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
+FIELD(GITS_CBASER, PHYADDR, 12, 40)
+FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
+FIELD(GITS_CBASER, INNERCACHE, 59, 3)
+FIELD(GITS_CBASER, VALID, 63, 1)
+
+FIELD(GITS_CREADR, STALLED, 0, 1)
+FIELD(GITS_CREADR, OFFSET, 5, 15)
+
+FIELD(GITS_CWRITER, RETRY, 0, 1)
+FIELD(GITS_CWRITER, OFFSET, 5, 15)
+
+FIELD(GITS_CTLR, ENABLED, 0, 1)
 FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 
 FIELD(GITS_TYPER, PHYSICAL, 0, 1)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
 FIELD(GITS_TYPER, CIDBITS, 32, 4)
 FIELD(GITS_TYPER, CIL, 36, 1)
 
+#define GITS_IDREGS           0xFFD0
+
+#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
+
+#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
+                                              R_GITS_BASER_TYPE_MASK)
+
 #define GITS_BASER_PAGESIZE_4K                0
 #define GITS_BASER_PAGESIZE_16K               1
 #define GITS_BASER_PAGESIZE_64K               2
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define GITS_BASER_TYPE_DEVICE               1ULL
 #define GITS_BASER_TYPE_COLLECTION           4ULL
 
+#define GITS_PAGE_SIZE_4K       0x1000
+#define GITS_PAGE_SIZE_16K      0x4000
+#define GITS_PAGE_SIZE_64K      0x10000
+
+#define L1TABLE_ENTRY_SIZE         8
+
+#define GITS_CMDQ_ENTRY_SIZE               32
+
 /**
  * Default features advertised by this version of ITS
  */
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     int dev_fd; /* kvm device fd if backed by kvm vgic support */
     Error *migration_blocker;
 
+    MemoryRegion *dma;
+    AddressSpace dma_as;
+
     /* Distributor */
 
     /* for a GIC with the security extensions the NS banked version of this
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 
 #define GITS_TRANSLATER  0x0040
 
+typedef struct {
+    bool valid;
+    bool indirect;
+    uint16_t entry_sz;
+    uint32_t page_sz;
+    uint32_t max_entries;
+    union {
+        uint32_t max_devids;
+        uint32_t max_collids;
+    } maxids;
+    uint64_t base_addr;
+} TableDesc;
+
+typedef struct {
+    bool valid;
+    uint32_t max_entries;
+    uint64_t base_addr;
+} CmdQDesc;
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     uint64_t creadr;
     uint64_t baser[8];
 
+    TableDesc  dt;
+    TableDesc  ct;
+    CmdQDesc   cq;
+
     Error *migration_blocker;
 };
 
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
+{
+    uint64_t result = 0;
+
+    switch (page_sz) {
+    case GITS_PAGE_SIZE_4K:
+    case GITS_PAGE_SIZE_16K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
+        break;
+
+    case GITS_PAGE_SIZE_64K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
+        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
+        break;
+
+    default:
+        break;
+    }
+    return result;
+}
+
+/*
+ * This function extracts the ITS Device and Collection table specific
+ * parameters (like base_addr, size etc) from GITS_BASER register.
+ * It is called during ITS enable and also during post_load migration
+ */
+static void extract_table_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint8_t  page_sz_type;
+    uint8_t type;
+    uint32_t page_sz = 0;
+    uint64_t value;
+
+    for (int i = 0; i < 8; i++) {
+        value = s->baser[i];
+
+        if (!value) {
+            continue;
+        }
+
+        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
+
+        switch (page_sz_type) {
+        case 0:
+            page_sz = GITS_PAGE_SIZE_4K;
+            break;
+
+        case 1:
+            page_sz = GITS_PAGE_SIZE_16K;
+            break;
+
+        case 2:
+        case 3:
+            page_sz = GITS_PAGE_SIZE_64K;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+
+        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
+
+        type = FIELD_EX64(value, GITS_BASER, TYPE);
+
+        switch (type) {
+
+        case GITS_BASER_TYPE_DEVICE:
+            memset(&s->dt, 0 , sizeof(s->dt));
+            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            if (!s->dt.valid) {
+                return;
+            }
+
+            s->dt.page_sz = page_sz;
+            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->dt.indirect) {
+                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
+            } else {
+                s->dt.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->dt.entry_sz));
+            }
+
+            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
+                                       DEVBITS) + 1));
+
+            s->dt.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        case GITS_BASER_TYPE_COLLECTION:
+            memset(&s->ct, 0 , sizeof(s->ct));
+            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            /*
+             * GITS_TYPER.HCC is 0 for this implementation
+             * hence writes are discarded if ct.valid is 0
+             */
+            if (!s->ct.valid) {
+                return;
+            }
+
+            s->ct.page_sz = page_sz;
+            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->ct.indirect) {
+                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
+            } else {
+                s->ct.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->ct.entry_sz));
+            }
+
+            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
+                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
+                                            GITS_TYPER, CIDBITS) + 1));
+            } else {
+                /* 16-bit CollectionId supported when CIL == 0 */
+                s->ct.maxids.max_collids = (1UL << 16);
+            }
+
+            s->ct.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        default:
+            break;
+        }
+    }
+}
+
+static void extract_cmdq_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint64_t value = s->cbaser;
+
+    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
+
+    memset(&s->cq, 0 , sizeof(s->cq));
+    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
+
+    if (s->cq.valid) {
+        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
+                             GITS_CMDQ_ENTRY_SIZE;
+        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
+        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
+    }
+}
+
 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
                               uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        s->ctlr |= (value & ~(s->ctlr));
+
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            extract_table_params(s);
+            extract_cmdq_params(s);
+            s->creadr = 0;
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 0, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CBASER + 4:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 32, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = deposit64(s->cwriter, 0, 32,
+                               (value & ~R_GITS_CWRITER_RETRY_MASK));
+        break;
+    case GITS_CWRITER + 4:
+        s->cwriter = deposit64(s->cwriter, 32, 32, value);
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 0, 32,
+                                  (value & ~R_GITS_CREADR_STALLED_MASK));
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_CREADR + 4:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 32, 32, value);
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+
+            if (offset & 7) {
+                value <<= 32;
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
+                s->baser[index] |= value;
+            } else {
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
+                s->baser[index] |= value;
+            }
+        }
+        break;
+    case GITS_IIDR:
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
                              uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        *data = s->ctlr;
+        break;
+    case GITS_IIDR:
+        *data = gicv3_iidr();
+        break;
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* ID registers */
+        *data = gicv3_idreg(offset - GITS_IDREGS);
+        break;
+    case GITS_TYPER:
+        *data = extract64(s->typer, 0, 32);
+        break;
+    case GITS_TYPER + 4:
+        *data = extract64(s->typer, 32, 32);
+        break;
+    case GITS_CBASER:
+        *data = extract64(s->cbaser, 0, 32);
+        break;
+    case GITS_CBASER + 4:
+        *data = extract64(s->cbaser, 32, 32);
+        break;
+    case GITS_CREADR:
+        *data = extract64(s->creadr, 0, 32);
+        break;
+    case GITS_CREADR + 4:
+        *data = extract64(s->creadr, 32, 32);
+        break;
+    case GITS_CWRITER:
+        *data = extract64(s->cwriter, 0, 32);
+        break;
+    case GITS_CWRITER + 4:
+        *data = extract64(s->cwriter, 32, 32);
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        if (offset & 7) {
+            *data = extract64(s->baser[index], 32, 32);
+        } else {
+            *data = extract64(s->baser[index], 0, 32);
+        }
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
                                uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+            s->baser[index] &= GITS_BASER_RO_MASK;
+            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = value;
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_TYPER:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
                               uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_TYPER:
+        *data = s->typer;
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        *data = s->baser[index];
+        break;
+    case GITS_CBASER:
+        *data = s->cbaser;
+        break;
+    case GITS_CREADR:
+        *data = s->creadr;
+        break;
+    case GITS_CWRITER:
+        *data = s->cwriter;
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 
+    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
+                       "gicv3-its-sysmem");
+
     /* set the ITS default features supported */
     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                           GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                              GITS_CTE_SIZE - 1);
 }
 
+static void gicv3_its_post_load(GICv3ITSState *s)
+{
+    if (s->ctlr & ITS_CTLR_ENABLED) {
+        extract_table_params(s);
+        extract_cmdq_params(s);
+    }
+}
+
 static Property gicv3_its_props[] = {
     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                      GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
 
     dc->realize = gicv3_arm_its_realize;
     device_class_set_props(dc, gicv3_its_props);
     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+    icc->post_load = gicv3_its_post_load;
 }
 
 static const TypeInfo gicv3_its_info = {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added functionality to trigger ITS command queue processing on
write to CWRITE register and process each command queue entry to
identify the command type and handle commands like MAPD,MAPC,SYNC.

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define L1TABLE_ENTRY_SIZE         8
 
 #define GITS_CMDQ_ENTRY_SIZE               32
+#define NUM_BYTES_IN_DW                     8
+
+#define CMD_MASK                  0xff
+
+/* ITS Commands */
+#define GITS_CMD_CLEAR            0x04
+#define GITS_CMD_DISCARD          0x0F
+#define GITS_CMD_INT              0x03
+#define GITS_CMD_MAPC             0x09
+#define GITS_CMD_MAPD             0x08
+#define GITS_CMD_MAPI             0x0B
+#define GITS_CMD_MAPTI            0x0A
+#define GITS_CMD_INV              0x0C
+#define GITS_CMD_INVALL           0x0D
+#define GITS_CMD_SYNC             0x05
+
+/* MAPC command fields */
+#define ICID_LENGTH                  16
+#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
+FIELD(MAPC, RDBASE, 16, 32)
+
+#define RDBASE_PROCNUM_LENGTH        16
+#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
+
+/* MAPD command fields */
+#define ITTADDR_LENGTH               44
+#define ITTADDR_SHIFT                 8
+#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
+#define SIZE_MASK                 0x1f
+
+#define DEVID_SHIFT                  32
+#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
+
+#define VALID_SHIFT               63
+#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
+#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
+#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
 
 /**
  * Default features advertised by this version of ITS
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
  * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
  */
 #define GITS_DTE_SIZE                 (0x8ULL)
+#define GITS_DTE_ITTADDR_SHIFT           6
+#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
+                                                      ITTADDR_LENGTH)
 
 /*
  * 8 bytes Collection Table Entry size
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
+                       uint64_t rdbase)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t cte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (!s->ct.valid) {
+        return true;
+    }
+
+    if (valid) {
+        /* add mapping entry to collection table */
+        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
+                             cte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapc(GICv3ITSState *s, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint16_t icid;
+    uint64_t rdbase;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+    uint64_t value;
+
+    offset += NUM_BYTES_IN_DW;
+    offset += NUM_BYTES_IN_DW;
+
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
+    rdbase &= RDBASE_PROCNUM_MASK;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPC: invalid collection table attributes "
+                      "icid %d rdbase %lu\n",  icid, rdbase);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_cte(s, icid, valid, rdbase);
+    }
+
+    return result;
+}
+
+static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
+                       uint8_t size, uint64_t itt_addr)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t dte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (s->dt.valid) {
+        if (valid) {
+            /* add mapping entry to device table */
+            dte = (valid & TABLE_ENTRY_VALID_MASK) |
+                  ((size & SIZE_MASK) << 1U) |
+                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
+        }
+    } else {
+        return true;
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
+                             dte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid;
+    uint8_t size;
+    uint64_t itt_addr;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    size = (value & SIZE_MASK);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((devid > s->dt.maxids.max_devids) ||
+        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPD: invalid device table attributes "
+                      "devid %d or size %d\n", devid, size);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_dte(s, devid, valid, size, itt_addr);
+    }
+
+    return result;
+}
+
+/*
+ * Current implementation blocks until all
+ * commands are processed
+ */
+static void process_cmdq(GICv3ITSState *s)
+{
+    uint32_t wr_offset = 0;
+    uint32_t rd_offset = 0;
+    uint32_t cq_offset = 0;
+    uint64_t data;
+    AddressSpace *as = &s->gicv3->dma_as;
+    MemTxResult res = MEMTX_OK;
+    bool result = true;
+    uint8_t cmd;
+
+    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+        return;
+    }
+
+    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
+
+    if (wr_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid write offset "
+                      "%d\n", __func__, wr_offset);
+        return;
+    }
+
+    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
+
+    if (rd_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid read offset "
+                      "%d\n", __func__, rd_offset);
+        return;
+    }
+
+    while (wr_offset != rd_offset) {
+        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
+        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
+                                    MEMTXATTRS_UNSPECIFIED, &res);
+        if (res != MEMTX_OK) {
+            result = false;
+        }
+        cmd = (data & CMD_MASK);
+
+        switch (cmd) {
+        case GITS_CMD_INT:
+            break;
+        case GITS_CMD_CLEAR:
+            break;
+        case GITS_CMD_SYNC:
+            /*
+             * Current implementation makes a blocking synchronous call
+             * for every command issued earlier, hence the internal state
+             * is already consistent by the time SYNC command is executed.
+             * Hence no further processing is required for SYNC command.
+             */
+            break;
+        case GITS_CMD_MAPD:
+            result = process_mapd(s, data, cq_offset);
+            break;
+        case GITS_CMD_MAPC:
+            result = process_mapc(s, cq_offset);
+            break;
+        case GITS_CMD_MAPTI:
+            break;
+        case GITS_CMD_MAPI:
+            break;
+        case GITS_CMD_DISCARD:
+            break;
+        case GITS_CMD_INV:
+        case GITS_CMD_INVALL:
+            break;
+        default:
+            break;
+        }
+        if (result) {
+            rd_offset++;
+            rd_offset %= s->cq.max_entries;
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
+        } else {
+            /*
+             * in this implementation, in case of dma read/write error
+             * we stall the command processing
+             */
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: %x cmd processing failed\n", __func__, cmd);
+            break;
+        }
+    }
+}
+
 /*
  * This function extracts the ITS Device and Collection table specific
  * parameters (like base_addr, size etc) from GITS_BASER register.
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
             extract_table_params(s);
             extract_cmdq_params(s);
             s->creadr = 0;
+            process_cmdq(s);
         }
         break;
     case GITS_CBASER:
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
     case GITS_CWRITER:
         s->cwriter = deposit64(s->cwriter, 0, 32,
                                (value & ~R_GITS_CWRITER_RETRY_MASK));
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CWRITER + 4:
         s->cwriter = deposit64(s->cwriter, 32, 32, value);
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
         break;
     case GITS_CWRITER:
         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CREADR:
         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
translation which triggers an LPI via INT command as well as write
to GITS_TRANSLATER register,defined enum to differentiate between ITS
command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
Each of these commands make use of other functionalities implemented to
get device table entry,collection table entry or interrupt translation
table entry required for their processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  12 +
 include/hw/intc/arm_gicv3_common.h |   2 +
 hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
 3 files changed, 378 insertions(+), 1 deletion(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
 #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 #define SIZE_MASK                 0x1f
 
+/* MAPI command fields */
+#define EVENTID_MASK              ((1ULL << 32) - 1)
+
+/* MAPTI command fields */
+#define pINTID_SHIFT                 32
+#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
+
 #define DEVID_SHIFT                  32
 #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  *   Values:  |  vPEID    |  ICID   |
  */
 #define ITS_ITT_ENTRY_SIZE            0xC
+#define ITE_ENTRY_INTTYPE_SHIFT        1
+#define ITE_ENTRY_INTID_SHIFT          2
+#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
+#define ITE_ENTRY_INTSP_SHIFT          26
+#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
 
 /* 16 bits EventId */
 #define ITS_IDBITS                   GICD_TYPER_IDBITS
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@
 #define GICV3_MAXIRQ 1020
 #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
 
+#define GICV3_LPI_INTID_START 8192
+
 #define GICV3_REDIST_SIZE 0x20000
 
 /* Number of SGI target-list bits */
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+/*
+ * This is an internal enum used to distinguish between LPI triggered
+ * via command queue and LPI triggered via gits_translater write.
+ */
+typedef enum ItsCmdType {
+    NONE = 0, /* internal indication for GITS_TRANSLATER write */
+    CLEAR = 1,
+    DISCARD = 2,
+    INT = 3,
+} ItsCmdType;
+
+typedef struct {
+    uint32_t iteh;
+    uint64_t itel;
+} IteEntry;
+
 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
 {
     uint64_t result = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
+                    MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                *cte =  address_space_ldq_le(as, l2t_addr +
+                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                    MEMTXATTRS_UNSPECIFIED, res);
+           }
+       }
+    } else {
+        /* Flat level table */
+        *cte =  address_space_ldq_le(as, s->ct.base_addr +
+                                     (icid * GITS_CTE_SIZE),
+                                      MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
+}
+
+static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                       IteEntry ite)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    MemTxResult res = MEMTX_OK;
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
+                         &res);
+
+    if (res == MEMTX_OK) {
+        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
+                             MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    bool status = false;
+    IteEntry ite = {};
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    ite.itel = address_space_ldq_le(as, itt_addr +
+                                    (eventid * (sizeof(uint64_t) +
+                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
+                                    res);
+
+    if (*res == MEMTX_OK) {
+        ite.iteh = address_space_ldl_le(as, itt_addr +
+                                        (eventid * (sizeof(uint64_t) +
+                                        sizeof(uint32_t))) + sizeof(uint32_t),
+                                        MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
+                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
+                    GITS_TYPE_PHYSICAL) {
+                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
+                               ITE_ENTRY_INTID_SHIFT;
+                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
+                    status = true;
+                }
+            }
+        }
+    }
+    return status;
+}
+
+static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                value =  address_space_ldq_le(as, l2t_addr +
+                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                   MEMTXATTRS_UNSPECIFIED, res);
+            }
+        }
+    } else {
+        /* Flat level table */
+        value = address_space_ldq_le(as, s->dt.base_addr +
+                                     (devid * GITS_DTE_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return value;
+}
+
+/*
+ * This function handles the processing of following commands based on
+ * the ItsCmdType parameter passed:-
+ * 1. triggering of lpi interrupt translation via ITS INT command
+ * 2. triggering of lpi interrupt translation via gits_translater register
+ * 3. handling of ITS CLEAR command
+ * 4. handling of ITS DISCARD command
+ */
+static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                            ItsCmdType cmd)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    MemTxResult res = MEMTX_OK;
+    bool dte_valid;
+    uint64_t dte = 0;
+    uint32_t max_eventid;
+    uint16_t icid = 0;
+    uint32_t pIntid = 0;
+    bool ite_valid = false;
+    uint64_t cte = 0;
+    bool cte_valid = false;
+    bool result = false;
+
+    if (cmd == NONE) {
+        devid = offset;
+    } else {
+        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+        offset += NUM_BYTES_IN_DW;
+        value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+    }
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    if (dte_valid) {
+        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+
+        if (ite_valid) {
+            cte_valid = get_cte(s, icid, &cte, &res);
+        }
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
+            !cte_valid || (eventid > max_eventid)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or eventid %d or invalid dte %d or"
+                      "invalid cte %d or invalid ite %d\n",
+                      __func__, devid, eventid, dte_valid, cte_valid,
+                      ite_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /*
+         * Current implementation only supports rdbase == procnum
+         * Hence rdbase physical address is ignored
+         */
+        if (cmd == DISCARD) {
+            IteEntry ite = {};
+            /* remove mapping from interrupt translation table */
+            result = update_ite(s, eventid, dte, ite);
+        }
+    }
+
+    return result;
+}
+
+static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                          bool ignore_pInt)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    uint32_t pIntid = 0;
+    uint32_t max_eventid, max_Intid;
+    bool dte_valid;
+    MemTxResult res = MEMTX_OK;
+    uint16_t icid = 0;
+    uint64_t dte = 0;
+    IteEntry ite;
+    uint32_t int_spurious = INTID_SPURIOUS;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    if (!ignore_pInt) {
+        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
+    }
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+    if (!ignore_pInt) {
+        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
+            || !dte_valid || (eventid > max_eventid) ||
+            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
+            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or icid %d or eventid %d or pIntid %d or"
+                      "unmapped dte %d\n", __func__, devid, icid, eventid,
+                      pIntid, dte_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /* add ite entry to interrupt translation table */
+        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
+                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
+
+        if (ignore_pInt) {
+            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
+        } else {
+            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
+        }
+        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
+        ite.iteh = icid;
+
+        result = update_ite(s, eventid, dte, ite);
+    }
+
+    return result;
+}
+
 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
                        uint64_t rdbase)
 {
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
 
         switch (cmd) {
         case GITS_CMD_INT:
+            res = process_its_cmd(s, data, cq_offset, INT);
             break;
         case GITS_CMD_CLEAR:
+            res = process_its_cmd(s, data, cq_offset, CLEAR);
             break;
         case GITS_CMD_SYNC:
             /*
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             result = process_mapc(s, cq_offset);
             break;
         case GITS_CMD_MAPTI:
+            result = process_mapti(s, data, cq_offset, false);
             break;
         case GITS_CMD_MAPI:
+            result = process_mapti(s, data, cq_offset, true);
             break;
         case GITS_CMD_DISCARD:
+            result = process_its_cmd(s, data, cq_offset, DISCARD);
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
 {
-    return MEMTX_OK;
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result = true;
+    uint32_t devid = 0;
+
+    switch (offset) {
+    case GITS_TRANSLATER:
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            devid = attrs.requester_id;
+            result = process_its_cmd(s, data, devid, NONE);
+        }
+        break;
+    default:
+        break;
+    }
+
+    if (result) {
+        return MEMTX_OK;
+    } else {
+        return MEMTX_ERROR;
+    }
 }
 
 static bool its_writel(GICv3ITSState *s, hwaddr offset,
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added properties to enable ITS feature and define qemu system
address space memory in gicv3 common,setup distributor and
redistributor registers to indicate LPI support.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  2 ++
 include/hw/intc/arm_gicv3_common.h |  1 +
 hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
 hw/intc/arm_gicv3_dist.c           |  5 ++++-
 hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
 5 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+#define GICD_TYPER_LPIS_SHIFT          17
+
 /* 16 bits EventId */
 #define GICD_TYPER_IDBITS            0xf
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     uint32_t num_cpu;
     uint32_t num_irq;
     uint32_t revision;
+    bool lpi_enable;
     bool security_extn;
     bool irq_reset_nonsecure;
     bool gicd_no_migration_shift_bug;
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->lpi_enable && !s->dma) {
+        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
+        return;
+    }
+
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
             (1 << 24) |
             (i << 8) |
             (last << 4);
+
+        if (s->lpi_enable) {
+            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
     DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
     DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
+    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
     DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
                       redist_region_count, qdev_prop_uint32, uint32_t),
+    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
          * A3V == 1 (non-zero values of Affinity level 3 supported)
          * IDbits == 0xf (we support 16-bit interrupt identifiers)
          * DVIS == 0 (Direct virtual LPI injection not supported)
-         * LPIS == 0 (LPIs not supported)
+         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
+         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
+         *                      by GICD_TYPER.IDbits)
          * MBIS == 0 (message-based SPIs not supported)
          * SecurityExtn == 1 if security extns supported
          * CPUNumber == 0 since for us ARE is always 1
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
         bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
         *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
+            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
             (0xf << 19) | itlinesnumber;
         return true;
     }
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
     case GICR_CTLR:
         /* For our implementation, GICR_TYPER.DPGS is 0 and so all
          * the DPG bits are RAZ/WI. We don't do anything asynchronously,
-         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
-         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
-         * bits for us.
+         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
+         * implement LPIs) so Enable_LPIs is programmable.
          */
+        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
+            if (value & GICR_CTLR_ENABLE_LPIS) {
+                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+            } else {
+                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
+            }
+        }
         return MEMTX_OK;
     case GICR_STATUSR:
         /* RAZ/WI for our implementation */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Implemented lpi processing at redistributor to get lpi config info
from lpi configuration table,determine priority,set pending state in
lpi pending table and forward the lpi to cpuif.Added logic to invoke
redistributor lpi processing with translated LPI which set/clear LPI
from ITS device as part of ITS INT,CLEAR,DISCARD command and
GITS_TRANSLATER processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |   9 ++
 include/hw/intc/arm_gicv3_common.h |   7 ++
 hw/intc/arm_gicv3.c                |  14 +++
 hw/intc/arm_gicv3_common.c         |   1 +
 hw/intc/arm_gicv3_cpuif.c          |   7 +-
 hw/intc/arm_gicv3_its.c            |  23 +++++
 hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
 7 files changed, 200 insertions(+), 2 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
+#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
+
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
 #define ICC_CTLR_EL1_PMHE           (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 
 #define L1TABLE_ENTRY_SIZE         8
 
+#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
+#define LPI_PRIORITY_MASK         0xfc
+
 #define GITS_CMDQ_ENTRY_SIZE               32
 #define NUM_BYTES_IN_DW                     8
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
  */
 #define GITS_CTE_SIZE                 (0x8ULL)
+#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
 
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                unsigned size, MemTxAttrs attrs);
 void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_update_lpi(GICv3CPUState *cs);
 void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
 void gicv3_init_cpuif(GICv3State *s);
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
      * real state above; it doesn't need to be migrated.
      */
     PendingIrq hppi;
+
+    /*
+     * Cached information recalculated from LPI tables
+     * in guest memory
+     */
+    PendingIrq hpplpi;
+
     /* This is temporary working state, to avoid a malloc in gicv3_update() */
     bool seenbetter;
 };
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
         cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
     }
 
+    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
+        (cs->hpplpi.prio != 0xff)) {
+        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
+            cs->hppi.irq = cs->hpplpi.irq;
+            cs->hppi.prio = cs->hpplpi.prio;
+            cs->hppi.grp = cs->hpplpi.grp;
+            seenbetter = true;
+        }
+    }
+
     /* If the best interrupt we just found would preempt whatever
      * was the previous best interrupt before this update, then
      * we know it's definitely the best one now.
@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
 
 static void arm_gicv3_post_load(GICv3State *s)
 {
+    int i;
     /* Recalculate our cached idea of the current highest priority
      * pending interrupt, but don't set IRQ or FIQ lines.
      */
+    for (i = 0; i < s->num_cpu; i++) {
+        gicv3_redist_update_lpi(&s->cpu[i]);
+    }
     gicv3_full_update_noirqset(s);
     /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
     gicv3_cache_all_target_cpustates(s);
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
         memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
 
         cs->hppi.prio = 0xff;
+        cs->hpplpi.prio = 0xff;
 
         /* State in the CPU interface must *not* be reset here, because it
          * is part of the CPU's reset domain, not the GIC device's.
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
         gicv3_redist_update(cs);
-    } else {
+    } else if (irq < GICV3_LPI_INTID_START) {
         gicv3_gicd_active_set(cs->gic, irq);
         gicv3_gicd_pending_clear(cs->gic, irq);
         gicv3_update(cs->gic, irq, 1);
+    } else {
+        gicv3_redist_lpi_pending(cs, irq, 0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
                                gicv3_redist_affid(cs), value);
 
-    if (irq >= cs->gic->num_irq) {
+    if ((irq >= cs->gic->num_irq) &&
+        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
         /* This handles two cases:
          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
          * to the GICC_EOIR, the GIC ignores that write.
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
     uint64_t cte = 0;
     bool cte_valid = false;
     bool result = false;
+    uint64_t rdbase;
 
     if (cmd == NONE) {
         devid = offset;
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
          * Current implementation only supports rdbase == procnum
          * Hence rdbase physical address is ignored
          */
+        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
+
+        if (rdbase > s->gicv3->num_cpu) {
+            return result;
+        }
+
+        if ((cmd == CLEAR) || (cmd == DISCARD)) {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
+        } else {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
+        }
+
         if (cmd == DISCARD) {
             IteEntry ite = {};
             /* remove mapping from interrupt translation table */
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
     MemTxResult res = MEMTX_OK;
     bool result = true;
     uint8_t cmd;
+    int i;
 
     if (!(s->ctlr & ITS_CTLR_ENABLED)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
+            /*
+             * Current implementation doesn't cache any ITS tables,
+             * but the calculated lpi priority information. We only
+             * need to trigger lpi priority re-calculation to be in
+             * sync with LPI config table or pending table changes.
+             */
+            for (i = 0; i < s->gicv3->num_cpu; i++) {
+                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
+            }
             break;
         default:
             break;
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         if (cs->gicr_typer & GICR_TYPER_PLPIS) {
             if (value & GICR_CTLR_ENABLE_LPIS) {
                 cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+                /* Check for any pending interr in pending table */
+                gicv3_redist_update_lpi(cs);
+                gicv3_redist_update(cs);
             } else {
                 cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
             }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
     return r;
 }
 
+static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
+{
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpict_baddr;
+    uint8_t lpite;
+    uint8_t prio;
+
+    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
+                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
+                       sizeof(lpite));
+
+    if (!(lpite & LPI_CTE_ENABLED)) {
+        return;
+    }
+
+    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
+        prio = lpite & LPI_PRIORITY_MASK;
+    } else {
+        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
+    }
+
+    if ((prio < cs->hpplpi.prio) ||
+        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
+        cs->hpplpi.irq = irq;
+        cs->hpplpi.prio = prio;
+        /* LPIs are always non-secure Grp1 interrupts */
+        cs->hpplpi.grp = GICV3_G1NS;
+    }
+}
+
+void gicv3_redist_update_lpi(GICv3CPUState *cs)
+{
+    /*
+     * This function scans the LPI pending table and for each pending
+     * LPI, reads the corresponding entry from LPI configuration table
+     * to extract the priority info and determine if the current LPI
+     * priority is lower than the last computed high priority lpi interrupt.
+     * If yes, replace current LPI as the new high priority lpi interrupt.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    uint32_t pendt_size = 0;
+    uint8_t pend;
+    int i, bit;
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+        !cs->gicr_pendbaser) {
+        return;
+    }
+
+    cs->hpplpi.prio = 0xff;
+
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    /* Determine the highest priority pending interrupt among LPIs */
+    pendt_size = (1ULL << (idbits + 1));
+
+    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
+        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
+                           sizeof(pend));
+
+        while (pend) {
+            bit = ctz32(pend);
+            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
+            pend &= ~(1 << bit);
+        }
+    }
+}
+
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
+{
+    /*
+     * This function updates the pending bit in lpi pending table for
+     * the irq being activated or deactivated.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    bool ispend = false;
+    uint8_t pend;
+
+    /*
+     * get the bit value corresponding to this irq in the
+     * lpi pending table
+     */
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    ispend = extract32(pend, irq % 8, 1);
+
+    /* no change in the value of pending bit, return */
+    if (ispend == level) {
+        return;
+    }
+    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
+
+    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    /*
+     * check if this LPI is better than the current hpplpi, if yes
+     * just set hpplpi.prio and .irq without doing a full rescan
+     */
+    if (level) {
+        gicv3_redist_check_lpi_priority(cs, irq);
+    } else {
+        if (irq == cs->hpplpi.irq) {
+            gicv3_redist_update_lpi(cs);
+        }
+    }
+}
+
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
+{
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
+         irq < GICV3_LPI_INTID_START) {
+        return;
+    }
+
+    /* set/clear the pending bit for this irq */
+    gicv3_redist_lpi_pending(cs, irq, level);
+
+    gicv3_redist_update(cs);
+}
+
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
 {
     /* Update redistributor state for a change in an external PPI input line */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added expected IORT files applicable with latest GICv3
ITS changes.Temporarily differences in these files are
okay.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
 tests/data/acpi/virt/IORT                   | 0
 tests/data/acpi/virt/IORT.memhp             | 0
 tests/data/acpi/virt/IORT.numamem           | 0
 tests/data/acpi/virt/IORT.pxb               | 0
 5 files changed, 4 insertions(+)
 create mode 100644 tests/data/acpi/virt/IORT
 create mode 100644 tests/data/acpi/virt/IORT.memhp
 create mode 100644 tests/data/acpi/virt/IORT.numamem
 create mode 100644 tests/data/acpi/virt/IORT.pxb

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,5 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/virt/IORT",
+"tests/data/acpi/virt/IORT.memhp",
+"tests/data/acpi/virt/IORT.numamem",
+"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
new file mode 100644
index XXXXXXX..XXXXXXX
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Included creation of ITS as part of virt platform GIC
initialization. This Emulated ITS model now co-exists with kvm
ITS and is enabled in absence of kvm irq kernel support in a
platform.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |  2 ++
 target/arm/kvm_arm.h  |  4 ++--
 hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     MachineClass parent;
     bool disallow_affinity_adjustment;
     bool no_its;
+    bool no_tcg_its;
     bool no_pmu;
     bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
     bool highmem;
     bool highmem_ecam;
     bool its;
+    bool tcg_its;
     bool virt;
     bool ras;
     bool mte;
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
         /* KVM implementation requires this capability */
         return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
     } else {
-        /* Software emulation is not implemented yet */
-        return NULL;
+        /* Software emulation based model */
+        return "arm-gicv3-its";
     }
 }
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
     const char *itsclass = its_class_name();
     DeviceState *dev;
 
+    if (!strcmp(itsclass, "arm-gicv3-its")) {
+        if (!vms->tcg_its) {
+            itsclass = NULL;
+        }
+    }
+
     if (!itsclass) {
         /* Do nothing if not supported */
         return;
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
     vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
 }
 
-static void create_gic(VirtMachineState *vms)
+static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
 {
     MachineState *ms = MACHINE(vms);
     /* We create a standalone GIC */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
                              nb_redist_regions);
         qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
 
+        if (!kvm_irqchip_in_kernel()) {
+            if (vms->tcg_its) {
+                object_property_set_link(OBJECT(vms->gic), "sysmem",
+                                         OBJECT(mem), &error_fatal);
+                qdev_prop_set_bit(vms->gic, "has-lpi", true);
+            }
+        }
+
         if (nb_redist_regions == 2) {
             uint32_t redist1_capacity =
                     vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
-    create_gic(vms);
+    create_gic(vms, sysmem);
 
     virt_cpu_post_init(vms, sysmem);
 
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
     } else {
         /* Default allows ITS instantiation */
         vms->its = true;
+
+        if (vmc->no_tcg_its) {
+            vms->tcg_its = false;
+        } else {
+            vms->tcg_its = true;
+        }
     }
 
     /* Default disallows iommu instantiation */
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
 
 static void virt_machine_6_1_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_6_2_options(mc);
     compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
+
+    /* qemu ITS was introduced with 6.2 */
+    vmc->no_tcg_its = true;
 }
 DEFINE_VIRT_MACHINE(6, 1)
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Updated expected IORT files applicable with latest GICv3
ITS changes.

Full diff of new file disassembly:

/*
 * Intel ACPI Component Architecture
 * AML/ASL+ Disassembler version 20180629 (64-bit version)
 * Copyright (c) 2000 - 2018 Intel Corporation
 *
 * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
 *
 * ACPI Data Table [IORT]
 *
 * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
 */

[000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
[004h 0004   4]                 Table Length : 0000007C
[008h 0008   1]                     Revision : 00
[009h 0009   1]                     Checksum : 07
[00Ah 0010   6]                       Oem ID : "BOCHS "
[010h 0016   8]                 Oem Table ID : "BXPC    "
[018h 0024   4]                 Oem Revision : 00000001
[01Ch 0028   4]              Asl Compiler ID : "BXPC"
[020h 0032   4]        Asl Compiler Revision : 00000001

[024h 0036   4]                   Node Count : 00000002
[028h 0040   4]                  Node Offset : 00000030
[02Ch 0044   4]                     Reserved : 00000000

[030h 0048   1]                         Type : 00
[031h 0049   2]                       Length : 0018
[033h 0051   1]                     Revision : 00
[034h 0052   4]                     Reserved : 00000000
[038h 0056   4]                Mapping Count : 00000000
[03Ch 0060   4]               Mapping Offset : 00000000

[040h 0064   4]                     ItsCount : 00000001
[044h 0068   4]                  Identifiers : 00000000

[048h 0072   1]                         Type : 02
[049h 0073   2]                       Length : 0034
[04Bh 0075   1]                     Revision : 00
[04Ch 0076   4]                     Reserved : 00000000
[050h 0080   4]                Mapping Count : 00000001
[054h 0084   4]               Mapping Offset : 00000020

[058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
[058h 0088   4]              Cache Coherency : 00000001
[05Ch 0092   1]        Hints (decoded below) : 00
                                   Transient : 0
                              Write Allocate : 0
                               Read Allocate : 0
                                    Override : 0
[05Dh 0093   2]                     Reserved : 0000
[05Fh 0095   1] Memory Flags (decoded below) : 03
                                   Coherency : 1
                            Device Attribute : 1
[060h 0096   4]                ATS Attribute : 00000000
[064h 0100   4]           PCI Segment Number : 00000000
[068h 0104   1]            Memory Size Limit : 00
[069h 0105   3]                     Reserved : 000000

[068h 0104   4]                   Input base : 00000000
[06Ch 0108   4]                     ID Count : 0000FFFF
[070h 0112   4]                  Output Base : 00000000
[074h 0116   4]             Output Reference : 00000030
[078h 0120   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

Raw Table Data: Length 124 (0x7C)

0000: 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
    0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
    0020: 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
    0030: 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
    0040: 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
    0050: 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
    0060: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
    0070: 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
 tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
 5 files changed, 4 deletions(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,5 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/virt/IORT",
-"tests/data/acpi/virt/IORT.memhp",
-"tests/data/acpi/virt/IORT.numamem",
-"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

-- 
2.20.1

In v8A, the PSTATE.IL bit is set for various kinds of illegal
exception return or mode-change attempts.  We already set PSTATE.IL
(or its AArch32 equivalent CPSR.IL) in all those cases, but we
weren't implementing the part of the behaviour where attempting to
execute an instruction with PSTATE.IL takes an immediate exception
with an appropriate syndrome value.

Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
to take an exception instead of whatever the instruction would have
been.

PSTATE.IL and CPSR.IL change only on exception entry, attempted
exception exit, and various AArch32 mode changes via cpsr_write().
These places generally already rebuild the hflags, so the only place
we need an extra rebuild_hflags call is in the illegal-return
codepath of the AArch64 exception_return helper.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Added missing returns; set IL bit in syndrome]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h           |  1 +
 target/arm/syndrome.h      |  5 +++++
 target/arm/translate.h     |  2 ++
 target/arm/helper-a64.c    |  1 +
 target/arm/helper.c        |  8 ++++++++
 target/arm/translate-a64.c | 11 +++++++++++
 target/arm/translate.c     | 21 +++++++++++++++++++++
 7 files changed, 49 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
 FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
 FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
            (cv << 24) | (cond << 20) | ti;
 }
 
+static inline uint32_t syn_illegalstate(void)
+{
+    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
+}
+
 #endif /* TARGET_ARM_SYNDROME_H */
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool hstr_active;
     /* True if memory operations require alignment */
     bool align_mem;
+    /* True if PSTATE.IL is set */
+    bool pstate_il;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ illegal_return:
     if (!arm_singlestep_active(env)) {
         env->pstate &= ~PSTATE_SS;
     }
+    helper_rebuild_hflags_a64(env, cur_el);
     qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                   "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
 }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
     }
 
+    if (env->uncached_cpsr & CPSR_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
     }
 
+    if (env->pstate & PSTATE_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
         /*
          * Set MTE_ACTIVE if any access may be Checked, and leave clear
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
     s->fp_access_checked = false;
     s->sve_access_checked = false;
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (dc_isar_feature(aa64_bti, s)) {
         if (s->base.num_insns == 1) {
             /*
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         return;
     }
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (cond == 0xf) {
         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
          * choose to UNDEF. In ARMv5 and above the space is used
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
         dc->vfp_enabled = 1;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     dc->insn = insn;
 
+    if (dc->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(dc));
+        return;
+    }
+
     if (dc->eci) {
         /*
          * For M-profile continuable instructions, ECI/ICI handling
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

It is confusing to have different exits from translation
for various conditions in separate functions.

Merge disas_a64_insn into its only caller.  Standardize
on the "s" name for the DisasContext, as the code from
disas_a64_insn had more instances.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
 1 file changed, 109 insertions(+), 115 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
     return false;
 }
 
-/* C3.1 A64 instruction index by encoding */
-static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-{
-    uint32_t insn;
-
-    s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
-    s->insn = insn;
-    s->base.pc_next += 4;
-
-    s->fp_access_checked = false;
-    s->sve_access_checked = false;
-
-    if (s->pstate_il) {
-        /*
-         * Illegal execution state. This has priority over BTI
-         * exceptions, but comes after instruction abort exceptions.
-         */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
-        return;
-    }
-
-    if (dc_isar_feature(aa64_bti, s)) {
-        if (s->base.num_insns == 1) {
-            /*
-             * At the first insn of the TB, compute s->guarded_page.
-             * We delayed computing this until successfully reading
-             * the first insn of the TB, above.  This (mostly) ensures
-             * that the softmmu tlb entry has been populated, and the
-             * page table GP bit is available.
-             *
-             * Note that we need to compute this even if btype == 0,
-             * because this value is used for BR instructions later
-             * where ENV is not available.
-             */
-            s->guarded_page = is_guarded_page(env, s);
-
-            /* First insn can have btype set to non-zero.  */
-            tcg_debug_assert(s->btype >= 0);
-
-            /*
-             * Note that the Branch Target Exception has fairly high
-             * priority -- below debugging exceptions but above most
-             * everything else.  This allows us to handle this now
-             * instead of waiting until the insn is otherwise decoded.
-             */
-            if (s->btype != 0
-                && s->guarded_page
-                && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                                   syn_btitrap(s->btype),
-                                   default_exception_el(s));
-                return;
-            }
-        } else {
-            /* Not the first insn: btype must be 0.  */
-            tcg_debug_assert(s->btype == 0);
-        }
-    }
-
-    switch (extract32(insn, 25, 4)) {
-    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
-        unallocated_encoding(s);
-        break;
-    case 0x2:
-        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
-            unallocated_encoding(s);
-        }
-        break;
-    case 0x8: case 0x9: /* Data processing - immediate */
-        disas_data_proc_imm(s, insn);
-        break;
-    case 0xa: case 0xb: /* Branch, exception generation and system insns */
-        disas_b_exc_sys(s, insn);
-        break;
-    case 0x4:
-    case 0x6:
-    case 0xc:
-    case 0xe:      /* Loads and stores */
-        disas_ldst(s, insn);
-        break;
-    case 0x5:
-    case 0xd:      /* Data processing - register */
-        disas_data_proc_reg(s, insn);
-        break;
-    case 0x7:
-    case 0xf:      /* Data processing - SIMD and floating point */
-        disas_data_proc_simd_fp(s, insn);
-        break;
-    default:
-        assert(FALSE); /* all 15 cases should be handled above */
-        break;
-    }
-
-    /* if we allocated any temporaries, free them here */
-    free_tmp_a64(s);
-
-    /*
-     * After execution of most insns, btype is reset to 0.
-     * Note that we set btype == -1 when the insn sets btype.
-     */
-    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
-        reset_btype(s);
-    }
-}
-
 static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                           CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 
 static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
-    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    DisasContext *s = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t insn;
 
-    if (dc->ss_active && !dc->pstate_ss) {
+    if (s->ss_active && !s->pstate_ss) {
         /* Singlestep state is Active-pending.
          * If we're in this state at the start of a TB then either
          *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * "did not step an insn" case, and so the syndrome ISV and EX
          * bits should be zero.
          */
-        assert(dc->base.num_insns == 1);
-        gen_swstep_exception(dc, 0, 0);
-        dc->base.is_jmp = DISAS_NORETURN;
-    } else {
-        disas_a64_insn(env, dc);
+        assert(s->base.num_insns == 1);
+        gen_swstep_exception(s, 0, 0);
+        s->base.is_jmp = DISAS_NORETURN;
+        return;
     }
 
-    translator_loop_temp_check(&dc->base);
+    s->pc_curr = s->base.pc_next;
+    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    s->insn = insn;
+    s->base.pc_next += 4;
+
+    s->fp_access_checked = false;
+    s->sve_access_checked = false;
+
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
+    if (dc_isar_feature(aa64_bti, s)) {
+        if (s->base.num_insns == 1) {
+            /*
+             * At the first insn of the TB, compute s->guarded_page.
+             * We delayed computing this until successfully reading
+             * the first insn of the TB, above.  This (mostly) ensures
+             * that the softmmu tlb entry has been populated, and the
+             * page table GP bit is available.
+             *
+             * Note that we need to compute this even if btype == 0,
+             * because this value is used for BR instructions later
+             * where ENV is not available.
+             */
+            s->guarded_page = is_guarded_page(env, s);
+
+            /* First insn can have btype set to non-zero.  */
+            tcg_debug_assert(s->btype >= 0);
+
+            /*
+             * Note that the Branch Target Exception has fairly high
+             * priority -- below debugging exceptions but above most
+             * everything else.  This allows us to handle this now
+             * instead of waiting until the insn is otherwise decoded.
+             */
+            if (s->btype != 0
+                && s->guarded_page
+                && !btype_destination_ok(insn, s->bt, s->btype)) {
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype),
+                                   default_exception_el(s));
+                return;
+            }
+        } else {
+            /* Not the first insn: btype must be 0.  */
+            tcg_debug_assert(s->btype == 0);
+        }
+    }
+
+    switch (extract32(insn, 25, 4)) {
+    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
+        unallocated_encoding(s);
+        break;
+    case 0x2:
+        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
+            unallocated_encoding(s);
+        }
+        break;
+    case 0x8: case 0x9: /* Data processing - immediate */
+        disas_data_proc_imm(s, insn);
+        break;
+    case 0xa: case 0xb: /* Branch, exception generation and system insns */
+        disas_b_exc_sys(s, insn);
+        break;
+    case 0x4:
+    case 0x6:
+    case 0xc:
+    case 0xe:      /* Loads and stores */
+        disas_ldst(s, insn);
+        break;
+    case 0x5:
+    case 0xd:      /* Data processing - register */
+        disas_data_proc_reg(s, insn);
+        break;
+    case 0x7:
+    case 0xf:      /* Data processing - SIMD and floating point */
+        disas_data_proc_simd_fp(s, insn);
+        break;
+    default:
+        assert(FALSE); /* all 15 cases should be handled above */
+        break;
+    }
+
+    /* if we allocated any temporaries, free them here */
+    free_tmp_a64(s);
+
+    /*
+     * After execution of most insns, btype is reset to 0.
+     * Note that we set btype == -1 when the insn sets btype.
+     */
+    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
+        reset_btype(s);
+    }
+
+    translator_loop_temp_check(&s->base);
 }
 
 static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-- 
2.20.1

By default, QEMU will allow devices to be plugged into a bus up to
the bus class's device count limit.  If the user creates a device on
the command line or via the monitor and doesn't explicitly specify
the bus to plug it in, QEMU will plug it into the first non-full bus
that it finds.

This is fine in most cases, but some machines have multiple buses of
a given type, some of which are dedicated to on-board devices and
some of which have an externally exposed connector for user-pluggable
devices. One example is I2C buses.

Provide a new function qbus_mark_full() so that a machine model can
mark this kind of "internal only" bus as 'full' after it has created
all the devices that should be plugged into that bus. The "find a
non-full bus" algorithm will then skip the internal-only bus when
looking for a place to plug in user-created devices.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
---
 include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
 softmmu/qdev-monitor.c |  7 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -XXX,XX +XXX,XX @@ struct BusState {
     HotplugHandler *hotplug_handler;
     int max_index;
     bool realized;
+    bool full;
     int num_children;
 
     /*
@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
    return bus->hotplug_handler;
 }
 
+/**
+ * qbus_mark_full: Mark this bus as full, so no more devices can be attached
+ * @bus: Bus to mark as full
+ *
+ * By default, QEMU will allow devices to be plugged into a bus up
+ * to the bus class's device count limit. Calling this function
+ * marks a particular bus as full, so that no more devices can be
+ * plugged into it. In particular this means that the bus will not
+ * be considered as a candidate for plugging in devices created by
+ * the user on the commandline or via the monitor.
+ * If a machine has multiple buses of a given type, such as I2C,
+ * where some of those buses in the real hardware are used only for
+ * internal devices and some are exposed via expansion ports, you
+ * can use this function to mark the internal-only buses as full
+ * after you have created all their internal devices. Then user
+ * created devices will appear on the expansion-port bus where
+ * guest software expects them.
+ */
+static inline void qbus_mark_full(BusState *bus)
+{
+    bus->full = true;
+}
+
 void device_listener_register(DeviceListener *listener);
 void device_listener_unregister(DeviceListener *listener);
 
diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
 
 static inline bool qbus_is_full(BusState *bus)
 {
-    BusClass *bus_class = BUS_GET_CLASS(bus);
+    BusClass *bus_class;
+
+    if (bus->full) {
+        return true;
+    }
+    bus_class = BUS_GET_CLASS(bus);
     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
 }
 
-- 
2.20.1

The mps2-tz boards use a data-driven structure to create the devices
that sit behind peripheral protection controllers.  Currently the
functions which create these devices are passed an 'opaque' pointer
which is always the address within the machine struct of the device
to create, and some "all devices need this" information like irqs and
addresses.

If a specific device needs more information than this, it is
currently not possible to pass that through from the PPCInfo
data structure. Add support for passing an extra data parameter,
so that we can more flexibly handle the needs of specific
device types. To provide some type-safety we make this extra
parameter a pointer to a union (which initially has no members).

In particular, we would like to be able to indicate which of the
i2c controllers are for on-board devices only and which are
connected to the external 'shield' expansion port; a subsequent
patch will use this mechanism for that purpose.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
     }
 }
 
+/* Union describing the device-specific extra data we pass to the devfn. */
+typedef union PPCExtraData {
+} PPCExtraData;
+
 /* Most of the devices in the AN505 FPGA image sit behind
  * Peripheral Protection Controllers. These data structures
  * define the layout of which devices sit behind which PPCs.
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
  */
 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
                                 const char *name, hwaddr size,
-                                const int *irqs);
+                                const int *irqs,
+                                const PPCExtraData *extradata);
 
 typedef struct PPCPortInfo {
     const char *name;
@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
     hwaddr addr;
     hwaddr size;
     int irqs[3]; /* currently no device needs more IRQ lines than this */
+    PPCExtraData extradata; /* to pass device-specific info to the devfn */
 } PPCPortInfo;
 
 typedef struct PPCInfo {
@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
                                     void *opaque,
                                     const char *name, hwaddr size,
-                                    const int *irqs)
+                                    const int *irqs,
+                                    const PPCExtraData *extradata)
 {
     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
      * and return a pointer to its MemoryRegion.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
 
 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
                                const char *name, hwaddr size,
-                               const int *irqs)
+                               const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is tx, rx, combined, in that order */
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     MPS2SCC *scc = opaque;
     DeviceState *sccdev;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
                                  const char *name, hwaddr size,
-                                 const int *irqs)
+                                 const int *irqs, const PPCExtraData *extradata)
 {
     MPS2FPGAIO *fpgaio = opaque;
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     SysBusDevice *s;
     NICInfo *nd = &nd_table[0];
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     /*
      * The AN524 makes the ethernet and USB share a PPC port.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     TZMPC *mpc = opaque;
     int i = mpc - &mms->mpc[0];
@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
 
 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
     PL080State *dma = opaque;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /*
      * The AN505 has five PL022 SPI controllers.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     ArmSbconI2CState *i2c = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     PL031State *pl031 = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
             }
 
             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
-                              pinfo->irqs);
+                              pinfo->irqs, &pinfo->extradata);
             portname = g_strdup_printf("port[%d]", port);
             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
                                      &error_fatal);
-- 
2.20.1

The various MPS2 boards have multiple I2C buses: typically a bus
dedicated to the audio configuration, one for the LCD touchscreen
controller, one for a DDR4 EEPROM, and two which are connected to the
external Shield expansion connector.  Mark the buses which are used
only for board-internal devices as 'full' so that if the user creates
i2c devices on the commandline without specifying a bus name then
they will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
 
 /* Union describing the device-specific extra data we pass to the devfn. */
 typedef union PPCExtraData {
+    bool i2c_internal;
 } PPCExtraData;
 
 /* Most of the devices in the AN505 FPGA image sit behind
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
     s = SYS_BUS_DEVICE(i2c);
     sysbus_realize(s, &error_fatal);
+
+    /*
+     * If this is an internal-use-only i2c bus, mark it full
+     * so that user-created i2c devices are not plugged into it.
+     * If we implement models of any on-board i2c devices that
+     * plug in to one of the internal-use-only buses, then we will
+     * need to create and plugging those in here before we mark the
+     * bus as full.
+     */
+    if (extradata->i2c_internal) {
+        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
+        qbus_mark_full(qbus);
+    }
+
     return sysbus_mmio_get_region(s, 0);
 }
 
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
-                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
-- 
2.20.1

The various MPS2 boards implemented in mps2.c have multiple I2C
buses: a bus dedicated to the audio configuration, one for the LCD
touchscreen controller, and two which are connected to the external
Shield expansion connector.  Mark the buses which are used only for
board-internal devices as 'full' so that if the user creates i2c
devices on the commandline without specifying a bus name then they
will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                          0x40023000,    /* Audio */
                                          0x40029000,    /* Shield0 */
                                          0x4002a000};   /* Shield1 */
-        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        DeviceState *dev;
+
+        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        if (i < 2) {
+            /*
+             * internal-only bus: mark it full to avoid user-created
+             * i2c devices being plugged into it.
+             */
+            BusState *qbus = qdev_get_child_bus(dev, "i2c");
+            qbus_mark_full(qbus);
+        }
     }
     create_unimplemented_device("i2s", 0x40024000, 0x400);
 
-- 
2.20.1

Arm queue; not huge but I figured I might as well send it out since
I've been doing code review today and there's no queue of unprocessed
pullreqs...

thanks
-- PMM

The following changes since commit b3f846c59d8405bb87c551187721fc92ff2f1b92:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2021-01-11v2' into staging (2021-01-11 15:15:35 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210112

for you to fetch changes up to 19d131395ccaf503db21dadd8257e6dc9fc1d7de:

ui/cocoa: Fix openFile: deprecation on Big Sur (2021-01-12 11:38:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm: Support emulation of ARMv8.4-TTST extension
 * arm: Update cpu.h ID register field definitions
 * arm: Fix breakage of XScale instruction emulation
 * hw/net/lan9118: Fix RX Status FIFO PEEK value
 * npcm7xx: Add ADC and PWM emulation
 * ui/cocoa: Make "open docs" help menu entry work again when binary
   is run from the build tree
 * ui/cocoa: Fix openFile: deprecation on Big Sur
 * docs: Add qemu-storage-daemon(1) manpage to meson.build
 * docs: Build and install all the docs in a single manual

----------------------------------------------------------------
Hao Wu (6):
      hw/misc: Add clock converter in NPCM7XX CLK module
      hw/timer: Refactor NPCM7XX Timer to use CLK clock
      hw/adc: Add an ADC module for NPCM7XX
      hw/misc: Add a PWM module for NPCM7XX
      hw/misc: Add QTest for NPCM7XX PWM Module
      hw/*: Use type casting for SysBusDevice in NPCM7XX

Leif Lindholm (6):
      target/arm: fix typo in cpu.h ID_AA64PFR1 field name
      target/arm: make ARMCPU.clidr 64-bit
      target/arm: make ARMCPU.ctr 64-bit
      target/arm: add descriptions of CLIDR_EL1, CCSIDR_EL1, CTR_EL0 to cpu.h
      target/arm: add aarch64 ID register fields to cpu.h
      target/arm: add aarch32 ID register fields to cpu.h

Peter Maydell (5):
      docs: Add qemu-storage-daemon(1) manpage to meson.build
      docs: Build and install all the docs in a single manual
      target/arm: Don't decode insns in the XScale/iWMMXt space as cp insns
      hw/net/lan9118: Fix RX Status FIFO PEEK value
      hw/net/lan9118: Add symbolic constants for register offsets

Roman Bolshakov (2):
      ui/cocoa: Update path to docs in build tree
      ui/cocoa: Fix openFile: deprecation on Big Sur

Rémi Denis-Courmont (2):
      target/arm: ARMv8.4-TTST extension
      target/arm: enable Small Translation tables in max CPU

docs/conf.py                     |  46 ++-
 docs/devel/conf.py               |  15 -
 docs/index.html.in               |  17 -
 docs/interop/conf.py             |  28 --
 docs/meson.build                 |  65 ++--
 docs/specs/conf.py               |  16 -
 docs/system/arm/nuvoton.rst      |   4 +-
 docs/system/conf.py              |  28 --
 docs/tools/conf.py               |  37 --
 docs/user/conf.py                |  15 -
 meson.build                      |   1 +
 hw/adc/trace.h                   |   1 +
 include/hw/adc/npcm7xx_adc.h     |  69 ++++
 include/hw/arm/npcm7xx.h         |   4 +
 include/hw/misc/npcm7xx_clk.h    | 146 ++++++-
 include/hw/misc/npcm7xx_pwm.h    | 105 +++++
 include/hw/timer/npcm7xx_timer.h |   1 +
 target/arm/cpu.h                 |  85 ++++-
 hw/adc/npcm7xx_adc.c             | 301 +++++++++++++++
 hw/arm/npcm7xx.c                 |  55 ++-
 hw/arm/npcm7xx_boards.c          |   2 +-
 hw/mem/npcm7xx_mc.c              |   2 +-
 hw/misc/npcm7xx_clk.c            | 807 ++++++++++++++++++++++++++++++++++++++-
 hw/misc/npcm7xx_gcr.c            |   2 +-
 hw/misc/npcm7xx_pwm.c            | 550 ++++++++++++++++++++++++++
 hw/misc/npcm7xx_rng.c            |   2 +-
 hw/net/lan9118.c                 |  26 +-
 hw/nvram/npcm7xx_otp.c           |   2 +-
 hw/ssi/npcm7xx_fiu.c             |   2 +-
 hw/timer/npcm7xx_timer.c         |  39 +-
 target/arm/cpu64.c               |   1 +
 target/arm/helper.c              |  15 +-
 target/arm/translate.c           |   7 +
 tests/qtest/npcm7xx_adc-test.c   | 377 ++++++++++++++++++
 tests/qtest/npcm7xx_pwm-test.c   | 490 ++++++++++++++++++++++++
 hw/adc/meson.build               |   1 +
 hw/adc/trace-events              |   5 +
 hw/misc/meson.build              |   1 +
 hw/misc/trace-events             |   6 +
 tests/qtest/meson.build          |   4 +-
 ui/cocoa.m                       |   7 +-
 41 files changed, 3124 insertions(+), 263 deletions(-)
 delete mode 100644 docs/devel/conf.py
 delete mode 100644 docs/index.html.in
 delete mode 100644 docs/interop/conf.py
 delete mode 100644 docs/specs/conf.py
 delete mode 100644 docs/system/conf.py
 delete mode 100644 docs/tools/conf.py
 delete mode 100644 docs/user/conf.py
 create mode 100644 hw/adc/trace.h
 create mode 100644 include/hw/adc/npcm7xx_adc.h
 create mode 100644 include/hw/misc/npcm7xx_pwm.h
 create mode 100644 hw/adc/npcm7xx_adc.c
 create mode 100644 hw/misc/npcm7xx_pwm.c
 create mode 100644 tests/qtest/npcm7xx_adc-test.c
 create mode 100644 tests/qtest/npcm7xx_pwm-test.c
 create mode 100644 hw/adc/trace-events

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This adds for the Small Translation tables extension in AArch64 state.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  5 +++++
 target/arm/helper.c | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_uao(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, UAO) != 0;
 }
 
+static inline bool isar_feature_aa64_st(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, ST) != 0;
+}
+
 static inline bool isar_feature_aa64_bti(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, BT) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 {
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
     bool epd, hpd, using16k, using64k;
-    int select, tsz, tbi;
+    int select, tsz, tbi, max_tsz;
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             hpd = extract64(tcr, 42, 1);
         }
     }
-    tsz = MIN(tsz, 39);  /* TODO: ARMv8.4-TTST */
+
+    if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
+        max_tsz = 48 - using64k;
+    } else {
+        max_tsz = 39;
+    }
+
+    tsz = MIN(tsz, max_tsz);
     tsz = MAX(tsz, 16);  /* TODO: ARMv8.2-LVA  */
 
     /* Present TBI as a composite with TBID.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         if (!aarch64 || stride == 9) {
             /* AArch32 or 4KB pages */
             startlevel = 2 - sl0;
+
+            if (cpu_isar_feature(aa64_st, cpu)) {
+                startlevel &= 3;
+            }
         } else {
             /* 16KB or 64KB pages */
             startlevel = 3 - sl0;
-- 
2.20.1

From: Leif Lindholm <leif@nuviainc.com>

The AArch64 view of CLIDR_EL1 extends the ICB field to include also bit
32, as well as adding a Ttype<n> field when FEAT_MTE is implemented.
Extend the clidr field to be able to hold this context.

Signed-off-by: Leif Lindholm <leif@nuviainc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20210108185154.8108-3-leif@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     uint32_t id_afr0;
     uint64_t id_aa64afr0;
     uint64_t id_aa64afr1;
-    uint32_t clidr;
+    uint64_t clidr;
     uint64_t mp_affinity; /* MP ID without feature bits */
     /* The elements of this array are the CCSIDR values for each cache,
      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
-- 
2.20.1

From: Leif Lindholm <leif@nuviainc.com>

Signed-off-by: Leif Lindholm <leif@nuviainc.com>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20210108185154.8108-5-leif@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_FPCCR, ASPEN, 31, 1)
 /*
  * System register ID fields.
  */
+FIELD(CLIDR_EL1, CTYPE1, 0, 3)
+FIELD(CLIDR_EL1, CTYPE2, 3, 3)
+FIELD(CLIDR_EL1, CTYPE3, 6, 3)
+FIELD(CLIDR_EL1, CTYPE4, 9, 3)
+FIELD(CLIDR_EL1, CTYPE5, 12, 3)
+FIELD(CLIDR_EL1, CTYPE6, 15, 3)
+FIELD(CLIDR_EL1, CTYPE7, 18, 3)
+FIELD(CLIDR_EL1, LOUIS, 21, 3)
+FIELD(CLIDR_EL1, LOC, 24, 3)
+FIELD(CLIDR_EL1, LOUU, 27, 3)
+FIELD(CLIDR_EL1, ICB, 30, 3)
+
+/* When FEAT_CCIDX is implemented */
+FIELD(CCSIDR_EL1, CCIDX_LINESIZE, 0, 3)
+FIELD(CCSIDR_EL1, CCIDX_ASSOCIATIVITY, 3, 21)
+FIELD(CCSIDR_EL1, CCIDX_NUMSETS, 32, 24)
+
+/* When FEAT_CCIDX is not implemented */
+FIELD(CCSIDR_EL1, LINESIZE, 0, 3)
+FIELD(CCSIDR_EL1, ASSOCIATIVITY, 3, 10)
+FIELD(CCSIDR_EL1, NUMSETS, 13, 15)
+
+FIELD(CTR_EL0,  IMINLINE, 0, 4)
+FIELD(CTR_EL0,  L1IP, 14, 2)
+FIELD(CTR_EL0,  DMINLINE, 16, 4)
+FIELD(CTR_EL0,  ERG, 20, 4)
+FIELD(CTR_EL0,  CWG, 24, 4)
+FIELD(CTR_EL0,  IDC, 28, 1)
+FIELD(CTR_EL0,  DIC, 29, 1)
+FIELD(CTR_EL0,  TMINLINE, 32, 6)
+
 FIELD(MIDR_EL1, REVISION, 0, 4)
 FIELD(MIDR_EL1, PARTNUM, 4, 12)
 FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
-- 
2.20.1

From: Leif Lindholm <leif@nuviainc.com>

Add entries present in ARM DDI 0487F.c (August 2020).

Signed-off-by: Leif Lindholm <leif@nuviainc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20210108185154.8108-6-leif@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR1, GPI, 28, 4)
 FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
 FIELD(ID_AA64ISAR1, SB, 36, 4)
 FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
+FIELD(ID_AA64ISAR1, BF16, 44, 4)
+FIELD(ID_AA64ISAR1, DGH, 48, 4)
+FIELD(ID_AA64ISAR1, I8MM, 52, 4)
 
 FIELD(ID_AA64PFR0, EL0, 0, 4)
 FIELD(ID_AA64PFR0, EL1, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, ADVSIMD, 20, 4)
 FIELD(ID_AA64PFR0, GIC, 24, 4)
 FIELD(ID_AA64PFR0, RAS, 28, 4)
 FIELD(ID_AA64PFR0, SVE, 32, 4)
+FIELD(ID_AA64PFR0, SEL2, 36, 4)
+FIELD(ID_AA64PFR0, MPAM, 40, 4)
+FIELD(ID_AA64PFR0, AMU, 44, 4)
+FIELD(ID_AA64PFR0, DIT, 48, 4)
+FIELD(ID_AA64PFR0, CSV2, 56, 4)
+FIELD(ID_AA64PFR0, CSV3, 60, 4)
 
 FIELD(ID_AA64PFR1, BT, 0, 4)
 FIELD(ID_AA64PFR1, SSBS, 4, 4)
 FIELD(ID_AA64PFR1, MTE, 8, 4)
 FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
+FIELD(ID_AA64PFR1, MPAM_FRAC, 16, 4)
 
 FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
 FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR0, TGRAN16_2, 32, 4)
 FIELD(ID_AA64MMFR0, TGRAN64_2, 36, 4)
 FIELD(ID_AA64MMFR0, TGRAN4_2, 40, 4)
 FIELD(ID_AA64MMFR0, EXS, 44, 4)
+FIELD(ID_AA64MMFR0, FGT, 56, 4)
+FIELD(ID_AA64MMFR0, ECV, 60, 4)
 
 FIELD(ID_AA64MMFR1, HAFDBS, 0, 4)
 FIELD(ID_AA64MMFR1, VMIDBITS, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR1, LO, 16, 4)
 FIELD(ID_AA64MMFR1, PAN, 20, 4)
 FIELD(ID_AA64MMFR1, SPECSEI, 24, 4)
 FIELD(ID_AA64MMFR1, XNX, 28, 4)
+FIELD(ID_AA64MMFR1, TWED, 32, 4)
+FIELD(ID_AA64MMFR1, ETS, 36, 4)
 
 FIELD(ID_AA64MMFR2, CNP, 0, 4)
 FIELD(ID_AA64MMFR2, UAO, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)
 FIELD(ID_AA64DFR0, PMSVER, 32, 4)
 FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)
 FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)
+FIELD(ID_AA64DFR0, MTPMU, 48, 4)
 
 FIELD(ID_DFR0, COPDBG, 0, 4)
 FIELD(ID_DFR0, COPSDBG, 4, 4)
-- 
2.20.1

From: Leif Lindholm <leif@nuviainc.com>

Add entries present in ARM DDI 0487F.c (August 2020).

Signed-off-by: Leif Lindholm <leif@nuviainc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20210108185154.8108-7-leif@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_ISAR6, DP, 4, 4)
 FIELD(ID_ISAR6, FHM, 8, 4)
 FIELD(ID_ISAR6, SB, 12, 4)
 FIELD(ID_ISAR6, SPECRES, 16, 4)
+FIELD(ID_ISAR6, BF16, 20, 4)
+FIELD(ID_ISAR6, I8MM, 24, 4)
 
 FIELD(ID_MMFR0, VMSA, 0, 4)
 FIELD(ID_MMFR0, PMSA, 4, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR0, AUXREG, 20, 4)
 FIELD(ID_MMFR0, FCSE, 24, 4)
 FIELD(ID_MMFR0, INNERSHR, 28, 4)
 
+FIELD(ID_MMFR1, L1HVDVA, 0, 4)
+FIELD(ID_MMFR1, L1UNIVA, 4, 4)
+FIELD(ID_MMFR1, L1HVDSW, 8, 4)
+FIELD(ID_MMFR1, L1UNISW, 12, 4)
+FIELD(ID_MMFR1, L1HVD, 16, 4)
+FIELD(ID_MMFR1, L1UNI, 20, 4)
+FIELD(ID_MMFR1, L1TSTCLN, 24, 4)
+FIELD(ID_MMFR1, BPRED, 28, 4)
+
+FIELD(ID_MMFR2, L1HVDFG, 0, 4)
+FIELD(ID_MMFR2, L1HVDBG, 4, 4)
+FIELD(ID_MMFR2, L1HVDRNG, 8, 4)
+FIELD(ID_MMFR2, HVDTLB, 12, 4)
+FIELD(ID_MMFR2, UNITLB, 16, 4)
+FIELD(ID_MMFR2, MEMBARR, 20, 4)
+FIELD(ID_MMFR2, WFISTALL, 24, 4)
+FIELD(ID_MMFR2, HWACCFLG, 28, 4)
+
 FIELD(ID_MMFR3, CMAINTVA, 0, 4)
 FIELD(ID_MMFR3, CMAINTSW, 4, 4)
 FIELD(ID_MMFR3, BPMAINT, 8, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_MMFR4, LSM, 20, 4)
 FIELD(ID_MMFR4, CCIDX, 24, 4)
 FIELD(ID_MMFR4, EVT, 28, 4)
 
+FIELD(ID_MMFR5, ETS, 0, 4)
+
 FIELD(ID_PFR0, STATE0, 0, 4)
 FIELD(ID_PFR0, STATE1, 4, 4)
 FIELD(ID_PFR0, STATE2, 8, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_PFR1, SEC_FRAC, 20, 4)
 FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
 FIELD(ID_PFR1, GIC, 28, 4)
 
+FIELD(ID_PFR2, CSV3, 0, 4)
+FIELD(ID_PFR2, SSBS, 4, 4)
+FIELD(ID_PFR2, RAS_FRAC, 8, 4)
+
 FIELD(ID_AA64ISAR0, AES, 4, 4)
 FIELD(ID_AA64ISAR0, SHA1, 8, 4)
 FIELD(ID_AA64ISAR0, SHA2, 12, 4)
@@ -XXX,XX +XXX,XX @@ FIELD(ID_DFR0, MPROFDBG, 20, 4)
 FIELD(ID_DFR0, PERFMON, 24, 4)
 FIELD(ID_DFR0, TRACEFILT, 28, 4)
 
+FIELD(ID_DFR1, MTPMU, 0, 4)
+
 FIELD(DBGDIDR, SE_IMP, 12, 1)
 FIELD(DBGDIDR, NSUHD_IMP, 14, 1)
 FIELD(DBGDIDR, VERSION, 16, 4)
-- 
2.20.1

From: Roman Bolshakov <r.bolshakov@yadro.com>

QEMU documentation can't be opened if QEMU is run from build tree
because executables are placed in the top of build tree after conversion
to meson.

Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210108213815.64678-1-r.bolshakov@yadro.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 ui/cocoa.m | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index XXXXXXX..XXXXXXX 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
 - (void) openDocumentation: (NSString *) filename
 {
     /* Where to look for local files */
-    NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"../docs/"};
+    NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"docs/"};
     NSString *full_file_path;
 
     /* iterate thru the possible paths until the file is found */
-- 
2.20.1

In commit 1982e1602d15 we added a new qemu-storage-daemon(1) manpage.
At the moment new manpages have to be listed both in the conf.py for
Sphinx and also in docs/meson.build for Meson. We forgot the second
of those -- correct the omission.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20210108161416.21129-2-peter.maydell@linaro.org
---
 docs/meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/meson.build b/docs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
         'qemu-img.1': (have_tools ? 'man1' : ''),
         'qemu-nbd.8': (have_tools ? 'man8' : ''),
         'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
+        'qemu-storage-daemon.1': (have_tools ? 'man1' : ''),
         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
-- 
2.20.1

When we first converted our documentation to Sphinx, we split it into
multiple manuals (system, interop, tools, etc), which are all built
separately.  The primary driver for this was wanting to be able to
avoid shipping the 'devel' manual to end-users.  However, this is
working against the grain of the way Sphinx wants to be used and
causes some annoyances:
 * Cross-references between documents become much harder or
   possibly impossible
 * There is no single index to the whole documentation
 * Within one manual there's no links or table-of-contents info
   that lets you easily navigate to the others
 * The devel manual doesn't get published on the QEMU website
   (it would be nice to able to refer to it there)

Merely hiding our developer documentation from end users seems like
it's not enough benefit for these costs.  Combine all the
documentation into a single manual (the same way that the readthedocs
site builds it) and install the whole thing.  The previous manual
divisions remain as the new top level sections in the manual.

* The per-manual conf.py files are no longer needed
 * The man_pages[] specifications previously in each per-manual
   conf.py move to the top level conf.py
 * docs/meson.build logic is simplified as we now only need to run
   Sphinx once for the HTML and then once for the manpages5B
 * The old index.html.in that produced the top-level page with
   links to each manual is no longer needed

Unfortunately this means that we now have to build the HTML
documentation into docs/manual in the build tree rather than directly
into docs/; otherwise it is too awkward to ensure we install only the
built manual and not also the dependency info, stamp file, etc.  The
manual still ends up in the same place in the final installed
directory, but anybody who was consulting documentation from within
the build tree will have to adjust where they're looking.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20210108161416.21129-3-peter.maydell@linaro.org
---
 docs/conf.py         | 46 ++++++++++++++++++++++++++++++-
 docs/devel/conf.py   | 15 -----------
 docs/index.html.in   | 17 ------------
 docs/interop/conf.py | 28 -------------------
 docs/meson.build     | 64 +++++++++++++++++---------------------------
 docs/specs/conf.py   | 16 -----------
 docs/system/conf.py  | 28 -------------------
 docs/tools/conf.py   | 37 -------------------------
 docs/user/conf.py    | 15 -----------
 9 files changed, 70 insertions(+), 196 deletions(-)
 delete mode 100644 docs/devel/conf.py
 delete mode 100644 docs/index.html.in
 delete mode 100644 docs/interop/conf.py
 delete mode 100644 docs/specs/conf.py
 delete mode 100644 docs/system/conf.py
 delete mode 100644 docs/tools/conf.py
 delete mode 100644 docs/user/conf.py

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ latex_documents = [
 
 # -- Options for manual page output ---------------------------------------
 # Individual manual/conf.py can override this to create man pages
-man_pages = []
+man_pages = [
+    ('interop/qemu-ga', 'qemu-ga',
+     'QEMU Guest Agent',
+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
+    ('interop/qemu-ga-ref', 'qemu-ga-ref',
+     'QEMU Guest Agent Protocol Reference',
+     [], 7),
+    ('interop/qemu-qmp-ref', 'qemu-qmp-ref',
+     'QEMU QMP Reference Manual',
+     [], 7),
+    ('interop/qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
+     'QEMU Storage Daemon QMP Reference Manual',
+     [], 7),
+    ('system/qemu-manpage', 'qemu',
+     'QEMU User Documentation',
+     ['Fabrice Bellard'], 1),
+    ('system/qemu-block-drivers', 'qemu-block-drivers',
+     'QEMU block drivers reference',
+     ['Fabrice Bellard and the QEMU Project developers'], 7),
+    ('system/qemu-cpu-models', 'qemu-cpu-models',
+     'QEMU CPU Models',
+     ['The QEMU Project developers'], 7),
+    ('tools/qemu-img', 'qemu-img',
+     'QEMU disk image utility',
+     ['Fabrice Bellard'], 1),
+    ('tools/qemu-nbd', 'qemu-nbd',
+     'QEMU Disk Network Block Device Server',
+     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
+    ('tools/qemu-pr-helper', 'qemu-pr-helper',
+     'QEMU persistent reservation helper',
+     [], 8),
+    ('tools/qemu-storage-daemon', 'qemu-storage-daemon',
+     'QEMU storage daemon',
+     [], 1),
+    ('tools/qemu-trace-stap', 'qemu-trace-stap',
+     'QEMU SystemTap trace tool',
+     [], 1),
+    ('tools/virtfs-proxy-helper', 'virtfs-proxy-helper',
+     'QEMU 9p virtfs proxy filesystem helper',
+     ['M. Mohan Kumar'], 1),
+    ('tools/virtiofsd', 'virtiofsd',
+     'QEMU virtio-fs shared file system daemon',
+     ['Stefan Hajnoczi <stefanha@redhat.com>',
+      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
+]
 
 # -- Options for Texinfo output -------------------------------------------
 
diff --git a/docs/devel/conf.py b/docs/devel/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/devel/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'devel' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'Developer''s Guide'
diff --git a/docs/index.html.in b/docs/index.html.in
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/index.html.in
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-<!DOCTYPE html>
-<html lang="en">
-    <head>
-        <meta charset="UTF-8">
-        <title>QEMU @VERSION@ Documentation</title>
-    </head>
-    <body>
-        <h1>QEMU @VERSION@ Documentation</h1>
-        <ul>
-            <li><a href="system/index.html">System Emulation User's Guide</a></li>
-            <li><a href="user/index.html">User Mode Emulation User's Guide</a></li>
-            <li><a href="tools/index.html">Tools Guide</a></li>
-            <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
-            <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
-        </ul>
-    </body>
-</html>
diff --git a/docs/interop/conf.py b/docs/interop/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/interop/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'interop' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
-     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
-    ('qemu-ga-ref', 'qemu-ga-ref', 'QEMU Guest Agent Protocol Reference',
-     [], 7),
-    ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
-     [], 7),
-    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
-     'QEMU Storage Daemon QMP Reference Manual', [], 7),
-]
diff --git a/docs/meson.build b/docs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
                           meson.source_root() / 'docs/sphinx/qmp_lexer.py',
                           qapi_gen_depends ]
 
-  configure_file(output: 'index.html',
-                 input: files('index.html.in'),
-                 configuration: {'VERSION': meson.project_version()},
-                 install_dir: qemu_docdir)
-  manuals = [ 'devel', 'interop', 'tools', 'specs', 'system', 'user' ]
   man_pages = {
-    'interop' : {
         'qemu-ga.8': (have_tools ? 'man8' : ''),
         'qemu-ga-ref.7': 'man7',
         'qemu-qmp-ref.7': 'man7',
         'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
-    },
-    'tools': {
         'qemu-img.1': (have_tools ? 'man1' : ''),
         'qemu-nbd.8': (have_tools ? 'man8' : ''),
         'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
@@ -XXX,XX +XXX,XX @@ if build_docs
         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
-    },
-    'system': {
         'qemu.1': 'man1',
         'qemu-block-drivers.7': 'man7',
         'qemu-cpu-models.7': 'man7'
-    },
   }
 
   sphinxdocs = []
   sphinxmans = []
-  foreach manual : manuals
-    private_dir = meson.current_build_dir() / (manual + '.p')
-    output_dir = meson.current_build_dir() / manual
-    input_dir = meson.current_source_dir() / manual
 
-    this_manual = custom_target(manual + ' manual',
+  private_dir = meson.current_build_dir() / 'manual.p'
+  output_dir = meson.current_build_dir() / 'manual'
+  input_dir = meson.current_source_dir()
+
+  this_manual = custom_target('QEMU manual',
                 build_by_default: build_docs,
-                output: [manual + '.stamp'],
-                input: [files('conf.py'), files(manual / 'conf.py')],
-                depfile: manual + '.d',
+                output: 'docs.stamp',
+                input: files('conf.py'),
+                depfile: 'docs.d',
                 depend_files: sphinx_extn_depends,
                 command: [SPHINX_ARGS, '-Ddepfile=@DEPFILE@',
                           '-Ddepfile_stamp=@OUTPUT0@',
                           '-b', 'html', '-d', private_dir,
                           input_dir, output_dir])
-    sphinxdocs += this_manual
-    if build_docs and manual != 'devel'
-      install_subdir(output_dir, install_dir: qemu_docdir)
-    endif
+  sphinxdocs += this_manual
+  install_subdir(output_dir, install_dir: qemu_docdir, strip_directory: true)
 
-    these_man_pages = []
-    install_dirs = []
-    foreach page, section : man_pages.get(manual, {})
-      these_man_pages += page
-      install_dirs += section == '' ? false : get_option('mandir') / section
-    endforeach
-    if these_man_pages.length() > 0
-      sphinxmans += custom_target(manual + ' man pages',
-                         build_by_default: build_docs,
-                         output: these_man_pages,
-                         input: this_manual,
-                         install: build_docs,
-                         install_dir: install_dirs,
-                         command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
-                                   input_dir, meson.current_build_dir()])
-    endif
+  these_man_pages = []
+  install_dirs = []
+  foreach page, section : man_pages
+    these_man_pages += page
+    install_dirs += section == '' ? false : get_option('mandir') / section
   endforeach
+
+  sphinxmans += custom_target('QEMU man pages',
+                              build_by_default: build_docs,
+                              output: these_man_pages,
+                              input: this_manual,
+                              install: build_docs,
+                              install_dir: install_dirs,
+                              command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
+                                        input_dir, meson.current_build_dir()])
+
   alias_target('sphinxdocs', sphinxdocs)
   alias_target('html', sphinxdocs)
   alias_target('man', sphinxmans)
diff --git a/docs/specs/conf.py b/docs/specs/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/specs/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'specs' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = \
-    u'System Emulation Guest Hardware Specifications'
diff --git a/docs/system/conf.py b/docs/system/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/system/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'system' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'System Emulation User''s Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-manpage', 'qemu', u'QEMU User Documentation',
-     ['Fabrice Bellard'], 1),
-    ('qemu-block-drivers', 'qemu-block-drivers',
-     u'QEMU block drivers reference',
-     ['Fabrice Bellard and the QEMU Project developers'], 7),
-    ('qemu-cpu-models', 'qemu-cpu-models',
-     u'QEMU CPU Models',
-     ['The QEMU Project developers'], 7)
-]
diff --git a/docs/tools/conf.py b/docs/tools/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/tools/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'tools' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = \
-    u'Tools Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-img', 'qemu-img', u'QEMU disk image utility',
-     ['Fabrice Bellard'], 1),
-    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
-     [], 1),
-    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
-     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
-    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
-     [], 8),
-    ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
-     [], 1),
-    ('virtfs-proxy-helper', 'virtfs-proxy-helper',
-     u'QEMU 9p virtfs proxy filesystem helper',
-     ['M. Mohan Kumar'], 1),
-    ('virtiofsd', 'virtiofsd', u'QEMU virtio-fs shared file system daemon',
-     ['Stefan Hajnoczi <stefanha@redhat.com>',
-      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
-]
diff --git a/docs/user/conf.py b/docs/user/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/user/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'user' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'User Mode Emulation User''s Guide'
-- 
2.20.1

In commit cd8be50e58f63413c0 we converted the A32 coprocessor
insns to decodetree. This accidentally broke XScale/iWMMXt insns,
because it moved the handling of "cp insns which are handled
by looking up the cp register in the hashtable" from after the
call to the legacy disas_xscale_insn() decode to before it,
with the result that all XScale/iWMMXt insns now UNDEF.

Update valid_cp() so that it knows that on XScale cp 0 and 1
are not standard coprocessor instructions; this will cause
the decodetree trans_ functions to ignore them, so that
execution will correctly get through to the legacy decode again.

Cc: qemu-stable@nongnu.org
Reported-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20210108195157.32067-1-peter.maydell@linaro.org
---
 target/arm/translate.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool valid_cp(DisasContext *s, int cp)
      * only cp14 and cp15 are valid, and other values aren't considered
      * to be in the coprocessor-instruction space at all. v8M still
      * permits coprocessors 0..7.
+     * For XScale, we must not decode the XScale cp0, cp1 space as
+     * a standard coprocessor insn, because we want to fall through to
+     * the legacy disas_xscale_insn() decoder after decodetree is done.
      */
+    if (arm_dc_feature(s, ARM_FEATURE_XSCALE) && (cp == 0 || cp == 1)) {
+        return false;
+    }
+
     if (arm_dc_feature(s, ARM_FEATURE_V8) &&
         !arm_dc_feature(s, ARM_FEATURE_M)) {
         return cp >= 14;
-- 
2.20.1

The lan9118 code mostly uses symbolic constants for register offsets;
the exceptions are those which the datasheet doesn't give an official
symbolic name to.

Add some names for the registers which don't already have them, based
on the longer names they are given in the memory map.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210108180401.2263-3-peter.maydell@linaro.org
---
 hw/net/lan9118.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@ do { hw_error("lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
 do { fprintf(stderr, "lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
 #endif
 
+/* The tx and rx fifo ports are a range of aliased 32-bit registers */
+#define RX_DATA_FIFO_PORT_FIRST 0x00
+#define RX_DATA_FIFO_PORT_LAST 0x1f
+#define TX_DATA_FIFO_PORT_FIRST 0x20
+#define TX_DATA_FIFO_PORT_LAST 0x3f
+
+#define RX_STATUS_FIFO_PORT 0x40
+#define RX_STATUS_FIFO_PEEK 0x44
+#define TX_STATUS_FIFO_PORT 0x48
+#define TX_STATUS_FIFO_PEEK 0x4c
+
 #define CSR_ID_REV      0x50
 #define CSR_IRQ_CFG     0x54
 #define CSR_INT_STS     0x58
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
     offset &= 0xff;
 
     //DPRINTF("Write reg 0x%02x = 0x%08x\n", (int)offset, val);
-    if (offset >= 0x20 && offset < 0x40) {
+    if (offset >= TX_DATA_FIFO_PORT_FIRST &&
+        offset <= TX_DATA_FIFO_PORT_LAST) {
         /* TX FIFO */
         tx_fifo_push(s, val);
         return;
@@ -XXX,XX +XXX,XX @@ static uint64_t lan9118_readl(void *opaque, hwaddr offset,
     lan9118_state *s = (lan9118_state *)opaque;
 
     //DPRINTF("Read reg 0x%02x\n", (int)offset);
-    if (offset < 0x20) {
+    if (offset <= RX_DATA_FIFO_PORT_LAST) {
         /* RX FIFO */
         return rx_fifo_pop(s);
     }
     switch (offset) {
-    case 0x40:
+    case RX_STATUS_FIFO_PORT:
         return rx_status_fifo_pop(s);
-    case 0x44:
+    case RX_STATUS_FIFO_PEEK:
         return s->rx_status_fifo[s->rx_status_fifo_head];
-    case 0x48:
+    case TX_STATUS_FIFO_PORT:
         return tx_status_fifo_pop(s);
-    case 0x4c:
+    case TX_STATUS_FIFO_PEEK:
         return s->tx_status_fifo[s->tx_status_fifo_head];
     case CSR_ID_REV:
         return 0x01180001;
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch allows NPCM7XX CLK module to compute clocks that are used by
other NPCM7XX modules.

Add a new struct NPCM7xxClockConverterState which represents a
single converter.  Each clock converter in CLK module represents one
converter in NPCM7XX CLK Module(PLL, SEL or Divider). Each converter
takes one or more input clocks and converts them into one output clock.
They form a clock hierarchy in the CLK module and are responsible for
outputing clocks for various other modules in an NPCM7XX SoC.

Each converter has a function pointer called "convert" which represents
the unique logic for that converter.

The clock contains two initialization information: ConverterInitInfo and
ConverterConnectionInfo. They represent the vertices and edges in the
clock diagram respectively.

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210108190945.949196-2-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/npcm7xx_clk.h | 140 +++++-
 hw/misc/npcm7xx_clk.c         | 805 +++++++++++++++++++++++++++++++++-
 2 files changed, 932 insertions(+), 13 deletions(-)

diff --git a/include/hw/misc/npcm7xx_clk.h b/include/hw/misc/npcm7xx_clk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/npcm7xx_clk.h
+++ b/include/hw/misc/npcm7xx_clk.h
@@ -XXX,XX +XXX,XX @@
 #define NPCM7XX_CLK_H
 
 #include "exec/memory.h"
+#include "hw/clock.h"
 #include "hw/sysbus.h"
 
 /*
@@ -XXX,XX +XXX,XX @@
 
 #define NPCM7XX_WATCHDOG_RESET_GPIO_IN "npcm7xx-clk-watchdog-reset-gpio-in"
 
-typedef struct NPCM7xxCLKState {
+/* Maximum amount of clock inputs in a SEL module. */
+#define NPCM7XX_CLK_SEL_MAX_INPUT 5
+
+/* PLLs in CLK module. */
+typedef enum NPCM7xxClockPLL {
+    NPCM7XX_CLOCK_PLL0,
+    NPCM7XX_CLOCK_PLL1,
+    NPCM7XX_CLOCK_PLL2,
+    NPCM7XX_CLOCK_PLLG,
+    NPCM7XX_CLOCK_NR_PLLS,
+} NPCM7xxClockPLL;
+
+/* SEL/MUX in CLK module. */
+typedef enum NPCM7xxClockSEL {
+    NPCM7XX_CLOCK_PIXCKSEL,
+    NPCM7XX_CLOCK_MCCKSEL,
+    NPCM7XX_CLOCK_CPUCKSEL,
+    NPCM7XX_CLOCK_CLKOUTSEL,
+    NPCM7XX_CLOCK_UARTCKSEL,
+    NPCM7XX_CLOCK_TIMCKSEL,
+    NPCM7XX_CLOCK_SDCKSEL,
+    NPCM7XX_CLOCK_GFXMSEL,
+    NPCM7XX_CLOCK_SUCKSEL,
+    NPCM7XX_CLOCK_NR_SELS,
+} NPCM7xxClockSEL;
+
+/* Dividers in CLK module. */
+typedef enum NPCM7xxClockDivider {
+    NPCM7XX_CLOCK_PLL1D2, /* PLL1/2 */
+    NPCM7XX_CLOCK_PLL2D2, /* PLL2/2 */
+    NPCM7XX_CLOCK_MC_DIVIDER,
+    NPCM7XX_CLOCK_AXI_DIVIDER,
+    NPCM7XX_CLOCK_AHB_DIVIDER,
+    NPCM7XX_CLOCK_AHB3_DIVIDER,
+    NPCM7XX_CLOCK_SPI0_DIVIDER,
+    NPCM7XX_CLOCK_SPIX_DIVIDER,
+    NPCM7XX_CLOCK_APB1_DIVIDER,
+    NPCM7XX_CLOCK_APB2_DIVIDER,
+    NPCM7XX_CLOCK_APB3_DIVIDER,
+    NPCM7XX_CLOCK_APB4_DIVIDER,
+    NPCM7XX_CLOCK_APB5_DIVIDER,
+    NPCM7XX_CLOCK_CLKOUT_DIVIDER,
+    NPCM7XX_CLOCK_UART_DIVIDER,
+    NPCM7XX_CLOCK_TIMER_DIVIDER,
+    NPCM7XX_CLOCK_ADC_DIVIDER,
+    NPCM7XX_CLOCK_MMC_DIVIDER,
+    NPCM7XX_CLOCK_SDHC_DIVIDER,
+    NPCM7XX_CLOCK_GFXM_DIVIDER, /* divide by 3 */
+    NPCM7XX_CLOCK_UTMI_DIVIDER,
+    NPCM7XX_CLOCK_NR_DIVIDERS,
+} NPCM7xxClockConverter;
+
+typedef struct NPCM7xxCLKState NPCM7xxCLKState;
+
+/**
+ * struct NPCM7xxClockPLLState - A PLL module in CLK module.
+ * @name: The name of the module.
+ * @clk: The CLK module that owns this module.
+ * @clock_in: The input clock of this module.
+ * @clock_out: The output clock of this module.
+ * @reg: The control registers for this PLL module.
+ */
+typedef struct NPCM7xxClockPLLState {
+    DeviceState parent;
+
+    const char *name;
+    NPCM7xxCLKState *clk;
+    Clock *clock_in;
+    Clock *clock_out;
+
+    int reg;
+} NPCM7xxClockPLLState;
+
+/**
+ * struct NPCM7xxClockSELState - A SEL module in CLK module.
+ * @name: The name of the module.
+ * @clk: The CLK module that owns this module.
+ * @input_size: The size of inputs of this module.
+ * @clock_in: The input clocks of this module.
+ * @clock_out: The output clocks of this module.
+ * @offset: The offset of this module in the control register.
+ * @len: The length of this module in the control register.
+ */
+typedef struct NPCM7xxClockSELState {
+    DeviceState parent;
+
+    const char *name;
+    NPCM7xxCLKState *clk;
+    uint8_t input_size;
+    Clock *clock_in[NPCM7XX_CLK_SEL_MAX_INPUT];
+    Clock *clock_out;
+
+    int offset;
+    int len;
+} NPCM7xxClockSELState;
+
+/**
+ * struct NPCM7xxClockDividerState - A Divider module in CLK module.
+ * @name: The name of the module.
+ * @clk: The CLK module that owns this module.
+ * @clock_in: The input clock of this module.
+ * @clock_out: The output clock of this module.
+ * @divide: The function the divider uses to divide the input.
+ * @reg: The index of the control register that contains the divisor.
+ * @offset: The offset of the divisor in the control register.
+ * @len: The length of the divisor in the control register.
+ * @divisor: The divisor for a constant divisor
+ */
+typedef struct NPCM7xxClockDividerState {
+    DeviceState parent;
+
+    const char *name;
+    NPCM7xxCLKState *clk;
+    Clock *clock_in;
+    Clock *clock_out;
+
+    uint32_t (*divide)(struct NPCM7xxClockDividerState *s);
+    union {
+        struct {
+            int reg;
+            int offset;
+            int len;
+        };
+        int divisor;
+    };
+} NPCM7xxClockDividerState;
+
+struct NPCM7xxCLKState {
     SysBusDevice parent;
 
     MemoryRegion iomem;
 
+    /* Clock converters */
+    NPCM7xxClockPLLState plls[NPCM7XX_CLOCK_NR_PLLS];
+    NPCM7xxClockSELState sels[NPCM7XX_CLOCK_NR_SELS];
+    NPCM7xxClockDividerState dividers[NPCM7XX_CLOCK_NR_DIVIDERS];
+
     uint32_t regs[NPCM7XX_CLK_NR_REGS];
 
     /* Time reference for SECCNT and CNTR25M, initialized by power on reset */
     int64_t ref_ns;
-} NPCM7xxCLKState;
+
+    /* The incoming reference clock. */
+    Clock *clkref;
+};
 
 #define TYPE_NPCM7XX_CLK "npcm7xx-clk"
 #define NPCM7XX_CLK(obj) OBJECT_CHECK(NPCM7xxCLKState, (obj), TYPE_NPCM7XX_CLK)
diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_clk.c
+++ b/hw/misc/npcm7xx_clk.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/misc/npcm7xx_clk.h"
 #include "hw/timer/npcm7xx_timer.h"
+#include "hw/qdev-clock.h"
 #include "migration/vmstate.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "sysemu/watchdog.h"
 
+/*
+ * The reference clock hz, and the SECCNT and CNTR25M registers in this module,
+ * is always 25 MHz.
+ */
+#define NPCM7XX_CLOCK_REF_HZ            (25000000)
+
+/* Register Field Definitions */
+#define NPCM7XX_CLK_WDRCR_CA9C  BIT(0) /* Cortex A9 Cores */
+
 #define PLLCON_LOKI     BIT(31)
 #define PLLCON_LOKS     BIT(30)
 #define PLLCON_PWDEN    BIT(12)
+#define PLLCON_FBDV(con) extract32((con), 16, 12)
+#define PLLCON_OTDV2(con) extract32((con), 13, 3)
+#define PLLCON_OTDV1(con) extract32((con), 8, 3)
+#define PLLCON_INDV(con) extract32((con), 0, 6)
 
 enum NPCM7xxCLKRegisters {
     NPCM7XX_CLK_CLKEN1,
@@ -XXX,XX +XXX,XX @@ static const uint32_t cold_reset_values[NPCM7XX_CLK_NR_REGS] = {
     [NPCM7XX_CLK_AHBCKFI]       = 0x000000c8,
 };
 
-/* Register Field Definitions */
-#define NPCM7XX_CLK_WDRCR_CA9C  BIT(0) /* Cortex A9 Cores */
-
 /* The number of watchdogs that can trigger a reset. */
 #define NPCM7XX_NR_WATCHDOGS    (3)
 
+/* Clock converter functions */
+
+#define TYPE_NPCM7XX_CLOCK_PLL "npcm7xx-clock-pll"
+#define NPCM7XX_CLOCK_PLL(obj) OBJECT_CHECK(NPCM7xxClockPLLState, \
+        (obj), TYPE_NPCM7XX_CLOCK_PLL)
+#define TYPE_NPCM7XX_CLOCK_SEL "npcm7xx-clock-sel"
+#define NPCM7XX_CLOCK_SEL(obj) OBJECT_CHECK(NPCM7xxClockSELState, \
+        (obj), TYPE_NPCM7XX_CLOCK_SEL)
+#define TYPE_NPCM7XX_CLOCK_DIVIDER "npcm7xx-clock-divider"
+#define NPCM7XX_CLOCK_DIVIDER(obj) OBJECT_CHECK(NPCM7xxClockDividerState, \
+        (obj), TYPE_NPCM7XX_CLOCK_DIVIDER)
+
+static void npcm7xx_clk_update_pll(void *opaque)
+{
+    NPCM7xxClockPLLState *s = opaque;
+    uint32_t con = s->clk->regs[s->reg];
+    uint64_t freq;
+
+    /* The PLL is grounded if it is not locked yet. */
+    if (con & PLLCON_LOKI) {
+        freq = clock_get_hz(s->clock_in);
+        freq *= PLLCON_FBDV(con);
+        freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
+    } else {
+        freq = 0;
+    }
+
+    clock_update_hz(s->clock_out, freq);
+}
+
+static void npcm7xx_clk_update_sel(void *opaque)
+{
+    NPCM7xxClockSELState *s = opaque;
+    uint32_t index = extract32(s->clk->regs[NPCM7XX_CLK_CLKSEL], s->offset,
+            s->len);
+
+    if (index >= s->input_size) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: SEL index: %u out of range\n",
+                      __func__, index);
+        index = 0;
+    }
+    clock_update_hz(s->clock_out, clock_get_hz(s->clock_in[index]));
+}
+
+static void npcm7xx_clk_update_divider(void *opaque)
+{
+    NPCM7xxClockDividerState *s = opaque;
+    uint32_t freq;
+
+    freq = s->divide(s);
+    clock_update_hz(s->clock_out, freq);
+}
+
+static uint32_t divide_by_constant(NPCM7xxClockDividerState *s)
+{
+    return clock_get_hz(s->clock_in) / s->divisor;
+}
+
+static uint32_t divide_by_reg_divisor(NPCM7xxClockDividerState *s)
+{
+    return clock_get_hz(s->clock_in) /
+            (extract32(s->clk->regs[s->reg], s->offset, s->len) + 1);
+}
+
+static uint32_t divide_by_reg_divisor_times_2(NPCM7xxClockDividerState *s)
+{
+    return divide_by_reg_divisor(s) / 2;
+}
+
+static uint32_t shift_by_reg_divisor(NPCM7xxClockDividerState *s)
+{
+    return clock_get_hz(s->clock_in) >>
+        extract32(s->clk->regs[s->reg], s->offset, s->len);
+}
+
+static NPCM7xxClockPLL find_pll_by_reg(enum NPCM7xxCLKRegisters reg)
+{
+    switch (reg) {
+    case NPCM7XX_CLK_PLLCON0:
+        return NPCM7XX_CLOCK_PLL0;
+    case NPCM7XX_CLK_PLLCON1:
+        return NPCM7XX_CLOCK_PLL1;
+    case NPCM7XX_CLK_PLLCON2:
+        return NPCM7XX_CLOCK_PLL2;
+    case NPCM7XX_CLK_PLLCONG:
+        return NPCM7XX_CLOCK_PLLG;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void npcm7xx_clk_update_all_plls(NPCM7xxCLKState *clk)
+{
+    int i;
+
+    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
+        npcm7xx_clk_update_pll(&clk->plls[i]);
+    }
+}
+
+static void npcm7xx_clk_update_all_sels(NPCM7xxCLKState *clk)
+{
+    int i;
+
+    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
+        npcm7xx_clk_update_sel(&clk->sels[i]);
+    }
+}
+
+static void npcm7xx_clk_update_all_dividers(NPCM7xxCLKState *clk)
+{
+    int i;
+
+    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
+        npcm7xx_clk_update_divider(&clk->dividers[i]);
+    }
+}
+
+static void npcm7xx_clk_update_all_clocks(NPCM7xxCLKState *clk)
+{
+    clock_update_hz(clk->clkref, NPCM7XX_CLOCK_REF_HZ);
+    npcm7xx_clk_update_all_plls(clk);
+    npcm7xx_clk_update_all_sels(clk);
+    npcm7xx_clk_update_all_dividers(clk);
+}
+
+/* Types of clock sources. */
+typedef enum ClockSrcType {
+    CLKSRC_REF,
+    CLKSRC_PLL,
+    CLKSRC_SEL,
+    CLKSRC_DIV,
+} ClockSrcType;
+
+typedef struct PLLInitInfo {
+    const char *name;
+    ClockSrcType src_type;
+    int src_index;
+    int reg;
+    const char *public_name;
+} PLLInitInfo;
+
+typedef struct SELInitInfo {
+    const char *name;
+    uint8_t input_size;
+    ClockSrcType src_type[NPCM7XX_CLK_SEL_MAX_INPUT];
+    int src_index[NPCM7XX_CLK_SEL_MAX_INPUT];
+    int offset;
+    int len;
+    const char *public_name;
+} SELInitInfo;
+
+typedef struct DividerInitInfo {
+    const char *name;
+    ClockSrcType src_type;
+    int src_index;
+    uint32_t (*divide)(NPCM7xxClockDividerState *s);
+    int reg; /* not used when type == CONSTANT */
+    int offset; /* not used when type == CONSTANT */
+    int len; /* not used when type == CONSTANT */
+    int divisor; /* used only when type == CONSTANT */
+    const char *public_name;
+} DividerInitInfo;
+
+static const PLLInitInfo pll_init_info_list[] = {
+    [NPCM7XX_CLOCK_PLL0] = {
+        .name = "pll0",
+        .src_type = CLKSRC_REF,
+        .reg = NPCM7XX_CLK_PLLCON0,
+    },
+    [NPCM7XX_CLOCK_PLL1] = {
+        .name = "pll1",
+        .src_type = CLKSRC_REF,
+        .reg = NPCM7XX_CLK_PLLCON1,
+    },
+    [NPCM7XX_CLOCK_PLL2] = {
+        .name = "pll2",
+        .src_type = CLKSRC_REF,
+        .reg = NPCM7XX_CLK_PLLCON2,
+    },
+    [NPCM7XX_CLOCK_PLLG] = {
+        .name = "pllg",
+        .src_type = CLKSRC_REF,
+        .reg = NPCM7XX_CLK_PLLCONG,
+    },
+};
+
+static const SELInitInfo sel_init_info_list[] = {
+    [NPCM7XX_CLOCK_PIXCKSEL] = {
+        .name = "pixcksel",
+        .input_size = 2,
+        .src_type = {CLKSRC_PLL, CLKSRC_REF},
+        .src_index = {NPCM7XX_CLOCK_PLLG, 0},
+        .offset = 5,
+        .len = 1,
+        .public_name = "pixel-clock",
+    },
+    [NPCM7XX_CLOCK_MCCKSEL] = {
+        .name = "mccksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_DIV, CLKSRC_REF, CLKSRC_REF,
+            /*MCBPCK, shouldn't be used in normal operation*/
+            CLKSRC_REF},
+        .src_index = {NPCM7XX_CLOCK_PLL1D2, 0, 0, 0},
+        .offset = 12,
+        .len = 2,
+        .public_name = "mc-phy-clock",
+    },
+    [NPCM7XX_CLOCK_CPUCKSEL] = {
+        .name = "cpucksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF,
+            /*SYSBPCK, shouldn't be used in normal operation*/
+            CLKSRC_REF},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0, 0},
+        .offset = 0,
+        .len = 2,
+        .public_name = "system-clock",
+    },
+    [NPCM7XX_CLOCK_CLKOUTSEL] = {
+        .name = "clkoutsel",
+        .input_size = 5,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF,
+            CLKSRC_PLL, CLKSRC_DIV},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
+            NPCM7XX_CLOCK_PLLG, NPCM7XX_CLOCK_PLL2D2},
+        .offset = 18,
+        .len = 3,
+        .public_name = "tock",
+    },
+    [NPCM7XX_CLOCK_UARTCKSEL] = {
+        .name = "uartcksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
+            NPCM7XX_CLOCK_PLL2D2},
+        .offset = 8,
+        .len = 2,
+    },
+    [NPCM7XX_CLOCK_TIMCKSEL] = {
+        .name = "timcksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
+            NPCM7XX_CLOCK_PLL2D2},
+        .offset = 14,
+        .len = 2,
+    },
+    [NPCM7XX_CLOCK_SDCKSEL] = {
+        .name = "sdcksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
+            NPCM7XX_CLOCK_PLL2D2},
+        .offset = 6,
+        .len = 2,
+    },
+    [NPCM7XX_CLOCK_GFXMSEL] = {
+        .name = "gfxmksel",
+        .input_size = 2,
+        .src_type = {CLKSRC_REF, CLKSRC_PLL},
+        .src_index = {0, NPCM7XX_CLOCK_PLL2},
+        .offset = 21,
+        .len = 1,
+    },
+    [NPCM7XX_CLOCK_SUCKSEL] = {
+        .name = "sucksel",
+        .input_size = 4,
+        .src_type = {CLKSRC_PLL, CLKSRC_DIV, CLKSRC_REF, CLKSRC_DIV},
+        .src_index = {NPCM7XX_CLOCK_PLL0, NPCM7XX_CLOCK_PLL1D2, 0,
+            NPCM7XX_CLOCK_PLL2D2},
+        .offset = 10,
+        .len = 2,
+    },
+};
+
+static const DividerInitInfo divider_init_info_list[] = {
+    [NPCM7XX_CLOCK_PLL1D2] = {
+        .name = "pll1d2",
+        .src_type = CLKSRC_PLL,
+        .src_index = NPCM7XX_CLOCK_PLL1,
+        .divide = divide_by_constant,
+        .divisor = 2,
+    },
+    [NPCM7XX_CLOCK_PLL2D2] = {
+        .name = "pll2d2",
+        .src_type = CLKSRC_PLL,
+        .src_index = NPCM7XX_CLOCK_PLL2,
+        .divide = divide_by_constant,
+        .divisor = 2,
+    },
+    [NPCM7XX_CLOCK_MC_DIVIDER] = {
+        .name = "mc-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_MCCKSEL,
+        .divide = divide_by_constant,
+        .divisor = 2,
+        .public_name = "mc-clock"
+    },
+    [NPCM7XX_CLOCK_AXI_DIVIDER] = {
+        .name = "axi-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_CPUCKSEL,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 0,
+        .len = 1,
+        .public_name = "clk2"
+    },
+    [NPCM7XX_CLOCK_AHB_DIVIDER] = {
+        .name = "ahb-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AXI_DIVIDER,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 26,
+        .len = 2,
+        .public_name = "clk4"
+    },
+    [NPCM7XX_CLOCK_AHB3_DIVIDER] = {
+        .name = "ahb3-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 6,
+        .len = 5,
+        .public_name = "ahb3-spi3-clock"
+    },
+    [NPCM7XX_CLOCK_SPI0_DIVIDER] = {
+        .name = "spi0-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV3,
+        .offset = 6,
+        .len = 5,
+        .public_name = "spi0-clock",
+    },
+    [NPCM7XX_CLOCK_SPIX_DIVIDER] = {
+        .name = "spix-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV3,
+        .offset = 1,
+        .len = 5,
+        .public_name = "spix-clock",
+    },
+    [NPCM7XX_CLOCK_APB1_DIVIDER] = {
+        .name = "apb1-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 24,
+        .len = 2,
+        .public_name = "apb1-clock",
+    },
+    [NPCM7XX_CLOCK_APB2_DIVIDER] = {
+        .name = "apb2-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 26,
+        .len = 2,
+        .public_name = "apb2-clock",
+    },
+    [NPCM7XX_CLOCK_APB3_DIVIDER] = {
+        .name = "apb3-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 28,
+        .len = 2,
+        .public_name = "apb3-clock",
+    },
+    [NPCM7XX_CLOCK_APB4_DIVIDER] = {
+        .name = "apb4-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 30,
+        .len = 2,
+        .public_name = "apb4-clock",
+    },
+    [NPCM7XX_CLOCK_APB5_DIVIDER] = {
+        .name = "apb5-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_AHB_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 22,
+        .len = 2,
+        .public_name = "apb5-clock",
+    },
+    [NPCM7XX_CLOCK_CLKOUT_DIVIDER] = {
+        .name = "clkout-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_CLKOUTSEL,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 16,
+        .len = 5,
+        .public_name = "clkout",
+    },
+    [NPCM7XX_CLOCK_UART_DIVIDER] = {
+        .name = "uart-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_UARTCKSEL,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 16,
+        .len = 5,
+        .public_name = "uart-clock",
+    },
+    [NPCM7XX_CLOCK_TIMER_DIVIDER] = {
+        .name = "timer-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_TIMCKSEL,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 21,
+        .len = 5,
+        .public_name = "timer-clock",
+    },
+    [NPCM7XX_CLOCK_ADC_DIVIDER] = {
+        .name = "adc-divider",
+        .src_type = CLKSRC_DIV,
+        .src_index = NPCM7XX_CLOCK_TIMER_DIVIDER,
+        .divide = shift_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 28,
+        .len = 3,
+        .public_name = "adc-clock",
+    },
+    [NPCM7XX_CLOCK_MMC_DIVIDER] = {
+        .name = "mmc-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_SDCKSEL,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV1,
+        .offset = 11,
+        .len = 5,
+        .public_name = "mmc-clock",
+    },
+    [NPCM7XX_CLOCK_SDHC_DIVIDER] = {
+        .name = "sdhc-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_SDCKSEL,
+        .divide = divide_by_reg_divisor_times_2,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 0,
+        .len = 4,
+        .public_name = "sdhc-clock",
+    },
+    [NPCM7XX_CLOCK_GFXM_DIVIDER] = {
+        .name = "gfxm-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_GFXMSEL,
+        .divide = divide_by_constant,
+        .divisor = 3,
+        .public_name = "gfxm-clock",
+    },
+    [NPCM7XX_CLOCK_UTMI_DIVIDER] = {
+        .name = "utmi-divider",
+        .src_type = CLKSRC_SEL,
+        .src_index = NPCM7XX_CLOCK_SUCKSEL,
+        .divide = divide_by_reg_divisor,
+        .reg = NPCM7XX_CLK_CLKDIV2,
+        .offset = 8,
+        .len = 5,
+        .public_name = "utmi-clock",
+    },
+};
+
+static void npcm7xx_clk_pll_init(Object *obj)
+{
+    NPCM7xxClockPLLState *pll = NPCM7XX_CLOCK_PLL(obj);
+
+    pll->clock_in = qdev_init_clock_in(DEVICE(pll), "clock-in",
+            npcm7xx_clk_update_pll, pll);
+    pll->clock_out = qdev_init_clock_out(DEVICE(pll), "clock-out");
+}
+
+static void npcm7xx_clk_sel_init(Object *obj)
+{
+    int i;
+    NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
+
+    for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
+        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
+                g_strdup_printf("clock-in[%d]", i),
+                npcm7xx_clk_update_sel, sel);
+    }
+    sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
+}
+static void npcm7xx_clk_divider_init(Object *obj)
+{
+    NPCM7xxClockDividerState *div = NPCM7XX_CLOCK_DIVIDER(obj);
+
+    div->clock_in = qdev_init_clock_in(DEVICE(div), "clock-in",
+            npcm7xx_clk_update_divider, div);
+    div->clock_out = qdev_init_clock_out(DEVICE(div), "clock-out");
+}
+
+static void npcm7xx_init_clock_pll(NPCM7xxClockPLLState *pll,
+        NPCM7xxCLKState *clk, const PLLInitInfo *init_info)
+{
+    pll->name = init_info->name;
+    pll->clk = clk;
+    pll->reg = init_info->reg;
+    if (init_info->public_name != NULL) {
+        qdev_alias_clock(DEVICE(pll), "clock-out", DEVICE(clk),
+                init_info->public_name);
+    }
+}
+
+static void npcm7xx_init_clock_sel(NPCM7xxClockSELState *sel,
+        NPCM7xxCLKState *clk, const SELInitInfo *init_info)
+{
+    int input_size = init_info->input_size;
+
+    sel->name = init_info->name;
+    sel->clk = clk;
+    sel->input_size = init_info->input_size;
+    g_assert(input_size <= NPCM7XX_CLK_SEL_MAX_INPUT);
+    sel->offset = init_info->offset;
+    sel->len = init_info->len;
+    if (init_info->public_name != NULL) {
+        qdev_alias_clock(DEVICE(sel), "clock-out", DEVICE(clk),
+                init_info->public_name);
+    }
+}
+
+static void npcm7xx_init_clock_divider(NPCM7xxClockDividerState *div,
+        NPCM7xxCLKState *clk, const DividerInitInfo *init_info)
+{
+    div->name = init_info->name;
+    div->clk = clk;
+
+    div->divide = init_info->divide;
+    if (div->divide == divide_by_constant) {
+        div->divisor = init_info->divisor;
+    } else {
+        div->reg = init_info->reg;
+        div->offset = init_info->offset;
+        div->len = init_info->len;
+    }
+    if (init_info->public_name != NULL) {
+        qdev_alias_clock(DEVICE(div), "clock-out", DEVICE(clk),
+                init_info->public_name);
+    }
+}
+
+static Clock *npcm7xx_get_clock(NPCM7xxCLKState *clk, ClockSrcType type,
+        int index)
+{
+    switch (type) {
+    case CLKSRC_REF:
+        return clk->clkref;
+    case CLKSRC_PLL:
+        return clk->plls[index].clock_out;
+    case CLKSRC_SEL:
+        return clk->sels[index].clock_out;
+    case CLKSRC_DIV:
+        return clk->dividers[index].clock_out;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void npcm7xx_connect_clocks(NPCM7xxCLKState *clk)
+{
+    int i, j;
+    Clock *src;
+
+    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
+        src = npcm7xx_get_clock(clk, pll_init_info_list[i].src_type,
+                pll_init_info_list[i].src_index);
+        clock_set_source(clk->plls[i].clock_in, src);
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
+        for (j = 0; j < sel_init_info_list[i].input_size; ++j) {
+            src = npcm7xx_get_clock(clk, sel_init_info_list[i].src_type[j],
+                    sel_init_info_list[i].src_index[j]);
+            clock_set_source(clk->sels[i].clock_in[j], src);
+        }
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
+        src = npcm7xx_get_clock(clk, divider_init_info_list[i].src_type,
+                divider_init_info_list[i].src_index);
+        clock_set_source(clk->dividers[i].clock_in, src);
+    }
+}
+
 static uint64_t npcm7xx_clk_read(void *opaque, hwaddr offset, unsigned size)
 {
     uint32_t reg = offset / sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static uint64_t npcm7xx_clk_read(void *opaque, hwaddr offset, unsigned size)
          *
          * The 4 LSBs are always zero: (1e9 / 640) << 4 = 25000000.
          */
-        value = (((now_ns - s->ref_ns) / 640) << 4) % NPCM7XX_TIMER_REF_HZ;
+        value = (((now_ns - s->ref_ns) / 640) << 4) % NPCM7XX_CLOCK_REF_HZ;
         break;
 
     default:
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_write(void *opaque, hwaddr offset,
                 value |= (value & PLLCON_LOKS);
             }
         }
+        /* Only update PLL when it is locked. */
+        if (value & PLLCON_LOKI) {
+            npcm7xx_clk_update_pll(&s->plls[find_pll_by_reg(reg)]);
+        }
+        break;
+
+    case NPCM7XX_CLK_CLKSEL:
+        npcm7xx_clk_update_all_sels(s);
+        break;
+
+    case NPCM7XX_CLK_CLKDIV1:
+    case NPCM7XX_CLK_CLKDIV2:
+    case NPCM7XX_CLK_CLKDIV3:
+        npcm7xx_clk_update_all_dividers(s);
         break;
 
     case NPCM7XX_CLK_CNTR25M:
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_enter_reset(Object *obj, ResetType type)
     case RESET_TYPE_COLD:
         memcpy(s->regs, cold_reset_values, sizeof(cold_reset_values));
         s->ref_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+        npcm7xx_clk_update_all_clocks(s);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_enter_reset(Object *obj, ResetType type)
                   __func__, type);
 }
 
+static void npcm7xx_clk_init_clock_hierarchy(NPCM7xxCLKState *s)
+{
+    int i;
+
+    s->clkref = qdev_init_clock_in(DEVICE(s), "clkref", NULL, NULL);
+
+    /* First pass: init all converter modules */
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(pll_init_info_list) != NPCM7XX_CLOCK_NR_PLLS);
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(sel_init_info_list) != NPCM7XX_CLOCK_NR_SELS);
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(divider_init_info_list)
+            != NPCM7XX_CLOCK_NR_DIVIDERS);
+    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
+        object_initialize_child(OBJECT(s), pll_init_info_list[i].name,
+                &s->plls[i], TYPE_NPCM7XX_CLOCK_PLL);
+        npcm7xx_init_clock_pll(&s->plls[i], s,
+                &pll_init_info_list[i]);
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
+        object_initialize_child(OBJECT(s), sel_init_info_list[i].name,
+                &s->sels[i], TYPE_NPCM7XX_CLOCK_SEL);
+        npcm7xx_init_clock_sel(&s->sels[i], s,
+                &sel_init_info_list[i]);
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
+        object_initialize_child(OBJECT(s), divider_init_info_list[i].name,
+                &s->dividers[i], TYPE_NPCM7XX_CLOCK_DIVIDER);
+        npcm7xx_init_clock_divider(&s->dividers[i], s,
+                &divider_init_info_list[i]);
+    }
+
+    /* Second pass: connect converter modules */
+    npcm7xx_connect_clocks(s);
+
+    clock_update_hz(s->clkref, NPCM7XX_CLOCK_REF_HZ);
+}
+
 static void npcm7xx_clk_init(Object *obj)
 {
     NPCM7xxCLKState *s = NPCM7XX_CLK(obj);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_init(Object *obj)
     memory_region_init_io(&s->iomem, obj, &npcm7xx_clk_ops, s,
                           TYPE_NPCM7XX_CLK, 4 * KiB);
     sysbus_init_mmio(&s->parent, &s->iomem);
-    qdev_init_gpio_in_named(DEVICE(s), npcm7xx_clk_perform_watchdog_reset,
-            NPCM7XX_WATCHDOG_RESET_GPIO_IN, NPCM7XX_NR_WATCHDOGS);
 }
 
-static const VMStateDescription vmstate_npcm7xx_clk = {
-    .name = "npcm7xx-clk",
+static int npcm7xx_clk_post_load(void *opaque, int version_id)
+{
+    if (version_id >= 1) {
+        NPCM7xxCLKState *clk = opaque;
+
+        npcm7xx_clk_update_all_clocks(clk);
+    }
+
+    return 0;
+}
+
+static void npcm7xx_clk_realize(DeviceState *dev, Error **errp)
+{
+    int i;
+    NPCM7xxCLKState *s = NPCM7XX_CLK(dev);
+
+    qdev_init_gpio_in_named(DEVICE(s), npcm7xx_clk_perform_watchdog_reset,
+            NPCM7XX_WATCHDOG_RESET_GPIO_IN, NPCM7XX_NR_WATCHDOGS);
+    npcm7xx_clk_init_clock_hierarchy(s);
+
+    /* Realize child devices */
+    for (i = 0; i < NPCM7XX_CLOCK_NR_PLLS; ++i) {
+        if (!qdev_realize(DEVICE(&s->plls[i]), NULL, errp)) {
+            return;
+        }
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_SELS; ++i) {
+        if (!qdev_realize(DEVICE(&s->sels[i]), NULL, errp)) {
+            return;
+        }
+    }
+    for (i = 0; i < NPCM7XX_CLOCK_NR_DIVIDERS; ++i) {
+        if (!qdev_realize(DEVICE(&s->dividers[i]), NULL, errp)) {
+            return;
+        }
+    }
+}
+
+static const VMStateDescription vmstate_npcm7xx_clk_pll = {
+    .name = "npcm7xx-clock-pll",
     .version_id = 0,
     .minimum_version_id = 0,
-    .fields = (VMStateField[]) {
-        VMSTATE_UINT32_ARRAY(regs, NPCM7xxCLKState, NPCM7XX_CLK_NR_REGS),
-        VMSTATE_INT64(ref_ns, NPCM7xxCLKState),
+    .fields =  (VMStateField[]) {
+        VMSTATE_CLOCK(clock_in, NPCM7xxClockPLLState),
         VMSTATE_END_OF_LIST(),
     },
 };
 
+static const VMStateDescription vmstate_npcm7xx_clk_sel = {
+    .name = "npcm7xx-clock-sel",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields =  (VMStateField[]) {
+        VMSTATE_ARRAY_OF_POINTER_TO_STRUCT(clock_in, NPCM7xxClockSELState,
+                NPCM7XX_CLK_SEL_MAX_INPUT, 0, vmstate_clock, Clock),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static const VMStateDescription vmstate_npcm7xx_clk_divider = {
+    .name = "npcm7xx-clock-divider",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields =  (VMStateField[]) {
+        VMSTATE_CLOCK(clock_in, NPCM7xxClockDividerState),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static const VMStateDescription vmstate_npcm7xx_clk = {
+    .name = "npcm7xx-clk",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .post_load = npcm7xx_clk_post_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, NPCM7xxCLKState, NPCM7XX_CLK_NR_REGS),
+        VMSTATE_INT64(ref_ns, NPCM7xxCLKState),
+        VMSTATE_CLOCK(clkref, NPCM7xxCLKState),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void npcm7xx_clk_pll_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx Clock PLL Module";
+    dc->vmsd = &vmstate_npcm7xx_clk_pll;
+}
+
+static void npcm7xx_clk_sel_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx Clock SEL Module";
+    dc->vmsd = &vmstate_npcm7xx_clk_sel;
+}
+
+static void npcm7xx_clk_divider_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx Clock Divider Module";
+    dc->vmsd = &vmstate_npcm7xx_clk_divider;
+}
+
 static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
 {
     ResettableClass *rc = RESETTABLE_CLASS(klass);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_class_init(ObjectClass *klass, void *data)
 
     dc->desc = "NPCM7xx Clock Control Registers";
     dc->vmsd = &vmstate_npcm7xx_clk;
+    dc->realize = npcm7xx_clk_realize;
     rc->phases.enter = npcm7xx_clk_enter_reset;
 }
 
+static const TypeInfo npcm7xx_clk_pll_info = {
+    .name               = TYPE_NPCM7XX_CLOCK_PLL,
+    .parent             = TYPE_DEVICE,
+    .instance_size      = sizeof(NPCM7xxClockPLLState),
+    .instance_init      = npcm7xx_clk_pll_init,
+    .class_init         = npcm7xx_clk_pll_class_init,
+};
+
+static const TypeInfo npcm7xx_clk_sel_info = {
+    .name               = TYPE_NPCM7XX_CLOCK_SEL,
+    .parent             = TYPE_DEVICE,
+    .instance_size      = sizeof(NPCM7xxClockSELState),
+    .instance_init      = npcm7xx_clk_sel_init,
+    .class_init         = npcm7xx_clk_sel_class_init,
+};
+
+static const TypeInfo npcm7xx_clk_divider_info = {
+    .name               = TYPE_NPCM7XX_CLOCK_DIVIDER,
+    .parent             = TYPE_DEVICE,
+    .instance_size      = sizeof(NPCM7xxClockDividerState),
+    .instance_init      = npcm7xx_clk_divider_init,
+    .class_init         = npcm7xx_clk_divider_class_init,
+};
+
 static const TypeInfo npcm7xx_clk_info = {
     .name               = TYPE_NPCM7XX_CLK,
     .parent             = TYPE_SYS_BUS_DEVICE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_clk_info = {
 
 static void npcm7xx_clk_register_type(void)
 {
+    type_register_static(&npcm7xx_clk_pll_info);
+    type_register_static(&npcm7xx_clk_sel_info);
+    type_register_static(&npcm7xx_clk_divider_info);
     type_register_static(&npcm7xx_clk_info);
 }
 type_init(npcm7xx_clk_register_type);
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

This patch makes NPCM7XX Timer to use a the timer clock generated by the
CLK module instead of the magic number TIMER_REF_HZ.

diff --git a/include/hw/misc/npcm7xx_clk.h b/include/hw/misc/npcm7xx_clk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/npcm7xx_clk.h
+++ b/include/hw/misc/npcm7xx_clk.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/clock.h"
 #include "hw/sysbus.h"
 
-/*
- * The reference clock frequency for the timer modules, and the SECCNT and
- * CNTR25M registers in this module, is always 25 MHz.
- */
-#define NPCM7XX_TIMER_REF_HZ            (25000000)
-
 /*
  * Number of registers in our device state structure. Don't change this without
  * incrementing the version_id in the vmstate.
diff --git a/include/hw/timer/npcm7xx_timer.h b/include/hw/timer/npcm7xx_timer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/npcm7xx_timer.h
+++ b/include/hw/timer/npcm7xx_timer.h
@@ -XXX,XX +XXX,XX @@ struct NPCM7xxTimerCtrlState {
 
     uint32_t    tisr;
 
+    Clock       *clock;
     NPCM7xxTimer timer[NPCM7XX_TIMERS_PER_CTRL];
     NPCM7xxWatchdogTimer watchdog_timer;
 };
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "hw/loader.h"
 #include "hw/misc/unimp.h"
+#include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "qemu/units.h"
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
         int first_irq;
         int j;
 
+        /* Connect the timer clock. */
+        qdev_connect_clock_in(DEVICE(&s->tim[i]), "clock", qdev_get_clock_out(
+                    DEVICE(&s->clk), "timer-clock"));
+
         sysbus_realize(sbd, &error_abort);
         sysbus_mmio_map(sbd, 0, npcm7xx_tim_addr[i]);
 
diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/npcm7xx_timer.c
+++ b/hw/timer/npcm7xx_timer.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 
 #include "hw/irq.h"
+#include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
-#include "hw/misc/npcm7xx_clk.h"
 #include "hw/timer/npcm7xx_timer.h"
 #include "migration/vmstate.h"
 #include "qemu/bitops.h"
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_tcsr_prescaler(uint32_t tcsr)
 /* Convert a timer cycle count to a time interval in nanoseconds. */
 static int64_t npcm7xx_timer_count_to_ns(NPCM7xxTimer *t, uint32_t count)
 {
-    int64_t ns = count;
+    int64_t ticks = count;
 
-    ns *= NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ;
-    ns *= npcm7xx_tcsr_prescaler(t->tcsr);
+    ticks *= npcm7xx_tcsr_prescaler(t->tcsr);
 
-    return ns;
+    return clock_ticks_to_ns(t->ctrl->clock, ticks);
 }
 
 /* Convert a time interval in nanoseconds to a timer cycle count. */
 static uint32_t npcm7xx_timer_ns_to_count(NPCM7xxTimer *t, int64_t ns)
 {
-    int64_t count;
-
-    count = ns / (NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ);
-    count /= npcm7xx_tcsr_prescaler(t->tcsr);
-
-    return count;
+    return ns / clock_ticks_to_ns(t->ctrl->clock,
+                                  npcm7xx_tcsr_prescaler(t->tcsr));
 }
 
 static uint32_t npcm7xx_watchdog_timer_prescaler(const NPCM7xxWatchdogTimer *t)
@@ -XXX,XX +XXX,XX @@ static uint32_t npcm7xx_watchdog_timer_prescaler(const NPCM7xxWatchdogTimer *t)
 static void npcm7xx_watchdog_timer_reset_cycles(NPCM7xxWatchdogTimer *t,
         int64_t cycles)
 {
-    uint32_t prescaler = npcm7xx_watchdog_timer_prescaler(t);
-    int64_t ns = (NANOSECONDS_PER_SECOND / NPCM7XX_TIMER_REF_HZ) * cycles;
+    int64_t ticks = cycles * npcm7xx_watchdog_timer_prescaler(t);
+    int64_t ns = clock_ticks_to_ns(t->ctrl->clock, ticks);
 
     /*
      * The reset function always clears the current timer. The caller of the
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_watchdog_timer_reset_cycles(NPCM7xxWatchdogTimer *t,
      */
     npcm7xx_timer_clear(&t->base_timer);
 
-    ns *= prescaler;
     t->base_timer.remaining_ns = ns;
 }
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_hold_reset(Object *obj)
     qemu_irq_lower(s->watchdog_timer.irq);
 }
 
-static void npcm7xx_timer_realize(DeviceState *dev, Error **errp)
+static void npcm7xx_timer_init(Object *obj)
 {
-    NPCM7xxTimerCtrlState *s = NPCM7XX_TIMER(dev);
-    SysBusDevice *sbd = &s->parent;
+    NPCM7xxTimerCtrlState *s = NPCM7XX_TIMER(obj);
+    DeviceState *dev = DEVICE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     int i;
     NPCM7xxWatchdogTimer *w;
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_realize(DeviceState *dev, Error **errp)
             npcm7xx_watchdog_timer_expired, w);
     sysbus_init_irq(sbd, &w->irq);
 
-    memory_region_init_io(&s->iomem, OBJECT(s), &npcm7xx_timer_ops, s,
+    memory_region_init_io(&s->iomem, obj, &npcm7xx_timer_ops, s,
                           TYPE_NPCM7XX_TIMER, 4 * KiB);
     sysbus_init_mmio(sbd, &s->iomem);
     qdev_init_gpio_out_named(dev, &w->reset_signal,
             NPCM7XX_WATCHDOG_RESET_GPIO_OUT, 1);
+    s->clock = qdev_init_clock_in(dev, "clock", NULL, NULL);
 }
 
 static const VMStateDescription vmstate_npcm7xx_base_timer = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_npcm7xx_watchdog_timer = {
 
 static const VMStateDescription vmstate_npcm7xx_timer_ctrl = {
     .name = "npcm7xx-timer-ctrl",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(tisr, NPCM7xxTimerCtrlState),
+        VMSTATE_CLOCK(clock, NPCM7xxTimerCtrlState),
         VMSTATE_STRUCT_ARRAY(timer, NPCM7xxTimerCtrlState,
                              NPCM7XX_TIMERS_PER_CTRL, 0, vmstate_npcm7xx_timer,
                              NPCM7xxTimer),
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_class_init(ObjectClass *klass, void *data)
     QEMU_BUILD_BUG_ON(NPCM7XX_TIMER_REGS_END > NPCM7XX_TIMER_NR_REGS);
 
     dc->desc = "NPCM7xx Timer Controller";
-    dc->realize = npcm7xx_timer_realize;
     dc->vmsd = &vmstate_npcm7xx_timer_ctrl;
     rc->phases.enter = npcm7xx_timer_enter_reset;
     rc->phases.hold = npcm7xx_timer_hold_reset;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_timer_info = {
     .parent             = TYPE_SYS_BUS_DEVICE,
     .instance_size      = sizeof(NPCM7xxTimerCtrlState),
     .class_init         = npcm7xx_timer_class_init,
+    .instance_init      = npcm7xx_timer_init,
 };
 
 static void npcm7xx_timer_register_type(void)
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

The ADC is part of NPCM7XX Module. Its behavior is controled by the
ADC_CON register. It converts one of the eight analog inputs into a
digital input and stores it in the ADC_DATA register when enabled.

Users can alter input value by using qom-set QMP command.

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210108190945.949196-4-wuhaotsh@google.com
[PMM: Added missing hw/adc/trace.h file]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst    |   2 +-
 meson.build                    |   1 +
 hw/adc/trace.h                 |   1 +
 include/hw/adc/npcm7xx_adc.h   |  69 ++++++
 include/hw/arm/npcm7xx.h       |   2 +
 hw/adc/npcm7xx_adc.c           | 301 ++++++++++++++++++++++++++
 hw/arm/npcm7xx.c               |  24 ++-
 tests/qtest/npcm7xx_adc-test.c | 377 +++++++++++++++++++++++++++++++++
 hw/adc/meson.build             |   1 +
 hw/adc/trace-events            |   5 +
 tests/qtest/meson.build        |   3 +-
 11 files changed, 783 insertions(+), 3 deletions(-)
 create mode 100644 hw/adc/trace.h
 create mode 100644 include/hw/adc/npcm7xx_adc.h
 create mode 100644 hw/adc/npcm7xx_adc.c
 create mode 100644 tests/qtest/npcm7xx_adc-test.c
 create mode 100644 hw/adc/trace-events

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Supported devices
  * Random Number Generator (RNG)
  * USB host (USBH)
  * GPIO controller
+ * Analog to Digital Converter (ADC)
 
 Missing devices
 ---------------
@@ -XXX,XX +XXX,XX @@ Missing devices
  * USB device (USBD)
  * SMBus controller (SMBF)
  * Peripheral SPI controller (PSPI)
- * Analog to Digital Converter (ADC)
  * SD/MMC host
  * PECI interface
  * Pulse Width Modulation (PWM)
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if have_system
     'chardev',
     'hw/9pfs',
     'hw/acpi',
+    'hw/adc',
     'hw/alpha',
     'hw/arm',
     'hw/audio',
diff --git a/hw/adc/trace.h b/hw/adc/trace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/adc/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-hw_adc.h"
diff --git a/include/hw/adc/npcm7xx_adc.h b/include/hw/adc/npcm7xx_adc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/adc/npcm7xx_adc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx ADC Module
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+#ifndef NPCM7XX_ADC_H
+#define NPCM7XX_ADC_H
+
+#include "hw/clock.h"
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+
+#define NPCM7XX_ADC_NUM_INPUTS      8
+/**
+ * This value should not be changed unless write_adc_calibration function in
+ * hw/arm/npcm7xx.c is also changed.
+ */
+#define NPCM7XX_ADC_NUM_CALIB       2
+
+/**
+ * struct NPCM7xxADCState - Analog to Digital Converter Module device state.
+ * @parent: System bus device.
+ * @iomem: Memory region through which registers are accessed.
+ * @conv_timer: The timer counts down remaining cycles for the conversion.
+ * @irq: GIC interrupt line to fire on expiration (if enabled).
+ * @con: The Control Register.
+ * @data: The Data Buffer.
+ * @clock: The ADC Clock.
+ * @adci: The input voltage in units of uV. 1uv = 1e-6V.
+ * @vref: The external reference voltage.
+ * @iref: The internal reference voltage, initialized at launch time.
+ * @rv: The calibrated output values of 0.5V and 1.5V for the ADC.
+ */
+typedef struct {
+    SysBusDevice parent;
+
+    MemoryRegion iomem;
+
+    QEMUTimer    conv_timer;
+
+    qemu_irq     irq;
+    uint32_t     con;
+    uint32_t     data;
+    Clock       *clock;
+
+    /* Voltages are in unit of uV. 1V = 1000000uV. */
+    uint32_t     adci[NPCM7XX_ADC_NUM_INPUTS];
+    uint32_t     vref;
+    uint32_t     iref;
+
+    uint16_t     calibration_r_values[NPCM7XX_ADC_NUM_CALIB];
+} NPCM7xxADCState;
+
+#define TYPE_NPCM7XX_ADC "npcm7xx-adc"
+#define NPCM7XX_ADC(obj) \
+    OBJECT_CHECK(NPCM7xxADCState, (obj), TYPE_NPCM7XX_ADC)
+
+#endif /* NPCM7XX_ADC_H */
diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/npcm7xx.h
+++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
 #define NPCM7XX_H
 
 #include "hw/boards.h"
+#include "hw/adc/npcm7xx_adc.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/gpio/npcm7xx_gpio.h"
 #include "hw/mem/npcm7xx_mc.h"
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
     NPCM7xxGCRState     gcr;
     NPCM7xxCLKState     clk;
     NPCM7xxTimerCtrlState tim[3];
+    NPCM7xxADCState     adc;
     NPCM7xxOTPState     key_storage;
     NPCM7xxOTPState     fuse_array;
     NPCM7xxMCState      mc;
diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/adc/npcm7xx_adc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx ADC Module
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/adc/npcm7xx_adc.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/timer.h"
+#include "qemu/units.h"
+#include "trace.h"
+
+REG32(NPCM7XX_ADC_CON, 0x0)
+REG32(NPCM7XX_ADC_DATA, 0x4)
+
+/* Register field definitions. */
+#define NPCM7XX_ADC_CON_MUX(rv) extract32(rv, 24, 4)
+#define NPCM7XX_ADC_CON_INT_EN  BIT(21)
+#define NPCM7XX_ADC_CON_REFSEL  BIT(19)
+#define NPCM7XX_ADC_CON_INT     BIT(18)
+#define NPCM7XX_ADC_CON_EN      BIT(17)
+#define NPCM7XX_ADC_CON_RST     BIT(16)
+#define NPCM7XX_ADC_CON_CONV    BIT(14)
+#define NPCM7XX_ADC_CON_DIV(rv) extract32(rv, 1, 8)
+
+#define NPCM7XX_ADC_MAX_RESULT      1023
+#define NPCM7XX_ADC_DEFAULT_IREF    2000000
+#define NPCM7XX_ADC_CONV_CYCLES     20
+#define NPCM7XX_ADC_RESET_CYCLES    10
+#define NPCM7XX_ADC_R0_INPUT        500000
+#define NPCM7XX_ADC_R1_INPUT        1500000
+
+static void npcm7xx_adc_reset(NPCM7xxADCState *s)
+{
+    timer_del(&s->conv_timer);
+    s->con = 0x000c0001;
+    s->data = 0x00000000;
+}
+
+static uint32_t npcm7xx_adc_convert(uint32_t input, uint32_t ref)
+{
+    uint32_t result;
+
+    result = input * (NPCM7XX_ADC_MAX_RESULT + 1) / ref;
+    if (result > NPCM7XX_ADC_MAX_RESULT) {
+        result = NPCM7XX_ADC_MAX_RESULT;
+    }
+
+    return result;
+}
+
+static uint32_t npcm7xx_adc_prescaler(NPCM7xxADCState *s)
+{
+    return 2 * (NPCM7XX_ADC_CON_DIV(s->con) + 1);
+}
+
+static void npcm7xx_adc_start_timer(Clock *clk, QEMUTimer *timer,
+        uint32_t cycles, uint32_t prescaler)
+{
+    int64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
+    int64_t ticks = cycles;
+    int64_t ns;
+
+    ticks *= prescaler;
+    ns = clock_ticks_to_ns(clk, ticks);
+    ns += now;
+    timer_mod(timer, ns);
+}
+
+static void npcm7xx_adc_start_convert(NPCM7xxADCState *s)
+{
+    uint32_t prescaler = npcm7xx_adc_prescaler(s);
+
+    npcm7xx_adc_start_timer(s->clock, &s->conv_timer, NPCM7XX_ADC_CONV_CYCLES,
+            prescaler);
+}
+
+static void npcm7xx_adc_convert_done(void *opaque)
+{
+    NPCM7xxADCState *s = opaque;
+    uint32_t input = NPCM7XX_ADC_CON_MUX(s->con);
+    uint32_t ref = (s->con & NPCM7XX_ADC_CON_REFSEL)
+        ? s->iref : s->vref;
+
+    if (input >= NPCM7XX_ADC_NUM_INPUTS) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid input: %u\n",
+                      __func__, input);
+        return;
+    }
+    s->data = npcm7xx_adc_convert(s->adci[input], ref);
+    if (s->con & NPCM7XX_ADC_CON_INT_EN) {
+        s->con |= NPCM7XX_ADC_CON_INT;
+        qemu_irq_raise(s->irq);
+    }
+    s->con &= ~NPCM7XX_ADC_CON_CONV;
+}
+
+static void npcm7xx_adc_calibrate(NPCM7xxADCState *adc)
+{
+    adc->calibration_r_values[0] = npcm7xx_adc_convert(NPCM7XX_ADC_R0_INPUT,
+            adc->iref);
+    adc->calibration_r_values[1] = npcm7xx_adc_convert(NPCM7XX_ADC_R1_INPUT,
+            adc->iref);
+}
+
+static void npcm7xx_adc_write_con(NPCM7xxADCState *s, uint32_t new_con)
+{
+    uint32_t old_con = s->con;
+
+    /* Write ADC_INT to 1 to clear it */
+    if (new_con & NPCM7XX_ADC_CON_INT) {
+        new_con &= ~NPCM7XX_ADC_CON_INT;
+        qemu_irq_lower(s->irq);
+    } else if (old_con & NPCM7XX_ADC_CON_INT) {
+        new_con |= NPCM7XX_ADC_CON_INT;
+    }
+
+    s->con = new_con;
+
+    if (s->con & NPCM7XX_ADC_CON_RST) {
+        npcm7xx_adc_reset(s);
+        return;
+    }
+
+    if ((s->con & NPCM7XX_ADC_CON_EN)) {
+        if (s->con & NPCM7XX_ADC_CON_CONV) {
+            if (!(old_con & NPCM7XX_ADC_CON_CONV)) {
+                npcm7xx_adc_start_convert(s);
+            }
+        } else {
+            timer_del(&s->conv_timer);
+        }
+    }
+}
+
+static uint64_t npcm7xx_adc_read(void *opaque, hwaddr offset, unsigned size)
+{
+    uint64_t value = 0;
+    NPCM7xxADCState *s = opaque;
+
+    switch (offset) {
+    case A_NPCM7XX_ADC_CON:
+        value = s->con;
+        break;
+
+    case A_NPCM7XX_ADC_DATA:
+        value = s->data;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+
+    trace_npcm7xx_adc_read(DEVICE(s)->canonical_path, offset, value);
+    return value;
+}
+
+static void npcm7xx_adc_write(void *opaque, hwaddr offset, uint64_t v,
+        unsigned size)
+{
+    NPCM7xxADCState *s = opaque;
+
+    trace_npcm7xx_adc_write(DEVICE(s)->canonical_path, offset, v);
+    switch (offset) {
+    case A_NPCM7XX_ADC_CON:
+        npcm7xx_adc_write_con(s, v);
+        break;
+
+    case A_NPCM7XX_ADC_DATA:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: register @ 0x%04" HWADDR_PRIx " is read-only\n",
+                      __func__, offset);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+
+}
+
+static const struct MemoryRegionOps npcm7xx_adc_ops = {
+    .read       = npcm7xx_adc_read,
+    .write      = npcm7xx_adc_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid      = {
+        .min_access_size        = 4,
+        .max_access_size        = 4,
+        .unaligned              = false,
+    },
+};
+
+static void npcm7xx_adc_enter_reset(Object *obj, ResetType type)
+{
+    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
+
+    npcm7xx_adc_reset(s);
+}
+
+static void npcm7xx_adc_hold_reset(Object *obj)
+{
+    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
+
+    qemu_irq_lower(s->irq);
+}
+
+static void npcm7xx_adc_init(Object *obj)
+{
+    NPCM7xxADCState *s = NPCM7XX_ADC(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    int i;
+
+    sysbus_init_irq(sbd, &s->irq);
+
+    timer_init_ns(&s->conv_timer, QEMU_CLOCK_VIRTUAL,
+            npcm7xx_adc_convert_done, s);
+    memory_region_init_io(&s->iomem, obj, &npcm7xx_adc_ops, s,
+                          TYPE_NPCM7XX_ADC, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+    s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL);
+
+    for (i = 0; i < NPCM7XX_ADC_NUM_INPUTS; ++i) {
+        object_property_add_uint32_ptr(obj, "adci[*]",
+                &s->adci[i], OBJ_PROP_FLAG_WRITE);
+    }
+    object_property_add_uint32_ptr(obj, "vref",
+            &s->vref, OBJ_PROP_FLAG_WRITE);
+    npcm7xx_adc_calibrate(s);
+}
+
+static const VMStateDescription vmstate_npcm7xx_adc = {
+    .name = "npcm7xx-adc",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_TIMER(conv_timer, NPCM7xxADCState),
+        VMSTATE_UINT32(con, NPCM7xxADCState),
+        VMSTATE_UINT32(data, NPCM7xxADCState),
+        VMSTATE_CLOCK(clock, NPCM7xxADCState),
+        VMSTATE_UINT32_ARRAY(adci, NPCM7xxADCState, NPCM7XX_ADC_NUM_INPUTS),
+        VMSTATE_UINT32(vref, NPCM7xxADCState),
+        VMSTATE_UINT32(iref, NPCM7xxADCState),
+        VMSTATE_UINT16_ARRAY(calibration_r_values, NPCM7xxADCState,
+                NPCM7XX_ADC_NUM_CALIB),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static Property npcm7xx_timer_properties[] = {
+    DEFINE_PROP_UINT32("iref", NPCM7xxADCState, iref, NPCM7XX_ADC_DEFAULT_IREF),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void npcm7xx_adc_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx ADC Module";
+    dc->vmsd = &vmstate_npcm7xx_adc;
+    rc->phases.enter = npcm7xx_adc_enter_reset;
+    rc->phases.hold = npcm7xx_adc_hold_reset;
+
+    device_class_set_props(dc, npcm7xx_timer_properties);
+}
+
+static const TypeInfo npcm7xx_adc_info = {
+    .name               = TYPE_NPCM7XX_ADC,
+    .parent             = TYPE_SYS_BUS_DEVICE,
+    .instance_size      = sizeof(NPCM7xxADCState),
+    .class_init         = npcm7xx_adc_class_init,
+    .instance_init      = npcm7xx_adc_init,
+};
+
+static void npcm7xx_adc_register_types(void)
+{
+    type_register_static(&npcm7xx_adc_info);
+}
+
+type_init(npcm7xx_adc_register_types);
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@
 #define NPCM7XX_EHCI_BA         (0xf0806000)
 #define NPCM7XX_OHCI_BA         (0xf0807000)
 
+/* ADC Module */
+#define NPCM7XX_ADC_BA          (0xf000c000)
+
 /* Internal AHB SRAM */
 #define NPCM7XX_RAM3_BA         (0xc0008000)
 #define NPCM7XX_RAM3_SZ         (4 * KiB)
@@ -XXX,XX +XXX,XX @@
 #define NPCM7XX_ROM_BA          (0xffff0000)
 #define NPCM7XX_ROM_SZ          (64 * KiB)
 
+
 /* Clock configuration values to be fixed up when bypassing bootloader */
 
 /* Run PLL1 at 1600 MHz */
@@ -XXX,XX +XXX,XX @@
  * interrupts.
  */
 enum NPCM7xxInterrupt {
+    NPCM7XX_ADC_IRQ             = 0,
     NPCM7XX_UART0_IRQ           = 2,
     NPCM7XX_UART1_IRQ,
     NPCM7XX_UART2_IRQ,
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init_fuses(NPCM7xxState *s)
                             sizeof(value));
 }
 
+static void npcm7xx_write_adc_calibration(NPCM7xxState *s)
+{
+    /* Both ADC and the fuse array must have realized. */
+    QEMU_BUILD_BUG_ON(sizeof(s->adc.calibration_r_values) != 4);
+    npcm7xx_otp_array_write(&s->fuse_array, s->adc.calibration_r_values,
+            NPCM7XX_FUSE_ADC_CALIB, sizeof(s->adc.calibration_r_values));
+}
+
 static qemu_irq npcm7xx_irq(NPCM7xxState *s, int n)
 {
     return qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
                             TYPE_NPCM7XX_FUSE_ARRAY);
     object_initialize_child(obj, "mc", &s->mc, TYPE_NPCM7XX_MC);
     object_initialize_child(obj, "rng", &s->rng, TYPE_NPCM7XX_RNG);
+    object_initialize_child(obj, "adc", &s->adc, TYPE_NPCM7XX_ADC);
 
     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
         object_initialize_child(obj, "tim[*]", &s->tim[i], TYPE_NPCM7XX_TIMER);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->mc), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->mc), 0, NPCM7XX_MC_BA);
 
+    /* ADC Modules. Cannot fail. */
+    qdev_connect_clock_in(DEVICE(&s->adc), "clock", qdev_get_clock_out(
+                          DEVICE(&s->clk), "adc-clock"));
+    sysbus_realize(SYS_BUS_DEVICE(&s->adc), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->adc), 0, NPCM7XX_ADC_BA);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
+            npcm7xx_irq(s, NPCM7XX_ADC_IRQ));
+    npcm7xx_write_adc_calibration(s);
+
     /* Timer Modules (TIM). Cannot fail. */
     QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_tim_addr) != ARRAY_SIZE(s->tim));
     for (i = 0; i < ARRAY_SIZE(s->tim); i++) {
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
     create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
     create_unimplemented_device("npcm7xx.kcs",          0xf0007000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.adc",          0xf000c000,   4 * KiB);
     create_unimplemented_device("npcm7xx.gfxi",         0xf000e000,   4 * KiB);
     create_unimplemented_device("npcm7xx.gpio[0]",      0xf0010000,   4 * KiB);
     create_unimplemented_device("npcm7xx.gpio[1]",      0xf0011000,   4 * KiB);
diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/npcm7xx_adc-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTests for Nuvoton NPCM7xx ADCModules.
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "qemu/timer.h"
+#include "libqos/libqtest.h"
+#include "qapi/qmp/qdict.h"
+
+#define REF_HZ          (25000000)
+
+#define CON_OFFSET      0x0
+#define DATA_OFFSET     0x4
+
+#define NUM_INPUTS      8
+#define DEFAULT_IREF    2000000
+#define CONV_CYCLES     20
+#define RESET_CYCLES    10
+#define R0_INPUT        500000
+#define R1_INPUT        1500000
+#define MAX_RESULT      1023
+
+#define DEFAULT_CLKDIV  5
+
+#define FUSE_ARRAY_BA   0xf018a000
+#define FCTL_OFFSET     0x14
+#define FST_OFFSET      0x0
+#define FADDR_OFFSET    0x4
+#define FDATA_OFFSET    0x8
+#define ADC_CALIB_ADDR  24
+#define FUSE_READ       0x2
+
+/* Register field definitions. */
+#define CON_MUX(rv) ((rv) << 24)
+#define CON_INT_EN  BIT(21)
+#define CON_REFSEL  BIT(19)
+#define CON_INT     BIT(18)
+#define CON_EN      BIT(17)
+#define CON_RST     BIT(16)
+#define CON_CONV    BIT(14)
+#define CON_DIV(rv) extract32(rv, 1, 8)
+
+#define FST_RDST    BIT(1)
+#define FDATA_MASK  0xff
+
+#define MAX_ERROR   10000
+#define MIN_CALIB_INPUT 100000
+#define MAX_CALIB_INPUT 1800000
+
+static const uint32_t input_list[] = {
+    100000,
+    500000,
+    1000000,
+    1500000,
+    1800000,
+    2000000,
+};
+
+static const uint32_t vref_list[] = {
+    2000000,
+    2200000,
+    2500000,
+};
+
+static const uint32_t iref_list[] = {
+    1800000,
+    1900000,
+    2000000,
+    2100000,
+    2200000,
+};
+
+static const uint32_t div_list[] = {0, 1, 3, 7, 15};
+
+typedef struct ADC {
+    int irq;
+    uint64_t base_addr;
+} ADC;
+
+ADC adc = {
+    .irq        = 0,
+    .base_addr  = 0xf000c000
+};
+
+static uint32_t adc_read_con(QTestState *qts, const ADC *adc)
+{
+    return qtest_readl(qts, adc->base_addr + CON_OFFSET);
+}
+
+static void adc_write_con(QTestState *qts, const ADC *adc, uint32_t value)
+{
+    qtest_writel(qts, adc->base_addr + CON_OFFSET, value);
+}
+
+static uint32_t adc_read_data(QTestState *qts, const ADC *adc)
+{
+    return qtest_readl(qts, adc->base_addr + DATA_OFFSET);
+}
+
+static uint32_t adc_calibrate(uint32_t measured, uint32_t *rv)
+{
+    return R0_INPUT + (R1_INPUT - R0_INPUT) * (int32_t)(measured - rv[0])
+        / (int32_t)(rv[1] - rv[0]);
+}
+
+static void adc_qom_set(QTestState *qts, const ADC *adc,
+        const char *name, uint32_t value)
+{
+    QDict *response;
+    const char *path = "/machine/soc/adc";
+
+    g_test_message("Setting properties %s of %s with value %u",
+            name, path, value);
+    response = qtest_qmp(qts, "{ 'execute': 'qom-set',"
+            " 'arguments': { 'path': %s, 'property': %s, 'value': %u}}",
+            path, name, value);
+    /* The qom set message returns successfully. */
+    g_assert_true(qdict_haskey(response, "return"));
+}
+
+static void adc_write_input(QTestState *qts, const ADC *adc,
+        uint32_t index, uint32_t value)
+{
+    char name[100];
+
+    sprintf(name, "adci[%u]", index);
+    adc_qom_set(qts, adc, name, value);
+}
+
+static void adc_write_vref(QTestState *qts, const ADC *adc, uint32_t value)
+{
+    adc_qom_set(qts, adc, "vref", value);
+}
+
+static uint32_t adc_calculate_output(uint32_t input, uint32_t ref)
+{
+    uint32_t output;
+
+    g_assert_cmpuint(input, <=, ref);
+    output = (input * (MAX_RESULT + 1)) / ref;
+    if (output > MAX_RESULT) {
+        output = MAX_RESULT;
+    }
+
+    return output;
+}
+
+static uint32_t adc_prescaler(QTestState *qts, const ADC *adc)
+{
+    uint32_t div = extract32(adc_read_con(qts, adc), 1, 8);
+
+    return 2 * (div + 1);
+}
+
+static int64_t adc_calculate_steps(uint32_t cycles, uint32_t prescale,
+        uint32_t clkdiv)
+{
+    return (NANOSECONDS_PER_SECOND / (REF_HZ >> clkdiv)) * cycles * prescale;
+}
+
+static void adc_wait_conv_finished(QTestState *qts, const ADC *adc,
+        uint32_t clkdiv)
+{
+    uint32_t prescaler = adc_prescaler(qts, adc);
+
+    /*
+     * ADC should takes roughly 20 cycles to convert one sample. So we assert it
+     * should take 10~30 cycles here.
+     */
+    qtest_clock_step(qts, adc_calculate_steps(CONV_CYCLES / 2, prescaler,
+                clkdiv));
+    /* ADC is still converting. */
+    g_assert_true(adc_read_con(qts, adc) & CON_CONV);
+    qtest_clock_step(qts, adc_calculate_steps(CONV_CYCLES, prescaler, clkdiv));
+    /* ADC has finished conversion. */
+    g_assert_false(adc_read_con(qts, adc) & CON_CONV);
+}
+
+/* Check ADC can be reset to default value. */
+static void test_init(gconstpointer adc_p)
+{
+    const ADC *adc = adc_p;
+
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    adc_write_con(qts, adc, CON_REFSEL | CON_INT);
+    g_assert_cmphex(adc_read_con(qts, adc), ==, CON_REFSEL);
+    qtest_quit(qts);
+}
+
+/* Check ADC can convert from an internal reference. */
+static void test_convert_internal(gconstpointer adc_p)
+{
+    const ADC *adc = adc_p;
+    uint32_t index, input, output, expected_output;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
+
+    for (index = 0; index < NUM_INPUTS; ++index) {
+        for (size_t i = 0; i < ARRAY_SIZE(input_list); ++i) {
+            input = input_list[i];
+            expected_output = adc_calculate_output(input, DEFAULT_IREF);
+
+            adc_write_input(qts, adc, index, input);
+            adc_write_con(qts, adc, CON_MUX(index) | CON_REFSEL | CON_INT |
+                    CON_EN | CON_CONV);
+            adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
+            g_assert_cmphex(adc_read_con(qts, adc), ==, CON_MUX(index) |
+                    CON_REFSEL | CON_EN);
+            g_assert_false(qtest_get_irq(qts, adc->irq));
+            output = adc_read_data(qts, adc);
+            g_assert_cmpuint(output, ==, expected_output);
+        }
+    }
+
+    qtest_quit(qts);
+}
+
+/* Check ADC can convert from an external reference. */
+static void test_convert_external(gconstpointer adc_p)
+{
+    const ADC *adc = adc_p;
+    uint32_t index, input, vref, output, expected_output;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
+
+    for (index = 0; index < NUM_INPUTS; ++index) {
+        for (size_t i = 0; i < ARRAY_SIZE(input_list); ++i) {
+            for (size_t j = 0; j < ARRAY_SIZE(vref_list); ++j) {
+                input = input_list[i];
+                vref = vref_list[j];
+                expected_output = adc_calculate_output(input, vref);
+
+                adc_write_input(qts, adc, index, input);
+                adc_write_vref(qts, adc, vref);
+                adc_write_con(qts, adc, CON_MUX(index) | CON_INT | CON_EN |
+                        CON_CONV);
+                adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
+                g_assert_cmphex(adc_read_con(qts, adc), ==,
+                        CON_MUX(index) | CON_EN);
+                g_assert_false(qtest_get_irq(qts, adc->irq));
+                output = adc_read_data(qts, adc);
+                g_assert_cmpuint(output, ==, expected_output);
+            }
+        }
+    }
+
+    qtest_quit(qts);
+}
+
+/* Check ADC interrupt files if and only if CON_INT_EN is set. */
+static void test_interrupt(gconstpointer adc_p)
+{
+    const ADC *adc = adc_p;
+    uint32_t index, input, output, expected_output;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+
+    index = 1;
+    input = input_list[1];
+    expected_output = adc_calculate_output(input, DEFAULT_IREF);
+
+    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
+    adc_write_input(qts, adc, index, input);
+    g_assert_false(qtest_get_irq(qts, adc->irq));
+    adc_write_con(qts, adc, CON_MUX(index) | CON_INT_EN | CON_REFSEL | CON_INT
+            | CON_EN | CON_CONV);
+    adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
+    g_assert_cmphex(adc_read_con(qts, adc), ==, CON_MUX(index) | CON_INT_EN
+            | CON_REFSEL | CON_INT | CON_EN);
+    g_assert_true(qtest_get_irq(qts, adc->irq));
+    output = adc_read_data(qts, adc);
+    g_assert_cmpuint(output, ==, expected_output);
+
+    qtest_quit(qts);
+}
+
+/* Check ADC is reset after setting ADC_RST for 10 ADC cycles. */
+static void test_reset(gconstpointer adc_p)
+{
+    const ADC *adc = adc_p;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+
+    for (size_t i = 0; i < ARRAY_SIZE(div_list); ++i) {
+        uint32_t div = div_list[i];
+
+        adc_write_con(qts, adc, CON_INT | CON_EN | CON_RST | CON_DIV(div));
+        qtest_clock_step(qts, adc_calculate_steps(RESET_CYCLES,
+                    adc_prescaler(qts, adc), DEFAULT_CLKDIV));
+        g_assert_false(adc_read_con(qts, adc) & CON_EN);
+    }
+    qtest_quit(qts);
+}
+
+/* Check ADC Calibration works as desired. */
+static void test_calibrate(gconstpointer adc_p)
+{
+    int i, j;
+    const ADC *adc = adc_p;
+
+    for (j = 0; j < ARRAY_SIZE(iref_list); ++j) {
+        uint32_t iref = iref_list[j];
+        uint32_t expected_rv[] = {
+            adc_calculate_output(R0_INPUT, iref),
+            adc_calculate_output(R1_INPUT, iref),
+        };
+        char buf[100];
+        QTestState *qts;
+
+        sprintf(buf, "-machine quanta-gsj -global npcm7xx-adc.iref=%u", iref);
+        qts = qtest_init(buf);
+
+        /* Check the converted value is correct using the calibration value. */
+        for (i = 0; i < ARRAY_SIZE(input_list); ++i) {
+            uint32_t input;
+            uint32_t output;
+            uint32_t expected_output;
+            uint32_t calibrated_voltage;
+            uint32_t index = 0;
+
+            input = input_list[i];
+            /* Calibration only works for input range 0.1V ~ 1.8V. */
+            if (input < MIN_CALIB_INPUT || input > MAX_CALIB_INPUT) {
+                continue;
+            }
+            expected_output = adc_calculate_output(input, iref);
+
+            adc_write_input(qts, adc, index, input);
+            adc_write_con(qts, adc, CON_MUX(index) | CON_REFSEL | CON_INT |
+                    CON_EN | CON_CONV);
+            adc_wait_conv_finished(qts, adc, DEFAULT_CLKDIV);
+            g_assert_cmphex(adc_read_con(qts, adc), ==,
+                    CON_REFSEL | CON_MUX(index) | CON_EN);
+            output = adc_read_data(qts, adc);
+            g_assert_cmpuint(output, ==, expected_output);
+
+            calibrated_voltage = adc_calibrate(output, expected_rv);
+            g_assert_cmpuint(calibrated_voltage, >, input - MAX_ERROR);
+            g_assert_cmpuint(calibrated_voltage, <, input + MAX_ERROR);
+        }
+
+        qtest_quit(qts);
+    }
+}
+
+static void adc_add_test(const char *name, const ADC* wd,
+        GTestDataFunc fn)
+{
+    g_autofree char *full_name = g_strdup_printf("npcm7xx_adc/%s",  name);
+    qtest_add_data_func(full_name, wd, fn);
+}
+#define add_test(name, td) adc_add_test(#name, td, test_##name)
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    add_test(init, &adc);
+    add_test(convert_internal, &adc);
+    add_test(convert_external, &adc);
+    add_test(interrupt, &adc);
+    add_test(reset, &adc);
+    add_test(calibrate, &adc);
+
+    return g_test_run();
+}
diff --git a/hw/adc/meson.build b/hw/adc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/adc/meson.build
+++ b/hw/adc/meson.build
@@ -1 +1,2 @@
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_ADC', if_true: files('stm32f2xx_adc.c'))
+softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_adc.c'))
diff --git a/hw/adc/trace-events b/hw/adc/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/adc/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# npcm7xx_adc.c
+npcm7xx_adc_read(const char *id, uint64_t offset, uint32_t value) " %s offset: 0x%04" PRIx64 " value 0x%04" PRIx32
+npcm7xx_adc_write(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value 0x%04" PRIx32
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_sparc64 = \
   ['prom-env-test', 'boot-serial-test']
 
 qtests_npcm7xx = \
-  ['npcm7xx_gpio-test',
+  ['npcm7xx_adc-test',
+   'npcm7xx_gpio-test',
    'npcm7xx_rng-test',
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

The PWM module is part of NPCM7XX module. Each NPCM7XX module has two
identical PWM modules. Each module contains 4 PWM entries. Each PWM has
two outputs: frequency and duty_cycle. Both are computed using inputs
from software side.

This module does not model detail pulse signals since it is expensive.
It also does not model interrupts and watchdogs that are dependant on
the detail models. The interfaces for these are left in the module so
that anyone in need for these functionalities can implement on their
own.

The user can read the duty cycle and frequency using qom-get command.

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Supported devices
  * USB host (USBH)
  * GPIO controller
  * Analog to Digital Converter (ADC)
+ * Pulse Width Modulation (PWM)
 
 Missing devices
 ---------------
@@ -XXX,XX +XXX,XX @@ Missing devices
  * Peripheral SPI controller (PSPI)
  * SD/MMC host
  * PECI interface
- * Pulse Width Modulation (PWM)
  * Tachometer
  * PCI and PCIe root complex and bridges
  * VDM and MCTP support
diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/npcm7xx.h
+++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/mem/npcm7xx_mc.h"
 #include "hw/misc/npcm7xx_clk.h"
 #include "hw/misc/npcm7xx_gcr.h"
+#include "hw/misc/npcm7xx_pwm.h"
 #include "hw/misc/npcm7xx_rng.h"
 #include "hw/nvram/npcm7xx_otp.h"
 #include "hw/timer/npcm7xx_timer.h"
@@ -XXX,XX +XXX,XX @@ typedef struct NPCM7xxState {
     NPCM7xxCLKState     clk;
     NPCM7xxTimerCtrlState tim[3];
     NPCM7xxADCState     adc;
+    NPCM7xxPWMState     pwm[2];
     NPCM7xxOTPState     key_storage;
     NPCM7xxOTPState     fuse_array;
     NPCM7xxMCState      mc;
diff --git a/include/hw/misc/npcm7xx_pwm.h b/include/hw/misc/npcm7xx_pwm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/npcm7xx_pwm.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx PWM Module
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+#ifndef NPCM7XX_PWM_H
+#define NPCM7XX_PWM_H
+
+#include "hw/clock.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+
+/* Each PWM module holds 4 PWM channels. */
+#define NPCM7XX_PWM_PER_MODULE 4
+
+/*
+ * Number of registers in one pwm module. Don't change this without increasing
+ * the version_id in vmstate.
+ */
+#define NPCM7XX_PWM_NR_REGS (0x54 / sizeof(uint32_t))
+
+/*
+ * The maximum duty values. Each duty unit represents 1/NPCM7XX_PWM_MAX_DUTY
+ * cycles. For example, if NPCM7XX_PWM_MAX_DUTY=1,000,000 and a PWM has a duty
+ * value of 100,000 the duty cycle for that PWM is 10%.
+ */
+#define NPCM7XX_PWM_MAX_DUTY 1000000
+
+typedef struct NPCM7xxPWMState NPCM7xxPWMState;
+
+/**
+ * struct NPCM7xxPWM - The state of a single PWM channel.
+ * @module: The PWM module that contains this channel.
+ * @irq: GIC interrupt line to fire on expiration if enabled.
+ * @running: Whether this PWM channel is generating output.
+ * @inverted: Whether this PWM channel is inverted.
+ * @index: The index of this PWM channel.
+ * @cnr: The counter register.
+ * @cmr: The comparator register.
+ * @pdr: The data register.
+ * @pwdr: The watchdog register.
+ * @freq: The frequency of this PWM channel.
+ * @duty: The duty cycle of this PWM channel. One unit represents
+ *   1/NPCM7XX_MAX_DUTY cycles.
+ */
+typedef struct NPCM7xxPWM {
+    NPCM7xxPWMState         *module;
+
+    qemu_irq                irq;
+
+    bool                    running;
+    bool                    inverted;
+
+    uint8_t                 index;
+    uint32_t                cnr;
+    uint32_t                cmr;
+    uint32_t                pdr;
+    uint32_t                pwdr;
+
+    uint32_t                freq;
+    uint32_t                duty;
+} NPCM7xxPWM;
+
+/**
+ * struct NPCM7xxPWMState - Pulse Width Modulation device state.
+ * @parent: System bus device.
+ * @iomem: Memory region through which registers are accessed.
+ * @clock: The PWM clock.
+ * @pwm: The PWM channels owned by this module.
+ * @ppr: The prescaler register.
+ * @csr: The clock selector register.
+ * @pcr: The control register.
+ * @pier: The interrupt enable register.
+ * @piir: The interrupt indication register.
+ */
+struct NPCM7xxPWMState {
+    SysBusDevice parent;
+
+    MemoryRegion iomem;
+
+    Clock       *clock;
+    NPCM7xxPWM pwm[NPCM7XX_PWM_PER_MODULE];
+
+    uint32_t    ppr;
+    uint32_t    csr;
+    uint32_t    pcr;
+    uint32_t    pier;
+    uint32_t    piir;
+};
+
+#define TYPE_NPCM7XX_PWM "npcm7xx-pwm"
+#define NPCM7XX_PWM(obj) \
+    OBJECT_CHECK(NPCM7xxPWMState, (obj), TYPE_NPCM7XX_PWM)
+
+#endif /* NPCM7XX_PWM_H */
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
     NPCM7XX_WDG2_IRQ,                   /* Timer Module 2 Watchdog */
     NPCM7XX_EHCI_IRQ            = 61,
     NPCM7XX_OHCI_IRQ            = 62,
+    NPCM7XX_PWM0_IRQ            = 93,   /* PWM module 0 */
+    NPCM7XX_PWM1_IRQ,                   /* PWM module 1 */
     NPCM7XX_GPIO0_IRQ           = 116,
     NPCM7XX_GPIO1_IRQ,
     NPCM7XX_GPIO2_IRQ,
@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_fiu3_flash_addr[] = {
     0xb8000000, /* CS3 */
 };
 
+/* Register base address for each PWM Module */
+static const hwaddr npcm7xx_pwm_addr[] = {
+    0xf0103000,
+    0xf0104000,
+};
+
 static const struct {
     hwaddr regs_addr;
     uint32_t unconnected_pins;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
         object_initialize_child(obj, npcm7xx_fiu[i].name, &s->fiu[i],
                                 TYPE_NPCM7XX_FIU);
     }
+
+    for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
+        object_initialize_child(obj, "pwm[*]", &s->pwm[i], TYPE_NPCM7XX_PWM);
+    }
 }
 
 static void npcm7xx_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->ohci), 0,
                        npcm7xx_irq(s, NPCM7XX_OHCI_IRQ));
 
+    /* PWM Modules. Cannot fail. */
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pwm_addr) != ARRAY_SIZE(s->pwm));
+    for (i = 0; i < ARRAY_SIZE(s->pwm); i++) {
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pwm[i]);
+
+        qdev_connect_clock_in(DEVICE(&s->pwm[i]), "clock", qdev_get_clock_out(
+                    DEVICE(&s->clk), "apb3-clock"));
+        sysbus_realize(sbd, &error_abort);
+        sysbus_mmio_map(sbd, 0, npcm7xx_pwm_addr[i]);
+        sysbus_connect_irq(sbd, i, npcm7xx_irq(s, NPCM7XX_PWM0_IRQ + i));
+    }
+
     /*
      * Flash Interface Unit (FIU). Can fail if incorrect number of chip selects
      * specified, but this is a programming error.
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.pwm[0]",       0xf0103000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.pwm[1]",       0xf0104000,   4 * KiB);
     create_unimplemented_device("npcm7xx.mft[0]",       0xf0180000,   4 * KiB);
     create_unimplemented_device("npcm7xx.mft[1]",       0xf0181000,   4 * KiB);
     create_unimplemented_device("npcm7xx.mft[2]",       0xf0182000,   4 * KiB);
diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/npcm7xx_pwm.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM7xx PWM Module
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/npcm7xx_pwm.h"
+#include "hw/registerfields.h"
+#include "migration/vmstate.h"
+#include "qemu/bitops.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/units.h"
+#include "trace.h"
+
+REG32(NPCM7XX_PWM_PPR, 0x00);
+REG32(NPCM7XX_PWM_CSR, 0x04);
+REG32(NPCM7XX_PWM_PCR, 0x08);
+REG32(NPCM7XX_PWM_CNR0, 0x0c);
+REG32(NPCM7XX_PWM_CMR0, 0x10);
+REG32(NPCM7XX_PWM_PDR0, 0x14);
+REG32(NPCM7XX_PWM_CNR1, 0x18);
+REG32(NPCM7XX_PWM_CMR1, 0x1c);
+REG32(NPCM7XX_PWM_PDR1, 0x20);
+REG32(NPCM7XX_PWM_CNR2, 0x24);
+REG32(NPCM7XX_PWM_CMR2, 0x28);
+REG32(NPCM7XX_PWM_PDR2, 0x2c);
+REG32(NPCM7XX_PWM_CNR3, 0x30);
+REG32(NPCM7XX_PWM_CMR3, 0x34);
+REG32(NPCM7XX_PWM_PDR3, 0x38);
+REG32(NPCM7XX_PWM_PIER, 0x3c);
+REG32(NPCM7XX_PWM_PIIR, 0x40);
+REG32(NPCM7XX_PWM_PWDR0, 0x44);
+REG32(NPCM7XX_PWM_PWDR1, 0x48);
+REG32(NPCM7XX_PWM_PWDR2, 0x4c);
+REG32(NPCM7XX_PWM_PWDR3, 0x50);
+
+/* Register field definitions. */
+#define NPCM7XX_PPR(rv, index)      extract32((rv), npcm7xx_ppr_base[index], 8)
+#define NPCM7XX_CSR(rv, index)      extract32((rv), npcm7xx_csr_base[index], 3)
+#define NPCM7XX_CH(rv, index)       extract32((rv), npcm7xx_ch_base[index], 4)
+#define NPCM7XX_CH_EN               BIT(0)
+#define NPCM7XX_CH_INV              BIT(2)
+#define NPCM7XX_CH_MOD              BIT(3)
+
+/* Offset of each PWM channel's prescaler in the PPR register. */
+static const int npcm7xx_ppr_base[] = { 0, 0, 8, 8 };
+/* Offset of each PWM channel's clock selector in the CSR register. */
+static const int npcm7xx_csr_base[] = { 0, 4, 8, 12 };
+/* Offset of each PWM channel's control variable in the PCR register. */
+static const int npcm7xx_ch_base[] = { 0, 8, 12, 16 };
+
+static uint32_t npcm7xx_pwm_calculate_freq(NPCM7xxPWM *p)
+{
+    uint32_t ppr;
+    uint32_t csr;
+    uint32_t freq;
+
+    if (!p->running) {
+        return 0;
+    }
+
+    csr = NPCM7XX_CSR(p->module->csr, p->index);
+    ppr = NPCM7XX_PPR(p->module->ppr, p->index);
+    freq = clock_get_hz(p->module->clock);
+    freq /= ppr + 1;
+    /* csr can only be 0~4 */
+    if (csr > 4) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid csr value %u\n",
+                      __func__, csr);
+        csr = 4;
+    }
+    /* freq won't be changed if csr == 4. */
+    if (csr < 4) {
+        freq >>= csr + 1;
+    }
+
+    return freq / (p->cnr + 1);
+}
+
+static uint32_t npcm7xx_pwm_calculate_duty(NPCM7xxPWM *p)
+{
+    uint64_t duty;
+
+    if (p->running) {
+        if (p->cnr == 0) {
+            duty = 0;
+        } else if (p->cmr >= p->cnr) {
+            duty = NPCM7XX_PWM_MAX_DUTY;
+        } else {
+            duty = NPCM7XX_PWM_MAX_DUTY * (p->cmr + 1) / (p->cnr + 1);
+        }
+    } else {
+        duty = 0;
+    }
+
+    if (p->inverted) {
+        duty = NPCM7XX_PWM_MAX_DUTY - duty;
+    }
+
+    return duty;
+}
+
+static void npcm7xx_pwm_update_freq(NPCM7xxPWM *p)
+{
+    uint32_t freq = npcm7xx_pwm_calculate_freq(p);
+
+    if (freq != p->freq) {
+        trace_npcm7xx_pwm_update_freq(DEVICE(p->module)->canonical_path,
+                                      p->index, p->freq, freq);
+        p->freq = freq;
+    }
+}
+
+static void npcm7xx_pwm_update_duty(NPCM7xxPWM *p)
+{
+    uint32_t duty = npcm7xx_pwm_calculate_duty(p);
+
+    if (duty != p->duty) {
+        trace_npcm7xx_pwm_update_duty(DEVICE(p->module)->canonical_path,
+                                      p->index, p->duty, duty);
+        p->duty = duty;
+    }
+}
+
+static void npcm7xx_pwm_update_output(NPCM7xxPWM *p)
+{
+    npcm7xx_pwm_update_freq(p);
+    npcm7xx_pwm_update_duty(p);
+}
+
+static void npcm7xx_pwm_write_ppr(NPCM7xxPWMState *s, uint32_t new_ppr)
+{
+    int i;
+    uint32_t old_ppr = s->ppr;
+
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_ppr_base) != NPCM7XX_PWM_PER_MODULE);
+    s->ppr = new_ppr;
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
+        if (NPCM7XX_PPR(old_ppr, i) != NPCM7XX_PPR(new_ppr, i)) {
+            npcm7xx_pwm_update_freq(&s->pwm[i]);
+        }
+    }
+}
+
+static void npcm7xx_pwm_write_csr(NPCM7xxPWMState *s, uint32_t new_csr)
+{
+    int i;
+    uint32_t old_csr = s->csr;
+
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_csr_base) != NPCM7XX_PWM_PER_MODULE);
+    s->csr = new_csr;
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
+        if (NPCM7XX_CSR(old_csr, i) != NPCM7XX_CSR(new_csr, i)) {
+            npcm7xx_pwm_update_freq(&s->pwm[i]);
+        }
+    }
+}
+
+static void npcm7xx_pwm_write_pcr(NPCM7xxPWMState *s, uint32_t new_pcr)
+{
+    int i;
+    bool inverted;
+    uint32_t pcr;
+    NPCM7xxPWM *p;
+
+    s->pcr = new_pcr;
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_ch_base) != NPCM7XX_PWM_PER_MODULE);
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
+        p = &s->pwm[i];
+        pcr = NPCM7XX_CH(new_pcr, i);
+        inverted = pcr & NPCM7XX_CH_INV;
+
+        /*
+         * We only run a PWM channel with toggle mode. Single-shot mode does not
+         * generate frequency and duty-cycle values.
+         */
+        if ((pcr & NPCM7XX_CH_EN) && (pcr & NPCM7XX_CH_MOD)) {
+            if (p->running) {
+                /* Re-run this PWM channel if inverted changed. */
+                if (p->inverted ^ inverted) {
+                    p->inverted = inverted;
+                    npcm7xx_pwm_update_duty(p);
+                }
+            } else {
+                /* Run this PWM channel. */
+                p->running = true;
+                p->inverted = inverted;
+                npcm7xx_pwm_update_output(p);
+            }
+        } else {
+            /* Clear this PWM channel. */
+            p->running = false;
+            p->inverted = inverted;
+            npcm7xx_pwm_update_output(p);
+        }
+    }
+
+}
+
+static hwaddr npcm7xx_cnr_index(hwaddr offset)
+{
+    switch (offset) {
+    case A_NPCM7XX_PWM_CNR0:
+        return 0;
+    case A_NPCM7XX_PWM_CNR1:
+        return 1;
+    case A_NPCM7XX_PWM_CNR2:
+        return 2;
+    case A_NPCM7XX_PWM_CNR3:
+        return 3;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static hwaddr npcm7xx_cmr_index(hwaddr offset)
+{
+    switch (offset) {
+    case A_NPCM7XX_PWM_CMR0:
+        return 0;
+    case A_NPCM7XX_PWM_CMR1:
+        return 1;
+    case A_NPCM7XX_PWM_CMR2:
+        return 2;
+    case A_NPCM7XX_PWM_CMR3:
+        return 3;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static hwaddr npcm7xx_pdr_index(hwaddr offset)
+{
+    switch (offset) {
+    case A_NPCM7XX_PWM_PDR0:
+        return 0;
+    case A_NPCM7XX_PWM_PDR1:
+        return 1;
+    case A_NPCM7XX_PWM_PDR2:
+        return 2;
+    case A_NPCM7XX_PWM_PDR3:
+        return 3;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static hwaddr npcm7xx_pwdr_index(hwaddr offset)
+{
+    switch (offset) {
+    case A_NPCM7XX_PWM_PWDR0:
+        return 0;
+    case A_NPCM7XX_PWM_PWDR1:
+        return 1;
+    case A_NPCM7XX_PWM_PWDR2:
+        return 2;
+    case A_NPCM7XX_PWM_PWDR3:
+        return 3;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static uint64_t npcm7xx_pwm_read(void *opaque, hwaddr offset, unsigned size)
+{
+    NPCM7xxPWMState *s = opaque;
+    uint64_t value = 0;
+
+    switch (offset) {
+    case A_NPCM7XX_PWM_CNR0:
+    case A_NPCM7XX_PWM_CNR1:
+    case A_NPCM7XX_PWM_CNR2:
+    case A_NPCM7XX_PWM_CNR3:
+        value = s->pwm[npcm7xx_cnr_index(offset)].cnr;
+        break;
+
+    case A_NPCM7XX_PWM_CMR0:
+    case A_NPCM7XX_PWM_CMR1:
+    case A_NPCM7XX_PWM_CMR2:
+    case A_NPCM7XX_PWM_CMR3:
+        value = s->pwm[npcm7xx_cmr_index(offset)].cmr;
+        break;
+
+    case A_NPCM7XX_PWM_PDR0:
+    case A_NPCM7XX_PWM_PDR1:
+    case A_NPCM7XX_PWM_PDR2:
+    case A_NPCM7XX_PWM_PDR3:
+        value = s->pwm[npcm7xx_pdr_index(offset)].pdr;
+        break;
+
+    case A_NPCM7XX_PWM_PWDR0:
+    case A_NPCM7XX_PWM_PWDR1:
+    case A_NPCM7XX_PWM_PWDR2:
+    case A_NPCM7XX_PWM_PWDR3:
+        value = s->pwm[npcm7xx_pwdr_index(offset)].pwdr;
+        break;
+
+    case A_NPCM7XX_PWM_PPR:
+        value = s->ppr;
+        break;
+
+    case A_NPCM7XX_PWM_CSR:
+        value = s->csr;
+        break;
+
+    case A_NPCM7XX_PWM_PCR:
+        value = s->pcr;
+        break;
+
+    case A_NPCM7XX_PWM_PIER:
+        value = s->pier;
+        break;
+
+    case A_NPCM7XX_PWM_PIIR:
+        value = s->piir;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+
+    trace_npcm7xx_pwm_read(DEVICE(s)->canonical_path, offset, value);
+    return value;
+}
+
+static void npcm7xx_pwm_write(void *opaque, hwaddr offset,
+                                uint64_t v, unsigned size)
+{
+    NPCM7xxPWMState *s = opaque;
+    NPCM7xxPWM *p;
+    uint32_t value = v;
+
+    trace_npcm7xx_pwm_write(DEVICE(s)->canonical_path, offset, value);
+    switch (offset) {
+    case A_NPCM7XX_PWM_CNR0:
+    case A_NPCM7XX_PWM_CNR1:
+    case A_NPCM7XX_PWM_CNR2:
+    case A_NPCM7XX_PWM_CNR3:
+        p = &s->pwm[npcm7xx_cnr_index(offset)];
+        p->cnr = value;
+        npcm7xx_pwm_update_output(p);
+        break;
+
+    case A_NPCM7XX_PWM_CMR0:
+    case A_NPCM7XX_PWM_CMR1:
+    case A_NPCM7XX_PWM_CMR2:
+    case A_NPCM7XX_PWM_CMR3:
+        p = &s->pwm[npcm7xx_cmr_index(offset)];
+        p->cmr = value;
+        npcm7xx_pwm_update_output(p);
+        break;
+
+    case A_NPCM7XX_PWM_PDR0:
+    case A_NPCM7XX_PWM_PDR1:
+    case A_NPCM7XX_PWM_PDR2:
+    case A_NPCM7XX_PWM_PDR3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: register @ 0x%04" HWADDR_PRIx " is read-only\n",
+                      __func__, offset);
+        break;
+
+    case A_NPCM7XX_PWM_PWDR0:
+    case A_NPCM7XX_PWM_PWDR1:
+    case A_NPCM7XX_PWM_PWDR2:
+    case A_NPCM7XX_PWM_PWDR3:
+        qemu_log_mask(LOG_UNIMP,
+                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
+                     __func__, offset);
+        break;
+
+    case A_NPCM7XX_PWM_PPR:
+        npcm7xx_pwm_write_ppr(s, value);
+        break;
+
+    case A_NPCM7XX_PWM_CSR:
+        npcm7xx_pwm_write_csr(s, value);
+        break;
+
+    case A_NPCM7XX_PWM_PCR:
+        npcm7xx_pwm_write_pcr(s, value);
+        break;
+
+    case A_NPCM7XX_PWM_PIER:
+        qemu_log_mask(LOG_UNIMP,
+                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
+                     __func__, offset);
+        break;
+
+    case A_NPCM7XX_PWM_PIIR:
+        qemu_log_mask(LOG_UNIMP,
+                     "%s: register @ 0x%04" HWADDR_PRIx " is not implemented\n",
+                     __func__, offset);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid offset 0x%04" HWADDR_PRIx "\n",
+                      __func__, offset);
+        break;
+    }
+}
+
+static const struct MemoryRegionOps npcm7xx_pwm_ops = {
+    .read       = npcm7xx_pwm_read,
+    .write      = npcm7xx_pwm_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid      = {
+        .min_access_size        = 4,
+        .max_access_size        = 4,
+        .unaligned              = false,
+    },
+};
+
+static void npcm7xx_pwm_enter_reset(Object *obj, ResetType type)
+{
+    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
+    int i;
+
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
+        NPCM7xxPWM *p = &s->pwm[i];
+
+        p->cnr = 0x00000000;
+        p->cmr = 0x00000000;
+        p->pdr = 0x00000000;
+        p->pwdr = 0x00000000;
+    }
+
+    s->ppr = 0x00000000;
+    s->csr = 0x00000000;
+    s->pcr = 0x00000000;
+    s->pier = 0x00000000;
+    s->piir = 0x00000000;
+}
+
+static void npcm7xx_pwm_hold_reset(Object *obj)
+{
+    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
+    int i;
+
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
+        qemu_irq_lower(s->pwm[i].irq);
+    }
+}
+
+static void npcm7xx_pwm_init(Object *obj)
+{
+    NPCM7xxPWMState *s = NPCM7XX_PWM(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    int i;
+
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; i++) {
+        NPCM7xxPWM *p = &s->pwm[i];
+        p->module = s;
+        p->index = i;
+        sysbus_init_irq(sbd, &p->irq);
+    }
+
+    memory_region_init_io(&s->iomem, obj, &npcm7xx_pwm_ops, s,
+                          TYPE_NPCM7XX_PWM, 4 * KiB);
+    sysbus_init_mmio(sbd, &s->iomem);
+    s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL);
+
+    for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) {
+        object_property_add_uint32_ptr(obj, "freq[*]",
+                &s->pwm[i].freq, OBJ_PROP_FLAG_READ);
+        object_property_add_uint32_ptr(obj, "duty[*]",
+                &s->pwm[i].duty, OBJ_PROP_FLAG_READ);
+    }
+}
+
+static const VMStateDescription vmstate_npcm7xx_pwm = {
+    .name = "npcm7xx-pwm",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(running, NPCM7xxPWM),
+        VMSTATE_BOOL(inverted, NPCM7xxPWM),
+        VMSTATE_UINT8(index, NPCM7xxPWM),
+        VMSTATE_UINT32(cnr, NPCM7xxPWM),
+        VMSTATE_UINT32(cmr, NPCM7xxPWM),
+        VMSTATE_UINT32(pdr, NPCM7xxPWM),
+        VMSTATE_UINT32(pwdr, NPCM7xxPWM),
+        VMSTATE_UINT32(freq, NPCM7xxPWM),
+        VMSTATE_UINT32(duty, NPCM7xxPWM),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static const VMStateDescription vmstate_npcm7xx_pwm_module = {
+    .name = "npcm7xx-pwm-module",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_CLOCK(clock, NPCM7xxPWMState),
+        VMSTATE_STRUCT_ARRAY(pwm, NPCM7xxPWMState,
+                             NPCM7XX_PWM_PER_MODULE, 0, vmstate_npcm7xx_pwm,
+                             NPCM7xxPWM),
+        VMSTATE_UINT32(ppr, NPCM7xxPWMState),
+        VMSTATE_UINT32(csr, NPCM7xxPWMState),
+        VMSTATE_UINT32(pcr, NPCM7xxPWMState),
+        VMSTATE_UINT32(pier, NPCM7xxPWMState),
+        VMSTATE_UINT32(piir, NPCM7xxPWMState),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void npcm7xx_pwm_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM7xx PWM Controller";
+    dc->vmsd = &vmstate_npcm7xx_pwm_module;
+    rc->phases.enter = npcm7xx_pwm_enter_reset;
+    rc->phases.hold = npcm7xx_pwm_hold_reset;
+}
+
+static const TypeInfo npcm7xx_pwm_info = {
+    .name               = TYPE_NPCM7XX_PWM,
+    .parent             = TYPE_SYS_BUS_DEVICE,
+    .instance_size      = sizeof(NPCM7xxPWMState),
+    .class_init         = npcm7xx_pwm_class_init,
+    .instance_init      = npcm7xx_pwm_init,
+};
+
+static void npcm7xx_pwm_register_type(void)
+{
+    type_register_static(&npcm7xx_pwm_info);
+}
+type_init(npcm7xx_pwm_register_type);
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_MAINSTONE', if_true: files('mst_fpga.c'))
 softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files(
   'npcm7xx_clk.c',
   'npcm7xx_gcr.c',
+  'npcm7xx_pwm.c',
   'npcm7xx_rng.c',
 ))
 softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files(
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_gcr_write(uint64_t offset, uint32_t value) "offset: 0x%04" PRIx64 " valu
 npcm7xx_rng_read(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
 npcm7xx_rng_write(uint64_t offset, uint64_t value, unsigned size) "offset: 0x%04" PRIx64 " value: 0x%02" PRIx64 " size: %u"
 
+# npcm7xx_pwm.c
+npcm7xx_pwm_read(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
+npcm7xx_pwm_write(const char *id, uint64_t offset, uint32_t value) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
+npcm7xx_pwm_update_freq(const char *id, uint8_t index, uint32_t old_value, uint32_t new_value) "%s pwm[%u] Update Freq: old_freq: %u, new_freq: %u"
+npcm7xx_pwm_update_duty(const char *id, uint8_t index, uint32_t old_value, uint32_t new_value) "%s pwm[%u] Update Duty: old_duty: %u, new_duty: %u"
+
 # stm32f4xx_syscfg.c
 stm32f4xx_syscfg_set_irq(int gpio, int line, int level) "Interupt: GPIO: %d, Line: %d; Level: %d"
 stm32f4xx_pulse_exti(int irq) "Pulse EXTI: %d"
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

We add a qtest for the PWM in the previous patch. It proves it works as
expected.

Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
Reviewed-by: Tyrone Ting <kfting@nuvoton.com>
Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210108190945.949196-6-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_pwm-test.c | 490 +++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |   1 +
 2 files changed, 491 insertions(+)
 create mode 100644 tests/qtest/npcm7xx_pwm-test.c

diff --git a/tests/qtest/npcm7xx_pwm-test.c b/tests/qtest/npcm7xx_pwm-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/npcm7xx_pwm-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTests for Nuvoton NPCM7xx PWM Modules.
+ *
+ * Copyright 2020 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "libqos/libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qnum.h"
+
+#define REF_HZ          25000000
+
+/* Register field definitions. */
+#define CH_EN           BIT(0)
+#define CH_INV          BIT(2)
+#define CH_MOD          BIT(3)
+
+/* Registers shared between all PWMs in a module */
+#define PPR             0x00
+#define CSR             0x04
+#define PCR             0x08
+#define PIER            0x3c
+#define PIIR            0x40
+
+/* CLK module related */
+#define CLK_BA          0xf0801000
+#define CLKSEL          0x04
+#define CLKDIV1         0x08
+#define CLKDIV2         0x2c
+#define PLLCON0         0x0c
+#define PLLCON1         0x10
+#define PLL_INDV(rv)    extract32((rv), 0, 6)
+#define PLL_FBDV(rv)    extract32((rv), 16, 12)
+#define PLL_OTDV1(rv)   extract32((rv), 8, 3)
+#define PLL_OTDV2(rv)   extract32((rv), 13, 3)
+#define APB3CKDIV(rv)   extract32((rv), 28, 2)
+#define CLK2CKDIV(rv)   extract32((rv), 0, 1)
+#define CLK4CKDIV(rv)   extract32((rv), 26, 2)
+#define CPUCKSEL(rv)    extract32((rv), 0, 2)
+
+#define MAX_DUTY        1000000
+
+typedef struct PWMModule {
+    int irq;
+    uint64_t base_addr;
+} PWMModule;
+
+typedef struct PWM {
+    uint32_t cnr_offset;
+    uint32_t cmr_offset;
+    uint32_t pdr_offset;
+    uint32_t pwdr_offset;
+} PWM;
+
+typedef struct TestData {
+    const PWMModule *module;
+    const PWM *pwm;
+} TestData;
+
+static const PWMModule pwm_module_list[] = {
+    {
+        .irq        = 93,
+        .base_addr  = 0xf0103000
+    },
+    {
+        .irq        = 94,
+        .base_addr  = 0xf0104000
+    }
+};
+
+static const PWM pwm_list[] = {
+    {
+        .cnr_offset     = 0x0c,
+        .cmr_offset     = 0x10,
+        .pdr_offset     = 0x14,
+        .pwdr_offset    = 0x44,
+    },
+    {
+        .cnr_offset     = 0x18,
+        .cmr_offset     = 0x1c,
+        .pdr_offset     = 0x20,
+        .pwdr_offset    = 0x48,
+    },
+    {
+        .cnr_offset     = 0x24,
+        .cmr_offset     = 0x28,
+        .pdr_offset     = 0x2c,
+        .pwdr_offset    = 0x4c,
+    },
+    {
+        .cnr_offset     = 0x30,
+        .cmr_offset     = 0x34,
+        .pdr_offset     = 0x38,
+        .pwdr_offset    = 0x50,
+    },
+};
+
+static const int ppr_base[] = { 0, 0, 8, 8 };
+static const int csr_base[] = { 0, 4, 8, 12 };
+static const int pcr_base[] = { 0, 8, 12, 16 };
+
+static const uint32_t ppr_list[] = {
+    0,
+    1,
+    10,
+    100,
+    255, /* Max possible value. */
+};
+
+static const uint32_t csr_list[] = {
+    0,
+    1,
+    2,
+    3,
+    4, /* Max possible value. */
+};
+
+static const uint32_t cnr_list[] = {
+    0,
+    1,
+    50,
+    100,
+    150,
+    200,
+    1000,
+    10000,
+    65535, /* Max possible value. */
+};
+
+static const uint32_t cmr_list[] = {
+    0,
+    1,
+    10,
+    50,
+    100,
+    150,
+    200,
+    1000,
+    10000,
+    65535, /* Max possible value. */
+};
+
+/* Returns the index of the PWM module. */
+static int pwm_module_index(const PWMModule *module)
+{
+    ptrdiff_t diff = module - pwm_module_list;
+
+    g_assert_true(diff >= 0 && diff < ARRAY_SIZE(pwm_module_list));
+
+    return diff;
+}
+
+/* Returns the index of the PWM entry. */
+static int pwm_index(const PWM *pwm)
+{
+    ptrdiff_t diff = pwm - pwm_list;
+
+    g_assert_true(diff >= 0 && diff < ARRAY_SIZE(pwm_list));
+
+    return diff;
+}
+
+static uint64_t pwm_qom_get(QTestState *qts, const char *path, const char *name)
+{
+    QDict *response;
+
+    g_test_message("Getting properties %s from %s", name, path);
+    response = qtest_qmp(qts, "{ 'execute': 'qom-get',"
+            " 'arguments': { 'path': %s, 'property': %s}}",
+            path, name);
+    /* The qom set message returns successfully. */
+    g_assert_true(qdict_haskey(response, "return"));
+    return qnum_get_uint(qobject_to(QNum, qdict_get(response, "return")));
+}
+
+static uint64_t pwm_get_freq(QTestState *qts, int module_index, int pwm_index)
+{
+    char path[100];
+    char name[100];
+
+    sprintf(path, "/machine/soc/pwm[%d]", module_index);
+    sprintf(name, "freq[%d]", pwm_index);
+
+    return pwm_qom_get(qts, path, name);
+}
+
+static uint64_t pwm_get_duty(QTestState *qts, int module_index, int pwm_index)
+{
+    char path[100];
+    char name[100];
+
+    sprintf(path, "/machine/soc/pwm[%d]", module_index);
+    sprintf(name, "duty[%d]", pwm_index);
+
+    return pwm_qom_get(qts, path, name);
+}
+
+static uint32_t get_pll(uint32_t con)
+{
+    return REF_HZ * PLL_FBDV(con) / (PLL_INDV(con) * PLL_OTDV1(con)
+            * PLL_OTDV2(con));
+}
+
+static uint64_t read_pclk(QTestState *qts)
+{
+    uint64_t freq = REF_HZ;
+    uint32_t clksel = qtest_readl(qts, CLK_BA + CLKSEL);
+    uint32_t pllcon;
+    uint32_t clkdiv1 = qtest_readl(qts, CLK_BA + CLKDIV1);
+    uint32_t clkdiv2 = qtest_readl(qts, CLK_BA + CLKDIV2);
+
+    switch (CPUCKSEL(clksel)) {
+    case 0:
+        pllcon = qtest_readl(qts, CLK_BA + PLLCON0);
+        freq = get_pll(pllcon);
+        break;
+    case 1:
+        pllcon = qtest_readl(qts, CLK_BA + PLLCON1);
+        freq = get_pll(pllcon);
+        break;
+    case 2:
+        break;
+    case 3:
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    freq >>= (CLK2CKDIV(clkdiv1) + CLK4CKDIV(clkdiv1) + APB3CKDIV(clkdiv2));
+
+    return freq;
+}
+
+static uint32_t pwm_selector(uint32_t csr)
+{
+    switch (csr) {
+    case 0:
+        return 2;
+    case 1:
+        return 4;
+    case 2:
+        return 8;
+    case 3:
+        return 16;
+    case 4:
+        return 1;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static uint64_t pwm_compute_freq(QTestState *qts, uint32_t ppr, uint32_t csr,
+        uint32_t cnr)
+{
+    return read_pclk(qts) / ((ppr + 1) * pwm_selector(csr) * (cnr + 1));
+}
+
+static uint64_t pwm_compute_duty(uint32_t cnr, uint32_t cmr, bool inverted)
+{
+    uint64_t duty;
+
+    if (cnr == 0) {
+        /* PWM is stopped. */
+        duty = 0;
+    } else if (cmr >= cnr) {
+        duty = MAX_DUTY;
+    } else {
+        duty = MAX_DUTY * (cmr + 1) / (cnr + 1);
+    }
+
+    if (inverted) {
+        duty = MAX_DUTY - duty;
+    }
+
+    return duty;
+}
+
+static uint32_t pwm_read(QTestState *qts, const TestData *td, unsigned offset)
+{
+    return qtest_readl(qts, td->module->base_addr + offset);
+}
+
+static void pwm_write(QTestState *qts, const TestData *td, unsigned offset,
+        uint32_t value)
+{
+    qtest_writel(qts, td->module->base_addr + offset, value);
+}
+
+static uint32_t pwm_read_ppr(QTestState *qts, const TestData *td)
+{
+    return extract32(pwm_read(qts, td, PPR), ppr_base[pwm_index(td->pwm)], 8);
+}
+
+static void pwm_write_ppr(QTestState *qts, const TestData *td, uint32_t value)
+{
+    pwm_write(qts, td, PPR, value << ppr_base[pwm_index(td->pwm)]);
+}
+
+static uint32_t pwm_read_csr(QTestState *qts, const TestData *td)
+{
+    return extract32(pwm_read(qts, td, CSR), csr_base[pwm_index(td->pwm)], 3);
+}
+
+static void pwm_write_csr(QTestState *qts, const TestData *td, uint32_t value)
+{
+    pwm_write(qts, td, CSR, value << csr_base[pwm_index(td->pwm)]);
+}
+
+static uint32_t pwm_read_pcr(QTestState *qts, const TestData *td)
+{
+    return extract32(pwm_read(qts, td, PCR), pcr_base[pwm_index(td->pwm)], 4);
+}
+
+static void pwm_write_pcr(QTestState *qts, const TestData *td, uint32_t value)
+{
+    pwm_write(qts, td, PCR, value << pcr_base[pwm_index(td->pwm)]);
+}
+
+static uint32_t pwm_read_cnr(QTestState *qts, const TestData *td)
+{
+    return pwm_read(qts, td, td->pwm->cnr_offset);
+}
+
+static void pwm_write_cnr(QTestState *qts, const TestData *td, uint32_t value)
+{
+    pwm_write(qts, td, td->pwm->cnr_offset, value);
+}
+
+static uint32_t pwm_read_cmr(QTestState *qts, const TestData *td)
+{
+    return pwm_read(qts, td, td->pwm->cmr_offset);
+}
+
+static void pwm_write_cmr(QTestState *qts, const TestData *td, uint32_t value)
+{
+    pwm_write(qts, td, td->pwm->cmr_offset, value);
+}
+
+/* Check pwm registers can be reset to default value */
+static void test_init(gconstpointer test_data)
+{
+    const TestData *td = test_data;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    int module = pwm_module_index(td->module);
+    int pwm = pwm_index(td->pwm);
+
+    g_assert_cmpuint(pwm_get_freq(qts, module, pwm), ==, 0);
+    g_assert_cmpuint(pwm_get_duty(qts, module, pwm), ==, 0);
+
+    qtest_quit(qts);
+}
+
+/* One-shot mode should not change frequency and duty cycle. */
+static void test_oneshot(gconstpointer test_data)
+{
+    const TestData *td = test_data;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    int module = pwm_module_index(td->module);
+    int pwm = pwm_index(td->pwm);
+    uint32_t ppr, csr, pcr;
+    int i, j;
+
+    pcr = CH_EN;
+    for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
+        ppr = ppr_list[i];
+        pwm_write_ppr(qts, td, ppr);
+
+        for (j = 0; j < ARRAY_SIZE(csr_list); ++j) {
+            csr = csr_list[j];
+            pwm_write_csr(qts, td, csr);
+            pwm_write_pcr(qts, td, pcr);
+
+            g_assert_cmpuint(pwm_read_ppr(qts, td), ==, ppr);
+            g_assert_cmpuint(pwm_read_csr(qts, td), ==, csr);
+            g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr);
+            g_assert_cmpuint(pwm_get_freq(qts, module, pwm), ==, 0);
+            g_assert_cmpuint(pwm_get_duty(qts, module, pwm), ==, 0);
+        }
+    }
+
+    qtest_quit(qts);
+}
+
+/* In toggle mode, the PWM generates correct outputs. */
+static void test_toggle(gconstpointer test_data)
+{
+    const TestData *td = test_data;
+    QTestState *qts = qtest_init("-machine quanta-gsj");
+    int module = pwm_module_index(td->module);
+    int pwm = pwm_index(td->pwm);
+    uint32_t ppr, csr, pcr, cnr, cmr;
+    int i, j, k, l;
+    uint64_t expected_freq, expected_duty;
+
+    pcr = CH_EN | CH_MOD;
+    for (i = 0; i < ARRAY_SIZE(ppr_list); ++i) {
+        ppr = ppr_list[i];
+        pwm_write_ppr(qts, td, ppr);
+
+        for (j = 0; j < ARRAY_SIZE(csr_list); ++j) {
+            csr = csr_list[j];
+            pwm_write_csr(qts, td, csr);
+
+            for (k = 0; k < ARRAY_SIZE(cnr_list); ++k) {
+                cnr = cnr_list[k];
+                pwm_write_cnr(qts, td, cnr);
+
+                for (l = 0; l < ARRAY_SIZE(cmr_list); ++l) {
+                    cmr = cmr_list[l];
+                    pwm_write_cmr(qts, td, cmr);
+                    expected_freq = pwm_compute_freq(qts, ppr, csr, cnr);
+                    expected_duty = pwm_compute_duty(cnr, cmr, false);
+
+                    pwm_write_pcr(qts, td, pcr);
+                    g_assert_cmpuint(pwm_read_ppr(qts, td), ==, ppr);
+                    g_assert_cmpuint(pwm_read_csr(qts, td), ==, csr);
+                    g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr);
+                    g_assert_cmpuint(pwm_read_cnr(qts, td), ==, cnr);
+                    g_assert_cmpuint(pwm_read_cmr(qts, td), ==, cmr);
+                    g_assert_cmpuint(pwm_get_duty(qts, module, pwm),
+                            ==, expected_duty);
+                    if (expected_duty != 0 && expected_duty != 100) {
+                        /* Duty cycle with 0 or 100 doesn't need frequency. */
+                        g_assert_cmpuint(pwm_get_freq(qts, module, pwm),
+                                ==, expected_freq);
+                    }
+
+                    /* Test inverted mode */
+                    expected_duty = pwm_compute_duty(cnr, cmr, true);
+                    pwm_write_pcr(qts, td, pcr | CH_INV);
+                    g_assert_cmpuint(pwm_read_pcr(qts, td), ==, pcr | CH_INV);
+                    g_assert_cmpuint(pwm_get_duty(qts, module, pwm),
+                            ==, expected_duty);
+                    if (expected_duty != 0 && expected_duty != 100) {
+                        /* Duty cycle with 0 or 100 doesn't need frequency. */
+                        g_assert_cmpuint(pwm_get_freq(qts, module, pwm),
+                                ==, expected_freq);
+                    }
+
+                }
+            }
+        }
+    }
+
+    qtest_quit(qts);
+}
+
+static void pwm_add_test(const char *name, const TestData* td,
+        GTestDataFunc fn)
+{
+    g_autofree char *full_name = g_strdup_printf(
+            "npcm7xx_pwm/module[%d]/pwm[%d]/%s", pwm_module_index(td->module),
+            pwm_index(td->pwm), name);
+    qtest_add_data_func(full_name, td, fn);
+}
+#define add_test(name, td) pwm_add_test(#name, td, test_##name)
+
+int main(int argc, char **argv)
+{
+    TestData test_data_list[ARRAY_SIZE(pwm_module_list) * ARRAY_SIZE(pwm_list)];
+
+    g_test_init(&argc, &argv, NULL);
+
+    for (int i = 0; i < ARRAY_SIZE(pwm_module_list); ++i) {
+        for (int j = 0; j < ARRAY_SIZE(pwm_list); ++j) {
+            TestData *td = &test_data_list[i * ARRAY_SIZE(pwm_list) + j];
+
+            td->module = &pwm_module_list[i];
+            td->pwm = &pwm_list[j];
+
+            add_test(init, td);
+            add_test(oneshot, td);
+            add_test(toggle, td);
+        }
+    }
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_sparc64 = \
 qtests_npcm7xx = \
   ['npcm7xx_adc-test',
    'npcm7xx_gpio-test',
+   'npcm7xx_pwm-test',
    'npcm7xx_rng-test',
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test']
-- 
2.20.1

From: Hao Wu <wuhaotsh@google.com>

A device shouldn't access its parent object which is QOM internal.
Instead it should use type cast for this purporse. This patch fixes this
issue for all NPCM7XX Devices.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210108190945.949196-7-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm7xx_boards.c | 2 +-
 hw/mem/npcm7xx_mc.c     | 2 +-
 hw/misc/npcm7xx_clk.c   | 2 +-
 hw/misc/npcm7xx_gcr.c   | 2 +-
 hw/misc/npcm7xx_rng.c   | 2 +-
 hw/nvram/npcm7xx_otp.c  | 2 +-
 hw/ssi/npcm7xx_fiu.c    | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@ static NPCM7xxState *npcm7xx_create_soc(MachineState *machine,
                                         uint32_t hw_straps)
 {
     NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_GET_CLASS(machine);
-    MachineClass *mc = &nmc->parent;
+    MachineClass *mc = MACHINE_CLASS(nmc);
     Object *obj;
 
     if (strcmp(machine->cpu_type, mc->default_cpu_type) != 0) {
diff --git a/hw/mem/npcm7xx_mc.c b/hw/mem/npcm7xx_mc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mem/npcm7xx_mc.c
+++ b/hw/mem/npcm7xx_mc.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_mc_realize(DeviceState *dev, Error **errp)
 
     memory_region_init_io(&s->mmio, OBJECT(s), &npcm7xx_mc_ops, s, "regs",
                           NPCM7XX_MC_REGS_SIZE);
-    sysbus_init_mmio(&s->parent, &s->mmio);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->mmio);
 }
 
 static void npcm7xx_mc_class_init(ObjectClass *klass, void *data)
diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_clk.c
+++ b/hw/misc/npcm7xx_clk.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_init(Object *obj)
 
     memory_region_init_io(&s->iomem, obj, &npcm7xx_clk_ops, s,
                           TYPE_NPCM7XX_CLK, 4 * KiB);
-    sysbus_init_mmio(&s->parent, &s->iomem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 }
 
 static int npcm7xx_clk_post_load(void *opaque, int version_id)
diff --git a/hw/misc/npcm7xx_gcr.c b/hw/misc/npcm7xx_gcr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_gcr.c
+++ b/hw/misc/npcm7xx_gcr.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_gcr_init(Object *obj)
 
     memory_region_init_io(&s->iomem, obj, &npcm7xx_gcr_ops, s,
                           TYPE_NPCM7XX_GCR, 4 * KiB);
-    sysbus_init_mmio(&s->parent, &s->iomem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 }
 
 static const VMStateDescription vmstate_npcm7xx_gcr = {
diff --git a/hw/misc/npcm7xx_rng.c b/hw/misc/npcm7xx_rng.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_rng.c
+++ b/hw/misc/npcm7xx_rng.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_rng_init(Object *obj)
 
     memory_region_init_io(&s->iomem, obj, &npcm7xx_rng_ops, s, "regs",
                           NPCM7XX_RNG_REGS_SIZE);
-    sysbus_init_mmio(&s->parent, &s->iomem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 }
 
 static const VMStateDescription vmstate_npcm7xx_rng = {
diff --git a/hw/nvram/npcm7xx_otp.c b/hw/nvram/npcm7xx_otp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/npcm7xx_otp.c
+++ b/hw/nvram/npcm7xx_otp.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_otp_realize(DeviceState *dev, Error **errp)
 {
     NPCM7xxOTPClass *oc = NPCM7XX_OTP_GET_CLASS(dev);
     NPCM7xxOTPState *s = NPCM7XX_OTP(dev);
-    SysBusDevice *sbd = &s->parent;
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
     memset(s->array, 0, sizeof(s->array));
 
diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/npcm7xx_fiu.c
+++ b/hw/ssi/npcm7xx_fiu.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_hold_reset(Object *obj)
 static void npcm7xx_fiu_realize(DeviceState *dev, Error **errp)
 {
     NPCM7xxFIUState *s = NPCM7XX_FIU(dev);
-    SysBusDevice *sbd = &s->parent;
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     int i;
 
     if (s->cs_count <= 0) {
-- 
2.20.1

From: Roman Bolshakov <r.bolshakov@yadro.com>

ui/cocoa.m:1188:44: warning: 'openFile:' is deprecated: first deprecated in macOS 11.0 - Use -[NSWorkspace openURL:] instead.
      [-Wdeprecated-declarations]
        if ([[NSWorkspace sharedWorkspace] openFile: full_file_path] == YES) {
                                           ^
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/AppKit.framework/Headers/NSWorkspace.h:350:1: note:
      'openFile:' has been explicitly marked deprecated here
- (BOOL)openFile:(NSString *)fullPath API_DEPRECATED("Use -[NSWorkspace openURL:] instead.", macos(10.0, 11.0));
^

Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210102150718.47618-1-r.bolshakov@yadro.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 ui/cocoa.m | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index XXXXXXX..XXXXXXX 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
     /* Where to look for local files */
     NSString *path_array[] = {@"../share/doc/qemu/", @"../doc/qemu/", @"docs/"};
     NSString *full_file_path;
+    NSURL *full_file_url;
 
     /* iterate thru the possible paths until the file is found */
     int index;
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
         full_file_path = [full_file_path stringByDeletingLastPathComponent];
         full_file_path = [NSString stringWithFormat: @"%@/%@%@", full_file_path,
                           path_array[index], filename];
-        if ([[NSWorkspace sharedWorkspace] openFile: full_file_path] == YES) {
+        full_file_url = [NSURL fileURLWithPath: full_file_path
+                                   isDirectory: false];
+        if ([[NSWorkspace sharedWorkspace] openURL: full_file_url] == YES) {
             return;
         }
     }
-- 
2.20.1