Series comparison

-[PULL 00/31] target-arm queue
+[PULL 00/14] target-arm queue
-First arm pullreq for 7.1. The bulk of this is the qemu_split_irq
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
 removal.
-I have enough stuff in my to-review queue that I expect to do another
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 pullreq early next week, but 31 patches is enough to not hang on to.
 thanks
 -- PMM
 The following changes since commit 9c125d17e9402c232c46610802e5931b3639d77b:
   Merge tag 'pull-tcg-20220420' of https://gitlab.com/rth7680/qemu into staging (2022-04-20 16:43:11 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220421
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-for you to fetch changes up to 5b415dd61bdbf61fb4be0e9f1a7172b8bce682c6:
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-  hw/arm: Use bit fields for NPCM7XX PWRON STRAPs (2022-04-21 11:37:05 +0100)
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
+ * Implement FEAT_ECV
- * versal: Add the Cortex-R5s in the Real-Time Processing Unit (RPU) subsystem
+ * STM32L4x5: Implement GPIO device
- * versal: model enough of the Clock/Reset Low-power domain (CRL) to allow control of the Cortex-R5s
+ * Fix 32-bit SMOPA
- * xlnx-zynqmp: Connect 4 TTC timers
+ * Refactor v7m related code from cpu32.c into its own file
- * exynos4210: Refactor GIC/combiner code to stop using qemu_split_irq
+ * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
  * realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
  * stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
  * hw/core/irq: remove unused 'qemu_irq_split' function
  * npcm7xx: use symbolic constants for PWRON STRAP bit fields
  * virt: document impact of gic-version on max CPUs
 ----------------------------------------------------------------
-Edgar E. Iglesias (6):
+Inès Varhol (3):
-      timer: cadence_ttc: Break out header file to allow embedding
+      hw/gpio: Implement STM32L4x5 GPIO
-      hw/arm/xlnx-zynqmp: Connect 4 TTC timers
+      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-      hw/arm: versal: Create an APU CPU Cluster
+      tests/qtest: Add STM32L4x5 GPIO QTest testcase
       hw/arm: versal: Add the Cortex-R5Fs
       hw/misc: Add a model of the Xilinx Versal CRL
       hw/arm: versal: Connect the CRL
-Hao Wu (2):
+Peter Maydell (9):
-      hw/misc: Add PWRON STRAP bit fields in GCR module
+      target/arm: Move some register related defines to internals.h
-      hw/arm: Use bit fields for NPCM7XX PWRON STRAPs
+      target/arm: Timer _EL02 registers UNDEF for E2H == 0
       target/arm: use FIELD macro for CNTHCTL bit definitions
       target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
       target/arm: Implement new FEAT_ECV trap bits
       target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
       target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
       target/arm: Enable FEAT_ECV for 'max' CPU
       hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-Heinrich Schuchardt (1):
+Richard Henderson (1):
-      hw/arm/virt: impact of gic-version on max CPUs
+      target/arm: Fix 32-bit SMOPA
-Peter Maydell (19):
+Thomas Huth (1):
-      hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
+      target/arm: Move v7m-related code from cpu32.c into a separate file
       hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
       hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
       hw/arm/exynos4210: Put a9mpcore device into state struct
       hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
       hw/arm/exynos4210: Coalesce board_irqs and irq_table
       hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
       hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
       hw/arm/exynos4210: Put external GIC into state struct
       hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
       hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
       hw/arm/exynos4210: Delete unused macro definitions
       hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
       hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
       hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
       hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
       hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
       hw/arm/exynos4210: Put combiners into state struct
       hw/arm/exynos4210: Drop Exynos4210Irq struct
-Zongyuan Li (3):
+ MAINTAINERS                        |   1 +
-      hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
-      hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
+ docs/system/arm/emulation.rst      |   1 +
-      hw/core/irq: remove unused 'qemu_irq_split' function
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
  include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
  include/hw/misc/stm32l4x5_syscfg.h |   3 +-
  include/hw/rtc/sun4v-rtc.h         |   2 +-
  target/arm/cpu-features.h          |  10 +
  target/arm/cpu.h                   | 129 +--------
  target/arm/internals.h             | 151 ++++++++++
  hw/arm/stm32l4x5_soc.c             |  71 ++++-
  hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
  hw/misc/stm32l4x5_syscfg.c         |   1 +
  hw/rtc/sun4v-rtc.c                 |   2 +-
  target/arm/helper.c                | 189 ++++++++++++-
  target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
  target/arm/tcg/cpu32.c             | 261 ------------------
  target/arm/tcg/cpu64.c             |   1 +
  target/arm/tcg/sme_helper.c        |  77 +++---
  tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
  tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
  hw/arm/Kconfig                     |   3 +-
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
  target/arm/meson.build             |   3 +
  target/arm/tcg/meson.build         |   3 +
  target/arm/trace-events            |   1 +
  tests/qtest/meson.build            |   3 +-
  tests/tcg/aarch64/Makefile.target  |   2 +-
 files changed, 1962 insertions(+), 456 deletions(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
  create mode 100644 target/arm/tcg/cpu-v7m.c
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
- docs/system/arm/virt.rst              |   4 +-
- include/hw/arm/exynos4210.h           |  50 ++--
- include/hw/arm/xlnx-versal.h          |  16 ++
- include/hw/arm/xlnx-zynqmp.h          |   4 +
- include/hw/intc/exynos4210_combiner.h |  57 +++++
- include/hw/intc/exynos4210_gic.h      |  43 ++++
- include/hw/irq.h                      |   5 -
- include/hw/misc/npcm7xx_gcr.h         |  30 +++
- include/hw/misc/xlnx-versal-crl.h     | 235 +++++++++++++++++++
- include/hw/timer/cadence_ttc.h        |  54 +++++
- hw/arm/exynos4210.c                   | 430 ++++++++++++++++++++++++++++++----
- hw/arm/npcm7xx_boards.c               |  24 +-
- hw/arm/realview.c                     |  33 ++-
- hw/arm/stellaris.c                    |  15 +-
- hw/arm/virt.c                         |   7 +
- hw/arm/xlnx-versal-virt.c             |   6 +-
- hw/arm/xlnx-versal.c                  |  99 +++++++-
- hw/arm/xlnx-zynqmp.c                  |  22 ++
- hw/core/irq.c                         |  15 --
- hw/intc/exynos4210_combiner.c         | 108 +--------
- hw/intc/exynos4210_gic.c              | 344 +--------------------------
- hw/misc/xlnx-versal-crl.c             | 421 +++++++++++++++++++++++++++++++++
- hw/timer/cadence_ttc.c                |  32 +--
- MAINTAINERS                           |   2 +-
- hw/misc/meson.build                   |   1 +
-files changed, 1457 insertions(+), 600 deletions(-)
- create mode 100644 include/hw/intc/exynos4210_combiner.h
- create mode 100644 include/hw/intc/exynos4210_gic.h
- create mode 100644 include/hw/misc/xlnx-versal-crl.h
- create mode 100644 include/hw/timer/cadence_ttc.h
- create mode 100644 hw/misc/xlnx-versal-crl.c

-[PULL 01/31] hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
+Deleted patch
-It's not possible to provide the guest with the Security extensions
-(TrustZone) when using KVM or HVF, because the hardware
-virtualization extensions don't permit running EL3 guest code.
-However, we weren't checking for this combination, with the result
-that QEMU would assert if you tried it:
-$ qemu-system-aarch64 -enable-kvm -machine virt,secure=on -cpu host -display none
-Unexpected error in object_property_find_err() at ../../qom/object.c:1304:
-qemu-system-aarch64: Property 'host-arm-cpu.secure-memory' not found
-Aborted
-Check for this combination of options and report an error, in the
-same way we already do for attempts to give a KVM or HVF guest the
-Virtualization or MTE extensions. Now we will report:
-qemu-system-aarch64: mach-virt: KVM does not support providing Security extensions (TrustZone) to the guest CPU
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/961
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404155301.566542-1-peter.maydell@linaro.org
----
- hw/arm/virt.c | 7 +++++++
-file changed, 7 insertions(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-         exit(1);
-     }
-+    if (vms->secure && (kvm_enabled() || hvf_enabled())) {
-+        error_report("mach-virt: %s does not support providing "
-+                     "Security extensions (TrustZone) to the guest CPU",
-+                     kvm_enabled() ? "KVM" : "HVF");
-+        exit(1);
-+    }
-+
-     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
-         error_report("mach-virt: %s does not support providing "
-                      "Virtualization extensions to the guest CPU",
---
-.25.1

-[PULL 22/31] hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
+[PULL 01/14] target/arm: Move some register related defines to internals.h
-The combiner_grp_to_gic_id[] array includes the EXT_GIC_ID_MCT_G0
+cpu.h has a lot of #defines relating to CPU register fields.
-and EXT_GIC_ID_MCT_G1 multiple times. This means that we will
+Most of these aren't actually used outside target/arm code,
-connect multiple IRQs up to the same external GIC input, which
+so there's no point in cluttering up the cpu.h file with them.
-is not permitted. We do the same thing in the code in
+Move some easy ones to internals.h.
 exynos4210_init_board_irqs() because the conditionals selecting
 an irq_id in the first loop match multiple interrupt IDs.
 Overall we do this for interrupt IDs
 (1, 4), (12, 4), (35, 4), (51, 4), (53, 4) for EXT_GIC_ID_MCT_G0
 and
 (1, 5), (12, 5), (35, 5), (51, 5), (53, 5) for EXT_GIC_ID_MCT_G1
 These correspond to the cases for the multi-core timer that we are
 wiring up to multiple inputs on the combiner in
 exynos4210_combiner_get_gpioin().  That code already deals with all
 these interrupt IDs being the same input source, so we don't need to
 connect the external GIC interrupt for any of them except the first
 (1, 4) and (1, 5). Remove the array entries and conditionals which
 were incorrectly causing us to wire up extra lines.
 This bug didn't cause any visible effects, because we only connect
 up a device to the "primary" ID values (1, 4) and (1, 5), so the
 extra lines would never be set to a level.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-16-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  2 +-
+ target/arm/cpu.h       | 128 -----------------------------------------
- hw/arm/exynos4210.c         | 12 +++++-------
+ target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
-files changed, 6 insertions(+), 8 deletions(-)
+files changed, 128 insertions(+), 128 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
-  * one for every non-zero entry in combiner_grp_to_gic_id[].
+     uint64_t ctl; /* Timer Control register */
-  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
+ } ARMGenericTimer;
-  */
--#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
+-#define VTCR_NSW (1u << 29)
-+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
+-#define VTCR_NSA (1u << 30)
+-#define VSTCR_SW VTCR_NSW
- typedef struct Exynos4210Irq {
+-#define VSTCR_SA VTCR_NSA
-     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+-
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+ /* Define a maximum sized vector register.
   * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
   * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
  #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
  #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 -/* Bit definitions for CPACR (AArch32 only) */
 -FIELD(CPACR, CP10, 20, 2)
 -FIELD(CPACR, CP11, 22, 2)
 -FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
 -FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
 -FIELD(CPACR, ASEDIS, 31, 1)
 -
 -/* Bit definitions for CPACR_EL1 (AArch64 only) */
 -FIELD(CPACR_EL1, ZEN, 16, 2)
 -FIELD(CPACR_EL1, FPEN, 20, 2)
 -FIELD(CPACR_EL1, SMEN, 24, 2)
 -FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
 -
 -/* Bit definitions for HCPTR (AArch32 only) */
 -FIELD(HCPTR, TCP10, 10, 1)
 -FIELD(HCPTR, TCP11, 11, 1)
 -FIELD(HCPTR, TASE, 15, 1)
 -FIELD(HCPTR, TTA, 20, 1)
 -FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
 -FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
 -
 -/* Bit definitions for CPTR_EL2 (AArch64 only) */
 -FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
 -FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 -FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 -FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 -FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 -FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 -FIELD(CPTR_EL2, TTA, 28, 1)
 -FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 -FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 -
 -/* Bit definitions for CPTR_EL3 (AArch64 only) */
 -FIELD(CPTR_EL3, EZ, 8, 1)
 -FIELD(CPTR_EL3, TFP, 10, 1)
 -FIELD(CPTR_EL3, ESM, 12, 1)
 -FIELD(CPTR_EL3, TTA, 20, 1)
 -FIELD(CPTR_EL3, TAM, 30, 1)
 -FIELD(CPTR_EL3, TCPAC, 31, 1)
 -
 -#define MDCR_MTPME    (1U << 28)
 -#define MDCR_TDCC     (1U << 27)
 -#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 -#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 -#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 -#define MDCR_EPMAD    (1U << 21)
 -#define MDCR_EDAD     (1U << 20)
 -#define MDCR_TTRF     (1U << 19)
 -#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 -#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 -#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 -#define MDCR_SDD      (1U << 16)
 -#define MDCR_SPD      (3U << 14)
 -#define MDCR_TDRA     (1U << 11)
 -#define MDCR_TDOSA    (1U << 10)
 -#define MDCR_TDA      (1U << 9)
 -#define MDCR_TDE      (1U << 8)
 -#define MDCR_HPME     (1U << 7)
 -#define MDCR_TPM      (1U << 6)
 -#define MDCR_TPMCR    (1U << 5)
 -#define MDCR_HPMN     (0x1fU)
 -
 -/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 -#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 -                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 -                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 -
  #define CPSR_M (0x1fU)
  #define CPSR_T (1U << 5)
  #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define XPSR_NZCV CPSR_NZCV
  #define XPSR_IT CPSR_IT
 -#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 -#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 -#define TTBCR_PD0    (1U << 4)
 -#define TTBCR_PD1    (1U << 5)
 -#define TTBCR_EPD0   (1U << 7)
 -#define TTBCR_IRGN0  (3U << 8)
 -#define TTBCR_ORGN0  (3U << 10)
 -#define TTBCR_SH0    (3U << 12)
 -#define TTBCR_T1SZ   (3U << 16)
 -#define TTBCR_A1     (1U << 22)
 -#define TTBCR_EPD1   (1U << 23)
 -#define TTBCR_IRGN1  (3U << 24)
 -#define TTBCR_ORGN1  (3U << 26)
 -#define TTBCR_SH1    (1U << 28)
 -#define TTBCR_EAE    (1U << 31)
 -
 -FIELD(VTCR, T0SZ, 0, 6)
 -FIELD(VTCR, SL0, 6, 2)
 -FIELD(VTCR, IRGN0, 8, 2)
 -FIELD(VTCR, ORGN0, 10, 2)
 -FIELD(VTCR, SH0, 12, 2)
 -FIELD(VTCR, TG0, 14, 2)
 -FIELD(VTCR, PS, 16, 3)
 -FIELD(VTCR, VS, 19, 1)
 -FIELD(VTCR, HA, 21, 1)
 -FIELD(VTCR, HD, 22, 1)
 -FIELD(VTCR, HWU59, 25, 1)
 -FIELD(VTCR, HWU60, 26, 1)
 -FIELD(VTCR, HWU61, 27, 1)
 -FIELD(VTCR, HWU62, 28, 1)
 -FIELD(VTCR, NSW, 29, 1)
 -FIELD(VTCR, NSA, 30, 1)
 -FIELD(VTCR, DS, 32, 1)
 -FIELD(VTCR, SL2, 33, 1)
 -
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_TWEDEN    (1ULL << 59)
  #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 -#define HCRX_ENAS0    (1ULL << 0)
 -#define HCRX_ENALS    (1ULL << 1)
 -#define HCRX_ENASR    (1ULL << 2)
 -#define HCRX_FNXS     (1ULL << 3)
 -#define HCRX_FGTNXS   (1ULL << 4)
 -#define HCRX_SMPME    (1ULL << 5)
 -#define HCRX_TALLINT  (1ULL << 6)
 -#define HCRX_VINMI    (1ULL << 7)
 -#define HCRX_VFNMI    (1ULL << 8)
 -#define HCRX_CMOW     (1ULL << 9)
 -#define HCRX_MCE2     (1ULL << 10)
 -#define HCRX_MSCEN    (1ULL << 11)
 -
 -#define HPFAR_NS      (1ULL << 63)
 -
  #define SCR_NS                (1ULL << 0)
  #define SCR_IRQ               (1ULL << 1)
  #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_GPF               (1ULL << 48)
  #define SCR_NSE               (1ULL << 62)
 -#define HSTR_TTEE (1 << 16)
 -#define HSTR_TJDBX (1 << 17)
 -
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 -
  /* Return the current FPSCR value.  */
  uint32_t vfp_get_fpscr(CPUARMState *env);
  void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/internals.h
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
-     /* int combiner group 34 */
+ FIELD(DBGWCR, MASK, 24, 5)
-     { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
+ FIELD(DBGWCR, SSCE, 29, 1)
-     /* int combiner group 35 */
--    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++#define VTCR_NSW (1u << 29)
-+    { 0, 0, 0, EXT_GIC_ID_MCT_L1 },
++#define VTCR_NSA (1u << 30)
-     /* int combiner group 36 */
++#define VSTCR_SW VTCR_NSW
-     { EXT_GIC_ID_MIXER },
++#define VSTCR_SA VTCR_NSA
-     /* int combiner group 37 */
++
-@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
++/* Bit definitions for CPACR (AArch32 only) */
-     /* groups 38-50 */
++FIELD(CPACR, CP10, 20, 2)
-     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
++FIELD(CPACR, CP11, 22, 2)
-     /* int combiner group 51 */
++FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
--    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-+    { EXT_GIC_ID_MCT_L0 },
++FIELD(CPACR, ASEDIS, 31, 1)
-     /* group 52 */
++
-     { },
++/* Bit definitions for CPACR_EL1 (AArch64 only) */
-     /* int combiner group 53 */
++FIELD(CPACR_EL1, ZEN, 16, 2)
--    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
++FIELD(CPACR_EL1, FPEN, 20, 2)
-+    { EXT_GIC_ID_WDT },
++FIELD(CPACR_EL1, SMEN, 24, 2)
-     /* groups 54-63 */
++FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
++
- };
++/* Bit definitions for HCPTR (AArch32 only) */
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
++FIELD(HCPTR, TCP10, 10, 1)
++FIELD(HCPTR, TCP11, 11, 1)
-     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
++FIELD(HCPTR, TASE, 15, 1)
-         irq_id = 0;
++FIELD(HCPTR, TTA, 20, 1)
--        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
++FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
--                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
++FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4)) {
++
-             /* MCT_G0 is passed to External GIC */
++/* Bit definitions for CPTR_EL2 (AArch64 only) */
-             irq_id = EXT_GIC_ID_MCT_G0;
++FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-         }
++FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
--        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
++FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
--                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
++FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5)) {
++FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-             /* MCT_G1 is passed to External and GIC */
++FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-             irq_id = EXT_GIC_ID_MCT_G1;
++FIELD(CPTR_EL2, TTA, 28, 1)
-         }
++FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 +FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 +
 +/* Bit definitions for CPTR_EL3 (AArch64 only) */
 +FIELD(CPTR_EL3, EZ, 8, 1)
 +FIELD(CPTR_EL3, TFP, 10, 1)
 +FIELD(CPTR_EL3, ESM, 12, 1)
 +FIELD(CPTR_EL3, TTA, 20, 1)
 +FIELD(CPTR_EL3, TAM, 30, 1)
 +FIELD(CPTR_EL3, TCPAC, 31, 1)
 +
 +#define MDCR_MTPME    (1U << 28)
 +#define MDCR_TDCC     (1U << 27)
 +#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 +#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 +#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 +#define MDCR_EPMAD    (1U << 21)
 +#define MDCR_EDAD     (1U << 20)
 +#define MDCR_TTRF     (1U << 19)
 +#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 +#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 +#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 +#define MDCR_SDD      (1U << 16)
 +#define MDCR_SPD      (3U << 14)
 +#define MDCR_TDRA     (1U << 11)
 +#define MDCR_TDOSA    (1U << 10)
 +#define MDCR_TDA      (1U << 9)
 +#define MDCR_TDE      (1U << 8)
 +#define MDCR_HPME     (1U << 7)
 +#define MDCR_TPM      (1U << 6)
 +#define MDCR_TPMCR    (1U << 5)
 +#define MDCR_HPMN     (0x1fU)
 +
 +/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 +#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 +                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 +                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 +
 +#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 +#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 +#define TTBCR_PD0    (1U << 4)
 +#define TTBCR_PD1    (1U << 5)
 +#define TTBCR_EPD0   (1U << 7)
 +#define TTBCR_IRGN0  (3U << 8)
 +#define TTBCR_ORGN0  (3U << 10)
 +#define TTBCR_SH0    (3U << 12)
 +#define TTBCR_T1SZ   (3U << 16)
 +#define TTBCR_A1     (1U << 22)
 +#define TTBCR_EPD1   (1U << 23)
 +#define TTBCR_IRGN1  (3U << 24)
 +#define TTBCR_ORGN1  (3U << 26)
 +#define TTBCR_SH1    (1U << 28)
 +#define TTBCR_EAE    (1U << 31)
 +
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
 +#define HCRX_ENAS0    (1ULL << 0)
 +#define HCRX_ENALS    (1ULL << 1)
 +#define HCRX_ENASR    (1ULL << 2)
 +#define HCRX_FNXS     (1ULL << 3)
 +#define HCRX_FGTNXS   (1ULL << 4)
 +#define HCRX_SMPME    (1ULL << 5)
 +#define HCRX_TALLINT  (1ULL << 6)
 +#define HCRX_VINMI    (1ULL << 7)
 +#define HCRX_VFNMI    (1ULL << 8)
 +#define HCRX_CMOW     (1ULL << 9)
 +#define HCRX_MCE2     (1ULL << 10)
 +#define HCRX_MSCEN    (1ULL << 11)
 +
 +#define HPFAR_NS      (1ULL << 63)
 +
 +#define HSTR_TTEE (1 << 16)
 +#define HSTR_TJDBX (1 << 17)
 +
 +#define CNTHCTL_CNTVMASK      (1 << 18)
 +#define CNTHCTL_CNTPMASK      (1 << 19)
 +
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
   * get_phys_addr() code assumes A/R profile and reports failures via
 --
-.25.1
+.34.1

-[PULL 23/31] hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
-At this point, the function exynos4210_init_board_irqs() splits input
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
-IRQ lines to connect them to the input combiner, output combiner and
+or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
-external GIC.  The function exynos4210_combiner_get_gpioin() splits
+delivering the exception to EL2 with the wrong syndrome.
 some of the combiner input lines further to connect them to multiple
 different inputs on the combiner.
 Because (unlike qemu_irq_split()) the TYPE_SPLIT_IRQ device has a
 configurable number of outputs, we can do all this in one place, by
 making exynos4210_init_board_irqs() add extra outputs to the splitter
 device when it must be connected to more than one input on each
 combiner.
 We do this with a new data structure, the combinermap, which is an
 array each of whose elements is a list of the interrupt IDs on the
 combiner which must be tied together.  As we loop through each
 interrupt ID, if we find that it is the first one in one of these
 lists, we configure the splitter device with eonugh extra outputs and
 wire them up to the other interrupt IDs in the list.
 Conveniently, for all the cases where this is necessary, the
 lowest-numbered interrupt ID in each group is in the range of the
 external combiner, so we only need to code for this in the first of
 the two loops in exynos4210_init_board_irqs().
 The old code in exynos4210_combiner_get_gpioin() which is being
 deleted here had several problems which don't exist in the new code
 in its handling of the multi-core timer interrupts:
  (1) the case labels specified bits 4 ... 8, but bit '8' doesn't
      exist; these should have been 4 ... 7
  (2) it used the input irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]
      multiple times as the input of several different splitters,
      which isn't allowed
  (3) in an apparent cut-and-paste error, the cases for all the
      multi-core timer inputs used "bit + 4" even though the
      bit range for the case was (intended to be) 4 ... 7, which
      meant it was looking at non-existent bits 8 ... 11.
 None of these exist in the new code.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-17-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |   6 +-
+ target/arm/helper.c | 2 +-
- hw/arm/exynos4210.c         | 178 +++++++++++++++++++++++-------------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 119 insertions(+), 65 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
+         return CP_ACCESS_OK;
  /*
   * We need one splitter for every external combiner input, plus
 - * one for every non-zero entry in combiner_grp_to_gic_id[].
 + * one for every non-zero entry in combiner_grp_to_gic_id[],
 + * minus one for every external combiner ID in second or later
 + * places in a combinermap[] line.
   * We'll assert in exynos4210_init_board_irqs() if this is wrong.
   */
 -#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
 +#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
  typedef struct Exynos4210Irq {
      qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
      ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 +/*
 + * Some interrupt lines go to multiple combiner inputs.
 + * This data structure defines those: each array element is
 + * a list of combiner inputs which are connected together;
 + * the one with the smallest interrupt ID value must be first.
 + * As with combiner_grp_to_gic_id[], we rely on (0, 0) not being
 + * wired to anything so we can use 0 as a terminator.
 + */
 +#define IRQNO(G, B) EXYNOS4210_COMBINER_GET_IRQ_NUM(G, B)
 +#define IRQNONE 0
 +
 +#define COMBINERMAP_SIZE 16
 +
 +static const int combinermap[COMBINERMAP_SIZE][6] = {
 +    /* MDNIE_LCD1 */
 +    { IRQNO(0, 4), IRQNO(1, 0), IRQNONE },
 +    { IRQNO(0, 5), IRQNO(1, 1), IRQNONE },
 +    { IRQNO(0, 6), IRQNO(1, 2), IRQNONE },
 +    { IRQNO(0, 7), IRQNO(1, 3), IRQNONE },
 +    /* TMU */
 +    { IRQNO(2, 4), IRQNO(3, 4), IRQNONE },
 +    { IRQNO(2, 5), IRQNO(3, 5), IRQNONE },
 +    { IRQNO(2, 6), IRQNO(3, 6), IRQNONE },
 +    { IRQNO(2, 7), IRQNO(3, 7), IRQNONE },
 +    /* LCD1 */
 +    { IRQNO(11, 4), IRQNO(12, 0), IRQNONE },
 +    { IRQNO(11, 5), IRQNO(12, 1), IRQNONE },
 +    { IRQNO(11, 6), IRQNO(12, 2), IRQNONE },
 +    { IRQNO(11, 7), IRQNO(12, 3), IRQNONE },
 +    /* Multi-core timer */
 +    { IRQNO(1, 4), IRQNO(12, 4), IRQNO(35, 4), IRQNO(51, 4), IRQNO(53, 4), IRQNONE },
 +    { IRQNO(1, 5), IRQNO(12, 5), IRQNO(35, 5), IRQNO(51, 5), IRQNO(53, 5), IRQNONE },
 +    { IRQNO(1, 6), IRQNO(12, 6), IRQNO(35, 6), IRQNO(51, 6), IRQNO(53, 6), IRQNONE },
 +    { IRQNO(1, 7), IRQNO(12, 7), IRQNO(35, 7), IRQNO(51, 7), IRQNO(53, 7), IRQNONE },
 +};
 +
 +#undef IRQNO
 +
 +static const int *combinermap_entry(int irq)
 +{
 +    /*
 +     * If the interrupt number passed in is the first entry in some
 +     * line of the combinermap, return a pointer to that line;
 +     * otherwise return NULL.
 +     */
 +    int i;
 +    for (i = 0; i < COMBINERMAP_SIZE; i++) {
 +        if (combinermap[i][0] == irq) {
 +            return combinermap[i];
 +        }
 +    }
 +    return NULL;
 +}
 +
 +static int mapline_size(const int *mapline)
 +{
 +    /* Return number of entries in this mapline in total */
 +    int i = 0;
 +
 +    if (!mapline) {
 +        /* Not in the map? IRQ goes to exactly one combiner input */
 +        return 1;
 +    }
 +    while (*mapline != IRQNONE) {
 +        mapline++;
 +        i++;
 +    }
 +    return i;
 +}
 +
  /*
   * Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
      DeviceState *extgicdev = DEVICE(&s->ext_gic);
      int splitcount = 0;
      DeviceState *splitter;
 +    const int *mapline;
 +    int numlines, splitin, in;
      for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
          irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
              irq_id = EXT_GIC_ID_MCT_G1;
          }
 +        if (s->irq_table[n]) {
 +            /*
 +             * This must be some non-first entry in a combinermap line,
 +             * and we've already filled it in.
 +             */
 +            continue;
 +        }
 +        mapline = combinermap_entry(n);
 +        /*
 +         * We need to connect the IRQ to multiple inputs on both combiners
 +         * and possibly also to the external GIC.
 +         */
 +        numlines = 2 * mapline_size(mapline);
 +        if (irq_id) {
 +            numlines++;
 +        }
          assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
          splitter = DEVICE(&s->splitter[splitcount]);
 -        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
 +        qdev_prop_set_uint16(splitter, "num-lines", numlines);
          qdev_realize(splitter, NULL, &error_abort);
          splitcount++;
 -        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 -        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
 -        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
 +
 +        in = n;
 +        splitin = 0;
 +        for (;;) {
 +            s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
 +            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
 +            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
 +            splitin += 2;
 +            if (!mapline) {
 +                break;
 +            }
 +            mapline++;
 +            in = *mapline;
 +            if (in == IRQNONE) {
 +                break;
 +            }
 +        }
          if (irq_id) {
 -            qdev_connect_gpio_out(splitter, 2,
 +            qdev_connect_gpio_out(splitter, splitin,
                                    qdev_get_gpio_in(extgicdev, irq_id - 32));
          }
      }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
-         irq_id = combiner_grp_to_gic_id[grp -
+-        return CP_ACCESS_TRAP;
-                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
++        return CP_ACCESS_TRAP_UNCATEGORIZED;
 +        if (s->irq_table[n]) {
 +            /*
 +             * This must be some non-first entry in a combinermap line,
 +             * and we've already filled it in.
 +             */
 +            continue;
 +        }
 +
          if (irq_id) {
              assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
              splitter = DEVICE(&s->splitter[splitcount]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
                                             DeviceState *dev, int ext)
  {
      int n;
 -    int bit;
      int max;
      qemu_irq *irq;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
          EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
      irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 -    /*
 -     * Some IRQs of Int/External Combiner are going to two Combiners groups,
 -     * so let split them.
 -     */
      for (n = 0; n < max; n++) {
 -
 -        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 -
 -        switch (n) {
 -        /* MDNIE_LCD1 INTG1 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
 -            continue;
 -
 -        /* TMU INTG3 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
 -            continue;
 -
 -        /* LCD1 INTG12 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG12 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
 -               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG35 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG51 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG53 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -        }
 -
          irq[n] = qdev_get_gpio_in(dev, n);
      }
+     return CP_ACCESS_OK;
  }
 --
-.25.1
+.34.1

-[PULL 12/31] hw/arm/exynos4210: Coalesce board_irqs and irq_table
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-The exynos4210 code currently has two very similar arrays of IRQs:
+We prefer the FIELD macro over ad-hoc #defines for register bits;
+switch CNTHCTL to that style before we add any more bits.
  * board_irqs is a field of the Exynos4210Irq struct which is filled
    in by exynos4210_init_board_irqs() with the appropriate qemu_irqs
    for each IRQ the board/SoC can assert
  * irq_table is a set of qemu_irqs pointed to from the
    Exynos4210State struct.  It's allocated in exynos4210_init_irq,
    and the only behaviour these irqs have is that they pass on the
    level to the equivalent board_irqs[] irq
 The extra indirection through irq_table is unnecessary, so coalesce
 these into a single irq_table[] array as a direct field in
 Exynos4210State which exynos4210_init_board_irqs() fills in.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-6-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  8 ++------
+ target/arm/internals.h | 27 +++++++++++++++++++++++++--
- hw/arm/exynos4210.c         |  6 +-----
+ target/arm/helper.c    |  9 ++++-----
- hw/intc/exynos4210_gic.c    | 32 ++++++++------------------------
+files changed, 29 insertions(+), 7 deletions(-)
 files changed, 11 insertions(+), 35 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/internals.h
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
-     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+ #define HSTR_TTEE (1 << 16)
-     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
+ #define HSTR_TJDBX (1 << 17)
-     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
--    qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+-#define CNTHCTL_CNTVMASK      (1 << 18)
- } Exynos4210Irq;
+-#define CNTHCTL_CNTPMASK      (1 << 19)
++/*
- struct Exynos4210State {
++ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
-@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
++ * have different bit definitions, and EL1PCTEN might be
-     /*< public >*/
++ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
-     ARMCPU *cpu[EXYNOS4210_NCPUS];
++ * disambiguate if necessary.
-     Exynos4210Irq irqs;
++ */
--    qemu_irq *irq_table;
++FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
-+    qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
++FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
++FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
-     MemoryRegion chipid_mem;
++FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
-     MemoryRegion iram_mem;
++FIELD(CNTHCTL, EVNTEN, 2, 1)
-@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
++FIELD(CNTHCTL, EVNTDIR, 3, 1)
- void exynos4210_write_secondary(ARMCPU *cpu,
++FIELD(CNTHCTL, EVNTI, 4, 4)
-         const struct arm_boot_info *info);
++FIELD(CNTHCTL, EL0VTEN, 8, 1)
++FIELD(CNTHCTL, EL0PTEN, 9, 1)
--/* Initialize exynos4210 IRQ subsystem stub */
++FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
--qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
++FIELD(CNTHCTL, EL1PTEN, 11, 1)
 +FIELD(CNTHCTL, ECV, 12, 1)
 +FIELD(CNTHCTL, EL1TVT, 13, 1)
 +FIELD(CNTHCTL, EL1TVCT, 14, 1)
 +FIELD(CNTHCTL, EL1NVPCT, 15, 1)
 +FIELD(CNTHCTL, EL1NVVCT, 16, 1)
 +FIELD(CNTHCTL, EVNTIS, 17, 1)
 +FIELD(CNTHCTL, CNTVMASK, 18, 1)
 +FIELD(CNTHCTL, CNTPMASK, 19, 1)
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
       * It is RES0 in Secure and NonSecure state.
       */
      if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
 -        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
 -         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
 +        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
 +         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
          irqstate = 0;
      }
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      ARMCPU *cpu = env_archcpu(env);
      uint32_t oldval = env->cp15.cnthctl_el2;
 -
- /* Initialize board IRQs.
+     raw_write(env, ri, value);
-  * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
--void exynos4210_init_board_irqs(Exynos4210Irq *s);
+-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
-+void exynos4210_init_board_irqs(Exynos4210State *s);
++    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
+         gt_update_irq(cpu, GTIMER_VIRT);
- /* Get IRQ number from exynos4210 IRQ subsystem stub.
+-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
-  * To identify IRQ source use internal combiner group and bit number
++    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+         gt_update_irq(cpu, GTIMER_PHYS);
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
          qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);
      }
 -    /*** IRQs ***/
 -
 -    s->irq_table = exynos4210_init_irq(&s->irqs);
 -
      /* IRQ Gate */
      for (i = 0; i < EXYNOS4210_NCPUS; i++) {
          DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
      /* Initialize board IRQs. */
 -    exynos4210_init_board_irqs(&s->irqs);
 +    exynos4210_init_board_irqs(s);
      /*** Memory ***/
 diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_gic.c
 +++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -static void exynos4210_irq_handler(void *opaque, int irq, int level)
 -{
 -    Exynos4210Irq *s = (Exynos4210Irq *)opaque;
 -
 -    /* Bypass */
 -    qemu_set_irq(s->board_irqs[irq], level);
 -}
 -
 -/*
 - * Initialize exynos4210 IRQ subsystem stub.
 - */
 -qemu_irq *exynos4210_init_irq(Exynos4210Irq *s)
 -{
 -    return qemu_allocate_irqs(exynos4210_irq_handler, s,
 -            EXYNOS4210_MAX_INT_COMBINER_IN_IRQ);
 -}
 -
  /*
   * Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
   */
 -void exynos4210_init_board_irqs(Exynos4210Irq *s)
 +void exynos4210_init_board_irqs(Exynos4210State *s)
  {
      uint32_t grp, bit, irq_id, n;
 +    Exynos4210Irq *is = &s->irqs;
      for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
          irq_id = 0;
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
              irq_id = EXT_GIC_ID_MCT_G1;
          }
          if (irq_id) {
 -            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
 -                    s->ext_gic_irq[irq_id-32]);
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
          } else {
 -            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
 -                    s->ext_combiner_irq[n]);
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_combiner_irq[n]);
          }
      }
      for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
                       EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
          if (irq_id) {
 -            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
 -                    s->ext_gic_irq[irq_id-32]);
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
          }
      }
  }
 --
-.25.1
+.34.1

-[PULL 19/31] hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-In exynos4210_init_board_irqs(), use the TYPE_SPLIT_IRQ device
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
-instead of qemu_irq_split().
+This is not strictly architecturally required, but it is how we've
 tended to implement registers more recently.
 In particular, bits [19:18] are only present with FEAT_RME,
 and bits [17:12] will only be present with FEAT_ECV.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-13-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  9 ++++++++
+ target/arm/helper.c | 18 ++++++++++++++++++
- hw/arm/exynos4210.c         | 41 +++++++++++++++++++++++++++++--------
+file changed, 18 insertions(+)
 files changed, 42 insertions(+), 8 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
- #include "hw/sysbus.h"
+ {
- #include "hw/cpu/a9mpcore.h"
+     ARMCPU *cpu = env_archcpu(env);
- #include "hw/intc/exynos4210_gic.h"
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+#include "hw/core/split-irq.h"
++    uint32_t valid_mask =
- #include "target/arm/cpu-qom.h"
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
- #include "qom/object.h"
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
++        R_CNTHCTL_EVNTEN_MASK |
-@@ -XXX,XX +XXX,XX @@
++        R_CNTHCTL_EVNTDIR_MASK |
++        R_CNTHCTL_EVNTI_MASK |
- #define EXYNOS4210_NUM_DMA      3
++        R_CNTHCTL_EL0VTEN_MASK |
++        R_CNTHCTL_EL0PTEN_MASK |
-+/*
++        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
-+ * We need one splitter for every external combiner input, plus
++        R_CNTHCTL_EL1PTEN_MASK;
 + * one for every non-zero entry in combiner_grp_to_gic_id[].
 + * We'll assert in exynos4210_init_board_irqs() if this is wrong.
 + */
 +#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
 +
- typedef struct Exynos4210Irq {
++    if (cpu_isar_feature(aa64_rme, cpu)) {
-     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
++        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
      qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
      A9MPPrivState a9mpcore;
      Exynos4210GicState ext_gic;
 +    SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
  };
  #define TYPE_EXYNOS4210_SOC "exynos4210"
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
      uint32_t grp, bit, irq_id, n;
      Exynos4210Irq *is = &s->irqs;
      DeviceState *extgicdev = DEVICE(&s->ext_gic);
 +    int splitcount = 0;
 +    DeviceState *splitter;
      for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
          irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
              /* MCT_G1 is passed to External and GIC */
              irq_id = EXT_GIC_ID_MCT_G1;
          }
 +
 +        assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
 +        splitter = DEVICE(&s->splitter[splitcount]);
 +        qdev_prop_set_uint16(splitter, "num-lines", 2);
 +        qdev_realize(splitter, NULL, &error_abort);
 +        splitcount++;
 +        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 +        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
          if (irq_id) {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                                             qdev_get_gpio_in(extgicdev,
 -                                                              irq_id - 32));
 +            qdev_connect_gpio_out(splitter, 1,
 +                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
          } else {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_combiner_irq[n]);
 +            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
          }
      }
      for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
                       EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
          if (irq_id) {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                                             qdev_get_gpio_in(extgicdev,
 -                                                              irq_id - 32));
 +            assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
 +            splitter = DEVICE(&s->splitter[splitcount]);
 +            qdev_prop_set_uint16(splitter, "num-lines", 2);
 +            qdev_realize(splitter, NULL, &error_abort);
 +            splitcount++;
 +            s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 +            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
 +            qdev_connect_gpio_out(splitter, 1,
 +                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
          }
      }
 +    /*
 +     * We check this here to avoid a more obscure assert later when
 +     * qdev_assert_realized_properly() checks that we realized every
 +     * child object we initialized.
 +     */
 +    assert(splitcount == EXYNOS4210_NUM_SPLITTERS);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
          object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
      }
 +    for (i = 0; i < ARRAY_SIZE(s->splitter); i++) {
 +        g_autofree char *name = g_strdup_printf("irq-splitter%d", i);
 +        object_initialize_child(obj, name, &s->splitter[i], TYPE_SPLIT_IRQ);
 +    }
 +
-     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
++    /* Clear RES0 bits */
-     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
++    value &= valid_mask;
- }
++
      raw_write(env, ri, value);
      if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
 --
-.25.1
+.34.1

-[PULL 14/31] hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
-The function exynos4210_init_board_irqs() currently lives in
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
-exynos4210_gic.c, but it isn't really part of the exynos4210.gic
+ * four new trap bits for various counter and timer registers
-device -- it is a function that implements (some of) the wiring up of
+ * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
-interrupts between the SoC's GIC and combiner components.  This means
+   scaling of the event stream. This is a no-op for us, because we don't
-it fits better in exynos4210.c, which is the SoC-level code.  Move it
+   implement the event stream (our WFE is a NOP): all we need to do is
-there. Similarly, exynos4210_git_irq() is used almost only in the
+   allow CNTHCTL_EL2.ENVTIS to be read and written.
-SoC-level code, so move it too.
+ * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
    TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
    FEAT_SPE or FEAT_TRF.
  * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
    "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
    that no barriers are needed around their accesses. For us these
    are just the same as the normal views, because all our sysregs are
    inherently self-sychronizing.
 In this commit we implement the trap handling and permit the new
 CNTHCTL_EL2 bits to be written.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-8-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |   4 -
+ target/arm/cpu-features.h |  5 ++++
- hw/arm/exynos4210.c         | 202 +++++++++++++++++++++++++++++++++++
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
- hw/intc/exynos4210_gic.c    | 204 ------------------------------------
+files changed, 51 insertions(+), 5 deletions(-)
 files changed, 202 insertions(+), 208 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/cpu-features.h
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
- void exynos4210_write_secondary(ARMCPU *cpu,
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
-         const struct arm_boot_info *info);
+ }
--/* Initialize board IRQs.
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
-- * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
++{
--void exynos4210_init_board_irqs(Exynos4210State *s);
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
--
++}
- /* Get IRQ number from exynos4210 IRQ subsystem stub.
++
-  * To identify IRQ source use internal combiner group and bit number
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
-  *  grp - group number
+ {
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
- #define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
- #define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+             return CP_ACCESS_TRAP_EL2;
+         }
-+enum ExtGicId {
++        if (has_el2 && timeridx == GTIMER_VIRT) {
-+    EXT_GIC_ID_MDMA_LCD0 = 66,
++            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
-+    EXT_GIC_ID_PDMA0,
++                return CP_ACCESS_TRAP_EL2;
-+    EXT_GIC_ID_PDMA1,
++            }
-+    EXT_GIC_ID_TIMER0,
++        }
-+    EXT_GIC_ID_TIMER1,
+         break;
-+    EXT_GIC_ID_TIMER2,
+     }
-+    EXT_GIC_ID_TIMER3,
+     return CP_ACCESS_OK;
-+    EXT_GIC_ID_TIMER4,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
-+    EXT_GIC_ID_MCT_L0,
+                 }
-+    EXT_GIC_ID_WDT,
+             }
-+    EXT_GIC_ID_RTC_ALARM,
+         }
-+    EXT_GIC_ID_RTC_TIC,
++        if (has_el2 && timeridx == GTIMER_VIRT) {
-+    EXT_GIC_ID_GPIO_XB,
++            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
-+    EXT_GIC_ID_GPIO_XA,
++                return CP_ACCESS_TRAP_EL2;
-+    EXT_GIC_ID_MCT_L1,
++            }
-+    EXT_GIC_ID_IEM_APC,
++        }
-+    EXT_GIC_ID_IEM_IEC,
+         break;
-+    EXT_GIC_ID_NFC,
+     }
-+    EXT_GIC_ID_UART0,
+     return CP_ACCESS_OK;
-+    EXT_GIC_ID_UART1,
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+    EXT_GIC_ID_UART2,
+     if (cpu_isar_feature(aa64_rme, cpu)) {
-+    EXT_GIC_ID_UART3,
+         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
-+    EXT_GIC_ID_UART4,
+     }
-+    EXT_GIC_ID_MCT_G0,
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
-+    EXT_GIC_ID_I2C0,
++        valid_mask |=
-+    EXT_GIC_ID_I2C1,
++            R_CNTHCTL_EL1TVT_MASK |
-+    EXT_GIC_ID_I2C2,
++            R_CNTHCTL_EL1TVCT_MASK |
-+    EXT_GIC_ID_I2C3,
++            R_CNTHCTL_EL1NVPCT_MASK |
-+    EXT_GIC_ID_I2C4,
++            R_CNTHCTL_EL1NVVCT_MASK |
-+    EXT_GIC_ID_I2C5,
++            R_CNTHCTL_EVNTIS_MASK;
-+    EXT_GIC_ID_I2C6,
++    }
-+    EXT_GIC_ID_I2C7,
-+    EXT_GIC_ID_SPI0,
+     /* Clear RES0 bits */
-+    EXT_GIC_ID_SPI1,
+     value &= valid_mask;
-+    EXT_GIC_ID_SPI2,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-+    EXT_GIC_ID_MCT_G1,
+ {
-+    EXT_GIC_ID_USB_HOST,
+     if (arm_current_el(env) == 1) {
-+    EXT_GIC_ID_USB_DEVICE,
+         /* This must be a FEAT_NV access */
-+    EXT_GIC_ID_MODEMIF,
+-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
-+    EXT_GIC_ID_HSMMC0,
+         return CP_ACCESS_OK;
-+    EXT_GIC_ID_HSMMC1,
+     }
-+    EXT_GIC_ID_HSMMC2,
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
-+    EXT_GIC_ID_HSMMC3,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-+    EXT_GIC_ID_SDMMC,
+     return CP_ACCESS_OK;
-+    EXT_GIC_ID_MIPI_CSI_4LANE,
+ }
-+    EXT_GIC_ID_MIPI_DSI_4LANE,
-+    EXT_GIC_ID_MIPI_CSI_2LANE,
++static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
-+    EXT_GIC_ID_MIPI_DSI_2LANE,
++                                      bool isread)
 +    EXT_GIC_ID_ONENAND_AUDI,
 +    EXT_GIC_ID_ROTATOR,
 +    EXT_GIC_ID_FIMC0,
 +    EXT_GIC_ID_FIMC1,
 +    EXT_GIC_ID_FIMC2,
 +    EXT_GIC_ID_FIMC3,
 +    EXT_GIC_ID_JPEG,
 +    EXT_GIC_ID_2D,
 +    EXT_GIC_ID_PCIe,
 +    EXT_GIC_ID_MIXER,
 +    EXT_GIC_ID_HDMI,
 +    EXT_GIC_ID_HDMI_I2C,
 +    EXT_GIC_ID_MFC,
 +    EXT_GIC_ID_TVENC,
 +};
 +
 +enum ExtInt {
 +    EXT_GIC_ID_EXTINT0 = 48,
 +    EXT_GIC_ID_EXTINT1,
 +    EXT_GIC_ID_EXTINT2,
 +    EXT_GIC_ID_EXTINT3,
 +    EXT_GIC_ID_EXTINT4,
 +    EXT_GIC_ID_EXTINT5,
 +    EXT_GIC_ID_EXTINT6,
 +    EXT_GIC_ID_EXTINT7,
 +    EXT_GIC_ID_EXTINT8,
 +    EXT_GIC_ID_EXTINT9,
 +    EXT_GIC_ID_EXTINT10,
 +    EXT_GIC_ID_EXTINT11,
 +    EXT_GIC_ID_EXTINT12,
 +    EXT_GIC_ID_EXTINT13,
 +    EXT_GIC_ID_EXTINT14,
 +    EXT_GIC_ID_EXTINT15
 +};
 +
 +/*
 + * External GIC sources which are not from External Interrupt Combiner or
 + * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
 + * which is INTG16 in Internal Interrupt Combiner.
 + */
 +
 +static const uint32_t
 +combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 +    /* int combiner groups 16-19 */
 +    { }, { }, { }, { },
 +    /* int combiner group 20 */
 +    { 0, EXT_GIC_ID_MDMA_LCD0 },
 +    /* int combiner group 21 */
 +    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
 +    /* int combiner group 22 */
 +    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
 +            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
 +    /* int combiner group 23 */
 +    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
 +    /* int combiner group 24 */
 +    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
 +    /* int combiner group 25 */
 +    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
 +    /* int combiner group 26 */
 +    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
 +            EXT_GIC_ID_UART4 },
 +    /* int combiner group 27 */
 +    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
 +            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
 +            EXT_GIC_ID_I2C7 },
 +    /* int combiner group 28 */
 +    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
 +    /* int combiner group 29 */
 +    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
 +     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
 +    /* int combiner group 30 */
 +    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
 +    /* int combiner group 31 */
 +    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
 +    /* int combiner group 32 */
 +    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
 +    /* int combiner group 33 */
 +    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
 +    /* int combiner group 34 */
 +    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
 +    /* int combiner group 35 */
 +    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* int combiner group 36 */
 +    { EXT_GIC_ID_MIXER },
 +    /* int combiner group 37 */
 +    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
 +     EXT_GIC_ID_EXTINT7 },
 +    /* groups 38-50 */
 +    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
 +    /* int combiner group 51 */
 +    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* group 52 */
 +    { },
 +    /* int combiner group 53 */
 +    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 +    /* groups 54-63 */
 +    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 +};
 +
 +/*
 + * Initialize board IRQs.
 + * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
 + */
 +static void exynos4210_init_board_irqs(Exynos4210State *s)
 +{
-+    uint32_t grp, bit, irq_id, n;
++    if (arm_current_el(env) == 1) {
-+    Exynos4210Irq *is = &s->irqs;
++        /* This must be a FEAT_NV access with NVx == 101 */
-+
++        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
-+    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
++            return CP_ACCESS_TRAP_EL2;
 +        irq_id = 0;
 +        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
 +                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
 +            /* MCT_G0 is passed to External GIC */
 +            irq_id = EXT_GIC_ID_MCT_G0;
 +        }
 +        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
 +                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
 +            /* MCT_G1 is passed to External and GIC */
 +            irq_id = EXT_GIC_ID_MCT_G1;
 +        }
 +        if (irq_id) {
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_gic_irq[irq_id - 32]);
 +        } else {
 +            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 +                    is->ext_combiner_irq[n]);
 +        }
 +    }
-+    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
++    return e2h_access(env, ri, isread);
-+        /* these IDs are passed to Internal Combiner and External GIC */
++}
 +        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
 +        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 +        irq_id = combiner_grp_to_gic_id[grp -
 +                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 +
-+        if (irq_id) {
++static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
-+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
++                                      bool isread)
-+                    is->ext_gic_irq[irq_id - 32]);
++{
 +    if (arm_current_el(env) == 1) {
 +        /* This must be a FEAT_NV access with NVx == 101 */
 +        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
 +    }
++    return e2h_access(env, ri, isread);
 +}
 +
-+/*
+ /* Test if system register redirection is to occur in the current state.  */
-+ * Get IRQ number from exynos4210 IRQ subsystem stub.
+ static bool redirect_for_e2h(CPUARMState *env)
-+ * To identify IRQ source use internal combiner group and bit number
+ {
-+ *  grp - group number
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
-+ *  bit - bit number inside group
+     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
-+ */
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
-+uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
-+{
+-      .access = PL2_RW, .accessfn = e2h_access,
-+    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
++      .access = PL2_RW, .accessfn = access_el1nvpct,
-+}
+       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
-+
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
- static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
+       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
-x09, 0x00, 0x00, 0x00 };
+     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
-index XXXXXXX..XXXXXXX 100644
+-      .access = PL2_RW, .accessfn = e2h_access,
---- a/hw/intc/exynos4210_gic.c
++      .access = PL2_RW, .accessfn = access_el1nvvct,
-+++ b/hw/intc/exynos4210_gic.c
+       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
-@@ -XXX,XX +XXX,XX @@
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
- #include "hw/arm/exynos4210.h"
+       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
- #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
--enum ExtGicId {
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
--    EXT_GIC_ID_MDMA_LCD0 = 66,
+       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
--    EXT_GIC_ID_PDMA0,
+-      .access = PL2_RW, .accessfn = e2h_access,
--    EXT_GIC_ID_PDMA1,
++      .access = PL2_RW, .accessfn = access_el1nvpct,
--    EXT_GIC_ID_TIMER0,
+       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
--    EXT_GIC_ID_TIMER1,
+     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
--    EXT_GIC_ID_TIMER2,
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
--    EXT_GIC_ID_TIMER3,
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
--    EXT_GIC_ID_TIMER4,
+       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
--    EXT_GIC_ID_MCT_L0,
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
--    EXT_GIC_ID_WDT,
+-      .access = PL2_RW, .accessfn = e2h_access,
--    EXT_GIC_ID_RTC_ALARM,
++      .access = PL2_RW, .accessfn = access_el1nvvct,
--    EXT_GIC_ID_RTC_TIC,
+       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
--    EXT_GIC_ID_GPIO_XB,
+ #endif
--    EXT_GIC_ID_GPIO_XA,
+ };
 -    EXT_GIC_ID_MCT_L1,
 -    EXT_GIC_ID_IEM_APC,
 -    EXT_GIC_ID_IEM_IEC,
 -    EXT_GIC_ID_NFC,
 -    EXT_GIC_ID_UART0,
 -    EXT_GIC_ID_UART1,
 -    EXT_GIC_ID_UART2,
 -    EXT_GIC_ID_UART3,
 -    EXT_GIC_ID_UART4,
 -    EXT_GIC_ID_MCT_G0,
 -    EXT_GIC_ID_I2C0,
 -    EXT_GIC_ID_I2C1,
 -    EXT_GIC_ID_I2C2,
 -    EXT_GIC_ID_I2C3,
 -    EXT_GIC_ID_I2C4,
 -    EXT_GIC_ID_I2C5,
 -    EXT_GIC_ID_I2C6,
 -    EXT_GIC_ID_I2C7,
 -    EXT_GIC_ID_SPI0,
 -    EXT_GIC_ID_SPI1,
 -    EXT_GIC_ID_SPI2,
 -    EXT_GIC_ID_MCT_G1,
 -    EXT_GIC_ID_USB_HOST,
 -    EXT_GIC_ID_USB_DEVICE,
 -    EXT_GIC_ID_MODEMIF,
 -    EXT_GIC_ID_HSMMC0,
 -    EXT_GIC_ID_HSMMC1,
 -    EXT_GIC_ID_HSMMC2,
 -    EXT_GIC_ID_HSMMC3,
 -    EXT_GIC_ID_SDMMC,
 -    EXT_GIC_ID_MIPI_CSI_4LANE,
 -    EXT_GIC_ID_MIPI_DSI_4LANE,
 -    EXT_GIC_ID_MIPI_CSI_2LANE,
 -    EXT_GIC_ID_MIPI_DSI_2LANE,
 -    EXT_GIC_ID_ONENAND_AUDI,
 -    EXT_GIC_ID_ROTATOR,
 -    EXT_GIC_ID_FIMC0,
 -    EXT_GIC_ID_FIMC1,
 -    EXT_GIC_ID_FIMC2,
 -    EXT_GIC_ID_FIMC3,
 -    EXT_GIC_ID_JPEG,
 -    EXT_GIC_ID_2D,
 -    EXT_GIC_ID_PCIe,
 -    EXT_GIC_ID_MIXER,
 -    EXT_GIC_ID_HDMI,
 -    EXT_GIC_ID_HDMI_I2C,
 -    EXT_GIC_ID_MFC,
 -    EXT_GIC_ID_TVENC,
 -};
 -
 -enum ExtInt {
 -    EXT_GIC_ID_EXTINT0 = 48,
 -    EXT_GIC_ID_EXTINT1,
 -    EXT_GIC_ID_EXTINT2,
 -    EXT_GIC_ID_EXTINT3,
 -    EXT_GIC_ID_EXTINT4,
 -    EXT_GIC_ID_EXTINT5,
 -    EXT_GIC_ID_EXTINT6,
 -    EXT_GIC_ID_EXTINT7,
 -    EXT_GIC_ID_EXTINT8,
 -    EXT_GIC_ID_EXTINT9,
 -    EXT_GIC_ID_EXTINT10,
 -    EXT_GIC_ID_EXTINT11,
 -    EXT_GIC_ID_EXTINT12,
 -    EXT_GIC_ID_EXTINT13,
 -    EXT_GIC_ID_EXTINT14,
 -    EXT_GIC_ID_EXTINT15
 -};
 -
 -/*
 - * External GIC sources which are not from External Interrupt Combiner or
 - * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
 - * which is INTG16 in Internal Interrupt Combiner.
 - */
 -
 -static const uint32_t
 -combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 -    /* int combiner groups 16-19 */
 -    { }, { }, { }, { },
 -    /* int combiner group 20 */
 -    { 0, EXT_GIC_ID_MDMA_LCD0 },
 -    /* int combiner group 21 */
 -    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
 -    /* int combiner group 22 */
 -    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
 -            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
 -    /* int combiner group 23 */
 -    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
 -    /* int combiner group 24 */
 -    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
 -    /* int combiner group 25 */
 -    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
 -    /* int combiner group 26 */
 -    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
 -            EXT_GIC_ID_UART4 },
 -    /* int combiner group 27 */
 -    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
 -            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
 -            EXT_GIC_ID_I2C7 },
 -    /* int combiner group 28 */
 -    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
 -    /* int combiner group 29 */
 -    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
 -     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
 -    /* int combiner group 30 */
 -    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
 -    /* int combiner group 31 */
 -    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
 -    /* int combiner group 32 */
 -    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
 -    /* int combiner group 33 */
 -    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
 -    /* int combiner group 34 */
 -    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
 -    /* int combiner group 35 */
 -    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* int combiner group 36 */
 -    { EXT_GIC_ID_MIXER },
 -    /* int combiner group 37 */
 -    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
 -     EXT_GIC_ID_EXTINT7 },
 -    /* groups 38-50 */
 -    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
 -    /* int combiner group 51 */
 -    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* group 52 */
 -    { },
 -    /* int combiner group 53 */
 -    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
 -    /* groups 54-63 */
 -    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 -};
 -
  #define EXYNOS4210_GIC_NIRQ 160
  #define EXYNOS4210_EXT_GIC_CPU_REGION_SIZE     0x10000
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -/*
 - * Initialize board IRQs.
 - * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
 - */
 -void exynos4210_init_board_irqs(Exynos4210State *s)
 -{
 -    uint32_t grp, bit, irq_id, n;
 -    Exynos4210Irq *is = &s->irqs;
 -
 -    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
 -        irq_id = 0;
 -        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
 -                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
 -            /* MCT_G0 is passed to External GIC */
 -            irq_id = EXT_GIC_ID_MCT_G0;
 -        }
 -        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
 -                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
 -            /* MCT_G1 is passed to External and GIC */
 -            irq_id = EXT_GIC_ID_MCT_G1;
 -        }
 -        if (irq_id) {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_gic_irq[irq_id - 32]);
 -        } else {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_combiner_irq[n]);
 -        }
 -    }
 -    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
 -        /* these IDs are passed to Internal Combiner and External GIC */
 -        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
 -        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 -        irq_id = combiner_grp_to_gic_id[grp -
 -                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 -
 -        if (irq_id) {
 -            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
 -                    is->ext_gic_irq[irq_id - 32]);
 -        }
 -    }
 -}
 -
 -/*
 - * Get IRQ number from exynos4210 IRQ subsystem stub.
 - * To identify IRQ source use internal combiner group and bit number
 - *  grp - group number
 - *  bit - bit number inside group
 - */
 -uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
 -{
 -    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 -}
 -
 -/********* GIC part *********/
 -
  #define TYPE_EXYNOS4210_GIC "exynos4210.gic"
  OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 --
-.25.1
+.34.1

-[PULL 15/31] hw/arm/exynos4210: Put external GIC into state struct
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-Switch the creation of the external GIC to the new-style "embedded in
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
-state struct" approach, so we can easily refer to the object
+defined, which are "self-synchronized" views of the physical and
-elsewhere during realize.
+virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
 (meaning that no barriers are needed around accesses to them to
 ensure that reads of them do not occur speculatively and out-of-order
 with other instructions).
 For QEMU, all our system registers are self-synchronized, so we can
 simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
 to the new register encodings.
 This means we now implement all the functionality required for
 ID_AA64MMFR0_EL1.ECV == 0b0001.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-9-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h      |  2 ++
+ target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- include/hw/intc/exynos4210_gic.h | 43 ++++++++++++++++++++++++++++++++
+file changed, 43 insertions(+)
  hw/arm/exynos4210.c              | 10 ++++----
  hw/intc/exynos4210_gic.c         | 17 ++-----------
  MAINTAINERS                      |  2 +-
 files changed, 53 insertions(+), 21 deletions(-)
  create mode 100644 include/hw/intc/exynos4210_gic.h
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
- #include "hw/or-irq.h"
+     },
  #include "hw/sysbus.h"
  #include "hw/cpu/a9mpcore.h"
 +#include "hw/intc/exynos4210_gic.h"
  #include "target/arm/cpu-qom.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
      qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
      A9MPPrivState a9mpcore;
 +    Exynos4210GicState ext_gic;
  };
- #define TYPE_EXYNOS4210_SOC "exynos4210"
-diff --git a/include/hw/intc/exynos4210_gic.h b/include/hw/intc/exynos4210_gic.h
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/include/hw/intc/exynos4210_gic.h
-@@ -XXX,XX +XXX,XX @@
 +/*
-+ * Samsung exynos4210 GIC implementation. Based on hw/arm_gic.c
++ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
-+ *
++ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
-+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
++ * so our implementations here are identical to the normal registers.
 + * All rights reserved.
 + *
 + * Evgeny Voevodin <e.voevodin@samsung.com>
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or (at your
 + * option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 + * See the GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
-+#ifndef HW_INTC_EXYNOS4210_GIC_H
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
-+#define HW_INTC_EXYNOS4210_GIC_H
++    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
-+
++      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
-+#include "hw/sysbus.h"
++      .accessfn = gt_vct_access,
-+
++      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
-+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
++    },
-+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
++    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
-+
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
-+#define EXYNOS4210_GIC_NCPUS 2
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-+
++      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
-+struct Exynos4210GicState {
++    },
-+    SysBusDevice parent_obj;
++    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
-+
++      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
-+    MemoryRegion cpu_container;
++      .accessfn = gt_pct_access,
-+    MemoryRegion dist_container;
++      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
-+    MemoryRegion cpu_alias[EXYNOS4210_GIC_NCPUS];
++    },
-+    MemoryRegion dist_alias[EXYNOS4210_GIC_NCPUS];
++    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
-+    uint32_t num_cpu;
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
-+    DeviceState *gic;
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
 +    },
 +};
 +
-+#endif
+ #else
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
+ /*
---- a/hw/arm/exynos4210.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
-+++ b/hw/arm/exynos4210.c
+     },
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+ };
-     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
++/*
-     /* External GIC */
++ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
--    dev = qdev_new("exynos4210.gic");
++ * is exposed to userspace by Linux.
--    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
++ */
--    busdev = SYS_BUS_DEVICE(dev);
++static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
--    sysbus_realize_and_unref(busdev, &error_fatal);
++    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
-+    qdev_prop_set_uint32(DEVICE(&s->ext_gic), "num-cpu", EXYNOS4210_NCPUS);
++      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
-+    busdev = SYS_BUS_DEVICE(&s->ext_gic);
++      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
-+    sysbus_realize(busdev, &error_fatal);
++      .readfn = gt_virt_cnt_read,
-     /* Map CPU interface */
++    },
-     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_GIC_CPU_BASE_ADDR);
++};
-     /* Map Distributer interface */
++
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+ #endif
-                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
  static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
          define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
      }
-     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
--        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
++        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
-+        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
++    }
-     }
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
+         ARMCPRegInfo vapa_cp_reginfo[] = {
-     /* Internal Interrupt Combiner */
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
      }
      object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
 +    object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
  }
  static void exynos4210_class_init(ObjectClass *klass, void *data)
 diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_gic.c
 +++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
 +#include "hw/intc/exynos4210_gic.h"
  #include "hw/arm/exynos4210.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@
  #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
  #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 -#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
 -OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 -
 -struct Exynos4210GicState {
 -    SysBusDevice parent_obj;
 -
 -    MemoryRegion cpu_container;
 -    MemoryRegion dist_container;
 -    MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
 -    MemoryRegion dist_alias[EXYNOS4210_NCPUS];
 -    uint32_t num_cpu;
 -    DeviceState *gic;
 -};
 -
  static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
  {
      Exynos4210GicState *s = (Exynos4210GicState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_realize(DeviceState *dev, Error **errp)
       * enough room for the cpu numbers.  gcc 9.2.1 on 32-bit x86
       * doesn't figure this out, otherwise and gives spurious warnings.
       */
 -    assert(n <= EXYNOS4210_NCPUS);
 +    assert(n <= EXYNOS4210_GIC_NCPUS);
      for (i = 0; i < n; i++) {
          /* Map CPU interface per SMP Core */
          sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Odd Fixes
  F: hw/*/exynos*
 -F: include/hw/arm/exynos4210.h
 +F: include/hw/*/exynos*
  Calxeda Highbank
  M: Rob Herring <robh@kernel.org>
 --
-.25.1
+.34.1

-[PULL 17/31] hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-The function exynos4210_combiner_get_gpioin() currently lives in
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
-exynos4210_combiner.c, but it isn't really part of the combiner
+implemented.  This is similar to the existing CNTVOFF_EL2, except
-device itself -- it is a function that implements the wiring up of
+that it controls a hypervisor-adjustable offset made to the physical
-some interrupt sources to multiple combiner inputs.  Move it to live
+counter and timer.
-with the other SoC-level code in exynos4210.c, along with a few
-macros previously defined in exynos4210.h which are now used only
+Implement the handling for this register, which includes control/trap
-in exynos4210.c.
+bits in SCR_EL3 and CNTHCTL_EL2.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-11-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h   | 11 -----
+ target/arm/cpu-features.h |  5 +++
- hw/arm/exynos4210.c           | 82 +++++++++++++++++++++++++++++++++++
+ target/arm/cpu.h          |  1 +
- hw/intc/exynos4210_combiner.c | 77 --------------------------------
+ target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
-files changed, 82 insertions(+), 88 deletions(-)
+ target/arm/trace-events   |  1 +
 files changed, 73 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/cpu-features.h
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
- #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
      (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
 -#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp)*8 + (bit))
 -#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
 -#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
 -    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 -
  /* IRQs number for external and internal GIC */
  #define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
  #define EXYNOS4210_INT_GIC_NIRQ     64
@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
   *  bit - bit number inside group */
  uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit);
 -/*
 - * Get Combiner input GPIO into irqs structure
 - */
 -void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
 -        int ext);
 -
  /*
   * exynos4210 UART
   */
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
      { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
  };
 +#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp) * 8 + (bit))
 +#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
 +#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
 +    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 +
  /*
   * Initialize board IRQs.
   * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
      return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
  }
-+/*
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
 + * Get Combiner input GPIO into irqs structure
 + */
 +static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
 +                                           DeviceState *dev, int ext)
 +{
-+    int n;
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
 +    int bit;
 +    int max;
 +    qemu_irq *irq;
 +
 +    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
 +        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
 +    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 +
 +    /*
 +     * Some IRQs of Int/External Combiner are going to two Combiners groups,
 +     * so let split them.
 +     */
 +    for (n = 0; n < max; n++) {
 +
 +        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
 +
 +        switch (n) {
 +        /* MDNIE_LCD1 INTG1 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
 +            continue;
 +
 +        /* TMU INTG3 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
 +            continue;
 +
 +        /* LCD1 INTG12 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
 +            continue;
 +
 +        /* Multi-Core Timer INTG12 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
 +               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 +            continue;
 +
 +        /* Multi-Core Timer INTG35 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 +            continue;
 +
 +        /* Multi-Core Timer INTG51 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 +            continue;
 +
 +        /* Multi-Core Timer INTG53 */
 +        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
 +             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
 +            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 +                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 +            continue;
 +        }
 +
 +        irq[n] = qdev_get_gpio_in(dev, n);
 +    }
 +}
 +
- static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
-x09, 0x00, 0x00, 0x00 };
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
-diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_combiner.c
+--- a/target/arm/cpu.h
-+++ b/hw/intc/exynos4210_combiner.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_combiner = {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          uint64_t c14_cntkctl; /* Timer Control register */
          uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
          uint64_t cntvoff_el2; /* Counter Virtual Offset register */
 +        uint64_t cntpoff_el2; /* Counter Physical Offset register */
          ARMGenericTimer c14_timer[NUM_GTIMERS];
          uint32_t c15_cpar; /* XScale Coprocessor Access Register */
          uint32_t c15_ticonfig; /* TI925T configuration byte.  */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          if (cpu_isar_feature(aa64_rme, cpu)) {
              valid_mask |= SCR_NSE | SCR_GPF;
          }
 +        if (cpu_isar_feature(aa64_ecv, cpu)) {
 +            valid_mask |= SCR_ECVEN;
 +        }
      } else {
          valid_mask &= ~(SCR_RW | SCR_ST);
          if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
      gt_update_irq(cpu, GTIMER_PHYS);
  }
 +static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
 +{
 +    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
 +        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
 +        arm_is_el2_enabled(env) &&
 +        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
 +        return env->cp15.cntpoff_el2;
 +    }
 +    return 0;
 +}
 +
 +static uint64_t gt_phys_cnt_offset(CPUARMState *env)
 +{
 +    if (arm_current_el(env) >= 2) {
 +        return 0;
 +    }
 +    return gt_phys_raw_cnt_offset(env);
 +}
 +
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
  {
      ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
           * reset timer to when ISTATUS next has to change
           */
          uint64_t offset = timeridx == GTIMER_VIRT ?
 -                                      cpu->env.cp15.cntvoff_el2 : 0;
 +            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
          uint64_t count = gt_get_countervalue(&cpu->env);
          /* Note that this must be unsigned 64 bit arithmetic: */
          int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
  static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
 -    return gt_get_countervalue(env);
 +    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
  }
  static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
+     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
+@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     case GTIMER_HYPVIRT:
+         offset = gt_virt_cnt_offset(env);
+         break;
++    case GTIMER_PHYS:
++        offset = gt_phys_cnt_offset(env);
++        break;
+     }
+     trace_arm_gt_tval_write(timeridx, value);
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
+             R_CNTHCTL_EL1NVVCT_MASK |
+             R_CNTHCTL_EVNTIS_MASK;
+     }
++    if (cpu_isar_feature(aa64_ecv, cpu)) {
++        valid_mask |= R_CNTHCTL_ECV_MASK;
++    }
+     /* Clear RES0 bits */
+     value &= valid_mask;
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+     },
  };
--/*
++static CPAccessResult gt_cntpoff_access(CPUARMState *env,
-- * Get Combiner input GPIO into irqs structure
++                                        const ARMCPRegInfo *ri,
-- */
++                                        bool isread)
--void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
++{
--        int ext)
++    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
--{
++        return CP_ACCESS_TRAP_EL3;
--    int n;
++    }
--    int bit;
++    return CP_ACCESS_OK;
--    int max;
++}
--    qemu_irq *irq;
++
--
++static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
--    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
++                              uint64_t value)
--        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
++{
--    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
++    ARMCPU *cpu = env_archcpu(env);
--
++
--    /*
++    trace_arm_gt_cntpoff_write(value);
--     * Some IRQs of Int/External Combiner are going to two Combiners groups,
++    raw_write(env, ri, value);
--     * so let split them.
++    gt_recalc_timer(cpu, GTIMER_PHYS);
--     */
++}
--    for (n = 0; n < max; n++) {
++
--
++static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
--        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
++    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
--
++    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
--        switch (n) {
++    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
--        /* MDNIE_LCD1 INTG1 */
++    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
--        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
++    .nv2_redirect_offset = 0x1a8,
--             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
++    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
--            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
++};
--                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
+ #else
--            continue;
--
+ /*
--        /* TMU INTG3 */
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
--        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
+     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
--            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
--                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
+     }
--            continue;
++#ifndef CONFIG_USER_ONLY
--
++    if (cpu_isar_feature(aa64_ecv, cpu)) {
--        /* LCD1 INTG12 */
++        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
--        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
++    }
--             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
++#endif
--            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
--                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
+         ARMCPRegInfo vapa_cp_reginfo[] = {
--            continue;
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
--
+diff --git a/target/arm/trace-events b/target/arm/trace-events
--        /* Multi-Core Timer INTG12 */
+index XXXXXXX..XXXXXXX 100644
--        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
+--- a/target/arm/trace-events
--             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
++++ b/target/arm/trace-events
--               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
--                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+ arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
--            continue;
+ arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
--
+ arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
--        /* Multi-Core Timer INTG35 */
++arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
--        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
+ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
--             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
--            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+ # kvm.c
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG51 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -
 -        /* Multi-Core Timer INTG53 */
 -        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
 -             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
 -            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
 -                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
 -            continue;
 -        }
 -
 -        irq[n] = qdev_get_gpio_in(dev, n);
 -    }
 -}
 -
  static uint64_t
  exynos4210_combiner_read(void *opaque, hwaddr offset, unsigned size)
  {
 --
-.25.1
+.34.1

-[PULL 25/31] hw/arm/exynos4210: Drop Exynos4210Irq struct
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
-The only time we use the int_combiner_irq[] and ext_combiner_irq[]
+Enable all FEAT_ECV features on the 'max' CPU.
 arrays in the Exynos4210Irq struct is during realize of the SoC -- we
 initialize them with the input IRQs of the combiner devices, and then
 connect those to outputs of other devices in
 exynos4210_init_board_irqs().  Now that the combiner objects are
 easily accessible as s->int_combiner and s->ext_combiner we can make
 the connections directly from one device to the other without going
 via these arrays.
 Since these are the only two remaining elements of Exynos4210Irq,
 we can remove that struct entirely.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-19-peter.maydell@linaro.org
+Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  6 ------
+ docs/system/arm/emulation.rst | 1 +
- hw/arm/exynos4210.c         | 34 ++++++++--------------------------
+ target/arm/tcg/cpu64.c        | 1 +
-files changed, 8 insertions(+), 32 deletions(-)
+files changed, 2 insertions(+)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/docs/system/arm/emulation.rst
-+++ b/include/hw/arm/exynos4210.h
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-  */
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
- #define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
+ - FEAT_DoubleFault (Double Fault Extension)
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
--typedef struct Exynos4210Irq {
++- FEAT_ECV (Enhanced Counter Virtualization)
--    qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
+ - FEAT_EPAC (Enhanced pointer authentication)
--    qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
+ - FEAT_ETS (Enhanced Translation Synchronization)
--} Exynos4210Irq;
+ - FEAT_EVT (Enhanced Virtualization Traps)
--
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
  struct Exynos4210State {
      /*< private >*/
      SysBusDevice parent_obj;
      /*< public >*/
      ARMCPU *cpu[EXYNOS4210_NCPUS];
 -    Exynos4210Irq irqs;
      qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
      MemoryRegion chipid_mem;
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/tcg/cpu64.c
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/tcg/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static int mapline_size(const int *mapline)
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
- static void exynos4210_init_board_irqs(Exynos4210State *s)
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
- {
+     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
-     uint32_t grp, bit, irq_id, n;
+     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
--    Exynos4210Irq *is = &s->irqs;
++    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
-     DeviceState *extgicdev = DEVICE(&s->ext_gic);
+     cpu->isar.id_aa64mmfr0 = t;
-+    DeviceState *intcdev = DEVICE(&s->int_combiner);
-+    DeviceState *extcdev = DEVICE(&s->ext_combiner);
+     t = cpu->isar.id_aa64mmfr1;
      int splitcount = 0;
      DeviceState *splitter;
      const int *mapline;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
          splitin = 0;
          for (;;) {
              s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
 -            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
 -            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
 +            qdev_connect_gpio_out(splitter, splitin,
 +                                  qdev_get_gpio_in(intcdev, in));
 +            qdev_connect_gpio_out(splitter, splitin + 1,
 +                                  qdev_get_gpio_in(extcdev, in));
              splitin += 2;
              if (!mapline) {
                  break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
              qdev_realize(splitter, NULL, &error_abort);
              splitcount++;
              s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
 -            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
 +            qdev_connect_gpio_out(splitter, 0, qdev_get_gpio_in(intcdev, n));
              qdev_connect_gpio_out(splitter, 1,
                                    qdev_get_gpio_in(extgicdev, irq_id - 32));
          } else {
 -            s->irq_table[n] = is->int_combiner_irq[n];
 +            s->irq_table[n] = qdev_get_gpio_in(intcdev, n);
          }
      }
      /*
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
      return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
  }
 -/*
 - * Get Combiner input GPIO into irqs structure
 - */
 -static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
 -                                           DeviceState *dev, int ext)
 -{
 -    int n;
 -    int max;
 -    qemu_irq *irq;
 -
 -    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
 -        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
 -    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 -
 -    for (n = 0; n < max; n++) {
 -        irq[n] = qdev_get_gpio_in(dev, n);
 -    }
 -}
 -
  static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
          sysbus_connect_irq(busdev, n,
                             qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
      /* External Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
          sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
      /* Initialize board IRQs. */
 --
-.25.1
+.34.1

-[PULL 06/31] hw/misc: Add a model of the Xilinx Versal CRL
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Add a model of the Xilinx Versal CRL.
+Features supported :
 - the 8 STM32L4x5 GPIOs are initialized with their reset values
     (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Difference with the real GPIOs :
-Reviewed-by: Frederic Konrad <fkonrad@amd.com>
+- Alternate Function and Analog mode aren't implemented :
-Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
+    pins in AF/Analog behave like pins in input mode
-Message-id: 20220406174303.2022038-4-edgar.iglesias@xilinx.com
+- floating pins stay at their last value
 - register IDR reset values differ from the real one :
     values are coherent with the other registers reset values
     and the fact that AF/Analog modes aren't implemented
 - setting I/O output speed isn't supported
 - locking port bits isn't supported
 - ADC function isn't supported
 - GPIOH has 16 pins instead of 2 pins
 - writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
 Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
 Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Acked-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/xlnx-versal-crl.h | 235 +++++++++++++++++
+ MAINTAINERS                        |   1 +
- hw/misc/xlnx-versal-crl.c         | 421 ++++++++++++++++++++++++++++++
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- hw/misc/meson.build               |   1 +
+ include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
-files changed, 657 insertions(+)
+ hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
- create mode 100644 include/hw/misc/xlnx-versal-crl.h
+ hw/gpio/Kconfig                    |   3 +
- create mode 100644 hw/misc/xlnx-versal-crl.c
+ hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
  F: hw/misc/stm32l4x5_exti.c
  F: hw/misc/stm32l4x5_syscfg.c
  F: hw/misc/stm32l4x5_rcc.c
 +F: hw/gpio/stm32l4x5_gpio.c
  F: include/hw/*/stm32l4x5_*.h
  B-L475E-IOT01A IoT Node
 diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/b-l475e-iot01a.rst
 +++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
  - STM32L4x5 EXTI (Extended interrupts and events controller)
  - STM32L4x5 SYSCFG (System configuration controller)
  - STM32L4x5 RCC (Reset and clock control)
 +- STM32L4x5 GPIOs (General-purpose I/Os)
  Missing devices
  """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
  The B-L475E-IOT01A does *not* support the following devices:
  - Serial ports (UART)
 -- General-purpose I/Os (GPIO)
  - Analog to Digital Converter (ADC)
  - SPI controller
  - Timer controller (TIMER)
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/misc/xlnx-versal-crl.h
++++ b/include/hw/gpio/stm32l4x5_gpio.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU model of the Clock-Reset-LPD (CRL).
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ * Copyright (c) 2022 Xilinx Inc.
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
-+#ifndef HW_MISC_XLNX_VERSAL_CRL_H
++
-+#define HW_MISC_XLNX_VERSAL_CRL_H
++/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#ifndef HW_STM32L4X5_GPIO_H
 +#define HW_STM32L4X5_GPIO_H
 +
 +#include "hw/sysbus.h"
-+#include "hw/register.h"
++#include "qom/object.h"
-+#include "target/arm/cpu.h"
++
-+
++#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
-+#define TYPE_XLNX_VERSAL_CRL "xlnx,versal-crl"
++OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
-+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
++
-+
++#define GPIO_NUM_PINS 16
-+REG32(ERR_CTRL, 0x0)
++
-+    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
++struct Stm32l4x5GpioState {
 +REG32(IR_STATUS, 0x4)
 +    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_MASK, 0x8)
 +    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_ENABLE, 0xc)
 +    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_DISABLE, 0x10)
 +    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
 +REG32(WPROT, 0x1c)
 +    FIELD(WPROT, ACTIVE, 0, 1)
 +REG32(PLL_CLK_OTHER_DMN, 0x20)
 +    FIELD(PLL_CLK_OTHER_DMN, APLL_BYPASS, 0, 1)
 +REG32(RPLL_CTRL, 0x40)
 +    FIELD(RPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(RPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(RPLL_CTRL, CLKOUTDIV, 16, 2)
 +    FIELD(RPLL_CTRL, FBDIV, 8, 8)
 +    FIELD(RPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(RPLL_CTRL, RESET, 0, 1)
 +REG32(RPLL_CFG, 0x44)
 +    FIELD(RPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(RPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(RPLL_CFG, LFHF, 10, 2)
 +    FIELD(RPLL_CFG, CP, 5, 4)
 +    FIELD(RPLL_CFG, RES, 0, 4)
 +REG32(RPLL_FRAC_CFG, 0x48)
 +    FIELD(RPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(RPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(RPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(RPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(RPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(PLL_STATUS, 0x50)
 +    FIELD(PLL_STATUS, RPLL_STABLE, 2, 1)
 +    FIELD(PLL_STATUS, RPLL_LOCK, 0, 1)
 +REG32(RPLL_TO_XPD_CTRL, 0x100)
 +    FIELD(RPLL_TO_XPD_CTRL, CLKACT, 25, 1)
 +    FIELD(RPLL_TO_XPD_CTRL, DIVISOR0, 8, 10)
 +REG32(LPD_TOP_SWITCH_CTRL, 0x104)
 +    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT_ADMA, 26, 1)
 +    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT, 25, 1)
 +    FIELD(LPD_TOP_SWITCH_CTRL, DIVISOR0, 8, 10)
 +    FIELD(LPD_TOP_SWITCH_CTRL, SRCSEL, 0, 3)
 +REG32(LPD_LSBUS_CTRL, 0x108)
 +    FIELD(LPD_LSBUS_CTRL, CLKACT, 25, 1)
 +    FIELD(LPD_LSBUS_CTRL, DIVISOR0, 8, 10)
 +    FIELD(LPD_LSBUS_CTRL, SRCSEL, 0, 3)
 +REG32(CPU_R5_CTRL, 0x10c)
 +    FIELD(CPU_R5_CTRL, CLKACT_OCM2, 28, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT_OCM, 27, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT_CORE, 26, 1)
 +    FIELD(CPU_R5_CTRL, CLKACT, 25, 1)
 +    FIELD(CPU_R5_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CPU_R5_CTRL, SRCSEL, 0, 3)
 +REG32(IOU_SWITCH_CTRL, 0x114)
 +    FIELD(IOU_SWITCH_CTRL, CLKACT, 25, 1)
 +    FIELD(IOU_SWITCH_CTRL, DIVISOR0, 8, 10)
 +    FIELD(IOU_SWITCH_CTRL, SRCSEL, 0, 3)
 +REG32(GEM0_REF_CTRL, 0x118)
 +    FIELD(GEM0_REF_CTRL, CLKACT_RX, 27, 1)
 +    FIELD(GEM0_REF_CTRL, CLKACT_TX, 26, 1)
 +    FIELD(GEM0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GEM1_REF_CTRL, 0x11c)
 +    FIELD(GEM1_REF_CTRL, CLKACT_RX, 27, 1)
 +    FIELD(GEM1_REF_CTRL, CLKACT_TX, 26, 1)
 +    FIELD(GEM1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GEM_TSU_REF_CTRL, 0x120)
 +    FIELD(GEM_TSU_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(GEM_TSU_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(GEM_TSU_REF_CTRL, SRCSEL, 0, 3)
 +REG32(USB0_BUS_REF_CTRL, 0x124)
 +    FIELD(USB0_BUS_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(USB0_BUS_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(USB0_BUS_REF_CTRL, SRCSEL, 0, 3)
 +REG32(UART0_REF_CTRL, 0x128)
 +    FIELD(UART0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(UART0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(UART0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(UART1_REF_CTRL, 0x12c)
 +    FIELD(UART1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(UART1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(UART1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SPI0_REF_CTRL, 0x130)
 +    FIELD(SPI0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(SPI0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(SPI0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SPI1_REF_CTRL, 0x134)
 +    FIELD(SPI1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(SPI1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(SPI1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CAN0_REF_CTRL, 0x138)
 +    FIELD(CAN0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CAN0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CAN0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CAN1_REF_CTRL, 0x13c)
 +    FIELD(CAN1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CAN1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CAN1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(I2C0_REF_CTRL, 0x140)
 +    FIELD(I2C0_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(I2C0_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(I2C0_REF_CTRL, SRCSEL, 0, 3)
 +REG32(I2C1_REF_CTRL, 0x144)
 +    FIELD(I2C1_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(I2C1_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(I2C1_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_LPD_CTRL, 0x148)
 +    FIELD(DBG_LPD_CTRL, CLKACT, 25, 1)
 +    FIELD(DBG_LPD_CTRL, DIVISOR0, 8, 10)
 +    FIELD(DBG_LPD_CTRL, SRCSEL, 0, 3)
 +REG32(TIMESTAMP_REF_CTRL, 0x14c)
 +    FIELD(TIMESTAMP_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(TIMESTAMP_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(TIMESTAMP_REF_CTRL, SRCSEL, 0, 3)
 +REG32(CRL_SAFETY_CHK, 0x150)
 +REG32(PSM_REF_CTRL, 0x154)
 +    FIELD(PSM_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(PSM_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TSTMP_CTRL, 0x158)
 +    FIELD(DBG_TSTMP_CTRL, CLKACT, 25, 1)
 +    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 10)
 +    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
 +REG32(CPM_TOPSW_REF_CTRL, 0x15c)
 +    FIELD(CPM_TOPSW_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(CPM_TOPSW_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(CPM_TOPSW_REF_CTRL, SRCSEL, 0, 3)
 +REG32(USB3_DUAL_REF_CTRL, 0x160)
 +    FIELD(USB3_DUAL_REF_CTRL, CLKACT, 25, 1)
 +    FIELD(USB3_DUAL_REF_CTRL, DIVISOR0, 8, 10)
 +    FIELD(USB3_DUAL_REF_CTRL, SRCSEL, 0, 3)
 +REG32(RST_CPU_R5, 0x300)
 +    FIELD(RST_CPU_R5, RESET_PGE, 4, 1)
 +    FIELD(RST_CPU_R5, RESET_AMBA, 2, 1)
 +    FIELD(RST_CPU_R5, RESET_CPU1, 1, 1)
 +    FIELD(RST_CPU_R5, RESET_CPU0, 0, 1)
 +REG32(RST_ADMA, 0x304)
 +    FIELD(RST_ADMA, RESET, 0, 1)
 +REG32(RST_GEM0, 0x308)
 +    FIELD(RST_GEM0, RESET, 0, 1)
 +REG32(RST_GEM1, 0x30c)
 +    FIELD(RST_GEM1, RESET, 0, 1)
 +REG32(RST_SPARE, 0x310)
 +    FIELD(RST_SPARE, RESET, 0, 1)
 +REG32(RST_USB0, 0x314)
 +    FIELD(RST_USB0, RESET, 0, 1)
 +REG32(RST_UART0, 0x318)
 +    FIELD(RST_UART0, RESET, 0, 1)
 +REG32(RST_UART1, 0x31c)
 +    FIELD(RST_UART1, RESET, 0, 1)
 +REG32(RST_SPI0, 0x320)
 +    FIELD(RST_SPI0, RESET, 0, 1)
 +REG32(RST_SPI1, 0x324)
 +    FIELD(RST_SPI1, RESET, 0, 1)
 +REG32(RST_CAN0, 0x328)
 +    FIELD(RST_CAN0, RESET, 0, 1)
 +REG32(RST_CAN1, 0x32c)
 +    FIELD(RST_CAN1, RESET, 0, 1)
 +REG32(RST_I2C0, 0x330)
 +    FIELD(RST_I2C0, RESET, 0, 1)
 +REG32(RST_I2C1, 0x334)
 +    FIELD(RST_I2C1, RESET, 0, 1)
 +REG32(RST_DBG_LPD, 0x338)
 +    FIELD(RST_DBG_LPD, RPU_DBG1_RESET, 5, 1)
 +    FIELD(RST_DBG_LPD, RPU_DBG0_RESET, 4, 1)
 +    FIELD(RST_DBG_LPD, RESET_HSDP, 1, 1)
 +    FIELD(RST_DBG_LPD, RESET, 0, 1)
 +REG32(RST_GPIO, 0x33c)
 +    FIELD(RST_GPIO, RESET, 0, 1)
 +REG32(RST_TTC, 0x344)
 +    FIELD(RST_TTC, TTC3_RESET, 3, 1)
 +    FIELD(RST_TTC, TTC2_RESET, 2, 1)
 +    FIELD(RST_TTC, TTC1_RESET, 1, 1)
 +    FIELD(RST_TTC, TTC0_RESET, 0, 1)
 +REG32(RST_TIMESTAMP, 0x348)
 +    FIELD(RST_TIMESTAMP, RESET, 0, 1)
 +REG32(RST_SWDT, 0x34c)
 +    FIELD(RST_SWDT, RESET, 0, 1)
 +REG32(RST_OCM, 0x350)
 +    FIELD(RST_OCM, RESET, 0, 1)
 +REG32(RST_IPI, 0x354)
 +    FIELD(RST_IPI, RESET, 0, 1)
 +REG32(RST_SYSMON, 0x358)
 +    FIELD(RST_SYSMON, SEQ_RST, 1, 1)
 +    FIELD(RST_SYSMON, CFG_RST, 0, 1)
 +REG32(RST_FPD, 0x360)
 +    FIELD(RST_FPD, SRST, 1, 1)
 +    FIELD(RST_FPD, POR, 0, 1)
 +REG32(PSM_RST_MODE, 0x370)
 +    FIELD(PSM_RST_MODE, WAKEUP, 2, 1)
 +    FIELD(PSM_RST_MODE, RST_MODE, 0, 2)
 +
 +#define CRL_R_MAX (R_PSM_RST_MODE + 1)
 +
 +#define RPU_MAX_CPU 2
 +
 +struct XlnxVersalCRL {
 +    SysBusDevice parent_obj;
-+    qemu_irq irq;
++
-+
++    MemoryRegion mmio;
-+    struct {
++
-+        ARMCPU *cpu_r5[RPU_MAX_CPU];
++    /* GPIO registers */
-+        DeviceState *adma[8];
++    uint32_t moder;
-+        DeviceState *uart[2];
++    uint32_t otyper;
-+        DeviceState *gem[2];
++    uint32_t ospeedr;
-+        DeviceState *usb;
++    uint32_t pupdr;
-+    } cfg;
++    uint32_t idr;
-+
++    uint32_t odr;
-+    RegisterInfoArray *reg_array;
++    uint32_t lckr;
-+    uint32_t regs[CRL_R_MAX];
++    uint32_t afrl;
-+    RegisterInfo regs_info[CRL_R_MAX];
++    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
++
 +#endif
-diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
+diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/misc/xlnx-versal-crl.c
++++ b/hw/gpio/stm32l4x5_gpio.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * QEMU model of the Clock-Reset-LPD (CRL).
++ * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
-+ * Copyright (c) 2022 Advanced Micro Devices, Inc.
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
-+ * Written by Edgar E. Iglesias <edgar.iglesias@amd.com>
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
++/*
++ * The reference used is the STMicroElectronics RM0351 Reference manual
++ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
++ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
++ */
++
 +#include "qemu/osdep.h"
++#include "qemu/log.h"
++#include "hw/gpio/stm32l4x5_gpio.h"
++#include "hw/irq.h"
++#include "hw/qdev-clock.h"
++#include "hw/qdev-properties.h"
++#include "qapi/visitor.h"
 +#include "qapi/error.h"
-+#include "qemu/log.h"
-+#include "qemu/bitops.h"
 +#include "migration/vmstate.h"
-+#include "hw/qdev-properties.h"
++#include "trace.h"
-+#include "hw/sysbus.h"
++
-+#include "hw/irq.h"
++#define GPIO_MODER 0x00
-+#include "hw/register.h"
++#define GPIO_OTYPER 0x04
-+#include "hw/resettable.h"
++#define GPIO_OSPEEDR 0x08
-+
++#define GPIO_PUPDR 0x0C
-+#include "target/arm/arm-powerctl.h"
++#define GPIO_IDR 0x10
-+#include "hw/misc/xlnx-versal-crl.h"
++#define GPIO_ODR 0x14
-+
++#define GPIO_BSRR 0x18
-+#ifndef XLNX_VERSAL_CRL_ERR_DEBUG
++#define GPIO_LCKR 0x1C
-+#define XLNX_VERSAL_CRL_ERR_DEBUG 0
++#define GPIO_AFRL 0x20
-+#endif
++#define GPIO_AFRH 0x24
-+
++#define GPIO_BRR 0x28
-+static void crl_update_irq(XlnxVersalCRL *s)
++#define GPIO_ASCR 0x2C
-+{
++
-+    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
++/* 0b11111111_11111111_00000000_00000000 */
-+    qemu_set_irq(s->irq, pending);
++#define RESERVED_BITS_MASK 0xFFFF0000
-+}
++
-+
++static void update_gpio_idr(Stm32l4x5GpioState *s);
-+static void crl_status_postw(RegisterInfo *reg, uint64_t val64)
++
-+{
++static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++{
-+    crl_update_irq(s);
++    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
-+static uint64_t crl_enable_prew(RegisterInfo *reg, uint64_t val64)
++static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++    return extract32(s->pupdr, 2 * pin, 2) == 2;
-+    uint32_t val = val64;
++}
 +
-+    s->regs[R_IR_MASK] &= ~val;
++static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
-+    crl_update_irq(s);
++{
-+    return 0;
++    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
-+static uint64_t crl_disable_prew(RegisterInfo *reg, uint64_t val64)
++static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++    return extract32(s->otyper, pin, 1) == 1;
-+    uint32_t val = val64;
++}
 +
-+    s->regs[R_IR_MASK] |= val;
++static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
-+    crl_update_irq(s);
++{
-+    return 0;
++    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
-+static void crl_reset_dev(XlnxVersalCRL *s, DeviceState *dev,
++static void stm32l4x5_gpio_reset_hold(Object *obj)
-+                          bool rst_old, bool rst_new)
++{
-+{
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+    device_cold_reset(dev);
++
-+}
++    s->moder = s->moder_reset;
-+
++    s->otyper = 0x00000000;
-+static void crl_reset_cpu(XlnxVersalCRL *s, ARMCPU *armcpu,
++    s->ospeedr = s->ospeedr_reset;
-+                          bool rst_old, bool rst_new)
++    s->pupdr = s->pupdr_reset;
-+{
++    s->idr = 0x00000000;
-+    if (rst_new) {
++    s->odr = 0x00000000;
-+        arm_set_cpu_off(armcpu->mp_affinity);
++    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
-+        arm_set_cpu_on_and_reset(armcpu->mp_affinity);
++        s->pins_connected_high &= ~(1 << line);
 +    }
-+}
++    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
-+
++                              s->pins_connected_high);
-+#define REGFIELD_RESET(type, s, reg, f, new_val, dev) {     \
++    update_gpio_idr(s);
-+    bool old_f = ARRAY_FIELD_EX32((s)->regs, reg, f);       \
++}
-+    bool new_f = FIELD_EX32(new_val, reg, f);               \
++
-+                                                            \
++
-+    /* Detect edges.  */                                    \
++static void update_gpio_idr(Stm32l4x5GpioState *s)
-+    if (dev && old_f != new_f) {                            \
++{
-+        crl_reset_ ## type(s, dev, old_f, new_f);           \
++    uint32_t new_idr_mask = 0;
-+    }                                                       \
++    uint32_t new_idr = s->odr;
-+}
++    uint32_t old_idr = s->idr;
-+
++    int new_pin_state, old_pin_state;
-+static uint64_t crl_rst_r5_prew(RegisterInfo *reg, uint64_t val64)
++
-+{
++    for (int i = 0; i < GPIO_NUM_PINS; i++) {
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++        if (is_output(s, i)) {
-+
++            if (is_push_pull(s, i)) {
-+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU0, val64, s->cfg.cpu_r5[0]);
++                new_idr_mask |= (1 << i);
-+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU1, val64, s->cfg.cpu_r5[1]);
++            } else if (!(s->odr & (1 << i))) {
-+    return val64;
++                /* open-drain ODR 0 */
-+}
++                new_idr_mask |= (1 << i);
-+
++            /* open-drain ODR 1 */
-+static uint64_t crl_rst_adma_prew(RegisterInfo *reg, uint64_t val64)
++            } else if (!(s->disconnected_pins & (1 << i)) &&
-+{
++                       !(s->pins_connected_high & (1 << i))) {
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++                /* open-drain ODR 1 with pin connected low */
-+    int i;
++                new_idr_mask |= (1 << i);
-+
++                new_idr &= ~(1 << i);
-+    /* A single register fans out to all ADMA reset inputs.  */
++            /* open-drain ODR 1 with unactive pin */
-+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); i++) {
++            } else if (is_pull_up(s, i)) {
-+        REGFIELD_RESET(dev, s, RST_ADMA, RESET, val64, s->cfg.adma[i]);
++                new_idr_mask |= (1 << i);
-+    }
++            } else if (is_pull_down(s, i)) {
-+    return val64;
++                new_idr_mask |= (1 << i);
-+}
++                new_idr &= ~(1 << i);
-+
++            }
-+static uint64_t crl_rst_uart0_prew(RegisterInfo *reg, uint64_t val64)
++            /*
-+{
++             * The only case left is for open-drain ODR 1
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++             * with unactive pin without pull-up or pull-down :
-+
++             * the value is floating.
-+    REGFIELD_RESET(dev, s, RST_UART0, RESET, val64, s->cfg.uart[0]);
++             */
-+    return val64;
++        /* input or analog mode with connected pin */
-+}
++        } else if (!(s->disconnected_pins & (1 << i))) {
-+
++            if (s->pins_connected_high & (1 << i)) {
-+static uint64_t crl_rst_uart1_prew(RegisterInfo *reg, uint64_t val64)
++                /* pin high */
-+{
++                new_idr_mask |= (1 << i);
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++                new_idr |= (1 << i);
-+
++            } else {
-+    REGFIELD_RESET(dev, s, RST_UART1, RESET, val64, s->cfg.uart[1]);
++                /* pin low */
-+    return val64;
++                new_idr_mask |= (1 << i);
-+}
++                new_idr &= ~(1 << i);
-+
++            }
-+static uint64_t crl_rst_gem0_prew(RegisterInfo *reg, uint64_t val64)
++        /* input or analog mode with disconnected pin */
-+{
++        } else {
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++            if (is_pull_up(s, i)) {
-+
++                /* pull-up */
-+    REGFIELD_RESET(dev, s, RST_GEM0, RESET, val64, s->cfg.gem[0]);
++                new_idr_mask |= (1 << i);
-+    return val64;
++                new_idr |= (1 << i);
-+}
++            } else if (is_pull_down(s, i)) {
-+
++                /* pull-down */
-+static uint64_t crl_rst_gem1_prew(RegisterInfo *reg, uint64_t val64)
++                new_idr_mask |= (1 << i);
-+{
++                new_idr &= ~(1 << i);
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++            }
-+
++            /*
-+    REGFIELD_RESET(dev, s, RST_GEM1, RESET, val64, s->cfg.gem[1]);
++             * The only case left is for a disconnected pin
-+    return val64;
++             * without pull-up or pull-down :
-+}
++             * the value is floating.
-+
++             */
-+static uint64_t crl_rst_usb_prew(RegisterInfo *reg, uint64_t val64)
++        }
-+{
++    }
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
++
-+
++    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
-+    REGFIELD_RESET(dev, s, RST_USB0, RESET, val64, s->cfg.usb);
++    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
-+    return val64;
++
-+}
++    for (int i = 0; i < GPIO_NUM_PINS; i++) {
-+
++        if (new_idr_mask & (1 << i)) {
-+static const RegisterAccessInfo crl_regs_info[] = {
++            new_pin_state = (new_idr & (1 << i)) > 0;
-+    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
++            old_pin_state = (old_idr & (1 << i)) > 0;
-+    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
++            if (new_pin_state > old_pin_state) {
-+        .w1c = 0x1,
++                qemu_irq_raise(s->pin[i]);
-+        .post_write = crl_status_postw,
++            } else if (new_pin_state < old_pin_state) {
-+    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
++                qemu_irq_lower(s->pin[i]);
-+        .reset = 0x1,
++            }
-+        .ro = 0x1,
++        }
-+    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
++    }
-+        .pre_write = crl_enable_prew,
++}
-+    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
++
-+        .pre_write = crl_disable_prew,
++/*
-+    },{ .name = "WPROT",  .addr = A_WPROT,
++ * Return mask of pins that are both configured in output
-+    },{ .name = "PLL_CLK_OTHER_DMN",  .addr = A_PLL_CLK_OTHER_DMN,
++ * mode and externally driven (except pins in open-drain
-+        .reset = 0x1,
++ * mode externally set to 0).
-+        .rsvd = 0xe,
++ */
-+    },{ .name = "RPLL_CTRL",  .addr = A_RPLL_CTRL,
++static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
-+        .reset = 0x24809,
++{
-+        .rsvd = 0xf88c00f6,
++    uint32_t pins_to_disconnect = 0;
-+    },{ .name = "RPLL_CFG",  .addr = A_RPLL_CFG,
++    for (int i = 0; i < GPIO_NUM_PINS; i++) {
-+        .reset = 0x2000000,
++        /* for each connected pin in output mode */
-+        .rsvd = 0x1801210,
++        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
-+    },{ .name = "RPLL_FRAC_CFG",  .addr = A_RPLL_FRAC_CFG,
++            /* if either push-pull or high level */
-+        .rsvd = 0x7e330000,
++            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
-+    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
++                pins_to_disconnect |= (1 << i);
-+        .reset = R_PLL_STATUS_RPLL_STABLE_MASK |
++                qemu_log_mask(LOG_GUEST_ERROR,
-+                 R_PLL_STATUS_RPLL_LOCK_MASK,
++                              "Line %d can't be driven externally\n",
-+        .rsvd = 0xfa,
++                              i);
-+        .ro = 0x5,
++            }
-+    },{ .name = "RPLL_TO_XPD_CTRL",  .addr = A_RPLL_TO_XPD_CTRL,
++        }
-+        .reset = 0x2000100,
++    }
-+        .rsvd = 0xfdfc00ff,
++    return pins_to_disconnect;
-+    },{ .name = "LPD_TOP_SWITCH_CTRL",  .addr = A_LPD_TOP_SWITCH_CTRL,
++}
-+        .reset = 0x6000300,
++
-+        .rsvd = 0xf9fc00f8,
++/*
-+    },{ .name = "LPD_LSBUS_CTRL",  .addr = A_LPD_LSBUS_CTRL,
++ * Set field `disconnected_pins` and call `update_gpio_idr()`
-+        .reset = 0x2000800,
++ */
-+        .rsvd = 0xfdfc00f8,
++static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
-+    },{ .name = "CPU_R5_CTRL",  .addr = A_CPU_R5_CTRL,
++{
-+        .reset = 0xe000300,
++    s->disconnected_pins |= lines;
-+        .rsvd = 0xe1fc00f8,
++    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
-+    },{ .name = "IOU_SWITCH_CTRL",  .addr = A_IOU_SWITCH_CTRL,
++                              s->pins_connected_high);
-+        .reset = 0x2000500,
++    update_gpio_idr(s);
-+        .rsvd = 0xfdfc00f8,
++}
-+    },{ .name = "GEM0_REF_CTRL",  .addr = A_GEM0_REF_CTRL,
++
-+        .reset = 0xe000a00,
++static void disconnected_pins_set(Object *obj, Visitor *v,
-+        .rsvd = 0xf1fc00f8,
++    const char *name, void *opaque, Error **errp)
-+    },{ .name = "GEM1_REF_CTRL",  .addr = A_GEM1_REF_CTRL,
++{
-+        .reset = 0xe000a00,
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+        .rsvd = 0xf1fc00f8,
++    uint16_t value;
-+    },{ .name = "GEM_TSU_REF_CTRL",  .addr = A_GEM_TSU_REF_CTRL,
++    if (!visit_type_uint16(v, name, &value, errp)) {
-+        .reset = 0x300,
++        return;
-+        .rsvd = 0xfdfc00f8,
++    }
-+    },{ .name = "USB0_BUS_REF_CTRL",  .addr = A_USB0_BUS_REF_CTRL,
++    disconnect_gpio_pins(s, value);
-+        .reset = 0x2001900,
++}
-+        .rsvd = 0xfdfc00f8,
++
-+    },{ .name = "UART0_REF_CTRL",  .addr = A_UART0_REF_CTRL,
++static void disconnected_pins_get(Object *obj, Visitor *v,
-+        .reset = 0xc00,
++    const char *name, void *opaque, Error **errp)
-+        .rsvd = 0xfdfc00f8,
++{
-+    },{ .name = "UART1_REF_CTRL",  .addr = A_UART1_REF_CTRL,
++    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
-+        .reset = 0xc00,
++}
-+        .rsvd = 0xfdfc00f8,
++
-+    },{ .name = "SPI0_REF_CTRL",  .addr = A_SPI0_REF_CTRL,
++static void clock_freq_get(Object *obj, Visitor *v,
-+        .reset = 0x600,
++    const char *name, void *opaque, Error **errp)
-+        .rsvd = 0xfdfc00f8,
++{
-+    },{ .name = "SPI1_REF_CTRL",  .addr = A_SPI1_REF_CTRL,
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+        .reset = 0x600,
++    uint32_t clock_freq_hz = clock_get_hz(s->clk);
-+        .rsvd = 0xfdfc00f8,
++    visit_type_uint32(v, name, &clock_freq_hz, errp);
-+    },{ .name = "CAN0_REF_CTRL",  .addr = A_CAN0_REF_CTRL,
++}
-+        .reset = 0xc00,
++
-+        .rsvd = 0xfdfc00f8,
++static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
-+    },{ .name = "CAN1_REF_CTRL",  .addr = A_CAN1_REF_CTRL,
++                                 uint64_t val64, unsigned int size)
-+        .reset = 0xc00,
++{
-+        .rsvd = 0xfdfc00f8,
++    Stm32l4x5GpioState *s = opaque;
-+    },{ .name = "I2C0_REF_CTRL",  .addr = A_I2C0_REF_CTRL,
++
-+        .reset = 0xc00,
++    uint32_t value = val64;
-+        .rsvd = 0xfdfc00f8,
++    trace_stm32l4x5_gpio_write(s->name, addr, val64);
-+    },{ .name = "I2C1_REF_CTRL",  .addr = A_I2C1_REF_CTRL,
++
-+        .reset = 0xc00,
++    switch (addr) {
-+        .rsvd = 0xfdfc00f8,
++    case GPIO_MODER:
-+    },{ .name = "DBG_LPD_CTRL",  .addr = A_DBG_LPD_CTRL,
++        s->moder = value;
-+        .reset = 0x300,
++        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
-+        .rsvd = 0xfdfc00f8,
++        qemu_log_mask(LOG_UNIMP,
-+    },{ .name = "TIMESTAMP_REF_CTRL",  .addr = A_TIMESTAMP_REF_CTRL,
++                      "%s: Analog and AF modes aren't supported\n\
-+        .reset = 0x2000c00,
++                       Analog and AF mode behave like input mode\n",
-+        .rsvd = 0xfdfc00f8,
++                      __func__);
-+    },{ .name = "CRL_SAFETY_CHK",  .addr = A_CRL_SAFETY_CHK,
++        return;
-+    },{ .name = "PSM_REF_CTRL",  .addr = A_PSM_REF_CTRL,
++    case GPIO_OTYPER:
-+        .reset = 0xf04,
++        s->otyper = value & ~RESERVED_BITS_MASK;
-+        .rsvd = 0xfffc00f8,
++        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
-+    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
++        return;
-+        .reset = 0x300,
++    case GPIO_OSPEEDR:
-+        .rsvd = 0xfdfc00f8,
++        qemu_log_mask(LOG_UNIMP,
-+    },{ .name = "CPM_TOPSW_REF_CTRL",  .addr = A_CPM_TOPSW_REF_CTRL,
++                      "%s: Changing I/O output speed isn't supported\n\
-+        .reset = 0x300,
++                       I/O speed is already maximal\n",
-+        .rsvd = 0xfdfc00f8,
++                      __func__);
-+    },{ .name = "USB3_DUAL_REF_CTRL",  .addr = A_USB3_DUAL_REF_CTRL,
++        s->ospeedr = value;
-+        .reset = 0x3c00,
++        return;
-+        .rsvd = 0xfdfc00f8,
++    case GPIO_PUPDR:
-+    },{ .name = "RST_CPU_R5",  .addr = A_RST_CPU_R5,
++        s->pupdr = value;
-+        .reset = 0x17,
++        update_gpio_idr(s);
-+        .rsvd = 0x8,
++        return;
-+        .pre_write = crl_rst_r5_prew,
++    case GPIO_IDR:
-+    },{ .name = "RST_ADMA",  .addr = A_RST_ADMA,
++        qemu_log_mask(LOG_UNIMP,
-+        .reset = 0x1,
++                      "%s: GPIO->IDR is read-only\n",
-+        .pre_write = crl_rst_adma_prew,
++                      __func__);
-+    },{ .name = "RST_GEM0",  .addr = A_RST_GEM0,
++        return;
-+        .reset = 0x1,
++    case GPIO_ODR:
-+        .pre_write = crl_rst_gem0_prew,
++        s->odr = value & ~RESERVED_BITS_MASK;
-+    },{ .name = "RST_GEM1",  .addr = A_RST_GEM1,
++        update_gpio_idr(s);
-+        .reset = 0x1,
++        return;
-+        .pre_write = crl_rst_gem1_prew,
++    case GPIO_BSRR: {
-+    },{ .name = "RST_SPARE",  .addr = A_RST_SPARE,
++        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
-+        .reset = 0x1,
++        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
-+    },{ .name = "RST_USB0",  .addr = A_RST_USB0,
++        /* If both BSx and BRx are set, BSx has priority.*/
-+        .reset = 0x1,
++        s->odr &= ~bits_to_reset;
-+        .pre_write = crl_rst_usb_prew,
++        s->odr |= bits_to_set;
-+    },{ .name = "RST_UART0",  .addr = A_RST_UART0,
++        update_gpio_idr(s);
-+        .reset = 0x1,
++        return;
-+        .pre_write = crl_rst_uart0_prew,
++    }
-+    },{ .name = "RST_UART1",  .addr = A_RST_UART1,
++    case GPIO_LCKR:
-+        .reset = 0x1,
++        qemu_log_mask(LOG_UNIMP,
-+        .pre_write = crl_rst_uart1_prew,
++                      "%s: Locking port bits configuration isn't supported\n",
-+    },{ .name = "RST_SPI0",  .addr = A_RST_SPI0,
++                      __func__);
-+        .reset = 0x1,
++        s->lckr = value & ~RESERVED_BITS_MASK;
-+    },{ .name = "RST_SPI1",  .addr = A_RST_SPI1,
++        return;
-+        .reset = 0x1,
++    case GPIO_AFRL:
-+    },{ .name = "RST_CAN0",  .addr = A_RST_CAN0,
++        qemu_log_mask(LOG_UNIMP,
-+        .reset = 0x1,
++                      "%s: Alternate functions aren't supported\n",
-+    },{ .name = "RST_CAN1",  .addr = A_RST_CAN1,
++                      __func__);
-+        .reset = 0x1,
++        s->afrl = value;
-+    },{ .name = "RST_I2C0",  .addr = A_RST_I2C0,
++        return;
-+        .reset = 0x1,
++    case GPIO_AFRH:
-+    },{ .name = "RST_I2C1",  .addr = A_RST_I2C1,
++        qemu_log_mask(LOG_UNIMP,
-+        .reset = 0x1,
++                      "%s: Alternate functions aren't supported\n",
-+    },{ .name = "RST_DBG_LPD",  .addr = A_RST_DBG_LPD,
++                      __func__);
-+        .reset = 0x33,
++        s->afrh = value;
-+        .rsvd = 0xcc,
++        return;
-+    },{ .name = "RST_GPIO",  .addr = A_RST_GPIO,
++    case GPIO_BRR: {
-+        .reset = 0x1,
++        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
-+    },{ .name = "RST_TTC",  .addr = A_RST_TTC,
++        s->odr &= ~bits_to_reset;
-+        .reset = 0xf,
++        update_gpio_idr(s);
-+    },{ .name = "RST_TIMESTAMP",  .addr = A_RST_TIMESTAMP,
++        return;
-+        .reset = 0x1,
++    }
-+    },{ .name = "RST_SWDT",  .addr = A_RST_SWDT,
++    case GPIO_ASCR:
-+        .reset = 0x1,
++        qemu_log_mask(LOG_UNIMP,
-+    },{ .name = "RST_OCM",  .addr = A_RST_OCM,
++                      "%s: ADC function isn't supported\n",
-+    },{ .name = "RST_IPI",  .addr = A_RST_IPI,
++                      __func__);
-+    },{ .name = "RST_FPD",  .addr = A_RST_FPD,
++        s->ascr = value & ~RESERVED_BITS_MASK;
-+        .reset = 0x3,
++        return;
-+    },{ .name = "PSM_RST_MODE",  .addr = A_PSM_RST_MODE,
++    default:
-+        .reset = 0x1,
++        qemu_log_mask(LOG_GUEST_ERROR,
-+        .rsvd = 0xf8,
++                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +    }
-+};
++}
 +
-+static void crl_reset_enter(Object *obj, ResetType type)
++static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
-+{
++                                    unsigned int size)
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
++{
-+    unsigned int i;
++    Stm32l4x5GpioState *s = opaque;
 +
-+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
++    trace_stm32l4x5_gpio_read(s->name, addr);
-+        register_reset(&s->regs_info[i]);
++
-+    }
++    switch (addr) {
-+}
++    case GPIO_MODER:
-+
++        return s->moder;
-+static void crl_reset_hold(Object *obj)
++    case GPIO_OTYPER:
-+{
++        return s->otyper;
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
++    case GPIO_OSPEEDR:
-+
++        return s->ospeedr;
-+    crl_update_irq(s);
++    case GPIO_PUPDR:
-+}
++        return s->pupdr;
-+
++    case GPIO_IDR:
-+static const MemoryRegionOps crl_ops = {
++        return s->idr;
-+    .read = register_read_memory,
++    case GPIO_ODR:
-+    .write = register_write_memory,
++        return s->odr;
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++    case GPIO_BSRR:
 +        return 0;
 +    case GPIO_LCKR:
 +        return s->lckr;
 +    case GPIO_AFRL:
 +        return s->afrl;
 +    case GPIO_AFRH:
 +        return s->afrh;
 +    case GPIO_BRR:
 +        return 0;
 +    case GPIO_ASCR:
 +        return s->ascr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +        return 0;
 +    }
 +}
 +
 +static const MemoryRegionOps stm32l4x5_gpio_ops = {
 +    .read = stm32l4x5_gpio_read,
 +    .write = stm32l4x5_gpio_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
++        .unaligned = false,
 +    },
 +};
 +
-+static void crl_init(Object *obj)
++static void stm32l4x5_gpio_init(Object *obj)
 +{
-+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
-+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
++
-+    int i;
++    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
-+
++                          TYPE_STM32L4X5_GPIO, 0x400);
-+    s->reg_array =
++
-+        register_init_block32(DEVICE(obj), crl_regs_info,
++    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-+                              ARRAY_SIZE(crl_regs_info),
++
-+                              s->regs_info, s->regs,
++    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
-+                              &crl_ops,
++    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
-+                              XLNX_VERSAL_CRL_ERR_DEBUG,
++
-+                              CRL_R_MAX * 4);
++    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
-+    sysbus_init_mmio(sbd, &s->reg_array->mem);
++
-+    sysbus_init_irq(sbd, &s->irq);
++    object_property_add(obj, "disconnected-pins", "uint16",
-+
++                        disconnected_pins_get, disconnected_pins_set,
-+    for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
++                        NULL, &s->disconnected_pins);
-+        object_property_add_link(obj, "cpu_r5[*]", TYPE_ARM_CPU,
++    object_property_add(obj, "clock-freq-hz", "uint32",
-+                                 (Object **)&s->cfg.cpu_r5[i],
++                        clock_freq_get, NULL, NULL, NULL);
-+                                 qdev_prop_allow_set_link_before_realize,
++}
-+                                 OBJ_PROP_LINK_STRONG);
++
-+    }
++static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
-+
++{
-+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); ++i) {
++    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
-+        object_property_add_link(obj, "adma[*]", TYPE_DEVICE,
++    if (!clock_has_source(s->clk)) {
-+                                 (Object **)&s->cfg.adma[i],
++        error_setg(errp, "GPIO: clk input must be connected");
-+                                 qdev_prop_allow_set_link_before_realize,
++        return;
-+                                 OBJ_PROP_LINK_STRONG);
++    }
-+    }
++}
 +
-+    for (i = 0; i < ARRAY_SIZE(s->cfg.uart); ++i) {
++static const VMStateDescription vmstate_stm32l4x5_gpio = {
-+        object_property_add_link(obj, "uart[*]", TYPE_DEVICE,
++    .name = TYPE_STM32L4X5_GPIO,
 +                                 (Object **)&s->cfg.uart[i],
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(s->cfg.gem); ++i) {
 +        object_property_add_link(obj, "gem[*]", TYPE_DEVICE,
 +                                 (Object **)&s->cfg.gem[i],
 +                                 qdev_prop_allow_set_link_before_realize,
 +                                 OBJ_PROP_LINK_STRONG);
 +    }
 +
 +    object_property_add_link(obj, "usb", TYPE_DEVICE,
 +                             (Object **)&s->cfg.gem[i],
 +                             qdev_prop_allow_set_link_before_realize,
 +                             OBJ_PROP_LINK_STRONG);
 +}
 +
 +static void crl_finalize(Object *obj)
 +{
 +    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 +    register_finalize_block(s->reg_array);
 +}
 +
 +static const VMStateDescription vmstate_crl = {
 +    .name = TYPE_XLNX_VERSAL_CRL,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
++    .fields = (VMStateField[]){
-+        VMSTATE_UINT32_ARRAY(regs, XlnxVersalCRL, CRL_R_MAX),
++        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
-+        VMSTATE_END_OF_LIST(),
++        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static void crl_class_init(ObjectClass *klass, void *data)
++static Property stm32l4x5_gpio_properties[] = {
-+{
++    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
 +    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
 +    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
 +    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++
-+
++    device_class_set_props(dc, stm32l4x5_gpio_properties);
-+    dc->vmsd = &vmstate_crl;
++    dc->vmsd = &vmstate_stm32l4x5_gpio;
-+
++    dc->realize = stm32l4x5_gpio_realize;
-+    rc->phases.enter = crl_reset_enter;
++    rc->phases.hold = stm32l4x5_gpio_reset_hold;
-+    rc->phases.hold = crl_reset_hold;
++}
-+}
++
-+
++static const TypeInfo stm32l4x5_gpio_types[] = {
-+static const TypeInfo crl_info = {
++    {
-+    .name          = TYPE_XLNX_VERSAL_CRL,
++        .name = TYPE_STM32L4X5_GPIO,
-+    .parent        = TYPE_SYS_BUS_DEVICE,
++        .parent = TYPE_SYS_BUS_DEVICE,
-+    .instance_size = sizeof(XlnxVersalCRL),
++        .instance_size = sizeof(Stm32l4x5GpioState),
-+    .class_init    = crl_class_init,
++        .instance_init = stm32l4x5_gpio_init,
-+    .instance_init = crl_init,
++        .class_init = stm32l4x5_gpio_class_init,
-+    .instance_finalize = crl_finalize,
++    },
 +};
 +
-+static void crl_register_types(void)
++DEFINE_TYPES(stm32l4x5_gpio_types)
-+{
+diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
 +    type_register_static(&crl_info);
 +}
 +
 +type_init(crl_register_types)
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/meson.build
+--- a/hw/gpio/Kconfig
-+++ b/hw/misc/meson.build
++++ b/hw/gpio/Kconfig
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
- softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
- specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
+ config SIFIVE_GPIO
- specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
+     bool
-+specific_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-crl.c'))
++
- softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
++config STM32L4X5_GPIO
-   'xlnx-versal-xramc.c',
++    bool
-   'xlnx-versal-pmc-iou-slcr.c',
+diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
      'bcm2835_gpio.c',
      'bcm2838_gpio.c'
  ))
 +system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
  system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
 diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/trace-events
 +++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
  # aspeed_gpio.c
  aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
  aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 +
 +# stm32l4x5_gpio.c
 +stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
 +stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
 +stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
 --
-.25.1
+.34.1

-[PULL 08/31] hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-The Exynos4210 SoC device currently uses a custom device
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-"exynos4210.irq_gate" to model the OR gate that feeds each CPU's IRQ
-line.  We have a standard TYPE_OR_IRQ device for this now, so use
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-that instead.
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-(This is a migration compatibility break, but that is OK for this
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-machine type.)
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-2-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  1 +
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
- hw/arm/exynos4210.c         | 31 ++++++++++++++++---------------
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
-files changed, 17 insertions(+), 15 deletions(-)
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
-index XXXXXXX..XXXXXXX 100644
+ hw/arm/Kconfig                     |  3 +-
---- a/include/hw/arm/exynos4210.h
+files changed, 63 insertions(+), 18 deletions(-)
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
-     MemoryRegion bootreg_mem;
+index XXXXXXX..XXXXXXX 100644
-     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
+--- a/include/hw/arm/stm32l4x5_soc.h
-     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
++++ b/include/hw/arm/stm32l4x5_soc.h
-+    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+@@ -XXX,XX +XXX,XX @@
  #include "hw/misc/stm32l4x5_syscfg.h"
  #include "hw/misc/stm32l4x5_exti.h"
  #include "hw/misc/stm32l4x5_rcc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "qom/object.h"
  #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
      OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
      Stm32l4x5SyscfgState syscfg;
      Stm32l4x5RccState rcc;
 +    Stm32l4x5GpioState gpio[NUM_GPIOS];
      MemoryRegion sram1;
      MemoryRegion sram2;
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/gpio/stm32l4x5_gpio.h
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
  #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +#define NUM_GPIOS 8
  #define GPIO_NUM_PINS 16
  struct Stm32l4x5GpioState {
 diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
- #define TYPE_EXYNOS4210_SOC "exynos4210"
++static const struct {
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
++    uint32_t addr;
-index XXXXXXX..XXXXXXX 100644
++    uint32_t moder_reset;
---- a/hw/arm/exynos4210.c
++    uint32_t ospeedr_reset;
-+++ b/hw/arm/exynos4210.c
++    uint32_t pupdr_reset;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
++} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
 +    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
  static void stm32l4x5_soc_initfn(Object *obj)
  {
-     Exynos4210State *s = EXYNOS4210_SOC(socdev);
+     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
-     MemoryRegion *system_mem = get_system_memory();
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
--    qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
+     }
-     SysBusDevice *busdev;
+     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
-     DeviceState *dev, *uart[4], *pl330[3];
+     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
-     int i, n;
++
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
++        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
-     /* IRQ Gate */
++        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
      for (i = 0; i < EXYNOS4210_NCPUS; i++) {
 -        dev = qdev_new("exynos4210.irq_gate");
 -        qdev_prop_set_uint32(dev, "n_in", EXYNOS4210_IRQ_GATE_NINPUTS);
 -        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -        /* Get IRQ Gate input in gate_irq */
 -        for (n = 0; n < EXYNOS4210_IRQ_GATE_NINPUTS; n++) {
 -            gate_irq[i][n] = qdev_get_gpio_in(dev, n);
 -        }
 -        busdev = SYS_BUS_DEVICE(dev);
 -
 -        /* Connect IRQ Gate output to CPU's IRQ line */
 -        sysbus_connect_irq(busdev, 0,
 -                           qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
 +        DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
 +        object_property_set_int(OBJECT(orgate), "num-lines",
 +                                EXYNOS4210_IRQ_GATE_NINPUTS,
 +                                &error_abort);
 +        qdev_realize(orgate, NULL, &error_abort);
 +        qdev_connect_gpio_out(orgate, 0,
 +                              qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
      }
      /* Private memory region and Internal GIC */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      sysbus_realize_and_unref(busdev, &error_fatal);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
      for (n = 0; n < EXYNOS4210_NCPUS; n++) {
 -        sysbus_connect_irq(busdev, n, gate_irq[n][0]);
 +        sysbus_connect_irq(busdev, n,
 +                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
      }
      for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
          s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
      /* Map Distributer interface */
      sysbus_mmio_map(busdev, 1, EXYNOS4210_EXT_GIC_DIST_BASE_ADDR);
      for (n = 0; n < EXYNOS4210_NCPUS; n++) {
 -        sysbus_connect_irq(busdev, n, gate_irq[n][1]);
 +        sysbus_connect_irq(busdev, n,
 +                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
      }
      for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
          s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
          object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
          g_free(name);
      }
 +
 +    for (i = 0; i < ARRAY_SIZE(s->cpu_irq_orgate); i++) {
 +        g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
 +        object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
 +    }
  }
- static void exynos4210_class_init(ObjectClass *klass, void *data)
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
      const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
      MemoryRegion *system_memory = get_system_memory();
 -    DeviceState *armv7m;
 +    DeviceState *armv7m, *dev;
      SysBusDevice *busdev;
 +    uint32_t pin_index;
      if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                  sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          return;
      }
 +    /* GPIOs */
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
 +        dev = DEVICE(&s->gpio[i]);
 +        qdev_prop_set_string(dev, "name", name);
 +        qdev_prop_set_uint32(dev, "mode-reset",
 +                             stm32l4x5_gpio_cfg[i].moder_reset);
 +        qdev_prop_set_uint32(dev, "ospeed-reset",
 +                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
 +        qdev_prop_set_uint32(dev, "pupd-reset",
 +                            stm32l4x5_gpio_cfg[i].pupdr_reset);
 +        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
 +        g_free(name);
 +        name = g_strdup_printf("gpio%c-out", 'a' + i);
 +        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
 +            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
 +        if (!sysbus_realize(busdev, errp)) {
 +            return;
 +        }
 +        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
 +    }
 +
      /* System configuration controller */
      busdev = SYS_BUS_DEVICE(&s->syscfg);
      if (!sysbus_realize(busdev, errp)) {
          return;
      }
      sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
 -    /*
 -     * TODO: when the GPIO device is implemented, connect it
 -     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
 -     * GPIO_NUM_PINS.
 -     */
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
 +            pin_index = GPIO_NUM_PINS * i + j;
 +            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
 +                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
 +                                  pin_index));
 +        }
 +    }
      /* EXTI device */
      busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          }
      }
 -    for (unsigned i = 0; i < 16; i++) {
 +    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
          qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                                qdev_get_gpio_in(DEVICE(&s->exti), i));
      }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      /* RESERVED:    0x40024400, 0x7FDBC00 */
      /* AHB2 BUS */
 -    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
 -    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
 -    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
 -    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
 -    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
 -    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
 -    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
 -    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
      /* RESERVED:    0x48002000, 0x7FDBC00 */
      create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
      create_unimplemented_device("ADC",       0x50040000, 0x400);
 diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32l4x5_syscfg.c
 +++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "migration/vmstate.h"
  #include "hw/misc/stm32l4x5_syscfg.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
-.25.1
+.34.1

-[PULL 24/31] hw/arm/exynos4210: Put combiners into state struct
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
-Switch the creation of the combiner devices to the new-style
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
 "embedded in state struct" approach, so we can easily refer
 to the object elsewhere during realize.
+The testcase contains :
+- `test_idr_reset_value()` :
+Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
+- `test_gpio_output_mode()` :
+Checks that writing a bit in register ODR results in the corresponding
+pin rising or lowering, if this pin is configured in output mode.
+- `test_gpio_input_mode()` :
+Checks that a input pin set high or low externally results
+in the pin rising and lowering.
+- `test_pull_up_pull_down()` :
+Checks that a floating pin in pull-up/down mode is actually high/down.
+- `test_push_pull()` :
+Checks that a pin set externally is disconnected when configured in
+push-pull output mode, and can't be set externally while in this mode.
+- `test_open_drain()` :
+Checks that a pin set externally high is disconnected when configured
+in open-drain output mode, and can't be set high while in this mode.
+- `test_bsrr_brr()` :
+Checks that writing to BSRR and BRR has the desired result in ODR.
+- `test_clock_enable()` :
+Checks that GPIO clock is at the right frequency after enabling it.
+Acked-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
+Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-18-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h           |  3 ++
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
- include/hw/intc/exynos4210_combiner.h | 57 +++++++++++++++++++++++++++
+ tests/qtest/meson.build           |   3 +-
- hw/arm/exynos4210.c                   | 20 +++++-----
+files changed, 553 insertions(+), 1 deletion(-)
- hw/intc/exynos4210_combiner.c         | 31 +--------------
+ create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 files changed, 72 insertions(+), 39 deletions(-)
  create mode 100644 include/hw/intc/exynos4210_combiner.h
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/exynos4210.h
 +++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "hw/cpu/a9mpcore.h"
  #include "hw/intc/exynos4210_gic.h"
 +#include "hw/intc/exynos4210_combiner.h"
  #include "hw/core/split-irq.h"
  #include "target/arm/cpu-qom.h"
  #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
      qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
      A9MPPrivState a9mpcore;
      Exynos4210GicState ext_gic;
 +    Exynos4210CombinerState int_combiner;
 +    Exynos4210CombinerState ext_combiner;
      SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
  };
 diff --git a/include/hw/intc/exynos4210_combiner.h b/include/hw/intc/exynos4210_combiner.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/intc/exynos4210_combiner.h
++++ b/tests/qtest/stm32l4x5_gpio-test.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Samsung exynos4210 Interrupt Combiner
++ * QTest testcase for STM32L4x5_GPIO
 + *
-+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
++ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
-+ * All rights reserved.
++ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
-+ * Evgeny Voevodin <e.voevodin@samsung.com>
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ *
++ * See the COPYING file in the top-level directory.
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or (at your
 + * option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 + * See the GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_INTC_EXYNOS4210_COMBINER
++#include "qemu/osdep.h"
-+#define HW_INTC_EXYNOS4210_COMBINER
++#include "libqtest-single.h"
 +
-+#include "hw/sysbus.h"
++#define GPIO_BASE_ADDR 0x48000000
-+
++#define GPIO_SIZE      0x400
-+/*
++#define NUM_GPIOS      8
-+ * State for each output signal of internal combiner
++#define NUM_GPIO_PINS  16
-+ */
++
-+typedef struct CombinerGroupState {
++#define GPIO_A 0x48000000
-+    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
++#define GPIO_B 0x48000400
-+    uint8_t src_pending;        /* Pending source interrupts before masking */
++#define GPIO_C 0x48000800
-+} CombinerGroupState;
++#define GPIO_D 0x48000C00
-+
++#define GPIO_E 0x48001000
-+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
++#define GPIO_F 0x48001400
-+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
++#define GPIO_G 0x48001800
-+
++#define GPIO_H 0x48001C00
-+/* Number of groups and total number of interrupts for the internal combiner */
++
-+#define IIC_NGRP 64
++#define MODER 0x00
-+#define IIC_NIRQ (IIC_NGRP * 8)
++#define OTYPER 0x04
-+#define IIC_REGSET_SIZE 0x41
++#define PUPDR 0x0C
-+
++#define IDR 0x10
-+struct Exynos4210CombinerState {
++#define ODR 0x14
-+    SysBusDevice parent_obj;
++#define BSRR 0x18
-+
++#define BRR 0x28
-+    MemoryRegion iomem;
++
-+
++#define MODER_INPUT 0
-+    struct CombinerGroupState group[IIC_NGRP];
++#define MODER_OUTPUT 1
-+    uint32_t reg_set[IIC_REGSET_SIZE];
++
-+    uint32_t icipsr[2];
++#define PUPDR_NONE 0
-+    uint32_t external;          /* 1 means that this combiner is external */
++#define PUPDR_PULLUP 1
-+
++#define PUPDR_PULLDOWN 2
-+    qemu_irq output_irq[IIC_NGRP];
++
 +#define OTYPER_PUSH_PULL 0
 +#define OTYPER_OPEN_DRAIN 1
 +
 +const uint32_t moder_reset[NUM_GPIOS] = {
 +    0xABFFFFFF,
 +    0xFFFFFEBF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0x0000000F
 +};
 +
-+#endif
++const uint32_t pupdr_reset[NUM_GPIOS] = {
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
++    0x64000000,
 +    0x00000100,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +const uint32_t idr_reset[NUM_GPIOS] = {
 +    0x0000A000,
 +    0x00000010,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
 +{
 +    return readl(gpio + offset);
 +}
 +
 +static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
 +{
 +    writel(gpio + offset, value);
 +}
 +
 +static void gpio_set_bit(unsigned int gpio, unsigned int reg,
 +                         unsigned int pin, uint32_t value)
 +{
 +    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
 +}
 +
 +static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
 +                           unsigned int pin, uint32_t value)
 +{
 +    uint32_t offset = 2 * pin;
 +    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
 +}
 +
 +static unsigned int get_gpio_id(uint32_t gpio_addr)
 +{
 +    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
 +}
 +
 +static void gpio_set_irq(unsigned int gpio, int num, int level)
 +{
 +    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    qtest_set_irq_in(global_qtest, name, NULL, num, level);
 +}
 +
 +static void disconnect_all_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
 +        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
 +        path, 0xFFFF);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static uint32_t get_disconnected_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    uint32_t disconnected_pins = 0;
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
 +        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    disconnected_pins = qdict_get_int(r, "return");
 +    qobject_unref(r);
 +    return disconnected_pins;
 +}
 +
 +static uint32_t reset(uint32_t gpio, unsigned int offset)
 +{
 +    switch (offset) {
 +    case MODER:
 +        return moder_reset[get_gpio_id(gpio)];
 +    case PUPDR:
 +        return pupdr_reset[get_gpio_id(gpio)];
 +    case IDR:
 +        return idr_reset[get_gpio_id(gpio)];
 +    }
 +    return 0x0;
 +}
 +
 +static void system_reset(void)
 +{
 +    QDict *r;
 +    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static void test_idr_reset_value(void)
 +{
 +    /*
 +     * Checks that the values in MODER, OTYPER, PUPDR and ODR
 +     * after reset are correct, and that the value in IDR is
 +     * coherent.
 +     * Since AF and analog modes aren't implemented, IDR reset
 +     * values aren't the same as with a real board.
 +     *
 +     * Register IDR contains the actual values of all GPIO pins.
 +     * Its value depends on the pins' configuration
 +     * (intput/output/analog : register MODER, push-pull/open-drain :
 +     * register OTYPER, pull-up/pull-down/none : register PUPDR)
 +     * and on the values stored in register ODR
 +     * (in case the pin is in output mode).
 +     */
 +
 +    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
 +
 +    system_reset();
 +
 +    uint32_t moder = gpio_readl(GPIO_A, MODER);
 +    uint32_t odr = gpio_readl(GPIO_A, ODR);
 +    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
 +    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
 +    uint32_t idr = gpio_readl(GPIO_A, IDR);
 +    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
 +    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
 +    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
 +
 +    moder = gpio_readl(GPIO_B, MODER);
 +    odr = gpio_readl(GPIO_B, ODR);
 +    otyper = gpio_readl(GPIO_B, OTYPER);
 +    pupdr = gpio_readl(GPIO_B, PUPDR);
 +    idr = gpio_readl(GPIO_B, IDR);
 +    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
 +    /* ... 5: neither, 4: pull-up, 3: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
 +    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
 +
 +    moder = gpio_readl(GPIO_C, MODER);
 +    odr = gpio_readl(GPIO_C, ODR);
 +    otyper = gpio_readl(GPIO_C, OTYPER);
 +    pupdr = gpio_readl(GPIO_C, PUPDR);
 +    idr = gpio_readl(GPIO_C, IDR);
 +    /* Analog, same as Input mode*/
 +    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
 +
 +    moder = gpio_readl(GPIO_H, MODER);
 +    odr = gpio_readl(GPIO_H, ODR);
 +    otyper = gpio_readl(GPIO_H, OTYPER);
 +    pupdr = gpio_readl(GPIO_H, PUPDR);
 +    idr = gpio_readl(GPIO_H, IDR);
 +    /* Analog, same as Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
 +}
 +
 +static void test_gpio_output_mode(const void *data)
 +{
 +    /*
 +     * Checks that setting a bit in ODR sets the corresponding
 +     * GPIO line high : it should set the right bit in IDR
 +     * and send an irq to syscfg.
 +     * Additionally, it checks that values written to ODR
 +     * when not in output mode are stored and not discarded.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Set a bit in ODR and check nothing happens */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the relevant line as output and check the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Reset the bit in ODR and check the pin is low */
 +    gpio_set_bit(gpio, ODR, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +}
 +
 +static void test_gpio_input_mode(const void *data)
 +{
 +    /*
 +     * Test that setting a line high/low externally sets the
 +     * corresponding GPIO line high/low : it should set the
 +     * right bit in IDR and send an irq to syscfg.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input, raise it, and check that the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Lower the line and check that the pin is low */
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    disconnect_all_pins(gpio);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_pull_up_pull_down(const void *data)
 +{
 +    /*
 +     * Test that a floating pin with pull-up sets the pin
 +     * high and vice-versa.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input with pull-up, check the line is set high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the line with pull-down, check the line is low */
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_push_pull(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in push-pull output mode
 +     * disconnects the pin, that the pin can't be set or reset
 +     * externally afterwards.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Trying to set a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio2, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +}
 +
 +static void test_open_drain(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in open-drain output mode
 +     * disconnects a pin set high externally and that the pin
 +     * can't be set high externally while configured in open-drain.
 +     *
 +     * However a pin set low externally shouldn't be disconnected,
 +     * and it can be set low externally when in open-drain mode.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in open-drain output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in open-drain output */
 +    /* And checking the pin wasn't disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Trying to set a open-drain output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a open-drain output pin, checking it works */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Clean the test */
 +    disconnect_all_pins(gpio2);
 +    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
 +    disconnect_all_pins(gpio);
 +    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_bsrr_brr(const void *data)
 +{
 +    /*
 +     * Test that writing a '1' in BSS and BSRR
 +     * has the desired effect on ODR.
 +     * In BSRR, BSx has priority over BRx.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    /* BSx should have priority over BRx */
 +    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int ret;
 +
 +    g_test_init(&argc, &argv, NULL);
 +    g_test_set_nonfatal_assertions();
 +    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
 +                   test_idr_reset_value);
 +    /*
 +     * The inputs for the tests (gpio and pin) can be changed,
 +     * but the tests don't work for pins that are high at reset
 +     * (GPIOA15, GPIO13 and GPIOB5).
 +     * Specifically, rising the pin then checking `get_irq()`
 +     * is problematic since the pin was already high.
 +     */
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
 +                        (void *)((uint64_t)GPIO_C << 32 | 5),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
 +                        (void *)((uint64_t)GPIO_D << 32 | 6),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
 +                        (void *)((uint64_t)GPIO_C << 32 | 10),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
 +                        (void *)((uint64_t)GPIO_B << 32 | 5),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
 +                        (void *)((uint64_t)GPIO_F << 32 | 1),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
 +                        (void *)((uint64_t)GPIO_G << 32 | 6),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
 +                        (void *)((uint64_t)GPIO_C << 32 | 4),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
 +                        (void *)((uint64_t)GPIO_E << 32 | 11),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
 +                        (void *)((uint64_t)GPIO_A << 32 | 12),
 +                        test_bsrr_brr);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
 +                        (void *)((uint64_t)GPIO_D << 32 | 0),
 +                        test_bsrr_brr);
 +
 +    qtest_start("-machine b-l475e-iot01a");
 +    ret = g_test_run();
 +    qtest_end();
 +
 +    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/tests/qtest/meson.build
-+++ b/hw/arm/exynos4210.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
-     }
+ qtests_stm32l4x5 = \
+   ['stm32l4x5_exti-test',
-     /* Internal Interrupt Combiner */
+    'stm32l4x5_syscfg-test',
--    dev = qdev_new("exynos4210.combiner");
+-   'stm32l4x5_rcc-test']
--    busdev = SYS_BUS_DEVICE(dev);
++   'stm32l4x5_rcc-test',
--    sysbus_realize_and_unref(busdev, &error_fatal);
++   'stm32l4x5_gpio-test']
-+    busdev = SYS_BUS_DEVICE(&s->int_combiner);
-+    sysbus_realize(busdev, &error_fatal);
+ qtests_arm = \
-     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
          sysbus_connect_irq(busdev, n,
                             qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
 +    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
      /* External Interrupt Combiner */
 -    dev = qdev_new("exynos4210.combiner");
 -    qdev_prop_set_uint32(dev, "external", 1);
 -    busdev = SYS_BUS_DEVICE(dev);
 -    sysbus_realize_and_unref(busdev, &error_fatal);
 +    qdev_prop_set_uint32(DEVICE(&s->ext_combiner), "external", 1);
 +    busdev = SYS_BUS_DEVICE(&s->ext_combiner);
 +    sysbus_realize(busdev, &error_fatal);
      for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
          sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
      }
 -    exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
 +    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
      sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
      /* Initialize board IRQs. */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
      object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
      object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
 +    object_initialize_child(obj, "int-combiner", &s->int_combiner,
 +                            TYPE_EXYNOS4210_COMBINER);
 +    object_initialize_child(obj, "ext-combiner", &s->ext_combiner,
 +                            TYPE_EXYNOS4210_COMBINER);
  }
  static void exynos4210_class_init(ObjectClass *klass, void *data)
 diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/exynos4210_combiner.c
 +++ b/hw/intc/exynos4210_combiner.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "migration/vmstate.h"
  #include "qemu/module.h"
 -
 +#include "hw/intc/exynos4210_combiner.h"
  #include "hw/arm/exynos4210.h"
  #include "hw/hw.h"
  #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
  #define DPRINTF(fmt, ...) do {} while (0)
  #endif
 -#define    IIC_NGRP        64            /* Internal Interrupt Combiner
 -                                            Groups number */
 -#define    IIC_NIRQ        (IIC_NGRP * 8)/* Internal Interrupt Combiner
 -                                            Interrupts number */
  #define IIC_REGION_SIZE    0x108         /* Size of memory mapped region */
 -#define IIC_REGSET_SIZE    0x41
 -
 -/*
 - * State for each output signal of internal combiner
 - */
 -typedef struct CombinerGroupState {
 -    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
 -    uint8_t src_pending;        /* Pending source interrupts before masking */
 -} CombinerGroupState;
 -
 -#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
 -OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
 -
 -struct Exynos4210CombinerState {
 -    SysBusDevice parent_obj;
 -
 -    MemoryRegion iomem;
 -
 -    struct CombinerGroupState group[IIC_NGRP];
 -    uint32_t reg_set[IIC_REGSET_SIZE];
 -    uint32_t icipsr[2];
 -    uint32_t external;          /* 1 means that this combiner is external */
 -
 -    qemu_irq output_irq[IIC_NGRP];
 -};
  static const VMStateDescription vmstate_exynos4210_combiner_group_state = {
      .name = "exynos4210.combiner.groupstate",
 --
-.25.1
+.34.1

-[PULL 05/31] hw/arm: versal: Add the Cortex-R5Fs
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add the Cortex-R5Fs of the Versal RPU (Real-time Processing Unit)
+While the 8-bit input elements are sequential in the input vector,
-subsystem.
+the 32-bit output elements are not sequential in the output matrix.
+Do not attempt to compute 2 32-bit outputs at the same time.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
+Cc: qemu-stable@nongnu.org
-Message-id: 20220406174303.2022038-3-edgar.iglesias@xilinx.com
+Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h | 10 ++++++++++
+ target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
- hw/arm/xlnx-versal-virt.c    |  6 +++---
+ tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
- hw/arm/xlnx-versal.c         | 36 ++++++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
-files changed, 49 insertions(+), 3 deletions(-)
+ tests/tcg/aarch64/Makefile.target |  2 +-
+files changed, 147 insertions(+), 33 deletions(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+ create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/target/arm/tcg/sme_helper.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/target/arm/tcg/sme_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
  OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
  #define XLNX_VERSAL_NR_ACPUS   2
 +#define XLNX_VERSAL_NR_RCPUS   2
  #define XLNX_VERSAL_NR_UARTS   2
  #define XLNX_VERSAL_NR_GEMS    2
  #define XLNX_VERSAL_NR_ADMAS   8
@@ -XXX,XX +XXX,XX @@ struct Versal {
              VersalUsb2 usb;
          } iou;
 +        /* Real-time Processing Unit.  */
 +        struct {
 +            MemoryRegion mr;
 +            MemoryRegion mr_ps_alias;
 +
 +            CPUClusterState cluster;
 +            ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
 +        } rpu;
 +
          struct {
              qemu_or_irq irq_orgate;
              XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
 diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal-virt.c
 +++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
      mc->desc = "Xilinx Versal Virtual development board";
      mc->init = versal_virt_init;
 -    mc->min_cpus = XLNX_VERSAL_NR_ACPUS;
 -    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
 -    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
 +    mc->min_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
 +    mc->max_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
 +    mc->default_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
      mc->no_cdrom = true;
      mc->default_ram_id = "ddr";
  }
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 +#define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
  #define GEM_REVISION        0x40070106
  #define VERSAL_NUM_PMC_APB_IRQS 3
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
      }
  }
-+static void versal_create_rpu_cpus(Versal *s)
+-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
 +static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn32 *fn)
 +{
-+    int i;
++    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
-+
++    bool neg = simd_data(desc);
-+    object_initialize_child(OBJECT(s), "rpu-cluster", &s->lpd.rpu.cluster,
-+                            TYPE_CPU_CLUSTER);
+-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-+    qdev_prop_set_uint32(DEVICE(&s->lpd.rpu.cluster), "cluster-id", 1);
+-                            uint8_t *pn, uint8_t *pm,
-+
+-                            uint32_t desc, IMOPFn *fn)
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
++    for (row = 0; row < oprsz; ++row) {
-+        Object *obj;
++        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
-+
++        uint32_t *za_row = &za[tile_vslice_index(row)];
-+        object_initialize_child(OBJECT(&s->lpd.rpu.cluster),
++        uint32_t n = zn[H4(row)];
-+                                "rpu-cpu[*]", &s->lpd.rpu.cpu[i],
++
-+                                XLNX_VERSAL_RCPU_TYPE);
++        for (col = 0; col < oprsz; ++col) {
-+        obj = OBJECT(&s->lpd.rpu.cpu[i]);
++            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
-+        object_property_set_bool(obj, "start-powered-off", true,
++            uint32_t *a = &za_row[H4(col)];
-+                                 &error_abort);
++
-+
++            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
-+        object_property_set_int(obj, "mp-affinity", 0x100 | i, &error_abort);
++        }
-+        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->lpd.rpu.cpu),
++    }
 +                                &error_abort);
 +        object_property_set_link(obj, "memory", OBJECT(&s->lpd.rpu.mr),
 +                                 &error_abort);
 +        qdev_realize(DEVICE(obj), NULL, &error_fatal);
 +    }
 +
 +    qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
 +}
 +
- static void versal_create_uarts(Versal *s, qemu_irq *pic)
++typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
 +static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
 +                              uint8_t *pn, uint8_t *pm,
 +                              uint32_t desc, IMOPFn64 *fn)
  {
-     int i;
+     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
-@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+     bool neg = simd_data(desc);
+@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
      versal_create_apu_cpus(s);
      versal_create_apu_gic(s, pic);
 +    versal_create_rpu_cpus(s);
      versal_create_uarts(s, pic);
      versal_create_usbs(s, pic);
      versal_create_gems(s, pic);
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
      memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
      memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
 +    memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
 +                                        &s->lpd.rpu.mr_ps_alias, 0);
  }
- static void versal_init(Object *obj)
+ #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-@@ -XXX,XX +XXX,XX @@ static void versal_init(Object *obj)
+-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
-     Versal *s = XLNX_VERSAL(obj);
++static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
+ {                                                                           \
-     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
+-    uint32_t sum0 = 0, sum1 = 0;                                            \
-+    memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
++    uint32_t sum = 0;                                                       \
-     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
+     /* Apply P to N as a mask, making the inactive elements 0. */           \
-+    memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
+     n &= expand_pred_b(p);                                                  \
-+                             "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
+-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
 -    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
 -    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
 -    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
 -    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
 -    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
 -    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
 -    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
 -    if (neg) {                                                              \
 -        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
 -    } else {                                                                \
 -        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
 -    }                                                                       \
 -    return ((uint64_t)sum1 << 32) | sum0;                                   \
 +    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
 +    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
 +    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
 +    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
 +    return neg ? a - sum : a + sum;                                         \
  }
- static Property versal_properties[] = {
+ #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
  DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
  DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 -#define DEF_IMOPH(NAME) \
 -    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
 -                            void *vpm, uint32_t desc)                        \
 -    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
 +#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  # SME Tests
  ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
 -AARCH64_TESTS += sme-outprod1
 +AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
  endif
  # System Registers Tests
 --
-.25.1
+.34.1

-[PULL 31/31] hw/arm: Use bit fields for NPCM7XX PWRON STRAPs
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-From: Hao Wu <wuhaotsh@google.com>
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
 was unfortunately added with a license of GPL-v3-or-later, which is
 not compatible with other QEMU code which has a GPL-v2-only license.
-This patch uses the defined fields to describe PWRON STRAPs for
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-better readability.
+to make it compatible with the rest of QEMU.
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Patrick Venture <venture@google.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20220411165842.3912945-3-wuhaotsh@google.com
+Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/npcm7xx_boards.c | 24 +++++++++++++++++++-----
+ include/hw/rtc/sun4v-rtc.h | 2 +-
-file changed, 19 insertions(+), 5 deletions(-)
+ hw/rtc/sun4v-rtc.c         | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/npcm7xx_boards.c
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/hw/arm/npcm7xx_boards.c
++++ b/include/hw/rtc/sun4v-rtc.h
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/sysemu.h"
+  *
- #include "sysemu/block-backend.h"
+  * Copyright (c) 2016 Artyom Tarasenko
+  *
--#define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
--#define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
--#define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
+  * version.
--#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
+  */
--#define MORI_BMC_POWER_ON_STRAPS 0x00001fff
-+#define NPCM7XX_POWER_ON_STRAPS_DEFAULT (           \
+diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
-+        NPCM7XX_PWRON_STRAP_SPI0F18 |               \
+index XXXXXXX..XXXXXXX 100644
-+        NPCM7XX_PWRON_STRAP_SFAB |                  \
+--- a/hw/rtc/sun4v-rtc.c
-+        NPCM7XX_PWRON_STRAP_BSPA |                  \
++++ b/hw/rtc/sun4v-rtc.c
-+        NPCM7XX_PWRON_STRAP_FUP(FUP_NORM_UART2) |   \
+@@ -XXX,XX +XXX,XX @@
-+        NPCM7XX_PWRON_STRAP_SECEN |                 \
+  *
-+        NPCM7XX_PWRON_STRAP_HIZ |                   \
+  * Copyright (c) 2016 Artyom Tarasenko
-+        NPCM7XX_PWRON_STRAP_ECC |                   \
+  *
-+        NPCM7XX_PWRON_STRAP_RESERVE1 |              \
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-+        NPCM7XX_PWRON_STRAP_J2EN |                  \
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-+        NPCM7XX_PWRON_STRAP_CKFRQ(CKFRQ_DEFAULT))
+  * version.
-+
+  */
 +#define NPCM750_EVB_POWER_ON_STRAPS ( \
 +        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_J2EN)
 +#define QUANTA_GSJ_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 +#define QUANTA_GBS_POWER_ON_STRAPS ( \
 +        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_SFAB)
 +#define KUDO_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 +#define MORI_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
  static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 --
-.25.1
+.34.1

-[PULL 02/31] timer: cadence_ttc: Break out header file to allow embedding
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
+From: Thomas Huth <thuth@redhat.com>
-Break out header file to allow embedding of the the TTC.
+Move the code to a separate file so that we do not have to compile
 it anymore if CONFIG_ARM_V7M is not set.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20240308141051.536599-2-thuth@redhat.com
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20220331222017.2914409-2-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/timer/cadence_ttc.h | 54 ++++++++++++++++++++++++++++++++++
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
- hw/timer/cadence_ttc.c         | 32 ++------------------
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
-files changed, 56 insertions(+), 30 deletions(-)
+ target/arm/meson.build     |   3 +
- create mode 100644 include/hw/timer/cadence_ttc.h
+ target/arm/tcg/meson.build |   3 +
 files changed, 296 insertions(+), 261 deletions(-)
  create mode 100644 target/arm/tcg/cpu-v7m.c
-diff --git a/include/hw/timer/cadence_ttc.h b/include/hw/timer/cadence_ttc.h
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/timer/cadence_ttc.h
++++ b/target/arm/tcg/cpu-v7m.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Xilinx Zynq cadence TTC model
++ * QEMU ARMv7-M TCG-only CPUs.
 + *
-+ * Copyright (c) 2011 Xilinx Inc.
++ * Copyright (c) 2012 SUSE LINUX Products GmbH
 + * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
 + * Copyright (c) 2012 PetaLogix Pty Ltd.
 + * Written By Haibing Ma
 + *            M. Habib
 + *
-+ * This program is free software; you can redistribute it and/or
++ * This code is licensed under the GNU GPL v2 or later.
 + * modify it under the terms of the GNU General Public License
 + * as published by the Free Software Foundation; either version
 + * 2 of the License, or (at your option) any later version.
 + *
-+ * You should have received a copy of the GNU General Public License along
++ * SPDX-License-Identifier: GPL-2.0-or-later
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
-+#ifndef HW_TIMER_CADENCE_TTC_H
++
-+#define HW_TIMER_CADENCE_TTC_H
++#include "qemu/osdep.h"
-+
++#include "cpu.h"
-+#include "hw/sysbus.h"
++#include "hw/core/tcg-cpu-ops.h"
-+#include "qemu/timer.h"
++#include "internals.h"
 +
-+typedef struct {
++#if !defined(CONFIG_USER_ONLY)
-+    QEMUTimer *timer;
++
-+    int freq;
++#include "hw/intc/armv7m_nvic.h"
 +
-+    uint32_t reg_clock;
++static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-+    uint32_t reg_count;
++{
-+    uint32_t reg_value;
++    CPUClass *cc = CPU_GET_CLASS(cs);
-+    uint16_t reg_interval;
++    ARMCPU *cpu = ARM_CPU(cs);
-+    uint16_t reg_match[3];
++    CPUARMState *env = &cpu->env;
-+    uint32_t reg_intr;
++    bool ret = false;
-+    uint32_t reg_intr_en;
++
-+    uint32_t reg_event_ctrl;
++    /*
-+    uint32_t reg_event;
++     * ARMv7-M interrupt masking works differently than -A or -R.
-+
++     * There is no FIQ/IRQ distinction. Instead of I and F bits
-+    uint64_t cpu_time;
++     * masking FIQ and IRQ interrupts, an exception is taken only
-+    unsigned int cpu_time_valid;
++     * if it is higher priority than the current execution priority
-+
++     * (which depends on state like BASEPRI, FAULTMASK and the
-+    qemu_irq irq;
++     * currently active exception).
-+} CadenceTimerState;
++     */
-+
++    if (interrupt_request & CPU_INTERRUPT_HARD
-+#define TYPE_CADENCE_TTC "cadence_ttc"
++        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-+OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
++        cs->exception_index = EXCP_IRQ;
-+
++        cc->tcg_ops->do_interrupt(cs);
-+struct CadenceTTCState {
++        ret = true;
-+    SysBusDevice parent_obj;
++    }
-+
++    return ret;
-+    MemoryRegion iomem;
++}
-+    CadenceTimerState timer[3];
++
 +#endif /* !CONFIG_USER_ONLY */
 +
 +static void cortex_m0_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V6);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +
 +    cpu->midr = 0x410cc200;
 +
 +    /*
 +     * These ID register values are not guest visible, because
 +     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 +     * features, because QEMU generally controls its emulation
 +     * by looking at ID register fields. We use the same values as
 +     * for the M3.
 +     */
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m3_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    cpu->midr = 0x410fc231;
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m4_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fc240; /* r0p0 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000000;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m7_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x411fc272; /* r1p2 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00100030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02112000;
 +    cpu->isar.id_isar2 = 0x20232231;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m33_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd213; /* r0p3 */
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
 +    cpu->isar.id_dfr0 = 0x00200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00101F40;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000;
 +    cpu->ctr = 0x8000c000;
 +}
 +
 +static void cortex_m55_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd221; /* r0p1 */
 +    cpu->revidr = 0;
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    /* These are the MVFR* values for the FPU + full MVE configuration */
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12100211;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x20000030;
 +    cpu->isar.id_pfr1 = 0x00000230;
 +    cpu->isar.id_dfr0 = 0x10200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00111040;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000011;
 +    cpu->isar.id_isar0 = 0x01103110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000; /* caches not implemented */
 +    cpu->ctr = 0x8303c003;
 +}
 +
 +static const TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +    .restore_state_to_opc = arm_restore_state_to_opc,
 +
 +#ifdef CONFIG_USER_ONLY
 +    .record_sigsegv = arm_cpu_record_sigsegv,
 +    .record_sigbus = arm_cpu_record_sigbus,
 +#else
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +    .debug_check_breakpoint = arm_debug_check_breakpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
-+#endif
++static void arm_v7m_class_init(ObjectClass *oc, void *data)
-diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
++{
 +    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
 +
 +    acc->info = data;
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
 +    cc->gdb_core_xml_file = "arm-m-profile.xml";
 +}
 +
 +static const ARMCPUInfo arm_v7m_cpus[] = {
 +    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 +                             .class_init = arm_v7m_class_init },
 +};
 +
 +static void arm_v7m_cpu_register_types(void)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
 +        arm_cpu_register(&arm_v7m_cpus[i]);
 +    }
 +}
 +
 +type_init(arm_v7m_cpu_register_types)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cadence_ttc.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/hw/timer/cadence_ttc.c
++++ b/target/arm/tcg/cpu32.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu/timer.h"
+ #include "hw/boards.h"
- #include "qom/object.h"
+ #endif
+ #include "cpregs.h"
-+#include "hw/timer/cadence_ttc.h"
+-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-+
+-#include "hw/intc/armv7m_nvic.h"
- #ifdef CADENCE_TTC_ERR_DEBUG
+-#endif
- #define DB_PRINT(...) do { \
-     fprintf(stderr,  ": %s: ", __func__); \
-@@ -XXX,XX +XXX,XX @@
+ /* Share AArch32 -cpu max features with AArch64. */
- #define CLOCK_CTRL_PS_EN    0x00000001
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
- #define CLOCK_CTRL_PS_V     0x0000001e
+ /* CPU models. These are not needed for the AArch64 linux-user build. */
+ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
--typedef struct {
--    QEMUTimer *timer;
+-#if !defined(CONFIG_USER_ONLY)
--    int freq;
+-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
--
+-{
--    uint32_t reg_clock;
+-    CPUClass *cc = CPU_GET_CLASS(cs);
--    uint32_t reg_count;
+-    ARMCPU *cpu = ARM_CPU(cs);
--    uint32_t reg_value;
+-    CPUARMState *env = &cpu->env;
--    uint16_t reg_interval;
+-    bool ret = false;
--    uint16_t reg_match[3];
+-
--    uint32_t reg_intr;
+-    /*
--    uint32_t reg_intr_en;
+-     * ARMv7-M interrupt masking works differently than -A or -R.
--    uint32_t reg_event_ctrl;
+-     * There is no FIQ/IRQ distinction. Instead of I and F bits
--    uint32_t reg_event;
+-     * masking FIQ and IRQ interrupts, an exception is taken only
--
+-     * if it is higher priority than the current execution priority
--    uint64_t cpu_time;
+-     * (which depends on state like BASEPRI, FAULTMASK and the
--    unsigned int cpu_time_valid;
+-     * currently active exception).
--
+-     */
--    qemu_irq irq;
+-    if (interrupt_request & CPU_INTERRUPT_HARD
--} CadenceTimerState;
+-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
--
+-        cs->exception_index = EXCP_IRQ;
--#define TYPE_CADENCE_TTC "cadence_ttc"
+-        cc->tcg_ops->do_interrupt(cs);
--OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
+-        ret = true;
--
+-    }
--struct CadenceTTCState {
+-    return ret;
--    SysBusDevice parent_obj;
+-}
--
+-#endif /* !CONFIG_USER_ONLY */
--    MemoryRegion iomem;
+-
--    CadenceTimerState timer[3];
+ static void arm926_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
 -static void cortex_m0_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_V6);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -
 -    cpu->midr = 0x410cc200;
 -
 -    /*
 -     * These ID register values are not guest visible, because
 -     * we do not implement the Main Extension. They must be set
 -     * to values corresponding to the Cortex-M0's implemented
 -     * features, because QEMU generally controls its emulation
 -     * by looking at ID register fields. We use the same values as
 -     * for the M3.
 -     */
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m3_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    cpu->midr = 0x410fc231;
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m4_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fc240; /* r0p0 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000000;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m7_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x411fc272; /* r1p2 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00100030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02112000;
 -    cpu->isar.id_isar2 = 0x20232231;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m33_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd213; /* r0p3 */
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000210;
 -    cpu->isar.id_dfr0 = 0x00200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00101F40;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000;
 -    cpu->ctr = 0x8000c000;
 -}
 -
 -static void cortex_m55_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd221; /* r0p1 */
 -    cpu->revidr = 0;
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    /* These are the MVFR* values for the FPU + full MVE configuration */
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12100211;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x20000030;
 -    cpu->isar.id_pfr1 = 0x00000230;
 -    cpu->isar.id_dfr0 = 0x10200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00111040;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000011;
 -    cpu->isar.id_isar0 = 0x01103110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000; /* caches not implemented */
 -    cpu->ctr = 0x8303c003;
 -}
 -
  static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
      /* Dummy the TCM region regs for the moment */
      { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
 -static const TCGCPUOps arm_v7m_tcg_ops = {
 -    .initialize = arm_translate_init,
 -    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 -    .debug_excp_handler = arm_debug_excp_handler,
 -    .restore_state_to_opc = arm_restore_state_to_opc,
 -
 -#ifdef CONFIG_USER_ONLY
 -    .record_sigsegv = arm_cpu_record_sigsegv,
 -    .record_sigbus = arm_cpu_record_sigbus,
 -#else
 -    .tlb_fill = arm_cpu_tlb_fill,
 -    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 -    .do_interrupt = arm_v7m_cpu_do_interrupt,
 -    .do_transaction_failed = arm_cpu_do_transaction_failed,
 -    .do_unaligned_access = arm_cpu_do_unaligned_access,
 -    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 -    .debug_check_watchpoint = arm_debug_check_watchpoint,
 -    .debug_check_breakpoint = arm_debug_check_breakpoint,
 -#endif /* !CONFIG_USER_ONLY */
 -};
 -
- static void cadence_timer_update(CadenceTimerState *s)
+-static void arm_v7m_class_init(ObjectClass *oc, void *data)
- {
+-{
-     qemu_set_irq(s->irq, !!(s->reg_intr & s->reg_intr_en));
+-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 -    CPUClass *cc = CPU_CLASS(oc);
 -
 -    acc->info = data;
 -    cc->tcg_ops = &arm_v7m_tcg_ops;
 -    cc->gdb_core_xml_file = "arm-m-profile.xml";
 -}
 -
  #ifndef TARGET_AARCH64
  /*
   * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
      { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
      { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
      { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
 -    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 -                             .class_init = arm_v7m_class_init },
 -    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 -                             .class_init = arm_v7m_class_init },
      { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
      { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
      { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
    'ptw.c',
  ))
 +arm_user_ss = ss.source_set()
 +
  subdir('hvf')
  if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
  target_arch += {'arm': arm_ss}
  target_system_arch += {'arm': arm_system_ss}
 +target_user_arch += {'arm': arm_user_ss}
 diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/meson.build
 +++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
  arm_system_ss.add(files(
    'psci.c',
  ))
 +
 +arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
 +arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 --
-.25.1
+.34.1

-[PULL 03/31] hw/arm/xlnx-zynqmp: Connect 4 TTC timers
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Connect the 4 TTC timers on the ZynqMP.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-id: 20220331222017.2914409-3-edgar.iglesias@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/xlnx-zynqmp.h |  4 ++++
- hw/arm/xlnx-zynqmp.c         | 22 ++++++++++++++++++++++
-files changed, 26 insertions(+)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/or-irq.h"
- #include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
- #include "hw/misc/xlnx-zynqmp-crf.h"
-+#include "hw/timer/cadence_ttc.h"
- #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
- OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
-@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
- #define XLNX_ZYNQMP_MAX_RAM_SIZE (XLNX_ZYNQMP_MAX_LOW_RAM_SIZE + \
-                                   XLNX_ZYNQMP_MAX_HIGH_RAM_SIZE)
-+#define XLNX_ZYNQMP_NUM_TTC 4
-+
- /*
-  * Unimplemented mmio regions needed to boot some images.
-  */
-@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
-     qemu_or_irq qspi_irq_orgate;
-     XlnxZynqMPAPUCtrl apu_ctrl;
-     XlnxZynqMPCRF crf;
-+    CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
-     char *boot_cpu;
-     ARMCPU *boot_cpu_ptr;
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@
- #define APU_ADDR            0xfd5c0000
- #define APU_IRQ             153
-+#define TTC0_ADDR           0xFF110000
-+#define TTC0_IRQ            36
-+
- #define IPI_ADDR            0xFF300000
- #define IPI_IRQ             64
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
-     sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
- }
-+static void xlnx_zynqmp_create_ttc(XlnxZynqMPState *s, qemu_irq *gic)
-+{
-+    SysBusDevice *sbd;
-+    int i, irq;
-+
-+    for (i = 0; i < XLNX_ZYNQMP_NUM_TTC; i++) {
-+        object_initialize_child(OBJECT(s), "ttc[*]", &s->ttc[i],
-+                                TYPE_CADENCE_TTC);
-+        sbd = SYS_BUS_DEVICE(&s->ttc[i]);
-+
-+        sysbus_realize(sbd, &error_fatal);
-+        sysbus_mmio_map(sbd, 0, TTC0_ADDR + i * 0x10000);
-+        for (irq = 0; irq < 3; irq++) {
-+            sysbus_connect_irq(sbd, irq, gic[TTC0_IRQ + i * 3 + irq]);
-+        }
-+    }
-+}
-+
- static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
- {
-     static const struct UnimpInfo {
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-     xlnx_zynqmp_create_efuse(s, gic_spi);
-     xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
-     xlnx_zynqmp_create_crf(s, gic_spi);
-+    xlnx_zynqmp_create_ttc(s, gic_spi);
-     xlnx_zynqmp_create_unimp_mmio(s);
-     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
---
-.25.1

-[PULL 04/31] hw/arm: versal: Create an APU CPU Cluster
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Create an APU CPU Cluster. This is in preparation to add the RPU.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
-Message-id: 20220406174303.2022038-2-edgar.iglesias@xilinx.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/xlnx-versal.h | 2 ++
- hw/arm/xlnx-versal.c         | 9 ++++++++-
-files changed, 10 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
-+++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "hw/arm/boot.h"
-+#include "hw/cpu/cluster.h"
- #include "hw/or-irq.h"
- #include "hw/sd/sdhci.h"
- #include "hw/intc/arm_gicv3.h"
-@@ -XXX,XX +XXX,XX @@ struct Versal {
-     struct {
-         struct {
-             MemoryRegion mr;
-+            CPUClusterState cluster;
-             ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
-             GICv3State gic;
-         } apu;
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
- {
-     int i;
-+    object_initialize_child(OBJECT(s), "apu-cluster", &s->fpd.apu.cluster,
-+                            TYPE_CPU_CLUSTER);
-+    qdev_prop_set_uint32(DEVICE(&s->fpd.apu.cluster), "cluster-id", 0);
-+
-     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
-         Object *obj;
--        object_initialize_child(OBJECT(s), "apu-cpu[*]", &s->fpd.apu.cpu[i],
-+        object_initialize_child(OBJECT(&s->fpd.apu.cluster),
-+                                "apu-cpu[*]", &s->fpd.apu.cpu[i],
-                                 XLNX_VERSAL_ACPU_TYPE);
-         obj = OBJECT(&s->fpd.apu.cpu[i]);
-         if (i) {
-@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
-                                  &error_abort);
-         qdev_realize(DEVICE(obj), NULL, &error_fatal);
-     }
-+
-+    qdev_realize(DEVICE(&s->fpd.apu.cluster), NULL, &error_fatal);
- }
- static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
---
-.25.1

-[PULL 07/31] hw/arm: versal: Connect the CRL
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
-Connect the CRL (Clock Reset LPD) to the Versal SoC.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
-Reviewed-by: Frederic Konrad <fkonrad@amd.com>
-Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
-Message-id: 20220406174303.2022038-5-edgar.iglesias@xilinx.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/xlnx-versal.h |  4 +++
- hw/arm/xlnx-versal.c         | 54 ++++++++++++++++++++++++++++++++++--
-files changed, 56 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
-+++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/nvram/xlnx-versal-efuse.h"
- #include "hw/ssi/xlnx-versal-ospi.h"
- #include "hw/dma/xlnx_csu_dma.h"
-+#include "hw/misc/xlnx-versal-crl.h"
- #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
- #define TYPE_XLNX_VERSAL "xlnx-versal"
-@@ -XXX,XX +XXX,XX @@ struct Versal {
-             qemu_or_irq irq_orgate;
-             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
-         } xram;
-+
-+        XlnxVersalCRL crl;
-     } lpd;
-     /* The Platform Management Controller subsystem.  */
-@@ -XXX,XX +XXX,XX @@ struct Versal {
- #define VERSAL_TIMER_NS_EL1_IRQ     14
- #define VERSAL_TIMER_NS_EL2_IRQ     10
-+#define VERSAL_CRL_IRQ             10
- #define VERSAL_UART0_IRQ_0         18
- #define VERSAL_UART1_IRQ_0         19
- #define VERSAL_USB0_IRQ_0          22
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@ static void versal_create_ospi(Versal *s, qemu_irq *pic)
-     qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
- }
-+static void versal_create_crl(Versal *s, qemu_irq *pic)
-+{
-+    SysBusDevice *sbd;
-+    int i;
-+
-+    object_initialize_child(OBJECT(s), "crl", &s->lpd.crl,
-+                            TYPE_XLNX_VERSAL_CRL);
-+    sbd = SYS_BUS_DEVICE(&s->lpd.crl);
-+
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
-+        g_autofree gchar *name = g_strdup_printf("cpu_r5[%d]", i);
-+
-+        object_property_set_link(OBJECT(&s->lpd.crl),
-+                                 name, OBJECT(&s->lpd.rpu.cpu[i]),
-+                                 &error_abort);
-+    }
-+
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
-+        g_autofree gchar *name = g_strdup_printf("gem[%d]", i);
-+
-+        object_property_set_link(OBJECT(&s->lpd.crl),
-+                                 name, OBJECT(&s->lpd.iou.gem[i]),
-+                                 &error_abort);
-+    }
-+
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
-+        g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
-+
-+        object_property_set_link(OBJECT(&s->lpd.crl),
-+                                 name, OBJECT(&s->lpd.iou.adma[i]),
-+                                 &error_abort);
-+    }
-+
-+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
-+        g_autofree gchar *name = g_strdup_printf("uart[%d]", i);
-+
-+        object_property_set_link(OBJECT(&s->lpd.crl),
-+                                 name, OBJECT(&s->lpd.iou.uart[i]),
-+                                 &error_abort);
-+    }
-+
-+    object_property_set_link(OBJECT(&s->lpd.crl),
-+                             "usb", OBJECT(&s->lpd.iou.usb),
-+                             &error_abort);
-+
-+    sysbus_realize(sbd, &error_fatal);
-+    memory_region_add_subregion(&s->mr_ps, MM_CRL,
-+                                sysbus_mmio_get_region(sbd, 0));
-+    sysbus_connect_irq(sbd, 0, pic[VERSAL_CRL_IRQ]);
-+}
-+
- /* This takes the board allocated linear DDR memory and creates aliases
-  * for each split DDR range/aperture on the Versal address map.
-  */
-@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
-     versal_unimp_area(s, "psm", &s->mr_ps,
-                         MM_PSM_START, MM_PSM_END - MM_PSM_START);
--    versal_unimp_area(s, "crl", &s->mr_ps,
--                        MM_CRL, MM_CRL_SIZE);
-     versal_unimp_area(s, "crf", &s->mr_ps,
-                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
-     versal_unimp_area(s, "apu", &s->mr_ps,
-@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
-     versal_create_efuse(s, pic);
-     versal_create_pmc_iou_slcr(s, pic);
-     versal_create_ospi(s, pic);
-+    versal_create_crl(s, pic);
-     versal_map_ddr(s);
-     versal_unimp(s);
---
-.25.1

-[PULL 09/31] hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
+Deleted patch
-Now we have removed the only use of TYPE_EXYNOS4210_IRQ_GATE we can
-delete the device entirely.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-id: 20220404154658.565020-3-peter.maydell@linaro.org
----
- hw/intc/exynos4210_gic.c | 107 ---------------------------------------
-file changed, 107 deletions(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_register_types(void)
- }
- type_init(exynos4210_gic_register_types)
--
--/* IRQ OR Gate struct.
-- *
-- * This device models an OR gate. There are n_in input qdev gpio lines and one
-- * output sysbus IRQ line. The output IRQ level is formed as OR between all
-- * gpio inputs.
-- */
--
--#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
--OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210IRQGateState, EXYNOS4210_IRQ_GATE)
--
--struct Exynos4210IRQGateState {
--    SysBusDevice parent_obj;
--
--    uint32_t n_in;      /* inputs amount */
--    uint32_t *level;    /* input levels */
--    qemu_irq out;       /* output IRQ */
--};
--
--static Property exynos4210_irq_gate_properties[] = {
--    DEFINE_PROP_UINT32("n_in", Exynos4210IRQGateState, n_in, 1),
--    DEFINE_PROP_END_OF_LIST(),
--};
--
--static const VMStateDescription vmstate_exynos4210_irq_gate = {
--    .name = "exynos4210.irq_gate",
--    .version_id = 2,
--    .minimum_version_id = 2,
--    .fields = (VMStateField[]) {
--        VMSTATE_VBUFFER_UINT32(level, Exynos4210IRQGateState, 1, NULL, n_in),
--        VMSTATE_END_OF_LIST()
--    }
--};
--
--/* Process a change in IRQ input. */
--static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
--{
--    Exynos4210IRQGateState *s = (Exynos4210IRQGateState *)opaque;
--    uint32_t i;
--
--    assert(irq < s->n_in);
--
--    s->level[irq] = level;
--
--    for (i = 0; i < s->n_in; i++) {
--        if (s->level[i] >= 1) {
--            qemu_irq_raise(s->out);
--            return;
--        }
--    }
--
--    qemu_irq_lower(s->out);
--}
--
--static void exynos4210_irq_gate_reset(DeviceState *d)
--{
--    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
--
--    memset(s->level, 0, s->n_in * sizeof(*s->level));
--}
--
--/*
-- * IRQ Gate initialization.
-- */
--static void exynos4210_irq_gate_init(Object *obj)
--{
--    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(obj);
--    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
--
--    sysbus_init_irq(sbd, &s->out);
--}
--
--static void exynos4210_irq_gate_realize(DeviceState *dev, Error **errp)
--{
--    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
--
--    /* Allocate general purpose input signals and connect a handler to each of
--     * them */
--    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
--
--    s->level = g_malloc0(s->n_in * sizeof(*s->level));
--}
--
--static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
--{
--    DeviceClass *dc = DEVICE_CLASS(klass);
--
--    dc->reset = exynos4210_irq_gate_reset;
--    dc->vmsd = &vmstate_exynos4210_irq_gate;
--    device_class_set_props(dc, exynos4210_irq_gate_properties);
--    dc->realize = exynos4210_irq_gate_realize;
--}
--
--static const TypeInfo exynos4210_irq_gate_info = {
--    .name          = TYPE_EXYNOS4210_IRQ_GATE,
--    .parent        = TYPE_SYS_BUS_DEVICE,
--    .instance_size = sizeof(Exynos4210IRQGateState),
--    .instance_init = exynos4210_irq_gate_init,
--    .class_init    = exynos4210_irq_gate_class_init,
--};
--
--static void exynos4210_irq_gate_register_types(void)
--{
--    type_register_static(&exynos4210_irq_gate_info);
--}
--
--type_init(exynos4210_irq_gate_register_types)
---
-.25.1

-[PULL 10/31] hw/arm/exynos4210: Put a9mpcore device into state struct
+Deleted patch
-The exynos4210 SoC mostly creates its child devices as if it were
-board code.  This includes the a9mpcore object.  Switch that to a
-new-style "embedded in the state struct" creation, because in the
-next commit we're going to want to refer to the object again further
-down in the exynos4210_realize() function.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-4-peter.maydell@linaro.org
----
- include/hw/arm/exynos4210.h |  2 ++
- hw/arm/exynos4210.c         | 11 ++++++-----
-files changed, 8 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/or-irq.h"
- #include "hw/sysbus.h"
-+#include "hw/cpu/a9mpcore.h"
- #include "target/arm/cpu-qom.h"
- #include "qom/object.h"
-@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
-     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
-     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
-     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
-+    A9MPPrivState a9mpcore;
- };
- #define TYPE_EXYNOS4210_SOC "exynos4210"
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-     }
-     /* Private memory region and Internal GIC */
--    dev = qdev_new(TYPE_A9MPCORE_PRIV);
--    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
--    busdev = SYS_BUS_DEVICE(dev);
--    sysbus_realize_and_unref(busdev, &error_fatal);
-+    qdev_prop_set_uint32(DEVICE(&s->a9mpcore), "num-cpu", EXYNOS4210_NCPUS);
-+    busdev = SYS_BUS_DEVICE(&s->a9mpcore);
-+    sysbus_realize(busdev, &error_fatal);
-     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
-     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-         sysbus_connect_irq(busdev, n,
-                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
-     }
-     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
--        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
-+        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
-     }
-     /* Cache controller */
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
-         g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
-         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
-     }
-+
-+    object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
- }
- static void exynos4210_class_init(ObjectClass *klass, void *data)
---
-.25.1

-[PULL 11/31] hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
+Deleted patch
-The only time we use the int_gic_irq[] array in the Exynos4210Irq
-struct is in the exynos4210_realize() function: we initialize it with
-the GPIO inputs of the a9mpcore device, and then a bit later on we
-connect those to the outputs of the internal combiner.  Now that the
-a9mpcore object is easily accessible as s->a9mpcore we can make the
-connection directly from one device to the other without going via
-this array.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-5-peter.maydell@linaro.org
----
- include/hw/arm/exynos4210.h | 1 -
- hw/arm/exynos4210.c         | 6 ++----
-files changed, 2 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@
- typedef struct Exynos4210Irq {
-     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
-     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
--    qemu_irq int_gic_irq[EXYNOS4210_INT_GIC_NIRQ];
-     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
-     qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
- } Exynos4210Irq;
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-         sysbus_connect_irq(busdev, n,
-                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
-     }
--    for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
--        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
--    }
-     /* Cache controller */
-     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-     busdev = SYS_BUS_DEVICE(dev);
-     sysbus_realize_and_unref(busdev, &error_fatal);
-     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
--        sysbus_connect_irq(busdev, n, s->irqs.int_gic_irq[n]);
-+        sysbus_connect_irq(busdev, n,
-+                           qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
-     }
-     exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
-     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
---
-.25.1

-[PULL 13/31] hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
+Deleted patch
-Fix a missing set of spaces around '-' in the definition of
-combiner_grp_to_gic_id[]. We're about to move this code, so
-fix the style issue first to keep checkpatch happy with the
-code-motion patch.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-7-peter.maydell@linaro.org
----
- hw/intc/exynos4210_gic.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/exynos4210_gic.c
-+++ b/hw/intc/exynos4210_gic.c
-@@ -XXX,XX +XXX,XX @@ enum ExtInt {
-  */
- static const uint32_t
--combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-+combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-     /* int combiner groups 16-19 */
-     { }, { }, { }, { },
-     /* int combiner group 20 */
---
-.25.1

-[PULL 16/31] hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
+Deleted patch
-The only time we use the ext_gic_irq[] array in the Exynos4210Irq
-struct is during realize of the SoC -- we initialize it with the
-input IRQs of the external GIC device, and then connect those to
-outputs of other devices further on in realize (including in the
-exynos4210_init_board_irqs() function).  Now that the ext_gic object
-is easily accessible as s->ext_gic we can make the connections
-directly from one device to the other without going via this array.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-10-peter.maydell@linaro.org
----
- include/hw/arm/exynos4210.h |  1 -
- hw/arm/exynos4210.c         | 12 ++++++------
-files changed, 6 insertions(+), 7 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@
- typedef struct Exynos4210Irq {
-     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
-     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
--    qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
- } Exynos4210Irq;
- struct Exynos4210State {
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
- {
-     uint32_t grp, bit, irq_id, n;
-     Exynos4210Irq *is = &s->irqs;
-+    DeviceState *extgicdev = DEVICE(&s->ext_gic);
-     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
-         irq_id = 0;
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
-         }
-         if (irq_id) {
-             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
--                    is->ext_gic_irq[irq_id - 32]);
-+                                             qdev_get_gpio_in(extgicdev,
-+                                                              irq_id - 32));
-         } else {
-             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                     is->ext_combiner_irq[n]);
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
-         if (irq_id) {
-             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
--                    is->ext_gic_irq[irq_id - 32]);
-+                                             qdev_get_gpio_in(extgicdev,
-+                                                              irq_id - 32));
-         }
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-         sysbus_connect_irq(busdev, n,
-                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
-     }
--    for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
--        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
--    }
-     /* Internal Interrupt Combiner */
-     dev = qdev_new("exynos4210.combiner");
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
-     busdev = SYS_BUS_DEVICE(dev);
-     sysbus_realize_and_unref(busdev, &error_fatal);
-     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
--        sysbus_connect_irq(busdev, n, s->irqs.ext_gic_irq[n]);
-+        sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
-     }
-     exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
-     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
---
-.25.1

-[PULL 18/31] hw/arm/exynos4210: Delete unused macro definitions
+Deleted patch
-Delete a couple of #defines which are never used.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-12-peter.maydell@linaro.org
----
- include/hw/arm/exynos4210.h | 4 ----
-file changed, 4 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
-+++ b/include/hw/arm/exynos4210.h
-@@ -XXX,XX +XXX,XX @@
- #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
-     (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
--/* IRQs number for external and internal GIC */
--#define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
--#define EXYNOS4210_INT_GIC_NIRQ     64
--
- #define EXYNOS4210_I2C_NUMBER               9
- #define EXYNOS4210_NUM_DMA      3
---
-.25.1

-[PULL 20/31] hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
+Deleted patch
-In exynos4210_init_board_irqs(), the loop that handles IRQ lines that
-are in a range that applies to the internal combiner only creates a
-splitter for those interrupts which go to both the internal combiner
-and to the external GIC, but it does nothing at all for the
-interrupts which don't go to the external GIC, leaving the
-irq_table[] array element empty for those.  (This will result in
-those interrupts simply being lost, not in a QEMU crash.)
-I don't have a reliable datasheet for this SoC, but since we do wire
-up one interrupt line in this category (the HDMI I2C device on
-interrupt 16,1), this seems like it must be a bug in the existing
-QEMU code.  Fill in the irq_table[] entries where we're not splitting
-the IRQ to both the internal combiner and the external GIC with the
-IRQ line of the internal combiner.  (That is, these IRQ lines go to
-just one device, not multiple.)
-This bug didn't have any visible guest effects because the only
-implemented device that was affected was the HDMI I2C controller,
-and we never connect any I2C devices to that bus.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-14-peter.maydell@linaro.org
----
- hw/arm/exynos4210.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
-             qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
-             qdev_connect_gpio_out(splitter, 1,
-                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
-+        } else {
-+            s->irq_table[n] = is->int_combiner_irq[n];
-         }
-     }
-     /*
---
-.25.1

-[PULL 21/31] hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
+Deleted patch
-Currently for the interrupts MCT_G0 and MCT_G1 which are
-the only ones in the input range of the external combiner
-and which are also wired to the external GIC, we connect
-them only to the internal combiner and the external GIC.
-This seems likely to be a bug, as all other interrupts
-which are in the input range of both combiners are
-connected to both combiners. (The fact that the code in
-exynos4210_combiner_get_gpioin() is also trying to wire
-up these inputs on both combiners also suggests this.)
-Wire these interrupts up to both combiners, like the rest.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220404154658.565020-15-peter.maydell@linaro.org
----
- hw/arm/exynos4210.c | 7 +++----
-file changed, 3 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
-+++ b/hw/arm/exynos4210.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
-         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
-         splitter = DEVICE(&s->splitter[splitcount]);
--        qdev_prop_set_uint16(splitter, "num-lines", 2);
-+        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
-         qdev_realize(splitter, NULL, &error_abort);
-         splitcount++;
-         s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
-         qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
-+        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
-         if (irq_id) {
--            qdev_connect_gpio_out(splitter, 1,
-+            qdev_connect_gpio_out(splitter, 2,
-                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
--        } else {
--            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
-         }
-     }
-     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
---
-.25.1

-[PULL 26/31] hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
+Deleted patch
-From: Zongyuan Li <zongyuan.li@smartx.com>
-Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20220324181557.203805-2-zongyuan.li@smartx.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/realview.c | 33 ++++++++++++++++++++++++---------
-file changed, 24 insertions(+), 9 deletions(-)
-diff --git a/hw/arm/realview.c b/hw/arm/realview.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/realview.c
-+++ b/hw/arm/realview.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/sysbus.h"
- #include "hw/arm/boot.h"
- #include "hw/arm/primecell.h"
-+#include "hw/core/split-irq.h"
- #include "hw/net/lan9118.h"
- #include "hw/net/smc91c111.h"
- #include "hw/pci/pci.h"
-+#include "hw/qdev-core.h"
- #include "net/net.h"
- #include "sysemu/sysemu.h"
- #include "hw/boards.h"
-@@ -XXX,XX +XXX,XX @@ static const int realview_board_id[] = {
-x76d
- };
-+static void split_irq_from_named(DeviceState *src, const char* outname,
-+                                 qemu_irq out1, qemu_irq out2) {
-+    DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
-+
-+    qdev_prop_set_uint32(splitter, "num-lines", 2);
-+
-+    qdev_realize_and_unref(splitter, NULL, &error_fatal);
-+
-+    qdev_connect_gpio_out(splitter, 0, out1);
-+    qdev_connect_gpio_out(splitter, 1, out2);
-+    qdev_connect_gpio_out_named(src, outname, 0,
-+                                qdev_get_gpio_in(splitter, 0));
-+}
-+
- static void realview_init(MachineState *machine,
-                           enum realview_board_type board_type)
- {
-@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
-     DeviceState *dev, *sysctl, *gpio2, *pl041;
-     SysBusDevice *busdev;
-     qemu_irq pic[64];
--    qemu_irq mmc_irq[2];
-     PCIBus *pci_bus = NULL;
-     NICInfo *nd;
-     DriveInfo *dinfo;
-@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
-      * and the PL061 has them the other way about. Also the card
-      * detect line is inverted.
-      */
--    mmc_irq[0] = qemu_irq_split(
--        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
--        qdev_get_gpio_in(gpio2, 1));
--    mmc_irq[1] = qemu_irq_split(
--        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
--        qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
--    qdev_connect_gpio_out_named(dev, "card-read-only", 0, mmc_irq[0]);
--    qdev_connect_gpio_out_named(dev, "card-inserted", 0, mmc_irq[1]);
-+    split_irq_from_named(dev, "card-read-only",
-+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
-+                   qdev_get_gpio_in(gpio2, 1));
-+
-+    split_irq_from_named(dev, "card-inserted",
-+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
-+                   qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
-+
-     dinfo = drive_get(IF_SD, 0, 0);
-     if (dinfo) {
-         DeviceState *card;
---
-.25.1

-[PULL 27/31] hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
+Deleted patch
-From: Zongyuan Li <zongyuan.li@smartx.com>
-Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20220324181557.203805-3-zongyuan.li@smartx.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/stellaris.c | 15 +++++++++++++--
-file changed, 13 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stellaris.c
-+++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/osdep.h"
- #include "qapi/error.h"
-+#include "hw/core/split-irq.h"
- #include "hw/sysbus.h"
- #include "hw/sd/sd.h"
- #include "hw/ssi/ssi.h"
-@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-             DeviceState *ssddev;
-             DriveInfo *dinfo;
-             DeviceState *carddev;
-+            DeviceState *gpio_d_splitter;
-             BlockBackend *blk;
-             /*
-@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-                                    &error_fatal);
-             ssddev = ssi_create_peripheral(bus, "ssd0323");
--            gpio_out[GPIO_D][0] = qemu_irq_split(
--                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
-+
-+            gpio_d_splitter = qdev_new(TYPE_SPLIT_IRQ);
-+            qdev_prop_set_uint32(gpio_d_splitter, "num-lines", 2);
-+            qdev_realize_and_unref(gpio_d_splitter, NULL, &error_fatal);
-+            qdev_connect_gpio_out(
-+                    gpio_d_splitter, 0,
-+                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0));
-+            qdev_connect_gpio_out(
-+                    gpio_d_splitter, 1,
-                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
-+            gpio_out[GPIO_D][0] = qdev_get_gpio_in(gpio_d_splitter, 0);
-+
-             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
-             /* Make sure the select pin is high.  */
---
-.25.1

-[PULL 28/31] hw/core/irq: remove unused 'qemu_irq_split' function
+Deleted patch
-From: Zongyuan Li <zongyuan.li@smartx.com>
-Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20220324181557.203805-5-zongyuan.li@smartx.com
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/811
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/irq.h |  5 -----
- hw/core/irq.c    | 15 ---------------
-files changed, 20 deletions(-)
-diff --git a/include/hw/irq.h b/include/hw/irq.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/irq.h
-+++ b/include/hw/irq.h
-@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
- /* Returns a new IRQ with opposite polarity.  */
- qemu_irq qemu_irq_invert(qemu_irq irq);
--/* Returns a new IRQ which feeds into both the passed IRQs.
-- * It's probably better to use the TYPE_SPLIT_IRQ device instead.
-- */
--qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
--
- /* For internal use in qtest.  Similar to qemu_irq_split, but operating
-    on an existing vector of qemu_irq.  */
- void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
-diff --git a/hw/core/irq.c b/hw/core/irq.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/irq.c
-+++ b/hw/core/irq.c
-@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_invert(qemu_irq irq)
-     return qemu_allocate_irq(qemu_notirq, irq, 0);
- }
--static void qemu_splitirq(void *opaque, int line, int level)
--{
--    struct IRQState **irq = opaque;
--    irq[0]->handler(irq[0]->opaque, irq[0]->n, level);
--    irq[1]->handler(irq[1]->opaque, irq[1]->n, level);
--}
--
--qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
--{
--    qemu_irq *s = g_new0(qemu_irq, 2);
--    s[0] = irq1;
--    s[1] = irq2;
--    return qemu_allocate_irq(qemu_splitirq, s, 0);
--}
--
- void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
- {
-     int i;
---
-.25.1

-[PULL 29/31] hw/arm/virt: impact of gic-version on max CPUs
+Deleted patch
-From: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Describe that the gic-version influences the maximum number of CPUs.
-Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
-Message-id: 20220413231456.35811-1-heinrich.schuchardt@canonical.com
-[PMM: minor punctuation tweaks]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/virt.rst | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/virt.rst
-+++ b/docs/system/arm/virt.rst
-@@ -XXX,XX +XXX,XX @@ gic-version
-   Valid values are:
-   ``2``
--    GICv2
-+    GICv2. Note that this limits the number of CPUs to 8.
-   ``3``
--    GICv3
-+    GICv3. This allows up to 512 CPUs.
-   ``host``
-     Use the same GIC version the host provides, when using KVM
-   ``max``
---
-.25.1

-[PULL 30/31] hw/misc: Add PWRON STRAP bit fields in GCR module
+Deleted patch
-From: Hao Wu <wuhaotsh@google.com>
-Similar to the Aspeed code in include/misc/aspeed_scu.h, we define
-the PWRON STRAP fields in their corresponding module for NPCM7XX.
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
-Reviewed-by: Patrick Venture <venture@google.com>
-Message-id: 20220411165842.3912945-2-wuhaotsh@google.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/misc/npcm7xx_gcr.h | 30 ++++++++++++++++++++++++++++++
-file changed, 30 insertions(+)
-diff --git a/include/hw/misc/npcm7xx_gcr.h b/include/hw/misc/npcm7xx_gcr.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/npcm7xx_gcr.h
-+++ b/include/hw/misc/npcm7xx_gcr.h
-@@ -XXX,XX +XXX,XX @@
- #include "exec/memory.h"
- #include "hw/sysbus.h"
-+/*
-+ * NPCM7XX PWRON STRAP bit fields
-+ * 12: SPI0 powered by VSBV3 at 1.8V
-+ * 11: System flash attached to BMC
-+ * 10: BSP alternative pins.
-+ * 9:8: Flash UART command route enabled.
-+ * 7: Security enabled.
-+ * 6: HI-Z state control.
-+ * 5: ECC disabled.
-+ * 4: Reserved
-+ * 3: JTAG2 enabled.
-+ * 2:0: CPU and DRAM clock frequency.
-+ */
-+#define NPCM7XX_PWRON_STRAP_SPI0F18                 BIT(12)
-+#define NPCM7XX_PWRON_STRAP_SFAB                    BIT(11)
-+#define NPCM7XX_PWRON_STRAP_BSPA                    BIT(10)
-+#define NPCM7XX_PWRON_STRAP_FUP(x)                  ((x) << 8)
-+#define     FUP_NORM_UART2      3
-+#define     FUP_PROG_UART3      2
-+#define     FUP_PROG_UART2      1
-+#define     FUP_NORM_UART3      0
-+#define NPCM7XX_PWRON_STRAP_SECEN                   BIT(7)
-+#define NPCM7XX_PWRON_STRAP_HIZ                     BIT(6)
-+#define NPCM7XX_PWRON_STRAP_ECC                     BIT(5)
-+#define NPCM7XX_PWRON_STRAP_RESERVE1                BIT(4)
-+#define NPCM7XX_PWRON_STRAP_J2EN                    BIT(3)
-+#define NPCM7XX_PWRON_STRAP_CKFRQ(x)                (x)
-+#define     CKFRQ_SKIPINIT      0x000
-+#define     CKFRQ_DEFAULT       0x111
-+
- /*
-  * Number of registers in our device state structure. Don't change this without
-  * incrementing the version_id in the vmstate.
---
-.25.1

First arm pullreq for 7.1. The bulk of this is the qemu_split_irq
removal.

I have enough stuff in my to-review queue that I expect to do another
pullreq early next week, but 31 patches is enough to not hang on to.

thanks
-- PMM

The following changes since commit 9c125d17e9402c232c46610802e5931b3639d77b:

Merge tag 'pull-tcg-20220420' of https://gitlab.com/rth7680/qemu into staging (2022-04-20 16:43:11 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220421

for you to fetch changes up to 5b415dd61bdbf61fb4be0e9f1a7172b8bce682c6:

hw/arm: Use bit fields for NPCM7XX PWRON STRAPs (2022-04-21 11:37:05 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
 * versal: Add the Cortex-R5s in the Real-Time Processing Unit (RPU) subsystem
 * versal: model enough of the Clock/Reset Low-power domain (CRL) to allow control of the Cortex-R5s
 * xlnx-zynqmp: Connect 4 TTC timers
 * exynos4210: Refactor GIC/combiner code to stop using qemu_split_irq
 * realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
 * stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
 * hw/core/irq: remove unused 'qemu_irq_split' function
 * npcm7xx: use symbolic constants for PWRON STRAP bit fields
 * virt: document impact of gic-version on max CPUs

----------------------------------------------------------------
Edgar E. Iglesias (6):
      timer: cadence_ttc: Break out header file to allow embedding
      hw/arm/xlnx-zynqmp: Connect 4 TTC timers
      hw/arm: versal: Create an APU CPU Cluster
      hw/arm: versal: Add the Cortex-R5Fs
      hw/misc: Add a model of the Xilinx Versal CRL
      hw/arm: versal: Connect the CRL

Hao Wu (2):
      hw/misc: Add PWRON STRAP bit fields in GCR module
      hw/arm: Use bit fields for NPCM7XX PWRON STRAPs

Heinrich Schuchardt (1):
      hw/arm/virt: impact of gic-version on max CPUs

Peter Maydell (19):
      hw/arm/virt: Check for attempt to use TrustZone with KVM or HVF
      hw/arm/exynos4210: Use TYPE_OR_IRQ instead of custom OR-gate device
      hw/intc/exynos4210_gic: Remove unused TYPE_EXYNOS4210_IRQ_GATE
      hw/arm/exynos4210: Put a9mpcore device into state struct
      hw/arm/exynos4210: Drop int_gic_irq[] from Exynos4210Irq struct
      hw/arm/exynos4210: Coalesce board_irqs and irq_table
      hw/arm/exynos4210: Fix code style nit in combiner_grp_to_gic_id[]
      hw/arm/exynos4210: Move exynos4210_init_board_irqs() into exynos4210.c
      hw/arm/exynos4210: Put external GIC into state struct
      hw/arm/exynos4210: Drop ext_gic_irq[] from Exynos4210Irq struct
      hw/arm/exynos4210: Move exynos4210_combiner_get_gpioin() into exynos4210.c
      hw/arm/exynos4210: Delete unused macro definitions
      hw/arm/exynos4210: Use TYPE_SPLIT_IRQ in exynos4210_init_board_irqs()
      hw/arm/exynos4210: Fill in irq_table[] for internal-combiner-only IRQ lines
      hw/arm/exynos4210: Connect MCT_G0 and MCT_G1 to both combiners
      hw/arm/exynos4210: Don't connect multiple lines to external GIC inputs
      hw/arm/exynos4210: Fold combiner splits into exynos4210_init_board_irqs()
      hw/arm/exynos4210: Put combiners into state struct
      hw/arm/exynos4210: Drop Exynos4210Irq struct

Zongyuan Li (3):
      hw/arm/realview: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
      hw/arm/stellaris: replace 'qemu_split_irq' with 'TYPE_SPLIT_IRQ'
      hw/core/irq: remove unused 'qemu_irq_split' function

docs/system/arm/virt.rst              |   4 +-
 include/hw/arm/exynos4210.h           |  50 ++--
 include/hw/arm/xlnx-versal.h          |  16 ++
 include/hw/arm/xlnx-zynqmp.h          |   4 +
 include/hw/intc/exynos4210_combiner.h |  57 +++++
 include/hw/intc/exynos4210_gic.h      |  43 ++++
 include/hw/irq.h                      |   5 -
 include/hw/misc/npcm7xx_gcr.h         |  30 +++
 include/hw/misc/xlnx-versal-crl.h     | 235 +++++++++++++++++++
 include/hw/timer/cadence_ttc.h        |  54 +++++
 hw/arm/exynos4210.c                   | 430 ++++++++++++++++++++++++++++++----
 hw/arm/npcm7xx_boards.c               |  24 +-
 hw/arm/realview.c                     |  33 ++-
 hw/arm/stellaris.c                    |  15 +-
 hw/arm/virt.c                         |   7 +
 hw/arm/xlnx-versal-virt.c             |   6 +-
 hw/arm/xlnx-versal.c                  |  99 +++++++-
 hw/arm/xlnx-zynqmp.c                  |  22 ++
 hw/core/irq.c                         |  15 --
 hw/intc/exynos4210_combiner.c         | 108 +--------
 hw/intc/exynos4210_gic.c              | 344 +--------------------------
 hw/misc/xlnx-versal-crl.c             | 421 +++++++++++++++++++++++++++++++++
 hw/timer/cadence_ttc.c                |  32 +--
 MAINTAINERS                           |   2 +-
 hw/misc/meson.build                   |   1 +
 25 files changed, 1457 insertions(+), 600 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_combiner.h
 create mode 100644 include/hw/intc/exynos4210_gic.h
 create mode 100644 include/hw/misc/xlnx-versal-crl.h
 create mode 100644 include/hw/timer/cadence_ttc.h
 create mode 100644 hw/misc/xlnx-versal-crl.c

It's not possible to provide the guest with the Security extensions
(TrustZone) when using KVM or HVF, because the hardware
virtualization extensions don't permit running EL3 guest code.
However, we weren't checking for this combination, with the result
that QEMU would assert if you tried it:

$ qemu-system-aarch64 -enable-kvm -machine virt,secure=on -cpu host -display none
Unexpected error in object_property_find_err() at ../../qom/object.c:1304:
qemu-system-aarch64: Property 'host-arm-cpu.secure-memory' not found
Aborted

Check for this combination of options and report an error, in the
same way we already do for attempts to give a KVM or HVF guest the
Virtualization or MTE extensions. Now we will report:

qemu-system-aarch64: mach-virt: KVM does not support providing Security extensions (TrustZone) to the guest CPU

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/961
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404155301.566542-1-peter.maydell@linaro.org
---
 hw/arm/virt.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
+    if (vms->secure && (kvm_enabled() || hvf_enabled())) {
+        error_report("mach-virt: %s does not support providing "
+                     "Security extensions (TrustZone) to the guest CPU",
+                     kvm_enabled() ? "KVM" : "HVF");
+        exit(1);
+    }
+
     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
         error_report("mach-virt: %s does not support providing "
                      "Virtualization extensions to the guest CPU",
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Break out header file to allow embedding of the the TTC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220331222017.2914409-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/timer/cadence_ttc.h | 54 ++++++++++++++++++++++++++++++++++
 hw/timer/cadence_ttc.c         | 32 ++------------------
 2 files changed, 56 insertions(+), 30 deletions(-)
 create mode 100644 include/hw/timer/cadence_ttc.h

diff --git a/include/hw/timer/cadence_ttc.h b/include/hw/timer/cadence_ttc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/timer/cadence_ttc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Xilinx Zynq cadence TTC model
+ *
+ * Copyright (c) 2011 Xilinx Inc.
+ * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
+ * Copyright (c) 2012 PetaLogix Pty Ltd.
+ * Written By Haibing Ma
+ *            M. Habib
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef HW_TIMER_CADENCE_TTC_H
+#define HW_TIMER_CADENCE_TTC_H
+
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+
+typedef struct {
+    QEMUTimer *timer;
+    int freq;
+
+    uint32_t reg_clock;
+    uint32_t reg_count;
+    uint32_t reg_value;
+    uint16_t reg_interval;
+    uint16_t reg_match[3];
+    uint32_t reg_intr;
+    uint32_t reg_intr_en;
+    uint32_t reg_event_ctrl;
+    uint32_t reg_event;
+
+    uint64_t cpu_time;
+    unsigned int cpu_time_valid;
+
+    qemu_irq irq;
+} CadenceTimerState;
+
+#define TYPE_CADENCE_TTC "cadence_ttc"
+OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
+
+struct CadenceTTCState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    CadenceTimerState timer[3];
+};
+
+#endif
diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cadence_ttc.c
+++ b/hw/timer/cadence_ttc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qom/object.h"
 
+#include "hw/timer/cadence_ttc.h"
+
 #ifdef CADENCE_TTC_ERR_DEBUG
 #define DB_PRINT(...) do { \
     fprintf(stderr,  ": %s: ", __func__); \
@@ -XXX,XX +XXX,XX @@
 #define CLOCK_CTRL_PS_EN    0x00000001
 #define CLOCK_CTRL_PS_V     0x0000001e
 
-typedef struct {
-    QEMUTimer *timer;
-    int freq;
-
-    uint32_t reg_clock;
-    uint32_t reg_count;
-    uint32_t reg_value;
-    uint16_t reg_interval;
-    uint16_t reg_match[3];
-    uint32_t reg_intr;
-    uint32_t reg_intr_en;
-    uint32_t reg_event_ctrl;
-    uint32_t reg_event;
-
-    uint64_t cpu_time;
-    unsigned int cpu_time_valid;
-
-    qemu_irq irq;
-} CadenceTimerState;
-
-#define TYPE_CADENCE_TTC "cadence_ttc"
-OBJECT_DECLARE_SIMPLE_TYPE(CadenceTTCState, CADENCE_TTC)
-
-struct CadenceTTCState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion iomem;
-    CadenceTimerState timer[3];
-};
-
 static void cadence_timer_update(CadenceTimerState *s)
 {
     qemu_set_irq(s->irq, !!(s->reg_intr & s->reg_intr_en));
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Connect the 4 TTC timers on the ZynqMP.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220331222017.2914409-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  4 ++++
 hw/arm/xlnx-zynqmp.c         | 22 ++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/or-irq.h"
 #include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
 #include "hw/misc/xlnx-zynqmp-crf.h"
+#include "hw/timer/cadence_ttc.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 #define XLNX_ZYNQMP_MAX_RAM_SIZE (XLNX_ZYNQMP_MAX_LOW_RAM_SIZE + \
                                   XLNX_ZYNQMP_MAX_HIGH_RAM_SIZE)
 
+#define XLNX_ZYNQMP_NUM_TTC 4
+
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     qemu_or_irq qspi_irq_orgate;
     XlnxZynqMPAPUCtrl apu_ctrl;
     XlnxZynqMPCRF crf;
+    CadenceTTCState ttc[XLNX_ZYNQMP_NUM_TTC];
 
     char *boot_cpu;
     ARMCPU *boot_cpu_ptr;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define APU_ADDR            0xfd5c0000
 #define APU_IRQ             153
 
+#define TTC0_ADDR           0xFF110000
+#define TTC0_IRQ            36
+
 #define IPI_ADDR            0xFF300000
 #define IPI_IRQ             64
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
 }
 
+static void xlnx_zynqmp_create_ttc(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+    int i, irq;
+
+    for (i = 0; i < XLNX_ZYNQMP_NUM_TTC; i++) {
+        object_initialize_child(OBJECT(s), "ttc[*]", &s->ttc[i],
+                                TYPE_CADENCE_TTC);
+        sbd = SYS_BUS_DEVICE(&s->ttc[i]);
+
+        sysbus_realize(sbd, &error_fatal);
+        sysbus_mmio_map(sbd, 0, TTC0_ADDR + i * 0x10000);
+        for (irq = 0; irq < 3; irq++) {
+            sysbus_connect_irq(sbd, irq, gic[TTC0_IRQ + i * 3 + irq]);
+        }
+    }
+}
+
 static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
 {
     static const struct UnimpInfo {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     xlnx_zynqmp_create_efuse(s, gic_spi);
     xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
     xlnx_zynqmp_create_crf(s, gic_spi);
+    xlnx_zynqmp_create_ttc(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Create an APU CPU Cluster. This is in preparation to add the RPU.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-2-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 2 ++
 hw/arm/xlnx-versal.c         | 9 ++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/cpu/cluster.h"
 #include "hw/or-irq.h"
 #include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
@@ -XXX,XX +XXX,XX @@ struct Versal {
     struct {
         struct {
             MemoryRegion mr;
+            CPUClusterState cluster;
             ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
             GICv3State gic;
         } apu;
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
 {
     int i;
 
+    object_initialize_child(OBJECT(s), "apu-cluster", &s->fpd.apu.cluster,
+                            TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->fpd.apu.cluster), "cluster-id", 0);
+
     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
         Object *obj;
 
-        object_initialize_child(OBJECT(s), "apu-cpu[*]", &s->fpd.apu.cpu[i],
+        object_initialize_child(OBJECT(&s->fpd.apu.cluster),
+                                "apu-cpu[*]", &s->fpd.apu.cpu[i],
                                 XLNX_VERSAL_ACPU_TYPE);
         obj = OBJECT(&s->fpd.apu.cpu[i]);
         if (i) {
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
                                  &error_abort);
         qdev_realize(DEVICE(obj), NULL, &error_fatal);
     }
+
+    qdev_realize(DEVICE(&s->fpd.apu.cluster), NULL, &error_fatal);
 }
 
 static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Add the Cortex-R5Fs of the Versal RPU (Real-time Processing Unit)
subsystem.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-3-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 10 ++++++++++
 hw/arm/xlnx-versal-virt.c    |  6 +++---
 hw/arm/xlnx-versal.c         | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
 
 #define XLNX_VERSAL_NR_ACPUS   2
+#define XLNX_VERSAL_NR_RCPUS   2
 #define XLNX_VERSAL_NR_UARTS   2
 #define XLNX_VERSAL_NR_GEMS    2
 #define XLNX_VERSAL_NR_ADMAS   8
@@ -XXX,XX +XXX,XX @@ struct Versal {
             VersalUsb2 usb;
         } iou;
 
+        /* Real-time Processing Unit.  */
+        struct {
+            MemoryRegion mr;
+            MemoryRegion mr_ps_alias;
+
+            CPUClusterState cluster;
+            ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
+        } rpu;
+
         struct {
             qemu_or_irq irq_orgate;
             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void versal_virt_machine_class_init(ObjectClass *oc, void *data)
 
     mc->desc = "Xilinx Versal Virtual development board";
     mc->init = versal_virt_init;
-    mc->min_cpus = XLNX_VERSAL_NR_ACPUS;
-    mc->max_cpus = XLNX_VERSAL_NR_ACPUS;
-    mc->default_cpus = XLNX_VERSAL_NR_ACPUS;
+    mc->min_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+    mc->max_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+    mc->default_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
     mc->no_cdrom = true;
     mc->default_ram_id = "ddr";
 }
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+#define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
 #define GEM_REVISION        0x40070106
 
 #define VERSAL_NUM_PMC_APB_IRQS 3
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
     }
 }
 
+static void versal_create_rpu_cpus(Versal *s)
+{
+    int i;
+
+    object_initialize_child(OBJECT(s), "rpu-cluster", &s->lpd.rpu.cluster,
+                            TYPE_CPU_CLUSTER);
+    qdev_prop_set_uint32(DEVICE(&s->lpd.rpu.cluster), "cluster-id", 1);
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
+        Object *obj;
+
+        object_initialize_child(OBJECT(&s->lpd.rpu.cluster),
+                                "rpu-cpu[*]", &s->lpd.rpu.cpu[i],
+                                XLNX_VERSAL_RCPU_TYPE);
+        obj = OBJECT(&s->lpd.rpu.cpu[i]);
+        object_property_set_bool(obj, "start-powered-off", true,
+                                 &error_abort);
+
+        object_property_set_int(obj, "mp-affinity", 0x100 | i, &error_abort);
+        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->lpd.rpu.cpu),
+                                &error_abort);
+        object_property_set_link(obj, "memory", OBJECT(&s->lpd.rpu.mr),
+                                 &error_abort);
+        qdev_realize(DEVICE(obj), NULL, &error_fatal);
+    }
+
+    qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
+}
+
 static void versal_create_uarts(Versal *s, qemu_irq *pic)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     versal_create_apu_cpus(s);
     versal_create_apu_gic(s, pic);
+    versal_create_rpu_cpus(s);
     versal_create_uarts(s, pic);
     versal_create_usbs(s, pic);
     versal_create_gems(s, pic);
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
     memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
+    memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
+                                        &s->lpd.rpu.mr_ps_alias, 0);
 }
 
 static void versal_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void versal_init(Object *obj)
     Versal *s = XLNX_VERSAL(obj);
 
     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
+    memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
+    memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
+                             "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
 }
 
 static Property versal_properties[] = {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Add a model of the Xilinx Versal CRL.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-4-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-versal-crl.h | 235 +++++++++++++++++
 hw/misc/xlnx-versal-crl.c         | 421 ++++++++++++++++++++++++++++++
 hw/misc/meson.build               |   1 +
 3 files changed, 657 insertions(+)
 create mode 100644 include/hw/misc/xlnx-versal-crl.h
 create mode 100644 hw/misc/xlnx-versal-crl.c

diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Clock-Reset-LPD (CRL).
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+#ifndef HW_MISC_XLNX_VERSAL_CRL_H
+#define HW_MISC_XLNX_VERSAL_CRL_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "target/arm/cpu.h"
+
+#define TYPE_XLNX_VERSAL_CRL "xlnx,versal-crl"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
+
+REG32(ERR_CTRL, 0x0)
+    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
+REG32(IR_STATUS, 0x4)
+    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_MASK, 0x8)
+    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_ENABLE, 0xc)
+    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_DISABLE, 0x10)
+    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(WPROT, 0x1c)
+    FIELD(WPROT, ACTIVE, 0, 1)
+REG32(PLL_CLK_OTHER_DMN, 0x20)
+    FIELD(PLL_CLK_OTHER_DMN, APLL_BYPASS, 0, 1)
+REG32(RPLL_CTRL, 0x40)
+    FIELD(RPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(RPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(RPLL_CTRL, CLKOUTDIV, 16, 2)
+    FIELD(RPLL_CTRL, FBDIV, 8, 8)
+    FIELD(RPLL_CTRL, BYPASS, 3, 1)
+    FIELD(RPLL_CTRL, RESET, 0, 1)
+REG32(RPLL_CFG, 0x44)
+    FIELD(RPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(RPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(RPLL_CFG, LFHF, 10, 2)
+    FIELD(RPLL_CFG, CP, 5, 4)
+    FIELD(RPLL_CFG, RES, 0, 4)
+REG32(RPLL_FRAC_CFG, 0x48)
+    FIELD(RPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(RPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(RPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(RPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(RPLL_FRAC_CFG, DATA, 0, 16)
+REG32(PLL_STATUS, 0x50)
+    FIELD(PLL_STATUS, RPLL_STABLE, 2, 1)
+    FIELD(PLL_STATUS, RPLL_LOCK, 0, 1)
+REG32(RPLL_TO_XPD_CTRL, 0x100)
+    FIELD(RPLL_TO_XPD_CTRL, CLKACT, 25, 1)
+    FIELD(RPLL_TO_XPD_CTRL, DIVISOR0, 8, 10)
+REG32(LPD_TOP_SWITCH_CTRL, 0x104)
+    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT_ADMA, 26, 1)
+    FIELD(LPD_TOP_SWITCH_CTRL, CLKACT, 25, 1)
+    FIELD(LPD_TOP_SWITCH_CTRL, DIVISOR0, 8, 10)
+    FIELD(LPD_TOP_SWITCH_CTRL, SRCSEL, 0, 3)
+REG32(LPD_LSBUS_CTRL, 0x108)
+    FIELD(LPD_LSBUS_CTRL, CLKACT, 25, 1)
+    FIELD(LPD_LSBUS_CTRL, DIVISOR0, 8, 10)
+    FIELD(LPD_LSBUS_CTRL, SRCSEL, 0, 3)
+REG32(CPU_R5_CTRL, 0x10c)
+    FIELD(CPU_R5_CTRL, CLKACT_OCM2, 28, 1)
+    FIELD(CPU_R5_CTRL, CLKACT_OCM, 27, 1)
+    FIELD(CPU_R5_CTRL, CLKACT_CORE, 26, 1)
+    FIELD(CPU_R5_CTRL, CLKACT, 25, 1)
+    FIELD(CPU_R5_CTRL, DIVISOR0, 8, 10)
+    FIELD(CPU_R5_CTRL, SRCSEL, 0, 3)
+REG32(IOU_SWITCH_CTRL, 0x114)
+    FIELD(IOU_SWITCH_CTRL, CLKACT, 25, 1)
+    FIELD(IOU_SWITCH_CTRL, DIVISOR0, 8, 10)
+    FIELD(IOU_SWITCH_CTRL, SRCSEL, 0, 3)
+REG32(GEM0_REF_CTRL, 0x118)
+    FIELD(GEM0_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(GEM0_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(GEM0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM0_REF_CTRL, SRCSEL, 0, 3)
+REG32(GEM1_REF_CTRL, 0x11c)
+    FIELD(GEM1_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(GEM1_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(GEM1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM1_REF_CTRL, SRCSEL, 0, 3)
+REG32(GEM_TSU_REF_CTRL, 0x120)
+    FIELD(GEM_TSU_REF_CTRL, CLKACT, 25, 1)
+    FIELD(GEM_TSU_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(GEM_TSU_REF_CTRL, SRCSEL, 0, 3)
+REG32(USB0_BUS_REF_CTRL, 0x124)
+    FIELD(USB0_BUS_REF_CTRL, CLKACT, 25, 1)
+    FIELD(USB0_BUS_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(USB0_BUS_REF_CTRL, SRCSEL, 0, 3)
+REG32(UART0_REF_CTRL, 0x128)
+    FIELD(UART0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(UART0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(UART0_REF_CTRL, SRCSEL, 0, 3)
+REG32(UART1_REF_CTRL, 0x12c)
+    FIELD(UART1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(UART1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(UART1_REF_CTRL, SRCSEL, 0, 3)
+REG32(SPI0_REF_CTRL, 0x130)
+    FIELD(SPI0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(SPI0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(SPI0_REF_CTRL, SRCSEL, 0, 3)
+REG32(SPI1_REF_CTRL, 0x134)
+    FIELD(SPI1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(SPI1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(SPI1_REF_CTRL, SRCSEL, 0, 3)
+REG32(CAN0_REF_CTRL, 0x138)
+    FIELD(CAN0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CAN0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CAN0_REF_CTRL, SRCSEL, 0, 3)
+REG32(CAN1_REF_CTRL, 0x13c)
+    FIELD(CAN1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CAN1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CAN1_REF_CTRL, SRCSEL, 0, 3)
+REG32(I2C0_REF_CTRL, 0x140)
+    FIELD(I2C0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(I2C0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(I2C0_REF_CTRL, SRCSEL, 0, 3)
+REG32(I2C1_REF_CTRL, 0x144)
+    FIELD(I2C1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(I2C1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(I2C1_REF_CTRL, SRCSEL, 0, 3)
+REG32(DBG_LPD_CTRL, 0x148)
+    FIELD(DBG_LPD_CTRL, CLKACT, 25, 1)
+    FIELD(DBG_LPD_CTRL, DIVISOR0, 8, 10)
+    FIELD(DBG_LPD_CTRL, SRCSEL, 0, 3)
+REG32(TIMESTAMP_REF_CTRL, 0x14c)
+    FIELD(TIMESTAMP_REF_CTRL, CLKACT, 25, 1)
+    FIELD(TIMESTAMP_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(TIMESTAMP_REF_CTRL, SRCSEL, 0, 3)
+REG32(CRL_SAFETY_CHK, 0x150)
+REG32(PSM_REF_CTRL, 0x154)
+    FIELD(PSM_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(PSM_REF_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TSTMP_CTRL, 0x158)
+    FIELD(DBG_TSTMP_CTRL, CLKACT, 25, 1)
+    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 10)
+    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
+REG32(CPM_TOPSW_REF_CTRL, 0x15c)
+    FIELD(CPM_TOPSW_REF_CTRL, CLKACT, 25, 1)
+    FIELD(CPM_TOPSW_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(CPM_TOPSW_REF_CTRL, SRCSEL, 0, 3)
+REG32(USB3_DUAL_REF_CTRL, 0x160)
+    FIELD(USB3_DUAL_REF_CTRL, CLKACT, 25, 1)
+    FIELD(USB3_DUAL_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(USB3_DUAL_REF_CTRL, SRCSEL, 0, 3)
+REG32(RST_CPU_R5, 0x300)
+    FIELD(RST_CPU_R5, RESET_PGE, 4, 1)
+    FIELD(RST_CPU_R5, RESET_AMBA, 2, 1)
+    FIELD(RST_CPU_R5, RESET_CPU1, 1, 1)
+    FIELD(RST_CPU_R5, RESET_CPU0, 0, 1)
+REG32(RST_ADMA, 0x304)
+    FIELD(RST_ADMA, RESET, 0, 1)
+REG32(RST_GEM0, 0x308)
+    FIELD(RST_GEM0, RESET, 0, 1)
+REG32(RST_GEM1, 0x30c)
+    FIELD(RST_GEM1, RESET, 0, 1)
+REG32(RST_SPARE, 0x310)
+    FIELD(RST_SPARE, RESET, 0, 1)
+REG32(RST_USB0, 0x314)
+    FIELD(RST_USB0, RESET, 0, 1)
+REG32(RST_UART0, 0x318)
+    FIELD(RST_UART0, RESET, 0, 1)
+REG32(RST_UART1, 0x31c)
+    FIELD(RST_UART1, RESET, 0, 1)
+REG32(RST_SPI0, 0x320)
+    FIELD(RST_SPI0, RESET, 0, 1)
+REG32(RST_SPI1, 0x324)
+    FIELD(RST_SPI1, RESET, 0, 1)
+REG32(RST_CAN0, 0x328)
+    FIELD(RST_CAN0, RESET, 0, 1)
+REG32(RST_CAN1, 0x32c)
+    FIELD(RST_CAN1, RESET, 0, 1)
+REG32(RST_I2C0, 0x330)
+    FIELD(RST_I2C0, RESET, 0, 1)
+REG32(RST_I2C1, 0x334)
+    FIELD(RST_I2C1, RESET, 0, 1)
+REG32(RST_DBG_LPD, 0x338)
+    FIELD(RST_DBG_LPD, RPU_DBG1_RESET, 5, 1)
+    FIELD(RST_DBG_LPD, RPU_DBG0_RESET, 4, 1)
+    FIELD(RST_DBG_LPD, RESET_HSDP, 1, 1)
+    FIELD(RST_DBG_LPD, RESET, 0, 1)
+REG32(RST_GPIO, 0x33c)
+    FIELD(RST_GPIO, RESET, 0, 1)
+REG32(RST_TTC, 0x344)
+    FIELD(RST_TTC, TTC3_RESET, 3, 1)
+    FIELD(RST_TTC, TTC2_RESET, 2, 1)
+    FIELD(RST_TTC, TTC1_RESET, 1, 1)
+    FIELD(RST_TTC, TTC0_RESET, 0, 1)
+REG32(RST_TIMESTAMP, 0x348)
+    FIELD(RST_TIMESTAMP, RESET, 0, 1)
+REG32(RST_SWDT, 0x34c)
+    FIELD(RST_SWDT, RESET, 0, 1)
+REG32(RST_OCM, 0x350)
+    FIELD(RST_OCM, RESET, 0, 1)
+REG32(RST_IPI, 0x354)
+    FIELD(RST_IPI, RESET, 0, 1)
+REG32(RST_SYSMON, 0x358)
+    FIELD(RST_SYSMON, SEQ_RST, 1, 1)
+    FIELD(RST_SYSMON, CFG_RST, 0, 1)
+REG32(RST_FPD, 0x360)
+    FIELD(RST_FPD, SRST, 1, 1)
+    FIELD(RST_FPD, POR, 0, 1)
+REG32(PSM_RST_MODE, 0x370)
+    FIELD(PSM_RST_MODE, WAKEUP, 2, 1)
+    FIELD(PSM_RST_MODE, RST_MODE, 0, 2)
+
+#define CRL_R_MAX (R_PSM_RST_MODE + 1)
+
+#define RPU_MAX_CPU 2
+
+struct XlnxVersalCRL {
+    SysBusDevice parent_obj;
+    qemu_irq irq;
+
+    struct {
+        ARMCPU *cpu_r5[RPU_MAX_CPU];
+        DeviceState *adma[8];
+        DeviceState *uart[2];
+        DeviceState *gem[2];
+        DeviceState *usb;
+    } cfg;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[CRL_R_MAX];
+    RegisterInfo regs_info[CRL_R_MAX];
+};
+#endif
diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-versal-crl.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the Clock-Reset-LPD (CRL).
+ *
+ * Copyright (c) 2022 Advanced Micro Devices, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Edgar E. Iglesias <edgar.iglesias@amd.com>
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "qemu/bitops.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+#include "hw/register.h"
+#include "hw/resettable.h"
+
+#include "target/arm/arm-powerctl.h"
+#include "hw/misc/xlnx-versal-crl.h"
+
+#ifndef XLNX_VERSAL_CRL_ERR_DEBUG
+#define XLNX_VERSAL_CRL_ERR_DEBUG 0
+#endif
+
+static void crl_update_irq(XlnxVersalCRL *s)
+{
+    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
+    qemu_set_irq(s->irq, pending);
+}
+
+static void crl_status_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    crl_update_irq(s);
+}
+
+static uint64_t crl_enable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] &= ~val;
+    crl_update_irq(s);
+    return 0;
+}
+
+static uint64_t crl_disable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] |= val;
+    crl_update_irq(s);
+    return 0;
+}
+
+static void crl_reset_dev(XlnxVersalCRL *s, DeviceState *dev,
+                          bool rst_old, bool rst_new)
+{
+    device_cold_reset(dev);
+}
+
+static void crl_reset_cpu(XlnxVersalCRL *s, ARMCPU *armcpu,
+                          bool rst_old, bool rst_new)
+{
+    if (rst_new) {
+        arm_set_cpu_off(armcpu->mp_affinity);
+    } else {
+        arm_set_cpu_on_and_reset(armcpu->mp_affinity);
+    }
+}
+
+#define REGFIELD_RESET(type, s, reg, f, new_val, dev) {     \
+    bool old_f = ARRAY_FIELD_EX32((s)->regs, reg, f);       \
+    bool new_f = FIELD_EX32(new_val, reg, f);               \
+                                                            \
+    /* Detect edges.  */                                    \
+    if (dev && old_f != new_f) {                            \
+        crl_reset_ ## type(s, dev, old_f, new_f);           \
+    }                                                       \
+}
+
+static uint64_t crl_rst_r5_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU0, val64, s->cfg.cpu_r5[0]);
+    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU1, val64, s->cfg.cpu_r5[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_adma_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    int i;
+
+    /* A single register fans out to all ADMA reset inputs.  */
+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); i++) {
+        REGFIELD_RESET(dev, s, RST_ADMA, RESET, val64, s->cfg.adma[i]);
+    }
+    return val64;
+}
+
+static uint64_t crl_rst_uart0_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_UART0, RESET, val64, s->cfg.uart[0]);
+    return val64;
+}
+
+static uint64_t crl_rst_uart1_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_UART1, RESET, val64, s->cfg.uart[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_gem0_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_GEM0, RESET, val64, s->cfg.gem[0]);
+    return val64;
+}
+
+static uint64_t crl_rst_gem1_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_GEM1, RESET, val64, s->cfg.gem[1]);
+    return val64;
+}
+
+static uint64_t crl_rst_usb_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+
+    REGFIELD_RESET(dev, s, RST_USB0, RESET, val64, s->cfg.usb);
+    return val64;
+}
+
+static const RegisterAccessInfo crl_regs_info[] = {
+    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
+    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
+        .w1c = 0x1,
+        .post_write = crl_status_postw,
+    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
+        .pre_write = crl_enable_prew,
+    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
+        .pre_write = crl_disable_prew,
+    },{ .name = "WPROT",  .addr = A_WPROT,
+    },{ .name = "PLL_CLK_OTHER_DMN",  .addr = A_PLL_CLK_OTHER_DMN,
+        .reset = 0x1,
+        .rsvd = 0xe,
+    },{ .name = "RPLL_CTRL",  .addr = A_RPLL_CTRL,
+        .reset = 0x24809,
+        .rsvd = 0xf88c00f6,
+    },{ .name = "RPLL_CFG",  .addr = A_RPLL_CFG,
+        .reset = 0x2000000,
+        .rsvd = 0x1801210,
+    },{ .name = "RPLL_FRAC_CFG",  .addr = A_RPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
+        .reset = R_PLL_STATUS_RPLL_STABLE_MASK |
+                 R_PLL_STATUS_RPLL_LOCK_MASK,
+        .rsvd = 0xfa,
+        .ro = 0x5,
+    },{ .name = "RPLL_TO_XPD_CTRL",  .addr = A_RPLL_TO_XPD_CTRL,
+        .reset = 0x2000100,
+        .rsvd = 0xfdfc00ff,
+    },{ .name = "LPD_TOP_SWITCH_CTRL",  .addr = A_LPD_TOP_SWITCH_CTRL,
+        .reset = 0x6000300,
+        .rsvd = 0xf9fc00f8,
+    },{ .name = "LPD_LSBUS_CTRL",  .addr = A_LPD_LSBUS_CTRL,
+        .reset = 0x2000800,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CPU_R5_CTRL",  .addr = A_CPU_R5_CTRL,
+        .reset = 0xe000300,
+        .rsvd = 0xe1fc00f8,
+    },{ .name = "IOU_SWITCH_CTRL",  .addr = A_IOU_SWITCH_CTRL,
+        .reset = 0x2000500,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "GEM0_REF_CTRL",  .addr = A_GEM0_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM1_REF_CTRL",  .addr = A_GEM1_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM_TSU_REF_CTRL",  .addr = A_GEM_TSU_REF_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB0_BUS_REF_CTRL",  .addr = A_USB0_BUS_REF_CTRL,
+        .reset = 0x2001900,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART0_REF_CTRL",  .addr = A_UART0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART1_REF_CTRL",  .addr = A_UART1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI0_REF_CTRL",  .addr = A_SPI0_REF_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI1_REF_CTRL",  .addr = A_SPI1_REF_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN0_REF_CTRL",  .addr = A_CAN0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN1_REF_CTRL",  .addr = A_CAN1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I2C0_REF_CTRL",  .addr = A_I2C0_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I2C1_REF_CTRL",  .addr = A_I2C1_REF_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "DBG_LPD_CTRL",  .addr = A_DBG_LPD_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "TIMESTAMP_REF_CTRL",  .addr = A_TIMESTAMP_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CRL_SAFETY_CHK",  .addr = A_CRL_SAFETY_CHK,
+    },{ .name = "PSM_REF_CTRL",  .addr = A_PSM_REF_CTRL,
+        .reset = 0xf04,
+        .rsvd = 0xfffc00f8,
+    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CPM_TOPSW_REF_CTRL",  .addr = A_CPM_TOPSW_REF_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB3_DUAL_REF_CTRL",  .addr = A_USB3_DUAL_REF_CTRL,
+        .reset = 0x3c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "RST_CPU_R5",  .addr = A_RST_CPU_R5,
+        .reset = 0x17,
+        .rsvd = 0x8,
+        .pre_write = crl_rst_r5_prew,
+    },{ .name = "RST_ADMA",  .addr = A_RST_ADMA,
+        .reset = 0x1,
+        .pre_write = crl_rst_adma_prew,
+    },{ .name = "RST_GEM0",  .addr = A_RST_GEM0,
+        .reset = 0x1,
+        .pre_write = crl_rst_gem0_prew,
+    },{ .name = "RST_GEM1",  .addr = A_RST_GEM1,
+        .reset = 0x1,
+        .pre_write = crl_rst_gem1_prew,
+    },{ .name = "RST_SPARE",  .addr = A_RST_SPARE,
+        .reset = 0x1,
+    },{ .name = "RST_USB0",  .addr = A_RST_USB0,
+        .reset = 0x1,
+        .pre_write = crl_rst_usb_prew,
+    },{ .name = "RST_UART0",  .addr = A_RST_UART0,
+        .reset = 0x1,
+        .pre_write = crl_rst_uart0_prew,
+    },{ .name = "RST_UART1",  .addr = A_RST_UART1,
+        .reset = 0x1,
+        .pre_write = crl_rst_uart1_prew,
+    },{ .name = "RST_SPI0",  .addr = A_RST_SPI0,
+        .reset = 0x1,
+    },{ .name = "RST_SPI1",  .addr = A_RST_SPI1,
+        .reset = 0x1,
+    },{ .name = "RST_CAN0",  .addr = A_RST_CAN0,
+        .reset = 0x1,
+    },{ .name = "RST_CAN1",  .addr = A_RST_CAN1,
+        .reset = 0x1,
+    },{ .name = "RST_I2C0",  .addr = A_RST_I2C0,
+        .reset = 0x1,
+    },{ .name = "RST_I2C1",  .addr = A_RST_I2C1,
+        .reset = 0x1,
+    },{ .name = "RST_DBG_LPD",  .addr = A_RST_DBG_LPD,
+        .reset = 0x33,
+        .rsvd = 0xcc,
+    },{ .name = "RST_GPIO",  .addr = A_RST_GPIO,
+        .reset = 0x1,
+    },{ .name = "RST_TTC",  .addr = A_RST_TTC,
+        .reset = 0xf,
+    },{ .name = "RST_TIMESTAMP",  .addr = A_RST_TIMESTAMP,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT",  .addr = A_RST_SWDT,
+        .reset = 0x1,
+    },{ .name = "RST_OCM",  .addr = A_RST_OCM,
+    },{ .name = "RST_IPI",  .addr = A_RST_IPI,
+    },{ .name = "RST_FPD",  .addr = A_RST_FPD,
+        .reset = 0x3,
+    },{ .name = "PSM_RST_MODE",  .addr = A_PSM_RST_MODE,
+        .reset = 0x1,
+        .rsvd = 0xf8,
+    }
+};
+
+static void crl_reset_enter(Object *obj, ResetType type)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
+static void crl_reset_hold(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+
+    crl_update_irq(s);
+}
+
+static const MemoryRegionOps crl_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void crl_init(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    int i;
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), crl_regs_info,
+                              ARRAY_SIZE(crl_regs_info),
+                              s->regs_info, s->regs,
+                              &crl_ops,
+                              XLNX_VERSAL_CRL_ERR_DEBUG,
+                              CRL_R_MAX * 4);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_irq(sbd, &s->irq);
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
+        object_property_add_link(obj, "cpu_r5[*]", TYPE_ARM_CPU,
+                                 (Object **)&s->cfg.cpu_r5[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); ++i) {
+        object_property_add_link(obj, "adma[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.adma[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.uart); ++i) {
+        object_property_add_link(obj, "uart[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.uart[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.gem); ++i) {
+        object_property_add_link(obj, "gem[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.gem[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    object_property_add_link(obj, "usb", TYPE_DEVICE,
+                             (Object **)&s->cfg.gem[i],
+                             qdev_prop_allow_set_link_before_realize,
+                             OBJ_PROP_LINK_STRONG);
+}
+
+static void crl_finalize(Object *obj)
+{
+    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_crl = {
+    .name = TYPE_XLNX_VERSAL_CRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxVersalCRL, CRL_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void crl_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_crl;
+
+    rc->phases.enter = crl_reset_enter;
+    rc->phases.hold = crl_reset_hold;
+}
+
+static const TypeInfo crl_info = {
+    .name          = TYPE_XLNX_VERSAL_CRL,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxVersalCRL),
+    .class_init    = crl_class_init,
+    .instance_init = crl_init,
+    .instance_finalize = crl_finalize,
+};
+
+static void crl_register_types(void)
+{
+    type_register_static(&crl_info);
+}
+
+type_init(crl_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
+specific_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-crl.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>

Connect the CRL (Clock Reset LPD) to the Versal SoC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Frederic Konrad <fkonrad@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20220406174303.2022038-5-edgar.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  4 +++
 hw/arm/xlnx-versal.c         | 54 ++++++++++++++++++++++++++++++++++--
 2 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
 #include "hw/dma/xlnx_csu_dma.h"
+#include "hw/misc/xlnx-versal-crl.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
@@ -XXX,XX +XXX,XX @@ struct Versal {
             qemu_or_irq irq_orgate;
             XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
         } xram;
+
+        XlnxVersalCRL crl;
     } lpd;
 
     /* The Platform Management Controller subsystem.  */
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define VERSAL_TIMER_NS_EL1_IRQ     14
 #define VERSAL_TIMER_NS_EL2_IRQ     10
 
+#define VERSAL_CRL_IRQ             10
 #define VERSAL_UART0_IRQ_0         18
 #define VERSAL_UART1_IRQ_0         19
 #define VERSAL_USB0_IRQ_0          22
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_ospi(Versal *s, qemu_irq *pic)
     qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
 }
 
+static void versal_create_crl(Versal *s, qemu_irq *pic)
+{
+    SysBusDevice *sbd;
+    int i;
+
+    object_initialize_child(OBJECT(s), "crl", &s->lpd.crl,
+                            TYPE_XLNX_VERSAL_CRL);
+    sbd = SYS_BUS_DEVICE(&s->lpd.crl);
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
+        g_autofree gchar *name = g_strdup_printf("cpu_r5[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.rpu.cpu[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
+        g_autofree gchar *name = g_strdup_printf("gem[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.gem[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
+        g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.adma[i]),
+                                 &error_abort);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
+        g_autofree gchar *name = g_strdup_printf("uart[%d]", i);
+
+        object_property_set_link(OBJECT(&s->lpd.crl),
+                                 name, OBJECT(&s->lpd.iou.uart[i]),
+                                 &error_abort);
+    }
+
+    object_property_set_link(OBJECT(&s->lpd.crl),
+                             "usb", OBJECT(&s->lpd.iou.usb),
+                             &error_abort);
+
+    sysbus_realize(sbd, &error_fatal);
+    memory_region_add_subregion(&s->mr_ps, MM_CRL,
+                                sysbus_mmio_get_region(sbd, 0));
+    sysbus_connect_irq(sbd, 0, pic[VERSAL_CRL_IRQ]);
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
 
     versal_unimp_area(s, "psm", &s->mr_ps,
                         MM_PSM_START, MM_PSM_END - MM_PSM_START);
-    versal_unimp_area(s, "crl", &s->mr_ps,
-                        MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
     versal_unimp_area(s, "apu", &s->mr_ps,
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_efuse(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
     versal_create_ospi(s, pic);
+    versal_create_crl(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.25.1

The Exynos4210 SoC device currently uses a custom device
"exynos4210.irq_gate" to model the OR gate that feeds each CPU's IRQ
line.  We have a standard TYPE_OR_IRQ device for this now, so use
that instead.

(This is a migration compatibility break, but that is OK for this
machine type.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-2-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  1 +
 hw/arm/exynos4210.c         | 31 ++++++++++++++++---------------
 2 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     MemoryRegion bootreg_mem;
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
+    qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
     Exynos4210State *s = EXYNOS4210_SOC(socdev);
     MemoryRegion *system_mem = get_system_memory();
-    qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev, *uart[4], *pl330[3];
     int i, n;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
 
     /* IRQ Gate */
     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
-        dev = qdev_new("exynos4210.irq_gate");
-        qdev_prop_set_uint32(dev, "n_in", EXYNOS4210_IRQ_GATE_NINPUTS);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-        /* Get IRQ Gate input in gate_irq */
-        for (n = 0; n < EXYNOS4210_IRQ_GATE_NINPUTS; n++) {
-            gate_irq[i][n] = qdev_get_gpio_in(dev, n);
-        }
-        busdev = SYS_BUS_DEVICE(dev);
-
-        /* Connect IRQ Gate output to CPU's IRQ line */
-        sysbus_connect_irq(busdev, 0,
-                           qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
+        DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
+        object_property_set_int(OBJECT(orgate), "num-lines",
+                                EXYNOS4210_IRQ_GATE_NINPUTS,
+                                &error_abort);
+        qdev_realize(orgate, NULL, &error_abort);
+        qdev_connect_gpio_out(orgate, 0,
+                              qdev_get_gpio_in(DEVICE(s->cpu[i]), ARM_CPU_IRQ));
     }
 
     /* Private memory region and Internal GIC */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_realize_and_unref(busdev, &error_fatal);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-        sysbus_connect_irq(busdev, n, gate_irq[n][0]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
         s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     /* Map Distributer interface */
     sysbus_mmio_map(busdev, 1, EXYNOS4210_EXT_GIC_DIST_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
-        sysbus_connect_irq(busdev, n, gate_irq[n][1]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
         s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         object_initialize_child(obj, name, orgate, TYPE_OR_IRQ);
         g_free(name);
     }
+
+    for (i = 0; i < ARRAY_SIZE(s->cpu_irq_orgate); i++) {
+        g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
+        object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
+    }
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
-- 
2.25.1

Now we have removed the only use of TYPE_EXYNOS4210_IRQ_GATE we can
delete the device entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20220404154658.565020-3-peter.maydell@linaro.org
---
 hw/intc/exynos4210_gic.c | 107 ---------------------------------------
 1 file changed, 107 deletions(-)

diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_register_types(void)
 }
 
 type_init(exynos4210_gic_register_types)
-
-/* IRQ OR Gate struct.
- *
- * This device models an OR gate. There are n_in input qdev gpio lines and one
- * output sysbus IRQ line. The output IRQ level is formed as OR between all
- * gpio inputs.
- */
-
-#define TYPE_EXYNOS4210_IRQ_GATE "exynos4210.irq_gate"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210IRQGateState, EXYNOS4210_IRQ_GATE)
-
-struct Exynos4210IRQGateState {
-    SysBusDevice parent_obj;
-
-    uint32_t n_in;      /* inputs amount */
-    uint32_t *level;    /* input levels */
-    qemu_irq out;       /* output IRQ */
-};
-
-static Property exynos4210_irq_gate_properties[] = {
-    DEFINE_PROP_UINT32("n_in", Exynos4210IRQGateState, n_in, 1),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static const VMStateDescription vmstate_exynos4210_irq_gate = {
-    .name = "exynos4210.irq_gate",
-    .version_id = 2,
-    .minimum_version_id = 2,
-    .fields = (VMStateField[]) {
-        VMSTATE_VBUFFER_UINT32(level, Exynos4210IRQGateState, 1, NULL, n_in),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-/* Process a change in IRQ input. */
-static void exynos4210_irq_gate_handler(void *opaque, int irq, int level)
-{
-    Exynos4210IRQGateState *s = (Exynos4210IRQGateState *)opaque;
-    uint32_t i;
-
-    assert(irq < s->n_in);
-
-    s->level[irq] = level;
-
-    for (i = 0; i < s->n_in; i++) {
-        if (s->level[i] >= 1) {
-            qemu_irq_raise(s->out);
-            return;
-        }
-    }
-
-    qemu_irq_lower(s->out);
-}
-
-static void exynos4210_irq_gate_reset(DeviceState *d)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(d);
-
-    memset(s->level, 0, s->n_in * sizeof(*s->level));
-}
-
-/*
- * IRQ Gate initialization.
- */
-static void exynos4210_irq_gate_init(Object *obj)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(obj);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-
-    sysbus_init_irq(sbd, &s->out);
-}
-
-static void exynos4210_irq_gate_realize(DeviceState *dev, Error **errp)
-{
-    Exynos4210IRQGateState *s = EXYNOS4210_IRQ_GATE(dev);
-
-    /* Allocate general purpose input signals and connect a handler to each of
-     * them */
-    qdev_init_gpio_in(dev, exynos4210_irq_gate_handler, s->n_in);
-
-    s->level = g_malloc0(s->n_in * sizeof(*s->level));
-}
-
-static void exynos4210_irq_gate_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->reset = exynos4210_irq_gate_reset;
-    dc->vmsd = &vmstate_exynos4210_irq_gate;
-    device_class_set_props(dc, exynos4210_irq_gate_properties);
-    dc->realize = exynos4210_irq_gate_realize;
-}
-
-static const TypeInfo exynos4210_irq_gate_info = {
-    .name          = TYPE_EXYNOS4210_IRQ_GATE,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(Exynos4210IRQGateState),
-    .instance_init = exynos4210_irq_gate_init,
-    .class_init    = exynos4210_irq_gate_class_init,
-};
-
-static void exynos4210_irq_gate_register_types(void)
-{
-    type_register_static(&exynos4210_irq_gate_info);
-}
-
-type_init(exynos4210_irq_gate_register_types)
-- 
2.25.1

The exynos4210 SoC mostly creates its child devices as if it were
board code.  This includes the a9mpcore object.  Switch that to a
new-style "embedded in the state struct" creation, because in the
next commit we're going to want to refer to the object again further
down in the exynos4210_realize() function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-4-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  2 ++
 hw/arm/exynos4210.c         | 11 ++++++-----
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/or-irq.h"
 #include "hw/sysbus.h"
+#include "hw/cpu/a9mpcore.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
+    A9MPPrivState a9mpcore;
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     }
 
     /* Private memory region and Internal GIC */
-    dev = qdev_new(TYPE_A9MPCORE_PRIV);
-    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->a9mpcore), "num-cpu", EXYNOS4210_NCPUS);
+    busdev = SYS_BUS_DEVICE(&s->a9mpcore);
+    sysbus_realize(busdev, &error_fatal);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_SMP_PRIVATE_BASE_ADDR);
     for (n = 0; n < EXYNOS4210_NCPUS; n++) {
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
     for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(dev, n);
+        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
     }
 
     /* Cache controller */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         g_autofree char *name = g_strdup_printf("cpu-irq-orgate%d", i);
         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
     }
+
+    object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
-- 
2.25.1

The only time we use the int_gic_irq[] array in the Exynos4210Irq
struct is in the exynos4210_realize() function: we initialize it with
the GPIO inputs of the a9mpcore device, and then a bit later on we
connect those to the outputs of the internal combiner.  Now that the
a9mpcore object is easily accessible as s->a9mpcore we can make the
connection directly from one device to the other without going via
this array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-5-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h | 1 -
 hw/arm/exynos4210.c         | 6 ++----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-    qemu_irq int_gic_irq[EXYNOS4210_INT_GIC_NIRQ];
     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
     qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 } Exynos4210Irq;
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 0));
     }
-    for (n = 0; n < EXYNOS4210_INT_GIC_NIRQ; n++) {
-        s->irqs.int_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->a9mpcore), n);
-    }
 
     /* Cache controller */
     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-        sysbus_connect_irq(busdev, n, s->irqs.int_gic_irq[n]);
+        sysbus_connect_irq(busdev, n,
+                           qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
     exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
-- 
2.25.1

The exynos4210 code currently has two very similar arrays of IRQs:

* board_irqs is a field of the Exynos4210Irq struct which is filled
   in by exynos4210_init_board_irqs() with the appropriate qemu_irqs
   for each IRQ the board/SoC can assert
 * irq_table is a set of qemu_irqs pointed to from the
   Exynos4210State struct.  It's allocated in exynos4210_init_irq,
   and the only behaviour these irqs have is that they pass on the
   level to the equivalent board_irqs[] irq

The extra indirection through irq_table is unnecessary, so coalesce
these into a single irq_table[] array as a direct field in
Exynos4210State which exynos4210_init_board_irqs() fills in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-6-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  8 ++------
 hw/arm/exynos4210.c         |  6 +-----
 hw/intc/exynos4210_gic.c    | 32 ++++++++------------------------
 3 files changed, 11 insertions(+), 35 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
     qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
-    qemu_irq board_irqs[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 } Exynos4210Irq;
 
 struct Exynos4210State {
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
-    qemu_irq *irq_table;
+    qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 
     MemoryRegion chipid_mem;
     MemoryRegion iram_mem;
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-/* Initialize exynos4210 IRQ subsystem stub */
-qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
-
 /* Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
-void exynos4210_init_board_irqs(Exynos4210Irq *s);
+void exynos4210_init_board_irqs(Exynos4210State *s);
 
 /* Get IRQ number from exynos4210 IRQ subsystem stub.
  * To identify IRQ source use internal combiner group and bit number
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         qdev_realize(DEVICE(cpuobj), NULL, &error_fatal);
     }
 
-    /*** IRQs ***/
-
-    s->irq_table = exynos4210_init_irq(&s->irqs);
-
     /* IRQ Gate */
     for (i = 0; i < EXYNOS4210_NCPUS; i++) {
         DeviceState *orgate = DEVICE(&s->cpu_irq_orgate[i]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
-    exynos4210_init_board_irqs(&s->irqs);
+    exynos4210_init_board_irqs(s);
 
     /*** Memory ***/
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64-EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-static void exynos4210_irq_handler(void *opaque, int irq, int level)
-{
-    Exynos4210Irq *s = (Exynos4210Irq *)opaque;
-
-    /* Bypass */
-    qemu_set_irq(s->board_irqs[irq], level);
-}
-
-/*
- * Initialize exynos4210 IRQ subsystem stub.
- */
-qemu_irq *exynos4210_init_irq(Exynos4210Irq *s)
-{
-    return qemu_allocate_irqs(exynos4210_irq_handler, s,
-            EXYNOS4210_MAX_INT_COMBINER_IN_IRQ);
-}
-
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
  */
-void exynos4210_init_board_irqs(Exynos4210Irq *s)
+void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
+    Exynos4210Irq *is = &s->irqs;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
             irq_id = EXT_GIC_ID_MCT_G1;
         }
         if (irq_id) {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_gic_irq[irq_id-32]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
         } else {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_combiner_irq[n]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ void exynos4210_init_board_irqs(Exynos4210Irq *s)
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
         if (irq_id) {
-            s->board_irqs[n] = qemu_irq_split(s->int_combiner_irq[n],
-                    s->ext_gic_irq[irq_id-32]);
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
         }
     }
 }
-- 
2.25.1

The function exynos4210_init_board_irqs() currently lives in
exynos4210_gic.c, but it isn't really part of the exynos4210.gic
device -- it is a function that implements (some of) the wiring up of
interrupts between the SoC's GIC and combiner components.  This means
it fits better in exynos4210.c, which is the SoC-level code.  Move it
there. Similarly, exynos4210_git_irq() is used almost only in the
SoC-level code, so move it too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-8-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |   4 -
 hw/arm/exynos4210.c         | 202 +++++++++++++++++++++++++++++++++++
 hw/intc/exynos4210_gic.c    | 204 ------------------------------------
 3 files changed, 202 insertions(+), 208 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210State, EXYNOS4210_SOC)
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-/* Initialize board IRQs.
- * These IRQs contain splitted Int/External Combiner and External Gic IRQs */
-void exynos4210_init_board_irqs(Exynos4210State *s);
-
 /* Get IRQ number from exynos4210 IRQ subsystem stub.
  * To identify IRQ source use internal combiner group and bit number
  *  grp - group number
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
 #define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
 
+enum ExtGicId {
+    EXT_GIC_ID_MDMA_LCD0 = 66,
+    EXT_GIC_ID_PDMA0,
+    EXT_GIC_ID_PDMA1,
+    EXT_GIC_ID_TIMER0,
+    EXT_GIC_ID_TIMER1,
+    EXT_GIC_ID_TIMER2,
+    EXT_GIC_ID_TIMER3,
+    EXT_GIC_ID_TIMER4,
+    EXT_GIC_ID_MCT_L0,
+    EXT_GIC_ID_WDT,
+    EXT_GIC_ID_RTC_ALARM,
+    EXT_GIC_ID_RTC_TIC,
+    EXT_GIC_ID_GPIO_XB,
+    EXT_GIC_ID_GPIO_XA,
+    EXT_GIC_ID_MCT_L1,
+    EXT_GIC_ID_IEM_APC,
+    EXT_GIC_ID_IEM_IEC,
+    EXT_GIC_ID_NFC,
+    EXT_GIC_ID_UART0,
+    EXT_GIC_ID_UART1,
+    EXT_GIC_ID_UART2,
+    EXT_GIC_ID_UART3,
+    EXT_GIC_ID_UART4,
+    EXT_GIC_ID_MCT_G0,
+    EXT_GIC_ID_I2C0,
+    EXT_GIC_ID_I2C1,
+    EXT_GIC_ID_I2C2,
+    EXT_GIC_ID_I2C3,
+    EXT_GIC_ID_I2C4,
+    EXT_GIC_ID_I2C5,
+    EXT_GIC_ID_I2C6,
+    EXT_GIC_ID_I2C7,
+    EXT_GIC_ID_SPI0,
+    EXT_GIC_ID_SPI1,
+    EXT_GIC_ID_SPI2,
+    EXT_GIC_ID_MCT_G1,
+    EXT_GIC_ID_USB_HOST,
+    EXT_GIC_ID_USB_DEVICE,
+    EXT_GIC_ID_MODEMIF,
+    EXT_GIC_ID_HSMMC0,
+    EXT_GIC_ID_HSMMC1,
+    EXT_GIC_ID_HSMMC2,
+    EXT_GIC_ID_HSMMC3,
+    EXT_GIC_ID_SDMMC,
+    EXT_GIC_ID_MIPI_CSI_4LANE,
+    EXT_GIC_ID_MIPI_DSI_4LANE,
+    EXT_GIC_ID_MIPI_CSI_2LANE,
+    EXT_GIC_ID_MIPI_DSI_2LANE,
+    EXT_GIC_ID_ONENAND_AUDI,
+    EXT_GIC_ID_ROTATOR,
+    EXT_GIC_ID_FIMC0,
+    EXT_GIC_ID_FIMC1,
+    EXT_GIC_ID_FIMC2,
+    EXT_GIC_ID_FIMC3,
+    EXT_GIC_ID_JPEG,
+    EXT_GIC_ID_2D,
+    EXT_GIC_ID_PCIe,
+    EXT_GIC_ID_MIXER,
+    EXT_GIC_ID_HDMI,
+    EXT_GIC_ID_HDMI_I2C,
+    EXT_GIC_ID_MFC,
+    EXT_GIC_ID_TVENC,
+};
+
+enum ExtInt {
+    EXT_GIC_ID_EXTINT0 = 48,
+    EXT_GIC_ID_EXTINT1,
+    EXT_GIC_ID_EXTINT2,
+    EXT_GIC_ID_EXTINT3,
+    EXT_GIC_ID_EXTINT4,
+    EXT_GIC_ID_EXTINT5,
+    EXT_GIC_ID_EXTINT6,
+    EXT_GIC_ID_EXTINT7,
+    EXT_GIC_ID_EXTINT8,
+    EXT_GIC_ID_EXTINT9,
+    EXT_GIC_ID_EXTINT10,
+    EXT_GIC_ID_EXTINT11,
+    EXT_GIC_ID_EXTINT12,
+    EXT_GIC_ID_EXTINT13,
+    EXT_GIC_ID_EXTINT14,
+    EXT_GIC_ID_EXTINT15
+};
+
+/*
+ * External GIC sources which are not from External Interrupt Combiner or
+ * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
+ * which is INTG16 in Internal Interrupt Combiner.
+ */
+
+static const uint32_t
+combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
+    /* int combiner groups 16-19 */
+    { }, { }, { }, { },
+    /* int combiner group 20 */
+    { 0, EXT_GIC_ID_MDMA_LCD0 },
+    /* int combiner group 21 */
+    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
+    /* int combiner group 22 */
+    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
+            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
+    /* int combiner group 23 */
+    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
+    /* int combiner group 24 */
+    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
+    /* int combiner group 25 */
+    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
+    /* int combiner group 26 */
+    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
+            EXT_GIC_ID_UART4 },
+    /* int combiner group 27 */
+    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
+            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
+            EXT_GIC_ID_I2C7 },
+    /* int combiner group 28 */
+    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
+    /* int combiner group 29 */
+    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
+     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
+    /* int combiner group 30 */
+    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
+    /* int combiner group 31 */
+    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
+    /* int combiner group 32 */
+    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
+    /* int combiner group 33 */
+    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
+    /* int combiner group 34 */
+    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
+    /* int combiner group 35 */
+    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* int combiner group 36 */
+    { EXT_GIC_ID_MIXER },
+    /* int combiner group 37 */
+    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
+     EXT_GIC_ID_EXTINT7 },
+    /* groups 38-50 */
+    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
+    /* int combiner group 51 */
+    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* group 52 */
+    { },
+    /* int combiner group 53 */
+    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    /* groups 54-63 */
+    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
+};
+
+/*
+ * Initialize board IRQs.
+ * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
+ */
+static void exynos4210_init_board_irqs(Exynos4210State *s)
+{
+    uint32_t grp, bit, irq_id, n;
+    Exynos4210Irq *is = &s->irqs;
+
+    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
+        irq_id = 0;
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
+                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
+            /* MCT_G0 is passed to External GIC */
+            irq_id = EXT_GIC_ID_MCT_G0;
+        }
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
+                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
+            /* MCT_G1 is passed to External and GIC */
+            irq_id = EXT_GIC_ID_MCT_G1;
+        }
+        if (irq_id) {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
+        } else {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_combiner_irq[n]);
+        }
+    }
+    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
+        /* these IDs are passed to Internal Combiner and External GIC */
+        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
+        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
+        irq_id = combiner_grp_to_gic_id[grp -
+                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
+
+        if (irq_id) {
+            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
+                    is->ext_gic_irq[irq_id - 32]);
+        }
+    }
+}
+
+/*
+ * Get IRQ number from exynos4210 IRQ subsystem stub.
+ * To identify IRQ source use internal combiner group and bit number
+ *  grp - group number
+ *  bit - bit number inside group
+ */
+uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
+{
+    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
+}
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/exynos4210.h"
 #include "qom/object.h"
 
-enum ExtGicId {
-    EXT_GIC_ID_MDMA_LCD0 = 66,
-    EXT_GIC_ID_PDMA0,
-    EXT_GIC_ID_PDMA1,
-    EXT_GIC_ID_TIMER0,
-    EXT_GIC_ID_TIMER1,
-    EXT_GIC_ID_TIMER2,
-    EXT_GIC_ID_TIMER3,
-    EXT_GIC_ID_TIMER4,
-    EXT_GIC_ID_MCT_L0,
-    EXT_GIC_ID_WDT,
-    EXT_GIC_ID_RTC_ALARM,
-    EXT_GIC_ID_RTC_TIC,
-    EXT_GIC_ID_GPIO_XB,
-    EXT_GIC_ID_GPIO_XA,
-    EXT_GIC_ID_MCT_L1,
-    EXT_GIC_ID_IEM_APC,
-    EXT_GIC_ID_IEM_IEC,
-    EXT_GIC_ID_NFC,
-    EXT_GIC_ID_UART0,
-    EXT_GIC_ID_UART1,
-    EXT_GIC_ID_UART2,
-    EXT_GIC_ID_UART3,
-    EXT_GIC_ID_UART4,
-    EXT_GIC_ID_MCT_G0,
-    EXT_GIC_ID_I2C0,
-    EXT_GIC_ID_I2C1,
-    EXT_GIC_ID_I2C2,
-    EXT_GIC_ID_I2C3,
-    EXT_GIC_ID_I2C4,
-    EXT_GIC_ID_I2C5,
-    EXT_GIC_ID_I2C6,
-    EXT_GIC_ID_I2C7,
-    EXT_GIC_ID_SPI0,
-    EXT_GIC_ID_SPI1,
-    EXT_GIC_ID_SPI2,
-    EXT_GIC_ID_MCT_G1,
-    EXT_GIC_ID_USB_HOST,
-    EXT_GIC_ID_USB_DEVICE,
-    EXT_GIC_ID_MODEMIF,
-    EXT_GIC_ID_HSMMC0,
-    EXT_GIC_ID_HSMMC1,
-    EXT_GIC_ID_HSMMC2,
-    EXT_GIC_ID_HSMMC3,
-    EXT_GIC_ID_SDMMC,
-    EXT_GIC_ID_MIPI_CSI_4LANE,
-    EXT_GIC_ID_MIPI_DSI_4LANE,
-    EXT_GIC_ID_MIPI_CSI_2LANE,
-    EXT_GIC_ID_MIPI_DSI_2LANE,
-    EXT_GIC_ID_ONENAND_AUDI,
-    EXT_GIC_ID_ROTATOR,
-    EXT_GIC_ID_FIMC0,
-    EXT_GIC_ID_FIMC1,
-    EXT_GIC_ID_FIMC2,
-    EXT_GIC_ID_FIMC3,
-    EXT_GIC_ID_JPEG,
-    EXT_GIC_ID_2D,
-    EXT_GIC_ID_PCIe,
-    EXT_GIC_ID_MIXER,
-    EXT_GIC_ID_HDMI,
-    EXT_GIC_ID_HDMI_I2C,
-    EXT_GIC_ID_MFC,
-    EXT_GIC_ID_TVENC,
-};
-
-enum ExtInt {
-    EXT_GIC_ID_EXTINT0 = 48,
-    EXT_GIC_ID_EXTINT1,
-    EXT_GIC_ID_EXTINT2,
-    EXT_GIC_ID_EXTINT3,
-    EXT_GIC_ID_EXTINT4,
-    EXT_GIC_ID_EXTINT5,
-    EXT_GIC_ID_EXTINT6,
-    EXT_GIC_ID_EXTINT7,
-    EXT_GIC_ID_EXTINT8,
-    EXT_GIC_ID_EXTINT9,
-    EXT_GIC_ID_EXTINT10,
-    EXT_GIC_ID_EXTINT11,
-    EXT_GIC_ID_EXTINT12,
-    EXT_GIC_ID_EXTINT13,
-    EXT_GIC_ID_EXTINT14,
-    EXT_GIC_ID_EXTINT15
-};
-
-/*
- * External GIC sources which are not from External Interrupt Combiner or
- * External Interrupts are starting from EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ,
- * which is INTG16 in Internal Interrupt Combiner.
- */
-
-static const uint32_t
-combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
-    /* int combiner groups 16-19 */
-    { }, { }, { }, { },
-    /* int combiner group 20 */
-    { 0, EXT_GIC_ID_MDMA_LCD0 },
-    /* int combiner group 21 */
-    { EXT_GIC_ID_PDMA0, EXT_GIC_ID_PDMA1 },
-    /* int combiner group 22 */
-    { EXT_GIC_ID_TIMER0, EXT_GIC_ID_TIMER1, EXT_GIC_ID_TIMER2,
-            EXT_GIC_ID_TIMER3, EXT_GIC_ID_TIMER4 },
-    /* int combiner group 23 */
-    { EXT_GIC_ID_RTC_ALARM, EXT_GIC_ID_RTC_TIC },
-    /* int combiner group 24 */
-    { EXT_GIC_ID_GPIO_XB, EXT_GIC_ID_GPIO_XA },
-    /* int combiner group 25 */
-    { EXT_GIC_ID_IEM_APC, EXT_GIC_ID_IEM_IEC },
-    /* int combiner group 26 */
-    { EXT_GIC_ID_UART0, EXT_GIC_ID_UART1, EXT_GIC_ID_UART2, EXT_GIC_ID_UART3,
-            EXT_GIC_ID_UART4 },
-    /* int combiner group 27 */
-    { EXT_GIC_ID_I2C0, EXT_GIC_ID_I2C1, EXT_GIC_ID_I2C2, EXT_GIC_ID_I2C3,
-            EXT_GIC_ID_I2C4, EXT_GIC_ID_I2C5, EXT_GIC_ID_I2C6,
-            EXT_GIC_ID_I2C7 },
-    /* int combiner group 28 */
-    { EXT_GIC_ID_SPI0, EXT_GIC_ID_SPI1, EXT_GIC_ID_SPI2 , EXT_GIC_ID_USB_HOST},
-    /* int combiner group 29 */
-    { EXT_GIC_ID_HSMMC0, EXT_GIC_ID_HSMMC1, EXT_GIC_ID_HSMMC2,
-     EXT_GIC_ID_HSMMC3, EXT_GIC_ID_SDMMC },
-    /* int combiner group 30 */
-    { EXT_GIC_ID_MIPI_CSI_4LANE, EXT_GIC_ID_MIPI_CSI_2LANE },
-    /* int combiner group 31 */
-    { EXT_GIC_ID_MIPI_DSI_4LANE, EXT_GIC_ID_MIPI_DSI_2LANE },
-    /* int combiner group 32 */
-    { EXT_GIC_ID_FIMC0, EXT_GIC_ID_FIMC1 },
-    /* int combiner group 33 */
-    { EXT_GIC_ID_FIMC2, EXT_GIC_ID_FIMC3 },
-    /* int combiner group 34 */
-    { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
-    /* int combiner group 35 */
-    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* int combiner group 36 */
-    { EXT_GIC_ID_MIXER },
-    /* int combiner group 37 */
-    { EXT_GIC_ID_EXTINT4, EXT_GIC_ID_EXTINT5, EXT_GIC_ID_EXTINT6,
-     EXT_GIC_ID_EXTINT7 },
-    /* groups 38-50 */
-    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
-    /* int combiner group 51 */
-    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* group 52 */
-    { },
-    /* int combiner group 53 */
-    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
-    /* groups 54-63 */
-    { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
-};
-
 #define EXYNOS4210_GIC_NIRQ 160
 
 #define EXYNOS4210_EXT_GIC_CPU_REGION_SIZE     0x10000
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-/*
- * Initialize board IRQs.
- * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
- */
-void exynos4210_init_board_irqs(Exynos4210State *s)
-{
-    uint32_t grp, bit, irq_id, n;
-    Exynos4210Irq *is = &s->irqs;
-
-    for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
-        irq_id = 0;
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
-            /* MCT_G0 is passed to External GIC */
-            irq_id = EXT_GIC_ID_MCT_G0;
-        }
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
-            /* MCT_G1 is passed to External and GIC */
-            irq_id = EXT_GIC_ID_MCT_G1;
-        }
-        if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
-        } else {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_combiner_irq[n]);
-        }
-    }
-    for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
-        /* these IDs are passed to Internal Combiner and External GIC */
-        grp = EXYNOS4210_COMBINER_GET_GRP_NUM(n);
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-        irq_id = combiner_grp_to_gic_id[grp -
-                     EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
-
-        if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
-        }
-    }
-}
-
-/*
- * Get IRQ number from exynos4210 IRQ subsystem stub.
- * To identify IRQ source use internal combiner group and bit number
- *  grp - group number
- *  bit - bit number inside group
- */
-uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
-{
-    return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
-}
-
-/********* GIC part *********/
-
 #define TYPE_EXYNOS4210_GIC "exynos4210.gic"
 OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
 
-- 
2.25.1

Switch the creation of the external GIC to the new-style "embedded in
state struct" approach, so we can easily refer to the object
elsewhere during realize.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-9-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h      |  2 ++
 include/hw/intc/exynos4210_gic.h | 43 ++++++++++++++++++++++++++++++++
 hw/arm/exynos4210.c              | 10 ++++----
 hw/intc/exynos4210_gic.c         | 17 ++-----------
 MAINTAINERS                      |  2 +-
 5 files changed, 53 insertions(+), 21 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_gic.h

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/or-irq.h"
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
+#include "hw/intc/exynos4210_gic.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq pl330_irq_orgate[EXYNOS4210_NUM_DMA];
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
+    Exynos4210GicState ext_gic;
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/include/hw/intc/exynos4210_gic.h b/include/hw/intc/exynos4210_gic.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/intc/exynos4210_gic.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Samsung exynos4210 GIC implementation. Based on hw/arm_gic.c
+ *
+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
+ * All rights reserved.
+ *
+ * Evgeny Voevodin <e.voevodin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef HW_INTC_EXYNOS4210_GIC_H
+#define HW_INTC_EXYNOS4210_GIC_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
+
+#define EXYNOS4210_GIC_NCPUS 2
+
+struct Exynos4210GicState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion cpu_container;
+    MemoryRegion dist_container;
+    MemoryRegion cpu_alias[EXYNOS4210_GIC_NCPUS];
+    MemoryRegion dist_alias[EXYNOS4210_GIC_NCPUS];
+    uint32_t num_cpu;
+    DeviceState *gic;
+};
+
+#endif
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     sysbus_create_simple("l2x0", EXYNOS4210_L2X0_BASE_ADDR, NULL);
 
     /* External GIC */
-    dev = qdev_new("exynos4210.gic");
-    qdev_prop_set_uint32(dev, "num-cpu", EXYNOS4210_NCPUS);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->ext_gic), "num-cpu", EXYNOS4210_NCPUS);
+    busdev = SYS_BUS_DEVICE(&s->ext_gic);
+    sysbus_realize(busdev, &error_fatal);
     /* Map CPU interface */
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_GIC_CPU_BASE_ADDR);
     /* Map Distributer interface */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
     for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
-        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(dev, n);
+        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
     }
 
     /* Internal Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
     }
 
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
+    object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/exynos4210_gic.c b/hw/intc/exynos4210_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_gic.c
+++ b/hw/intc/exynos4210_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "hw/intc/exynos4210_gic.h"
 #include "hw/arm/exynos4210.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_GIC_CPU_REGION_SIZE  0x100
 #define EXYNOS4210_GIC_DIST_REGION_SIZE 0x1000
 
-#define TYPE_EXYNOS4210_GIC "exynos4210.gic"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210GicState, EXYNOS4210_GIC)
-
-struct Exynos4210GicState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion cpu_container;
-    MemoryRegion dist_container;
-    MemoryRegion cpu_alias[EXYNOS4210_NCPUS];
-    MemoryRegion dist_alias[EXYNOS4210_NCPUS];
-    uint32_t num_cpu;
-    DeviceState *gic;
-};
-
 static void exynos4210_gic_set_irq(void *opaque, int irq, int level)
 {
     Exynos4210GicState *s = (Exynos4210GicState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gic_realize(DeviceState *dev, Error **errp)
      * enough room for the cpu numbers.  gcc 9.2.1 on 32-bit x86
      * doesn't figure this out, otherwise and gives spurious warnings.
      */
-    assert(n <= EXYNOS4210_NCPUS);
+    assert(n <= EXYNOS4210_GIC_NCPUS);
     for (i = 0; i < n; i++) {
         /* Map CPU interface per SMP Core */
         sprintf(cpu_alias_name, "%s%x", cpu_prefix, i);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/*/exynos*
-F: include/hw/arm/exynos4210.h
+F: include/hw/*/exynos*
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
-- 
2.25.1

The only time we use the ext_gic_irq[] array in the Exynos4210Irq
struct is during realize of the SoC -- we initialize it with the
input IRQs of the external GIC device, and then connect those to
outputs of other devices further on in realize (including in the
exynos4210_init_board_irqs() function).  Now that the ext_gic object
is easily accessible as s->ext_gic we can make the connections
directly from one device to the other without going via this array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-10-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  1 -
 hw/arm/exynos4210.c         | 12 ++++++------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-    qemu_irq ext_gic_irq[EXYNOS4210_EXT_GIC_NIRQ];
 } Exynos4210Irq;
 
 struct Exynos4210State {
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
     Exynos4210Irq *is = &s->irqs;
+    DeviceState *extgicdev = DEVICE(&s->ext_gic);
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         }
         if (irq_id) {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
+                                             qdev_get_gpio_in(extgicdev,
+                                                              irq_id - 32));
         } else {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
                     is->ext_combiner_irq[n]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
         if (irq_id) {
             s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_gic_irq[irq_id - 32]);
+                                             qdev_get_gpio_in(extgicdev,
+                                                              irq_id - 32));
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->cpu_irq_orgate[n]), 1));
     }
-    for (n = 0; n < EXYNOS4210_EXT_GIC_NIRQ; n++) {
-        s->irqs.ext_gic_irq[n] = qdev_get_gpio_in(DEVICE(&s->ext_gic), n);
-    }
 
     /* Internal Interrupt Combiner */
     dev = qdev_new("exynos4210.combiner");
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_realize_and_unref(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
-        sysbus_connect_irq(busdev, n, s->irqs.ext_gic_irq[n]);
+        sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
     exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
-- 
2.25.1

The function exynos4210_combiner_get_gpioin() currently lives in
exynos4210_combiner.c, but it isn't really part of the combiner
device itself -- it is a function that implements the wiring up of
some interrupt sources to multiple combiner inputs.  Move it to live
with the other SoC-level code in exynos4210.c, along with a few
macros previously defined in exynos4210.h which are now used only
in exynos4210.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-11-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h   | 11 -----
 hw/arm/exynos4210.c           | 82 +++++++++++++++++++++++++++++++++++
 hw/intc/exynos4210_combiner.c | 77 --------------------------------
 3 files changed, 82 insertions(+), 88 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #define EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ   \
     (EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ * 8)
 
-#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp)*8 + (bit))
-#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
-#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
-    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
-
 /* IRQs number for external and internal GIC */
 #define EXYNOS4210_EXT_GIC_NIRQ     (160-32)
 #define EXYNOS4210_INT_GIC_NIRQ     64
@@ -XXX,XX +XXX,XX @@ void exynos4210_write_secondary(ARMCPU *cpu,
  *  bit - bit number inside group */
 uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit);
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
-        int ext);
-
 /*
  * exynos4210 UART
  */
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 };
 
+#define EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit)  ((grp) * 8 + (bit))
+#define EXYNOS4210_COMBINER_GET_GRP_NUM(irq)       ((irq) / 8)
+#define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
+    ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
+
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
     return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 }
 
+/*
+ * Get Combiner input GPIO into irqs structure
+ */
+static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
+                                           DeviceState *dev, int ext)
+{
+    int n;
+    int bit;
+    int max;
+    qemu_irq *irq;
+
+    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
+        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
+    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
+
+    /*
+     * Some IRQs of Int/External Combiner are going to two Combiners groups,
+     * so let split them.
+     */
+    for (n = 0; n < max; n++) {
+
+        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
+
+        switch (n) {
+        /* MDNIE_LCD1 INTG1 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
+            continue;
+
+        /* TMU INTG3 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
+            continue;
+
+        /* LCD1 INTG12 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG12 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
+               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG35 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG51 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+
+        /* Multi-Core Timer INTG53 */
+        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
+             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
+            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
+                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
+            continue;
+        }
+
+        irq[n] = qdev_get_gpio_in(dev, n);
+    }
+}
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_combiner = {
     }
 };
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs, DeviceState *dev,
-        int ext)
-{
-    int n;
-    int bit;
-    int max;
-    qemu_irq *irq;
-
-    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
-        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
-    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
-
-    /*
-     * Some IRQs of Int/External Combiner are going to two Combiners groups,
-     * so let split them.
-     */
-    for (n = 0; n < max; n++) {
-
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-
-        switch (n) {
-        /* MDNIE_LCD1 INTG1 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
-            continue;
-
-        /* TMU INTG3 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
-            continue;
-
-        /* LCD1 INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
-               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG35 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG51 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG53 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-        }
-
-        irq[n] = qdev_get_gpio_in(dev, n);
-    }
-}
-
 static uint64_t
 exynos4210_combiner_read(void *opaque, hwaddr offset, unsigned size)
 {
-- 
2.25.1

In exynos4210_init_board_irqs(), use the TYPE_SPLIT_IRQ device
instead of qemu_irq_split().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-13-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  9 ++++++++
 hw/arm/exynos4210.c         | 41 +++++++++++++++++++++++++++++--------
 2 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/intc/exynos4210_gic.h"
+#include "hw/core/split-irq.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@
 
 #define EXYNOS4210_NUM_DMA      3
 
+/*
+ * We need one splitter for every external combiner input, plus
+ * one for every non-zero entry in combiner_grp_to_gic_id[].
+ * We'll assert in exynos4210_init_board_irqs() if this is wrong.
+ */
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
+
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
     qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
     Exynos4210GicState ext_gic;
+    SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
 };
 
 #define TYPE_EXYNOS4210_SOC "exynos4210"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
     uint32_t grp, bit, irq_id, n;
     Exynos4210Irq *is = &s->irqs;
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
+    int splitcount = 0;
+    DeviceState *splitter;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             /* MCT_G1 is passed to External and GIC */
             irq_id = EXT_GIC_ID_MCT_G1;
         }
+
+        assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
+        splitter = DEVICE(&s->splitter[splitcount]);
+        qdev_prop_set_uint16(splitter, "num-lines", 2);
+        qdev_realize(splitter, NULL, &error_abort);
+        splitcount++;
+        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
+        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
         if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                                             qdev_get_gpio_in(extgicdev,
-                                                              irq_id - 32));
+            qdev_connect_gpio_out(splitter, 1,
+                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
         } else {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                    is->ext_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
         if (irq_id) {
-            s->irq_table[n] = qemu_irq_split(is->int_combiner_irq[n],
-                                             qdev_get_gpio_in(extgicdev,
-                                                              irq_id - 32));
+            assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
+            splitter = DEVICE(&s->splitter[splitcount]);
+            qdev_prop_set_uint16(splitter, "num-lines", 2);
+            qdev_realize(splitter, NULL, &error_abort);
+            splitcount++;
+            s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
+            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 1,
+                                  qdev_get_gpio_in(extgicdev, irq_id - 32));
         }
     }
+    /*
+     * We check this here to avoid a more obscure assert later when
+     * qdev_assert_realized_properly() checks that we realized every
+     * child object we initialized.
+     */
+    assert(splitcount == EXYNOS4210_NUM_SPLITTERS);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
         object_initialize_child(obj, name, &s->cpu_irq_orgate[i], TYPE_OR_IRQ);
     }
 
+    for (i = 0; i < ARRAY_SIZE(s->splitter); i++) {
+        g_autofree char *name = g_strdup_printf("irq-splitter%d", i);
+        object_initialize_child(obj, name, &s->splitter[i], TYPE_SPLIT_IRQ);
+    }
+
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
 }
-- 
2.25.1

In exynos4210_init_board_irqs(), the loop that handles IRQ lines that
are in a range that applies to the internal combiner only creates a
splitter for those interrupts which go to both the internal combiner
and to the external GIC, but it does nothing at all for the
interrupts which don't go to the external GIC, leaving the
irq_table[] array element empty for those.  (This will result in
those interrupts simply being lost, not in a QEMU crash.)

I don't have a reliable datasheet for this SoC, but since we do wire
up one interrupt line in this category (the HDMI I2C device on
interrupt 16,1), this seems like it must be a bug in the existing
QEMU code.  Fill in the irq_table[] entries where we're not splitting
the IRQ to both the internal combiner and the external GIC with the
IRQ line of the internal combiner.  (That is, these IRQ lines go to
just one device, not multiple.)

This bug didn't have any visible guest effects because the only
implemented device that was affected was the HDMI I2C controller,
and we never connect any I2C devices to that bus.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-14-peter.maydell@linaro.org
---
 hw/arm/exynos4210.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
             qdev_connect_gpio_out(splitter, 1,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
+        } else {
+            s->irq_table[n] = is->int_combiner_irq[n];
         }
     }
     /*
-- 
2.25.1

Currently for the interrupts MCT_G0 and MCT_G1 which are
the only ones in the input range of the external combiner
and which are also wired to the external GIC, we connect
them only to the internal combiner and the external GIC.
This seems likely to be a bug, as all other interrupts
which are in the input range of both combiners are
connected to both combiners. (The fact that the code in
exynos4210_combiner_get_gpioin() is also trying to wire
up these inputs on both combiners also suggests this.)

Wire these interrupts up to both combiners, like the rest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-15-peter.maydell@linaro.org
---
 hw/arm/exynos4210.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
         splitter = DEVICE(&s->splitter[splitcount]);
-        qdev_prop_set_uint16(splitter, "num-lines", 2);
+        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
         qdev_realize(splitter, NULL, &error_abort);
         splitcount++;
         s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
         qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         if (irq_id) {
-            qdev_connect_gpio_out(splitter, 1,
+            qdev_connect_gpio_out(splitter, 2,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
-        } else {
-            qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
         }
     }
     for (; n < EXYNOS4210_MAX_INT_COMBINER_IN_IRQ; n++) {
-- 
2.25.1

The combiner_grp_to_gic_id[] array includes the EXT_GIC_ID_MCT_G0
and EXT_GIC_ID_MCT_G1 multiple times. This means that we will
connect multiple IRQs up to the same external GIC input, which
is not permitted. We do the same thing in the code in
exynos4210_init_board_irqs() because the conditionals selecting
an irq_id in the first loop match multiple interrupt IDs.

Overall we do this for interrupt IDs
(1, 4), (12, 4), (35, 4), (51, 4), (53, 4) for EXT_GIC_ID_MCT_G0
and
(1, 5), (12, 5), (35, 5), (51, 5), (53, 5) for EXT_GIC_ID_MCT_G1

These correspond to the cases for the multi-core timer that we are
wiring up to multiple inputs on the combiner in
exynos4210_combiner_get_gpioin().  That code already deals with all
these interrupt IDs being the same input source, so we don't need to
connect the external GIC interrupt for any of them except the first
(1, 4) and (1, 5). Remove the array entries and conditionals which
were incorrectly causing us to wire up extra lines.

This bug didn't cause any visible effects, because we only connect
up a device to the "primary" ID values (1, 4) and (1, 5), so the
extra lines would never be set to a level.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-16-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  2 +-
 hw/arm/exynos4210.c         | 12 +++++-------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
  * one for every non-zero entry in combiner_grp_to_gic_id[].
  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
  */
-#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 60)
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
 
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     /* int combiner group 34 */
     { EXT_GIC_ID_ONENAND_AUDI, EXT_GIC_ID_NFC },
     /* int combiner group 35 */
-    { 0, 0, 0, EXT_GIC_ID_MCT_L1, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { 0, 0, 0, EXT_GIC_ID_MCT_L1 },
     /* int combiner group 36 */
     { EXT_GIC_ID_MIXER },
     /* int combiner group 37 */
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
     /* groups 38-50 */
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { }, { },
     /* int combiner group 51 */
-    { EXT_GIC_ID_MCT_L0, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { EXT_GIC_ID_MCT_L0 },
     /* group 52 */
     { },
     /* int combiner group 53 */
-    { EXT_GIC_ID_WDT, 0, 0, 0, EXT_GIC_ID_MCT_G0, EXT_GIC_ID_MCT_G1 },
+    { EXT_GIC_ID_WDT },
     /* groups 54-63 */
     { }, { }, { }, { }, { }, { }, { }, { }, { }, { }
 };
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4)) {
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 4)) {
             /* MCT_G0 is passed to External GIC */
             irq_id = EXT_GIC_ID_MCT_G0;
         }
-        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5) ||
-                n == EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 5)) {
+        if (n == EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 5)) {
             /* MCT_G1 is passed to External and GIC */
             irq_id = EXT_GIC_ID_MCT_G1;
         }
-- 
2.25.1

At this point, the function exynos4210_init_board_irqs() splits input
IRQ lines to connect them to the input combiner, output combiner and
external GIC.  The function exynos4210_combiner_get_gpioin() splits
some of the combiner input lines further to connect them to multiple
different inputs on the combiner.

Because (unlike qemu_irq_split()) the TYPE_SPLIT_IRQ device has a
configurable number of outputs, we can do all this in one place, by
making exynos4210_init_board_irqs() add extra outputs to the splitter
device when it must be connected to more than one input on each
combiner.

We do this with a new data structure, the combinermap, which is an
array each of whose elements is a list of the interrupt IDs on the
combiner which must be tied together.  As we loop through each
interrupt ID, if we find that it is the first one in one of these
lists, we configure the splitter device with eonugh extra outputs and
wire them up to the other interrupt IDs in the list.

Conveniently, for all the cases where this is necessary, the
lowest-numbered interrupt ID in each group is in the range of the
external combiner, so we only need to code for this in the first of
the two loops in exynos4210_init_board_irqs().

The old code in exynos4210_combiner_get_gpioin() which is being
deleted here had several problems which don't exist in the new code
in its handling of the multi-core timer interrupts:
 (1) the case labels specified bits 4 ... 8, but bit '8' doesn't
     exist; these should have been 4 ... 7
 (2) it used the input irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]
     multiple times as the input of several different splitters,
     which isn't allowed
 (3) in an apparent cut-and-paste error, the cases for all the
     multi-core timer inputs used "bit + 4" even though the
     bit range for the case was (intended to be) 4 ... 7, which
     meant it was looking at non-existent bits 8 ... 11.
None of these exist in the new code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-17-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |   6 +-
 hw/arm/exynos4210.c         | 178 +++++++++++++++++++++++-------------
 2 files changed, 119 insertions(+), 65 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 
 /*
  * We need one splitter for every external combiner input, plus
- * one for every non-zero entry in combiner_grp_to_gic_id[].
+ * one for every non-zero entry in combiner_grp_to_gic_id[],
+ * minus one for every external combiner ID in second or later
+ * places in a combinermap[] line.
  * We'll assert in exynos4210_init_board_irqs() if this is wrong.
  */
-#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 54)
+#define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
 
 typedef struct Exynos4210Irq {
     qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ combiner_grp_to_gic_id[64 - EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][8] = {
 #define EXYNOS4210_COMBINER_GET_BIT_NUM(irq) \
     ((irq) - 8 * EXYNOS4210_COMBINER_GET_GRP_NUM(irq))
 
+/*
+ * Some interrupt lines go to multiple combiner inputs.
+ * This data structure defines those: each array element is
+ * a list of combiner inputs which are connected together;
+ * the one with the smallest interrupt ID value must be first.
+ * As with combiner_grp_to_gic_id[], we rely on (0, 0) not being
+ * wired to anything so we can use 0 as a terminator.
+ */
+#define IRQNO(G, B) EXYNOS4210_COMBINER_GET_IRQ_NUM(G, B)
+#define IRQNONE 0
+
+#define COMBINERMAP_SIZE 16
+
+static const int combinermap[COMBINERMAP_SIZE][6] = {
+    /* MDNIE_LCD1 */
+    { IRQNO(0, 4), IRQNO(1, 0), IRQNONE },
+    { IRQNO(0, 5), IRQNO(1, 1), IRQNONE },
+    { IRQNO(0, 6), IRQNO(1, 2), IRQNONE },
+    { IRQNO(0, 7), IRQNO(1, 3), IRQNONE },
+    /* TMU */
+    { IRQNO(2, 4), IRQNO(3, 4), IRQNONE },
+    { IRQNO(2, 5), IRQNO(3, 5), IRQNONE },
+    { IRQNO(2, 6), IRQNO(3, 6), IRQNONE },
+    { IRQNO(2, 7), IRQNO(3, 7), IRQNONE },
+    /* LCD1 */
+    { IRQNO(11, 4), IRQNO(12, 0), IRQNONE },
+    { IRQNO(11, 5), IRQNO(12, 1), IRQNONE },
+    { IRQNO(11, 6), IRQNO(12, 2), IRQNONE },
+    { IRQNO(11, 7), IRQNO(12, 3), IRQNONE },
+    /* Multi-core timer */
+    { IRQNO(1, 4), IRQNO(12, 4), IRQNO(35, 4), IRQNO(51, 4), IRQNO(53, 4), IRQNONE },
+    { IRQNO(1, 5), IRQNO(12, 5), IRQNO(35, 5), IRQNO(51, 5), IRQNO(53, 5), IRQNONE },
+    { IRQNO(1, 6), IRQNO(12, 6), IRQNO(35, 6), IRQNO(51, 6), IRQNO(53, 6), IRQNONE },
+    { IRQNO(1, 7), IRQNO(12, 7), IRQNO(35, 7), IRQNO(51, 7), IRQNO(53, 7), IRQNONE },
+};
+
+#undef IRQNO
+
+static const int *combinermap_entry(int irq)
+{
+    /*
+     * If the interrupt number passed in is the first entry in some
+     * line of the combinermap, return a pointer to that line;
+     * otherwise return NULL.
+     */
+    int i;
+    for (i = 0; i < COMBINERMAP_SIZE; i++) {
+        if (combinermap[i][0] == irq) {
+            return combinermap[i];
+        }
+    }
+    return NULL;
+}
+
+static int mapline_size(const int *mapline)
+{
+    /* Return number of entries in this mapline in total */
+    int i = 0;
+
+    if (!mapline) {
+        /* Not in the map? IRQ goes to exactly one combiner input */
+        return 1;
+    }
+    while (*mapline != IRQNONE) {
+        mapline++;
+        i++;
+    }
+    return i;
+}
+
 /*
  * Initialize board IRQs.
  * These IRQs contain splitted Int/External Combiner and External Gic IRQs.
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
     int splitcount = 0;
     DeviceState *splitter;
+    const int *mapline;
+    int numlines, splitin, in;
 
     for (n = 0; n < EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ; n++) {
         irq_id = 0;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             irq_id = EXT_GIC_ID_MCT_G1;
         }
 
+        if (s->irq_table[n]) {
+            /*
+             * This must be some non-first entry in a combinermap line,
+             * and we've already filled it in.
+             */
+            continue;
+        }
+        mapline = combinermap_entry(n);
+        /*
+         * We need to connect the IRQ to multiple inputs on both combiners
+         * and possibly also to the external GIC.
+         */
+        numlines = 2 * mapline_size(mapline);
+        if (irq_id) {
+            numlines++;
+        }
         assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
         splitter = DEVICE(&s->splitter[splitcount]);
-        qdev_prop_set_uint16(splitter, "num-lines", irq_id ? 3 : 2);
+        qdev_prop_set_uint16(splitter, "num-lines", numlines);
         qdev_realize(splitter, NULL, &error_abort);
         splitcount++;
-        s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
-        qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
-        qdev_connect_gpio_out(splitter, 1, is->ext_combiner_irq[n]);
+
+        in = n;
+        splitin = 0;
+        for (;;) {
+            s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
+            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
+            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
+            splitin += 2;
+            if (!mapline) {
+                break;
+            }
+            mapline++;
+            in = *mapline;
+            if (in == IRQNONE) {
+                break;
+            }
+        }
         if (irq_id) {
-            qdev_connect_gpio_out(splitter, 2,
+            qdev_connect_gpio_out(splitter, splitin,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
         }
     }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         irq_id = combiner_grp_to_gic_id[grp -
                      EXYNOS4210_MAX_EXT_COMBINER_OUT_IRQ][bit];
 
+        if (s->irq_table[n]) {
+            /*
+             * This must be some non-first entry in a combinermap line,
+             * and we've already filled it in.
+             */
+            continue;
+        }
+
         if (irq_id) {
             assert(splitcount < EXYNOS4210_NUM_SPLITTERS);
             splitter = DEVICE(&s->splitter[splitcount]);
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
                                            DeviceState *dev, int ext)
 {
     int n;
-    int bit;
     int max;
     qemu_irq *irq;
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
         EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
     irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
 
-    /*
-     * Some IRQs of Int/External Combiner are going to two Combiners groups,
-     * so let split them.
-     */
     for (n = 0; n < max; n++) {
-
-        bit = EXYNOS4210_COMBINER_GET_BIT_NUM(n);
-
-        switch (n) {
-        /* MDNIE_LCD1 INTG1 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(1, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(0, bit + 4)]);
-            continue;
-
-        /* TMU INTG3 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(3, 4):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(2, bit)]);
-            continue;
-
-        /* LCD1 INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 0) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 3):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(11, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG12 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(12, 8):
-               irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                       irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG35 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(35, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG51 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(51, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-
-        /* Multi-Core Timer INTG53 */
-        case EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 4) ...
-             EXYNOS4210_COMBINER_GET_IRQ_NUM(53, 8):
-            irq[n] = qemu_irq_split(qdev_get_gpio_in(dev, n),
-                    irq[EXYNOS4210_COMBINER_GET_IRQ_NUM(1, bit + 4)]);
-            continue;
-        }
-
         irq[n] = qdev_get_gpio_in(dev, n);
     }
 }
-- 
2.25.1

Switch the creation of the combiner devices to the new-style
"embedded in state struct" approach, so we can easily refer
to the object elsewhere during realize.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-18-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h           |  3 ++
 include/hw/intc/exynos4210_combiner.h | 57 +++++++++++++++++++++++++++
 hw/arm/exynos4210.c                   | 20 +++++-----
 hw/intc/exynos4210_combiner.c         | 31 +--------------
 4 files changed, 72 insertions(+), 39 deletions(-)
 create mode 100644 include/hw/intc/exynos4210_combiner.h

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/intc/exynos4210_gic.h"
+#include "hw/intc/exynos4210_combiner.h"
 #include "hw/core/split-irq.h"
 #include "target/arm/cpu-qom.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct Exynos4210State {
     qemu_or_irq cpu_irq_orgate[EXYNOS4210_NCPUS];
     A9MPPrivState a9mpcore;
     Exynos4210GicState ext_gic;
+    Exynos4210CombinerState int_combiner;
+    Exynos4210CombinerState ext_combiner;
     SplitIRQ splitter[EXYNOS4210_NUM_SPLITTERS];
 };
 
diff --git a/include/hw/intc/exynos4210_combiner.h b/include/hw/intc/exynos4210_combiner.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/intc/exynos4210_combiner.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Samsung exynos4210 Interrupt Combiner
+ *
+ * Copyright (c) 2000 - 2011 Samsung Electronics Co., Ltd.
+ * All rights reserved.
+ *
+ * Evgeny Voevodin <e.voevodin@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_INTC_EXYNOS4210_COMBINER
+#define HW_INTC_EXYNOS4210_COMBINER
+
+#include "hw/sysbus.h"
+
+/*
+ * State for each output signal of internal combiner
+ */
+typedef struct CombinerGroupState {
+    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
+    uint8_t src_pending;        /* Pending source interrupts before masking */
+} CombinerGroupState;
+
+#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
+OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
+
+/* Number of groups and total number of interrupts for the internal combiner */
+#define IIC_NGRP 64
+#define IIC_NIRQ (IIC_NGRP * 8)
+#define IIC_REGSET_SIZE 0x41
+
+struct Exynos4210CombinerState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+
+    struct CombinerGroupState group[IIC_NGRP];
+    uint32_t reg_set[IIC_REGSET_SIZE];
+    uint32_t icipsr[2];
+    uint32_t external;          /* 1 means that this combiner is external */
+
+    qemu_irq output_irq[IIC_NGRP];
+};
+
+#endif
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     }
 
     /* Internal Interrupt Combiner */
-    dev = qdev_new("exynos4210.combiner");
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    busdev = SYS_BUS_DEVICE(&s->int_combiner);
+    sysbus_realize(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 0);
+    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
 
     /* External Interrupt Combiner */
-    dev = qdev_new("exynos4210.combiner");
-    qdev_prop_set_uint32(dev, "external", 1);
-    busdev = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(busdev, &error_fatal);
+    qdev_prop_set_uint32(DEVICE(&s->ext_combiner), "external", 1);
+    busdev = SYS_BUS_DEVICE(&s->ext_combiner);
+    sysbus_realize(busdev, &error_fatal);
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, dev, 1);
+    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init(Object *obj)
 
     object_initialize_child(obj, "a9mpcore", &s->a9mpcore, TYPE_A9MPCORE_PRIV);
     object_initialize_child(obj, "ext-gic", &s->ext_gic, TYPE_EXYNOS4210_GIC);
+    object_initialize_child(obj, "int-combiner", &s->int_combiner,
+                            TYPE_EXYNOS4210_COMBINER);
+    object_initialize_child(obj, "ext-combiner", &s->ext_combiner,
+                            TYPE_EXYNOS4210_COMBINER);
 }
 
 static void exynos4210_class_init(ObjectClass *klass, void *data)
diff --git a/hw/intc/exynos4210_combiner.c b/hw/intc/exynos4210_combiner.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/exynos4210_combiner.c
+++ b/hw/intc/exynos4210_combiner.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
-
+#include "hw/intc/exynos4210_combiner.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
 #define DPRINTF(fmt, ...) do {} while (0)
 #endif
 
-#define    IIC_NGRP        64            /* Internal Interrupt Combiner
-                                            Groups number */
-#define    IIC_NIRQ        (IIC_NGRP * 8)/* Internal Interrupt Combiner
-                                            Interrupts number */
 #define IIC_REGION_SIZE    0x108         /* Size of memory mapped region */
-#define IIC_REGSET_SIZE    0x41
-
-/*
- * State for each output signal of internal combiner
- */
-typedef struct CombinerGroupState {
-    uint8_t src_mask;            /* 1 - source enabled, 0 - disabled */
-    uint8_t src_pending;        /* Pending source interrupts before masking */
-} CombinerGroupState;
-
-#define TYPE_EXYNOS4210_COMBINER "exynos4210.combiner"
-OBJECT_DECLARE_SIMPLE_TYPE(Exynos4210CombinerState, EXYNOS4210_COMBINER)
-
-struct Exynos4210CombinerState {
-    SysBusDevice parent_obj;
-
-    MemoryRegion iomem;
-
-    struct CombinerGroupState group[IIC_NGRP];
-    uint32_t reg_set[IIC_REGSET_SIZE];
-    uint32_t icipsr[2];
-    uint32_t external;          /* 1 means that this combiner is external */
-
-    qemu_irq output_irq[IIC_NGRP];
-};
 
 static const VMStateDescription vmstate_exynos4210_combiner_group_state = {
     .name = "exynos4210.combiner.groupstate",
-- 
2.25.1

The only time we use the int_combiner_irq[] and ext_combiner_irq[]
arrays in the Exynos4210Irq struct is during realize of the SoC -- we
initialize them with the input IRQs of the combiner devices, and then
connect those to outputs of other devices in
exynos4210_init_board_irqs().  Now that the combiner objects are
easily accessible as s->int_combiner and s->ext_combiner we can make
the connections directly from one device to the other without going
via these arrays.

Since these are the only two remaining elements of Exynos4210Irq,
we can remove that struct entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220404154658.565020-19-peter.maydell@linaro.org
---
 include/hw/arm/exynos4210.h |  6 ------
 hw/arm/exynos4210.c         | 34 ++++++++--------------------------
 2 files changed, 8 insertions(+), 32 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@
  */
 #define EXYNOS4210_NUM_SPLITTERS (EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ + 38)
 
-typedef struct Exynos4210Irq {
-    qemu_irq int_combiner_irq[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
-    qemu_irq ext_combiner_irq[EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ];
-} Exynos4210Irq;
-
 struct Exynos4210State {
     /*< private >*/
     SysBusDevice parent_obj;
     /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
-    Exynos4210Irq irqs;
     qemu_irq irq_table[EXYNOS4210_MAX_INT_COMBINER_IN_IRQ];
 
     MemoryRegion chipid_mem;
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static int mapline_size(const int *mapline)
 static void exynos4210_init_board_irqs(Exynos4210State *s)
 {
     uint32_t grp, bit, irq_id, n;
-    Exynos4210Irq *is = &s->irqs;
     DeviceState *extgicdev = DEVICE(&s->ext_gic);
+    DeviceState *intcdev = DEVICE(&s->int_combiner);
+    DeviceState *extcdev = DEVICE(&s->ext_combiner);
     int splitcount = 0;
     DeviceState *splitter;
     const int *mapline;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
         splitin = 0;
         for (;;) {
             s->irq_table[in] = qdev_get_gpio_in(splitter, 0);
-            qdev_connect_gpio_out(splitter, splitin, is->int_combiner_irq[in]);
-            qdev_connect_gpio_out(splitter, splitin + 1, is->ext_combiner_irq[in]);
+            qdev_connect_gpio_out(splitter, splitin,
+                                  qdev_get_gpio_in(intcdev, in));
+            qdev_connect_gpio_out(splitter, splitin + 1,
+                                  qdev_get_gpio_in(extcdev, in));
             splitin += 2;
             if (!mapline) {
                 break;
@@ -XXX,XX +XXX,XX @@ static void exynos4210_init_board_irqs(Exynos4210State *s)
             qdev_realize(splitter, NULL, &error_abort);
             splitcount++;
             s->irq_table[n] = qdev_get_gpio_in(splitter, 0);
-            qdev_connect_gpio_out(splitter, 0, is->int_combiner_irq[n]);
+            qdev_connect_gpio_out(splitter, 0, qdev_get_gpio_in(intcdev, n));
             qdev_connect_gpio_out(splitter, 1,
                                   qdev_get_gpio_in(extgicdev, irq_id - 32));
         } else {
-            s->irq_table[n] = is->int_combiner_irq[n];
+            s->irq_table[n] = qdev_get_gpio_in(intcdev, n);
         }
     }
     /*
@@ -XXX,XX +XXX,XX @@ uint32_t exynos4210_get_irq(uint32_t grp, uint32_t bit)
     return EXYNOS4210_COMBINER_GET_IRQ_NUM(grp, bit);
 }
 
-/*
- * Get Combiner input GPIO into irqs structure
- */
-static void exynos4210_combiner_get_gpioin(Exynos4210Irq *irqs,
-                                           DeviceState *dev, int ext)
-{
-    int n;
-    int max;
-    qemu_irq *irq;
-
-    max = ext ? EXYNOS4210_MAX_EXT_COMBINER_IN_IRQ :
-        EXYNOS4210_MAX_INT_COMBINER_IN_IRQ;
-    irq = ext ? irqs->ext_combiner_irq : irqs->int_combiner_irq;
-
-    for (n = 0; n < max; n++) {
-        irq[n] = qdev_get_gpio_in(dev, n);
-    }
-}
-
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
         sysbus_connect_irq(busdev, n,
                            qdev_get_gpio_in(DEVICE(&s->a9mpcore), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->int_combiner), 0);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_INT_COMBINER_BASE_ADDR);
 
     /* External Interrupt Combiner */
@@ -XXX,XX +XXX,XX @@ static void exynos4210_realize(DeviceState *socdev, Error **errp)
     for (n = 0; n < EXYNOS4210_MAX_INT_COMBINER_OUT_IRQ; n++) {
         sysbus_connect_irq(busdev, n, qdev_get_gpio_in(DEVICE(&s->ext_gic), n));
     }
-    exynos4210_combiner_get_gpioin(&s->irqs, DEVICE(&s->ext_combiner), 1);
     sysbus_mmio_map(busdev, 0, EXYNOS4210_EXT_COMBINER_BASE_ADDR);
 
     /* Initialize board IRQs. */
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-2-zongyuan.li@smartx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/realview.c | 33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
+#include "hw/core/split-irq.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
 #include "hw/pci/pci.h"
+#include "hw/qdev-core.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static const int realview_board_id[] = {
     0x76d
 };
 
+static void split_irq_from_named(DeviceState *src, const char* outname,
+                                 qemu_irq out1, qemu_irq out2) {
+    DeviceState *splitter = qdev_new(TYPE_SPLIT_IRQ);
+
+    qdev_prop_set_uint32(splitter, "num-lines", 2);
+
+    qdev_realize_and_unref(splitter, NULL, &error_fatal);
+
+    qdev_connect_gpio_out(splitter, 0, out1);
+    qdev_connect_gpio_out(splitter, 1, out2);
+    qdev_connect_gpio_out_named(src, outname, 0,
+                                qdev_get_gpio_in(splitter, 0));
+}
+
 static void realview_init(MachineState *machine,
                           enum realview_board_type board_type)
 {
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
     DeviceState *dev, *sysctl, *gpio2, *pl041;
     SysBusDevice *busdev;
     qemu_irq pic[64];
-    qemu_irq mmc_irq[2];
     PCIBus *pci_bus = NULL;
     NICInfo *nd;
     DriveInfo *dinfo;
@@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine,
      * and the PL061 has them the other way about. Also the card
      * detect line is inverted.
      */
-    mmc_irq[0] = qemu_irq_split(
-        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
-        qdev_get_gpio_in(gpio2, 1));
-    mmc_irq[1] = qemu_irq_split(
-        qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
-        qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
-    qdev_connect_gpio_out_named(dev, "card-read-only", 0, mmc_irq[0]);
-    qdev_connect_gpio_out_named(dev, "card-inserted", 0, mmc_irq[1]);
+    split_irq_from_named(dev, "card-read-only",
+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_WPROT),
+                   qdev_get_gpio_in(gpio2, 1));
+
+    split_irq_from_named(dev, "card-inserted",
+                   qdev_get_gpio_in(sysctl, ARM_SYSCTL_GPIO_MMC_CARDIN),
+                   qemu_irq_invert(qdev_get_gpio_in(gpio2, 0)));
+
     dinfo = drive_get(IF_SD, 0, 0);
     if (dinfo) {
         DeviceState *card;
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-3-zongyuan.li@smartx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "hw/core/split-irq.h"
 #include "hw/sysbus.h"
 #include "hw/sd/sd.h"
 #include "hw/ssi/ssi.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             DeviceState *ssddev;
             DriveInfo *dinfo;
             DeviceState *carddev;
+            DeviceState *gpio_d_splitter;
             BlockBackend *blk;
 
             /*
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
                                    &error_fatal);
 
             ssddev = ssi_create_peripheral(bus, "ssd0323");
-            gpio_out[GPIO_D][0] = qemu_irq_split(
-                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0),
+
+            gpio_d_splitter = qdev_new(TYPE_SPLIT_IRQ);
+            qdev_prop_set_uint32(gpio_d_splitter, "num-lines", 2);
+            qdev_realize_and_unref(gpio_d_splitter, NULL, &error_fatal);
+            qdev_connect_gpio_out(
+                    gpio_d_splitter, 0,
+                    qdev_get_gpio_in_named(sddev, SSI_GPIO_CS, 0));
+            qdev_connect_gpio_out(
+                    gpio_d_splitter, 1,
                     qdev_get_gpio_in_named(ssddev, SSI_GPIO_CS, 0));
+            gpio_out[GPIO_D][0] = qdev_get_gpio_in(gpio_d_splitter, 0);
+
             gpio_out[GPIO_C][7] = qdev_get_gpio_in(ssddev, 0);
 
             /* Make sure the select pin is high.  */
-- 
2.25.1

From: Zongyuan Li <zongyuan.li@smartx.com>

Signed-off-by: Zongyuan Li <zongyuan.li@smartx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220324181557.203805-5-zongyuan.li@smartx.com
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/811
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/irq.h |  5 -----
 hw/core/irq.c    | 15 ---------------
 2 files changed, 20 deletions(-)

diff --git a/include/hw/irq.h b/include/hw/irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -XXX,XX +XXX,XX @@ void qemu_free_irq(qemu_irq irq);
 /* Returns a new IRQ with opposite polarity.  */
 qemu_irq qemu_irq_invert(qemu_irq irq);
 
-/* Returns a new IRQ which feeds into both the passed IRQs.
- * It's probably better to use the TYPE_SPLIT_IRQ device instead.
- */
-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
-
 /* For internal use in qtest.  Similar to qemu_irq_split, but operating
    on an existing vector of qemu_irq.  */
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
diff --git a/hw/core/irq.c b/hw/core/irq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_invert(qemu_irq irq)
     return qemu_allocate_irq(qemu_notirq, irq, 0);
 }
 
-static void qemu_splitirq(void *opaque, int line, int level)
-{
-    struct IRQState **irq = opaque;
-    irq[0]->handler(irq[0]->opaque, irq[0]->n, level);
-    irq[1]->handler(irq[1]->opaque, irq[1]->n, level);
-}
-
-qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2)
-{
-    qemu_irq *s = g_new0(qemu_irq, 2);
-    s[0] = irq1;
-    s[1] = irq2;
-    return qemu_allocate_irq(qemu_splitirq, s, 0);
-}
-
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n)
 {
     int i;
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

Similar to the Aspeed code in include/misc/aspeed_scu.h, we define
the PWRON STRAP fields in their corresponding module for NPCM7XX.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20220411165842.3912945-2-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/npcm7xx_gcr.h | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/include/hw/misc/npcm7xx_gcr.h b/include/hw/misc/npcm7xx_gcr.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/npcm7xx_gcr.h
+++ b/include/hw/misc/npcm7xx_gcr.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 
+/*
+ * NPCM7XX PWRON STRAP bit fields
+ * 12: SPI0 powered by VSBV3 at 1.8V
+ * 11: System flash attached to BMC
+ * 10: BSP alternative pins.
+ * 9:8: Flash UART command route enabled.
+ * 7: Security enabled.
+ * 6: HI-Z state control.
+ * 5: ECC disabled.
+ * 4: Reserved
+ * 3: JTAG2 enabled.
+ * 2:0: CPU and DRAM clock frequency.
+ */
+#define NPCM7XX_PWRON_STRAP_SPI0F18                 BIT(12)
+#define NPCM7XX_PWRON_STRAP_SFAB                    BIT(11)
+#define NPCM7XX_PWRON_STRAP_BSPA                    BIT(10)
+#define NPCM7XX_PWRON_STRAP_FUP(x)                  ((x) << 8)
+#define     FUP_NORM_UART2      3
+#define     FUP_PROG_UART3      2
+#define     FUP_PROG_UART2      1
+#define     FUP_NORM_UART3      0
+#define NPCM7XX_PWRON_STRAP_SECEN                   BIT(7)
+#define NPCM7XX_PWRON_STRAP_HIZ                     BIT(6)
+#define NPCM7XX_PWRON_STRAP_ECC                     BIT(5)
+#define NPCM7XX_PWRON_STRAP_RESERVE1                BIT(4)
+#define NPCM7XX_PWRON_STRAP_J2EN                    BIT(3)
+#define NPCM7XX_PWRON_STRAP_CKFRQ(x)                (x)
+#define     CKFRQ_SKIPINIT      0x000
+#define     CKFRQ_DEFAULT       0x111
+
 /*
  * Number of registers in our device state structure. Don't change this without
  * incrementing the version_id in the vmstate.
-- 
2.25.1

From: Hao Wu <wuhaotsh@google.com>

This patch uses the defined fields to describe PWRON STRAPs for
better readability.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20220411165842.3912945-3-wuhaotsh@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/npcm7xx_boards.c | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "sysemu/block-backend.h"
 
-#define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
-#define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
-#define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
-#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
-#define MORI_BMC_POWER_ON_STRAPS 0x00001fff
+#define NPCM7XX_POWER_ON_STRAPS_DEFAULT (           \
+        NPCM7XX_PWRON_STRAP_SPI0F18 |               \
+        NPCM7XX_PWRON_STRAP_SFAB |                  \
+        NPCM7XX_PWRON_STRAP_BSPA |                  \
+        NPCM7XX_PWRON_STRAP_FUP(FUP_NORM_UART2) |   \
+        NPCM7XX_PWRON_STRAP_SECEN |                 \
+        NPCM7XX_PWRON_STRAP_HIZ |                   \
+        NPCM7XX_PWRON_STRAP_ECC |                   \
+        NPCM7XX_PWRON_STRAP_RESERVE1 |              \
+        NPCM7XX_PWRON_STRAP_J2EN |                  \
+        NPCM7XX_PWRON_STRAP_CKFRQ(CKFRQ_DEFAULT))
+
+#define NPCM750_EVB_POWER_ON_STRAPS ( \
+        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_J2EN)
+#define QUANTA_GSJ_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
+#define QUANTA_GBS_POWER_ON_STRAPS ( \
+        NPCM7XX_POWER_ON_STRAPS_DEFAULT & ~NPCM7XX_PWRON_STRAP_SFAB)
+#define KUDO_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
+#define MORI_BMC_POWER_ON_STRAPS NPCM7XX_POWER_ON_STRAPS_DEFAULT
 
 static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 
-- 
2.25.1

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1