Series comparison

-[PULL 00/26] target-arm queue
+[PULL 00/14] target-arm queue
-Hi; here's a target-arm pullreq. Mostly this is RTH's FEAT_RME
+The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:
 series; there are also a handful of bug fixes including some
 which aren't arm-specific but which it's convenient to include
 here.
-thanks
+  Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)
 -- PMM
 The following changes since commit b455ce4c2f300c8ba47cba7232dd03261368a4cb:
   Merge tag 'q800-for-8.1-pull-request' of https://github.com/vivier/qemu-m68k into staging (2023-06-22 10:18:32 +0200)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230623
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308
-for you to fetch changes up to 497fad38979c16b6412388927401e577eba43d26:
+for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:
-  pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym (2023-06-23 11:46:02 +0100)
+  target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Add (experimental) support for FEAT_RME
+ * Implement FEAT_ECV
- * host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
+ * STM32L4x5: Implement GPIO device
- * target/arm: Restructure has_vfp_d32 test
+ * Fix 32-bit SMOPA
- * hw/arm/sbsa-ref: add ITS support in SBSA GIC
+ * Refactor v7m related code from cpu32.c into its own file
- * target/arm: Fix sve predicate store, 8 <= VQ <= 15
+ * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
  * pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
 ----------------------------------------------------------------
-Peter Maydell (2):
+Inès Varhol (3):
-      host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
+      hw/gpio: Implement STM32L4x5 GPIO
-      pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
+      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
       tests/qtest: Add STM32L4x5 GPIO QTest testcase
-Richard Henderson (23):
+Peter Maydell (9):
-      target/arm: Add isar_feature_aa64_rme
+      target/arm: Move some register related defines to internals.h
-      target/arm: Update SCR and HCR for RME
+      target/arm: Timer _EL02 registers UNDEF for E2H == 0
-      target/arm: SCR_EL3.NS may be RES1
+      target/arm: use FIELD macro for CNTHCTL bit definitions
-      target/arm: Add RME cpregs
+      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-      target/arm: Introduce ARMSecuritySpace
+      target/arm: Implement new FEAT_ECV trap bits
-      include/exec/memattrs: Add two bits of space to MemTxAttrs
+      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-      target/arm: Adjust the order of Phys and Stage2 ARMMMUIdx
+      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-      target/arm: Introduce ARMMMUIdx_Phys_{Realm,Root}
+      target/arm: Enable FEAT_ECV for 'max' CPU
-      target/arm: Remove __attribute__((nonnull)) from ptw.c
+      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
       target/arm: Pipe ARMSecuritySpace through ptw.c
       target/arm: NSTable is RES0 for the RME EL3 regime
       target/arm: Handle Block and Page bits for security space
       target/arm: Handle no-execute for Realm and Root regimes
       target/arm: Use get_phys_addr_with_struct in S1_ptw_translate
       target/arm: Move s1_is_el0 into S1Translate
       target/arm: Use get_phys_addr_with_struct for stage2
       target/arm: Add GPC syndrome
       target/arm: Implement GPC exceptions
       target/arm: Implement the granule protection check
       target/arm: Add cpu properties for enabling FEAT_RME
       docs/system/arm: Document FEAT_RME
       target/arm: Restructure has_vfp_d32 test
       target/arm: Fix sve predicate store, 8 <= VQ <= 15
-Shashi Mallela (1):
+Richard Henderson (1):
-      hw/arm/sbsa-ref: add ITS support in SBSA GIC
+      target/arm: Fix 32-bit SMOPA
- docs/system/arm/cpu-features.rst |  23 ++
+Thomas Huth (1):
- docs/system/arm/emulation.rst    |   1 +
+      target/arm: Move v7m-related code from cpu32.c into a separate file
- docs/system/arm/sbsa.rst         |  14 +
- include/exec/memattrs.h          |   9 +-
+ MAINTAINERS                        |   1 +
- include/qemu/compiler.h          |  13 +
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
- include/qemu/host-utils.h        |   2 +-
+ docs/system/arm/emulation.rst      |   1 +
- target/arm/cpu.h                 | 151 ++++++++---
+ include/hw/arm/stm32l4x5_soc.h     |   2 +
- target/arm/internals.h           |  27 ++
+ include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
- target/arm/syndrome.h            |  10 +
+ include/hw/misc/stm32l4x5_syscfg.h |   3 +-
- hw/arm/sbsa-ref.c                |  33 ++-
+ include/hw/rtc/sun4v-rtc.h         |   2 +-
- target/arm/cpu.c                 |  32 ++-
+ target/arm/cpu-features.h          |  10 +
- target/arm/helper.c              | 162 ++++++++++-
+ target/arm/cpu.h                   | 129 +--------
- target/arm/ptw.c                 | 570 +++++++++++++++++++++++++++++++--------
+ target/arm/internals.h             | 151 ++++++++++
- target/arm/tcg/cpu64.c           |  53 ++++
+ hw/arm/stm32l4x5_soc.c             |  71 ++++-
- target/arm/tcg/tlb_helper.c      |  96 ++++++-
+ hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
- target/arm/tcg/translate-sve.c   |   2 +-
+ hw/misc/stm32l4x5_syscfg.c         |   1 +
- pc-bios/keymaps/meson.build      |   2 +-
+ hw/rtc/sun4v-rtc.c                 |   2 +-
-files changed, 1034 insertions(+), 166 deletions(-)
+ target/arm/helper.c                | 189 ++++++++++++-
  target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
  target/arm/tcg/cpu32.c             | 261 ------------------
  target/arm/tcg/cpu64.c             |   1 +
  target/arm/tcg/sme_helper.c        |  77 +++---
  tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
  tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
  tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
  hw/arm/Kconfig                     |   3 +-
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
  target/arm/meson.build             |   3 +
  target/arm/tcg/meson.build         |   3 +
  target/arm/trace-events            |   1 +
  tests/qtest/meson.build            |   3 +-
  tests/tcg/aarch64/Makefile.target  |   2 +-
 files changed, 1962 insertions(+), 456 deletions(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
  create mode 100644 target/arm/tcg/cpu-v7m.c
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

-[PULL 08/26] target/arm: Introduce ARMMMUIdx_Phys_{Realm,Root}
+[PULL 01/14] target/arm: Move some register related defines to internals.h
-From: Richard Henderson <richard.henderson@linaro.org>
+cpu.h has a lot of #defines relating to CPU register fields.
 Most of these aren't actually used outside target/arm code,
 so there's no point in cluttering up the cpu.h file with them.
 Move some easy ones to internals.h.
-With FEAT_RME, there are four physical address spaces.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 For now, just define the symbols, and mention them in
 the same spots as the other Phys indexes in ptw.c.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
 Message-id: 20230620124418.805717-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 23 +++++++++++++++++++++--
+ target/arm/cpu.h       | 128 -----------------------------------------
- target/arm/ptw.c | 10 ++++++++--
+ target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
-files changed, 29 insertions(+), 4 deletions(-)
+files changed, 128 insertions(+), 128 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
-     ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
+     uint64_t ctl; /* Timer Control register */
+ } ARMGenericTimer;
-     /* TLBs with 1-1 mapping to the physical address spaces. */
--    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
+-#define VTCR_NSW (1u << 29)
--    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
+-#define VTCR_NSA (1u << 30)
-+    ARMMMUIdx_Phys_S     = 10 | ARM_MMU_IDX_A,
+-#define VSTCR_SW VTCR_NSW
-+    ARMMMUIdx_Phys_NS    = 11 | ARM_MMU_IDX_A,
+-#define VSTCR_SA VTCR_NSA
-+    ARMMMUIdx_Phys_Root  = 12 | ARM_MMU_IDX_A,
+-
-+    ARMMMUIdx_Phys_Realm = 13 | ARM_MMU_IDX_A,
+ /* Define a maximum sized vector register.
+  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
-     /*
+  * For 64-bit, this is a 2048-bit SVE register.
-      * These are not allocated TLBs and are used only for AT system
+@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
+ #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
-     ARMASIdx_TagS = 3,
+ #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
- } ARMASIdx;
+-/* Bit definitions for CPACR (AArch32 only) */
-+static inline ARMMMUIdx arm_space_to_phys(ARMSecuritySpace space)
+-FIELD(CPACR, CP10, 20, 2)
-+{
+-FIELD(CPACR, CP11, 22, 2)
-+    /* Assert the relative order of the physical mmu indexes. */
+-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-+    QEMU_BUILD_BUG_ON(ARMSS_Secure != 0);
+-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS != ARMMMUIdx_Phys_S + ARMSS_NonSecure);
+-FIELD(CPACR, ASEDIS, 31, 1)
-+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Root != ARMMMUIdx_Phys_S + ARMSS_Root);
+-
-+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Realm != ARMMMUIdx_Phys_S + ARMSS_Realm);
+-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-+
+-FIELD(CPACR_EL1, ZEN, 16, 2)
-+    return ARMMMUIdx_Phys_S + space;
+-FIELD(CPACR_EL1, FPEN, 20, 2)
-+}
+-FIELD(CPACR_EL1, SMEN, 24, 2)
-+
+-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-+static inline ARMSecuritySpace arm_phys_to_space(ARMMMUIdx idx)
+-
-+{
+-/* Bit definitions for HCPTR (AArch32 only) */
-+    assert(idx >= ARMMMUIdx_Phys_S && idx <= ARMMMUIdx_Phys_Realm);
+-FIELD(HCPTR, TCP10, 10, 1)
-+    return idx - ARMMMUIdx_Phys_S;
+-FIELD(HCPTR, TCP11, 11, 1)
-+}
+-FIELD(HCPTR, TASE, 15, 1)
-+
+-FIELD(HCPTR, TTA, 20, 1)
- static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
+-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
- {
+-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
+-
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+-/* Bit definitions for CPTR_EL2 (AArch64 only) */
 -FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
 -FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 -FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 -FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 -FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 -FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 -FIELD(CPTR_EL2, TTA, 28, 1)
 -FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 -FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 -
 -/* Bit definitions for CPTR_EL3 (AArch64 only) */
 -FIELD(CPTR_EL3, EZ, 8, 1)
 -FIELD(CPTR_EL3, TFP, 10, 1)
 -FIELD(CPTR_EL3, ESM, 12, 1)
 -FIELD(CPTR_EL3, TTA, 20, 1)
 -FIELD(CPTR_EL3, TAM, 30, 1)
 -FIELD(CPTR_EL3, TCPAC, 31, 1)
 -
 -#define MDCR_MTPME    (1U << 28)
 -#define MDCR_TDCC     (1U << 27)
 -#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 -#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 -#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 -#define MDCR_EPMAD    (1U << 21)
 -#define MDCR_EDAD     (1U << 20)
 -#define MDCR_TTRF     (1U << 19)
 -#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 -#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 -#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 -#define MDCR_SDD      (1U << 16)
 -#define MDCR_SPD      (3U << 14)
 -#define MDCR_TDRA     (1U << 11)
 -#define MDCR_TDOSA    (1U << 10)
 -#define MDCR_TDA      (1U << 9)
 -#define MDCR_TDE      (1U << 8)
 -#define MDCR_HPME     (1U << 7)
 -#define MDCR_TPM      (1U << 6)
 -#define MDCR_TPMCR    (1U << 5)
 -#define MDCR_HPMN     (0x1fU)
 -
 -/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 -#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 -                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 -                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 -
  #define CPSR_M (0x1fU)
  #define CPSR_T (1U << 5)
  #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
  #define XPSR_NZCV CPSR_NZCV
  #define XPSR_IT CPSR_IT
 -#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 -#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 -#define TTBCR_PD0    (1U << 4)
 -#define TTBCR_PD1    (1U << 5)
 -#define TTBCR_EPD0   (1U << 7)
 -#define TTBCR_IRGN0  (3U << 8)
 -#define TTBCR_ORGN0  (3U << 10)
 -#define TTBCR_SH0    (3U << 12)
 -#define TTBCR_T1SZ   (3U << 16)
 -#define TTBCR_A1     (1U << 22)
 -#define TTBCR_EPD1   (1U << 23)
 -#define TTBCR_IRGN1  (3U << 24)
 -#define TTBCR_ORGN1  (3U << 26)
 -#define TTBCR_SH1    (1U << 28)
 -#define TTBCR_EAE    (1U << 31)
 -
 -FIELD(VTCR, T0SZ, 0, 6)
 -FIELD(VTCR, SL0, 6, 2)
 -FIELD(VTCR, IRGN0, 8, 2)
 -FIELD(VTCR, ORGN0, 10, 2)
 -FIELD(VTCR, SH0, 12, 2)
 -FIELD(VTCR, TG0, 14, 2)
 -FIELD(VTCR, PS, 16, 3)
 -FIELD(VTCR, VS, 19, 1)
 -FIELD(VTCR, HA, 21, 1)
 -FIELD(VTCR, HD, 22, 1)
 -FIELD(VTCR, HWU59, 25, 1)
 -FIELD(VTCR, HWU60, 26, 1)
 -FIELD(VTCR, HWU61, 27, 1)
 -FIELD(VTCR, HWU62, 28, 1)
 -FIELD(VTCR, NSW, 29, 1)
 -FIELD(VTCR, NSA, 30, 1)
 -FIELD(VTCR, DS, 32, 1)
 -FIELD(VTCR, SL2, 33, 1)
 -
  /* Bit definitions for ARMv8 SPSR (PSTATE) format.
   * Only these are valid when in AArch64 mode; in
   * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_TWEDEN    (1ULL << 59)
  #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 -#define HCRX_ENAS0    (1ULL << 0)
 -#define HCRX_ENALS    (1ULL << 1)
 -#define HCRX_ENASR    (1ULL << 2)
 -#define HCRX_FNXS     (1ULL << 3)
 -#define HCRX_FGTNXS   (1ULL << 4)
 -#define HCRX_SMPME    (1ULL << 5)
 -#define HCRX_TALLINT  (1ULL << 6)
 -#define HCRX_VINMI    (1ULL << 7)
 -#define HCRX_VFNMI    (1ULL << 8)
 -#define HCRX_CMOW     (1ULL << 9)
 -#define HCRX_MCE2     (1ULL << 10)
 -#define HCRX_MSCEN    (1ULL << 11)
 -
 -#define HPFAR_NS      (1ULL << 63)
 -
  #define SCR_NS                (1ULL << 0)
  #define SCR_IRQ               (1ULL << 1)
  #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_GPF               (1ULL << 48)
  #define SCR_NSE               (1ULL << 62)
 -#define HSTR_TTEE (1 << 16)
 -#define HSTR_TJDBX (1 << 17)
 -
 -#define CNTHCTL_CNTVMASK      (1 << 18)
 -#define CNTHCTL_CNTPMASK      (1 << 19)
 -
  /* Return the current FPSCR value.  */
  uint32_t vfp_get_fpscr(CPUARMState *env);
  void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/target/arm/internals.h
-+++ b/target/arm/ptw.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
+@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
-     case ARMMMUIdx_E3:
+ FIELD(DBGWCR, MASK, 24, 5)
-         break;
+ FIELD(DBGWCR, SSCE, 29, 1)
--    case ARMMMUIdx_Phys_NS:
++#define VTCR_NSW (1u << 29)
-     case ARMMMUIdx_Phys_S:
++#define VTCR_NSA (1u << 30)
-+    case ARMMMUIdx_Phys_NS:
++#define VSTCR_SW VTCR_NSW
-+    case ARMMMUIdx_Phys_Root:
++#define VSTCR_SA VTCR_NSA
-+    case ARMMMUIdx_Phys_Realm:
++
-         /* No translation for physical address spaces. */
++/* Bit definitions for CPACR (AArch32 only) */
-         return true;
++FIELD(CPACR, CP10, 20, 2)
++FIELD(CPACR, CP11, 22, 2)
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
++FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-     switch (mmu_idx) {
++FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-     case ARMMMUIdx_Stage2:
++FIELD(CPACR, ASEDIS, 31, 1)
-     case ARMMMUIdx_Stage2_S:
++
--    case ARMMMUIdx_Phys_NS:
++/* Bit definitions for CPACR_EL1 (AArch64 only) */
-     case ARMMMUIdx_Phys_S:
++FIELD(CPACR_EL1, ZEN, 16, 2)
-+    case ARMMMUIdx_Phys_NS:
++FIELD(CPACR_EL1, FPEN, 20, 2)
-+    case ARMMMUIdx_Phys_Root:
++FIELD(CPACR_EL1, SMEN, 24, 2)
-+    case ARMMMUIdx_Phys_Realm:
++FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-         break;
++
++/* Bit definitions for HCPTR (AArch32 only) */
-     default:
++FIELD(HCPTR, TCP10, 10, 1)
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
++FIELD(HCPTR, TCP11, 11, 1)
-     switch (mmu_idx) {
++FIELD(HCPTR, TASE, 15, 1)
-     case ARMMMUIdx_Phys_S:
++FIELD(HCPTR, TTA, 20, 1)
-     case ARMMMUIdx_Phys_NS:
++FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-+    case ARMMMUIdx_Phys_Root:
++FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-+    case ARMMMUIdx_Phys_Realm:
++
-         /* Checking Phys early avoids special casing later vs regime_el. */
++/* Bit definitions for CPTR_EL2 (AArch64 only) */
-         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
++FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-                                       is_secure, result, fi);
++FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
 +FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
 +FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
 +FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
 +FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
 +FIELD(CPTR_EL2, TTA, 28, 1)
 +FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
 +FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
 +
 +/* Bit definitions for CPTR_EL3 (AArch64 only) */
 +FIELD(CPTR_EL3, EZ, 8, 1)
 +FIELD(CPTR_EL3, TFP, 10, 1)
 +FIELD(CPTR_EL3, ESM, 12, 1)
 +FIELD(CPTR_EL3, TTA, 20, 1)
 +FIELD(CPTR_EL3, TAM, 30, 1)
 +FIELD(CPTR_EL3, TCPAC, 31, 1)
 +
 +#define MDCR_MTPME    (1U << 28)
 +#define MDCR_TDCC     (1U << 27)
 +#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
 +#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
 +#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
 +#define MDCR_EPMAD    (1U << 21)
 +#define MDCR_EDAD     (1U << 20)
 +#define MDCR_TTRF     (1U << 19)
 +#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
 +#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
 +#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
 +#define MDCR_SDD      (1U << 16)
 +#define MDCR_SPD      (3U << 14)
 +#define MDCR_TDRA     (1U << 11)
 +#define MDCR_TDOSA    (1U << 10)
 +#define MDCR_TDA      (1U << 9)
 +#define MDCR_TDE      (1U << 8)
 +#define MDCR_HPME     (1U << 7)
 +#define MDCR_TPM      (1U << 6)
 +#define MDCR_TPMCR    (1U << 5)
 +#define MDCR_HPMN     (0x1fU)
 +
 +/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
 +#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
 +                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
 +                         MDCR_STE | MDCR_SPME | MDCR_SPD)
 +
 +#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
 +#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
 +#define TTBCR_PD0    (1U << 4)
 +#define TTBCR_PD1    (1U << 5)
 +#define TTBCR_EPD0   (1U << 7)
 +#define TTBCR_IRGN0  (3U << 8)
 +#define TTBCR_ORGN0  (3U << 10)
 +#define TTBCR_SH0    (3U << 12)
 +#define TTBCR_T1SZ   (3U << 16)
 +#define TTBCR_A1     (1U << 22)
 +#define TTBCR_EPD1   (1U << 23)
 +#define TTBCR_IRGN1  (3U << 24)
 +#define TTBCR_ORGN1  (3U << 26)
 +#define TTBCR_SH1    (1U << 28)
 +#define TTBCR_EAE    (1U << 31)
 +
 +FIELD(VTCR, T0SZ, 0, 6)
 +FIELD(VTCR, SL0, 6, 2)
 +FIELD(VTCR, IRGN0, 8, 2)
 +FIELD(VTCR, ORGN0, 10, 2)
 +FIELD(VTCR, SH0, 12, 2)
 +FIELD(VTCR, TG0, 14, 2)
 +FIELD(VTCR, PS, 16, 3)
 +FIELD(VTCR, VS, 19, 1)
 +FIELD(VTCR, HA, 21, 1)
 +FIELD(VTCR, HD, 22, 1)
 +FIELD(VTCR, HWU59, 25, 1)
 +FIELD(VTCR, HWU60, 26, 1)
 +FIELD(VTCR, HWU61, 27, 1)
 +FIELD(VTCR, HWU62, 28, 1)
 +FIELD(VTCR, NSW, 29, 1)
 +FIELD(VTCR, NSA, 30, 1)
 +FIELD(VTCR, DS, 32, 1)
 +FIELD(VTCR, SL2, 33, 1)
 +
 +#define HCRX_ENAS0    (1ULL << 0)
 +#define HCRX_ENALS    (1ULL << 1)
 +#define HCRX_ENASR    (1ULL << 2)
 +#define HCRX_FNXS     (1ULL << 3)
 +#define HCRX_FGTNXS   (1ULL << 4)
 +#define HCRX_SMPME    (1ULL << 5)
 +#define HCRX_TALLINT  (1ULL << 6)
 +#define HCRX_VINMI    (1ULL << 7)
 +#define HCRX_VFNMI    (1ULL << 8)
 +#define HCRX_CMOW     (1ULL << 9)
 +#define HCRX_MCE2     (1ULL << 10)
 +#define HCRX_MSCEN    (1ULL << 11)
 +
 +#define HPFAR_NS      (1ULL << 63)
 +
 +#define HSTR_TTEE (1 << 16)
 +#define HSTR_TJDBX (1 << 17)
 +
 +#define CNTHCTL_CNTVMASK      (1 << 18)
 +#define CNTHCTL_CNTPMASK      (1 << 19)
 +
  /* We use a few fake FSR values for internal purposes in M profile.
   * M profile cores don't have A/R format FSRs, but currently our
   * get_phys_addr() code assumes A/R profile and reports failures via
 --
 .34.1

-[PULL 03/26] target/arm: SCR_EL3.NS may be RES1
+[PULL 02/14] target/arm: Timer _EL02 registers UNDEF for E2H == 0
-From: Richard Henderson <richard.henderson@linaro.org>
+The timer _EL02 registers should UNDEF for invalid accesses from EL2
 or EL3 when HCR_EL2.E2H == 0, not take a cp access trap.  We were
 delivering the exception to EL2 with the wrong syndrome.
-With RME, SEL2 must also be present to support secure state.
-The NS bit is RES1 if SEL2 is not present.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-3-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 3 +++
+ target/arm/helper.c | 2 +-
-file changed, 3 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
-         }
+         return CP_ACCESS_OK;
-         if (cpu_isar_feature(aa64_sel2, cpu)) {
+     }
-             valid_mask |= SCR_EEL2;
+     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
-+        } else if (cpu_isar_feature(aa64_rme, cpu)) {
+-        return CP_ACCESS_TRAP;
-+            /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */
++        return CP_ACCESS_TRAP_UNCATEGORIZED;
-+            value |= SCR_NS;
+     }
-         }
+     return CP_ACCESS_OK;
-         if (cpu_isar_feature(aa64_mte, cpu)) {
+ }
              valid_mask |= SCR_ATA;
 --
 .34.1

-[PULL 18/26] target/arm: Implement GPC exceptions
+[PULL 03/14] target/arm: use FIELD macro for CNTHCTL bit definitions
-From: Richard Henderson <richard.henderson@linaro.org>
+We prefer the FIELD macro over ad-hoc #defines for register bits;
 switch CNTHCTL to that style before we add any more bits.
-Handle GPC Fault types in arm_deliver_fault, reporting as
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-either a GPC exception at EL3, or falling through to insn
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-or data aborts at various exception levels.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
 ---
  target/arm/internals.h | 27 +++++++++++++++++++++++++--
  target/arm/helper.c    |  9 ++++-----
 files changed, 29 insertions(+), 7 deletions(-)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-19-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h            |  1 +
- target/arm/internals.h      | 27 +++++++++++
- target/arm/helper.c         |  5 ++
- target/arm/tcg/tlb_helper.c | 96 +++++++++++++++++++++++++++++++++++--
-files changed, 126 insertions(+), 3 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #define EXCP_UNALIGNED      22   /* v7M UNALIGNED UsageFault */
- #define EXCP_DIVBYZERO      23   /* v7M DIVBYZERO UsageFault */
- #define EXCP_VSERR          24
-+#define EXCP_GPC            25   /* v9 Granule Protection Check Fault */
- /* NB: add new EXCP_ defines to the array in arm_log_exception() too */
- #define ARMV7M_EXCP_RESET   1
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
+@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
-     ARMFault_ICacheMaint,
+ #define HSTR_TTEE (1 << 16)
-     ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
+ #define HSTR_TJDBX (1 << 17)
-     ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
-+    ARMFault_GPCFOnWalk,
+-#define CNTHCTL_CNTVMASK      (1 << 18)
-+    ARMFault_GPCFOnOutput,
+-#define CNTHCTL_CNTPMASK      (1 << 19)
- } ARMFaultType;
++/*
++ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
-+typedef enum ARMGPCF {
++ * have different bit definitions, and EL1PCTEN might be
-+    GPCF_None,
++ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
-+    GPCF_AddressSize,
++ * disambiguate if necessary.
-+    GPCF_Walk,
++ */
-+    GPCF_EABT,
++FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
-+    GPCF_Fail,
++FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
-+} ARMGPCF;
++FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
-+
++FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
- /**
++FIELD(CNTHCTL, EVNTEN, 2, 1)
-  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
++FIELD(CNTHCTL, EVNTDIR, 3, 1)
-  * @type: Type of fault
++FIELD(CNTHCTL, EVNTI, 4, 4)
-+ * @gpcf: Subtype of ARMFault_GPCFOn{Walk,Output}.
++FIELD(CNTHCTL, EL0VTEN, 8, 1)
-  * @level: Table walk level (for translation, access flag and permission faults)
++FIELD(CNTHCTL, EL0PTEN, 9, 1)
-  * @domain: Domain of the fault address (for non-LPAE CPUs only)
++FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
-  * @s2addr: Address that caused a fault at stage 2
++FIELD(CNTHCTL, EL1PTEN, 11, 1)
-+ * @paddr: physical address that caused a fault for gpc
++FIELD(CNTHCTL, ECV, 12, 1)
-+ * @paddr_space: physical address space that caused a fault for gpc
++FIELD(CNTHCTL, EL1TVT, 13, 1)
-  * @stage2: True if we faulted at stage 2
++FIELD(CNTHCTL, EL1TVCT, 14, 1)
-  * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
++FIELD(CNTHCTL, EL1NVPCT, 15, 1)
-  * @s1ns: True if we faulted on a non-secure IPA while in secure state
++FIELD(CNTHCTL, EL1NVVCT, 16, 1)
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
++FIELD(CNTHCTL, EVNTIS, 17, 1)
- typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
++FIELD(CNTHCTL, CNTVMASK, 18, 1)
- struct ARMMMUFaultInfo {
++FIELD(CNTHCTL, CNTPMASK, 19, 1)
-     ARMFaultType type;
-+    ARMGPCF gpcf;
+ /* We use a few fake FSR values for internal purposes in M profile.
-     target_ulong s2addr;
+  * M profile cores don't have A/R format FSRs, but currently our
 +    target_ulong paddr;
 +    ARMSecuritySpace paddr_space;
      int level;
      int domain;
      bool stage2;
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
      case ARMFault_Exclusive:
          fsc = 0x35;
          break;
 +    case ARMFault_GPCFOnWalk:
 +        assert(fi->level >= -1 && fi->level <= 3);
 +        if (fi->level < 0) {
 +            fsc = 0b100011;
 +        } else {
 +            fsc = 0b100100 | fi->level;
 +        }
 +        break;
 +    case ARMFault_GPCFOnOutput:
 +        fsc = 0b101000;
 +        break;
      default:
          /* Other faults can't occur in a context that requires a
           * long-format status code.
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_log_exception(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
-             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
+      * It is RES0 in Secure and NonSecure state.
-             [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
+      */
-             [EXCP_VSERR] = "Virtual SERR",
+     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-+            [EXCP_GPC] = "Granule Protection Check",
+-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         };
+-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
++        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
-         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
++         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
+         irqstate = 0;
      }
-     switch (cs->exception_index) {
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-+    case EXCP_GPC:
+ {
-+        qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n",
+     ARMCPU *cpu = env_archcpu(env);
-+                      env->cp15.mfar_el3);
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+        /* fall through */
+-
-     case EXCP_PREFETCH_ABORT:
+     raw_write(env, ri, value);
-     case EXCP_DATA_ABORT:
-         /*
+-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
-diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
++    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-index XXXXXXX..XXXXXXX 100644
+         gt_update_irq(cpu, GTIMER_VIRT);
---- a/target/arm/tcg/tlb_helper.c
+-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
-+++ b/target/arm/tcg/tlb_helper.c
++    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
+         gt_update_irq(cpu, GTIMER_PHYS);
-     return fsr;
+     }
  }
-+static bool report_as_gpc_exception(ARMCPU *cpu, int current_el,
-+                                    ARMMMUFaultInfo *fi)
-+{
-+    bool ret;
-+
-+    switch (fi->gpcf) {
-+    case GPCF_None:
-+        return false;
-+    case GPCF_AddressSize:
-+    case GPCF_Walk:
-+    case GPCF_EABT:
-+        /* R_PYTGX: GPT faults are reported as GPC. */
-+        ret = true;
-+        break;
-+    case GPCF_Fail:
-+        /*
-+         * R_BLYPM: A GPF at EL3 is reported as insn or data abort.
-+         * R_VBZMW, R_LXHQR: A GPF at EL[0-2] is reported as a GPC
-+         * if SCR_EL3.GPF is set, otherwise an insn or data abort.
-+         */
-+        ret = (cpu->env.cp15.scr_el3 & SCR_GPF) && current_el != 3;
-+        break;
-+    default:
-+        g_assert_not_reached();
-+    }
-+
-+    assert(cpu_isar_feature(aa64_rme, cpu));
-+    assert(fi->type == ARMFault_GPCFOnWalk ||
-+           fi->type == ARMFault_GPCFOnOutput);
-+    if (fi->gpcf == GPCF_AddressSize) {
-+        assert(fi->level == 0);
-+    } else {
-+        assert(fi->level >= 0 && fi->level <= 1);
-+    }
-+
-+    return ret;
-+}
-+
-+static unsigned encode_gpcsc(ARMMMUFaultInfo *fi)
-+{
-+    static uint8_t const gpcsc[] = {
-+        [GPCF_AddressSize] = 0b000000,
-+        [GPCF_Walk]        = 0b000100,
-+        [GPCF_Fail]        = 0b001100,
-+        [GPCF_EABT]        = 0b010100,
-+    };
-+
-+    /* Note that we've validated fi->gpcf and fi->level above. */
-+    return gpcsc[fi->gpcf] | fi->level;
-+}
-+
- static G_NORETURN
- void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
-                        MMUAccessType access_type,
-                        int mmu_idx, ARMMMUFaultInfo *fi)
- {
-     CPUARMState *env = &cpu->env;
--    int target_el;
-+    int target_el = exception_target_el(env);
-+    int current_el = arm_current_el(env);
-     bool same_el;
-     uint32_t syn, exc, fsr, fsc;
--    target_el = exception_target_el(env);
-+    if (report_as_gpc_exception(cpu, current_el, fi)) {
-+        target_el = 3;
-+
-+        fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
-+
-+        syn = syn_gpc(fi->stage2 && fi->type == ARMFault_GPCFOnWalk,
-+                      access_type == MMU_INST_FETCH,
-+                      encode_gpcsc(fi), 0, fi->s1ptw,
-+                      access_type == MMU_DATA_STORE, fsc);
-+
-+        env->cp15.mfar_el3 = fi->paddr;
-+        switch (fi->paddr_space) {
-+        case ARMSS_Secure:
-+            break;
-+        case ARMSS_NonSecure:
-+            env->cp15.mfar_el3 |= R_MFAR_NS_MASK;
-+            break;
-+        case ARMSS_Root:
-+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK;
-+            break;
-+        case ARMSS_Realm:
-+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK | R_MFAR_NS_MASK;
-+            break;
-+        default:
-+            g_assert_not_reached();
-+        }
-+
-+        exc = EXCP_GPC;
-+        goto do_raise;
-+    }
-+
-+    /* If SCR_EL3.GPF is unset, GPF may still be routed to EL2. */
-+    if (fi->gpcf == GPCF_Fail && target_el < 2) {
-+        if (arm_hcr_el2_eff(env) & HCR_GPF) {
-+            target_el = 2;
-+        }
-+    }
-+
-     if (fi->stage2) {
-         target_el = 2;
-         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
-@@ -XXX,XX +XXX,XX @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
-             env->cp15.hpfar_el2 |= HPFAR_NS;
-         }
-     }
--    same_el = (arm_current_el(env) == target_el);
-+    same_el = current_el == target_el;
-     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
-     if (access_type == MMU_INST_FETCH) {
-@@ -XXX,XX +XXX,XX @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
-         exc = EXCP_DATA_ABORT;
-     }
-+ do_raise:
-     env->exception.vaddress = addr;
-     env->exception.fsr = fsr;
-     raise_exception(env, exc, syn, target_el);
 --
 .34.1

-[PULL 04/26] target/arm: Add RME cpregs
+[PULL 04/14] target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
-From: Richard Henderson <richard.henderson@linaro.org>
+Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
 This is not strictly architecturally required, but it is how we've
 tended to implement registers more recently.
-This includes GPCCR, GPTBR, MFAR, the TLB flush insns PAALL, PAALLOS,
+In particular, bits [19:18] are only present with FEAT_RME,
-RPALOS, RPAOS, and the cache flush insns CIPAPA and CIGDPAPA.
+and bits [17:12] will only be present with FEAT_ECV.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    | 19 ++++++++++
+ target/arm/helper.c | 18 ++++++++++++++++++
- target/arm/helper.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
+file changed, 18 insertions(+)
 files changed, 103 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-         uint64_t fgt_read[2]; /* HFGRTR, HDFGRTR */
-         uint64_t fgt_write[2]; /* HFGWTR, HDFGWTR */
-         uint64_t fgt_exec[1]; /* HFGITR */
-+
-+        /* RME registers */
-+        uint64_t gpccr_el3;
-+        uint64_t gptbr_el3;
-+        uint64_t mfar_el3;
-     } cp15;
-     struct {
-@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
-     uint64_t reset_cbar;
-     uint32_t reset_auxcr;
-     bool reset_hivecs;
-+    uint8_t reset_l0gptsz;
-     /*
-      * Intermediate values used during property parsing.
-@@ -XXX,XX +XXX,XX @@ FIELD(MVFR1, SIMDFMAC, 28, 4)
- FIELD(MVFR2, SIMDMISC, 0, 4)
- FIELD(MVFR2, FPMISC, 4, 4)
-+FIELD(GPCCR, PPS, 0, 3)
-+FIELD(GPCCR, IRGN, 8, 2)
-+FIELD(GPCCR, ORGN, 10, 2)
-+FIELD(GPCCR, SH, 12, 2)
-+FIELD(GPCCR, PGS, 14, 2)
-+FIELD(GPCCR, GPC, 16, 1)
-+FIELD(GPCCR, GPCP, 17, 1)
-+FIELD(GPCCR, L0GPTSZ, 20, 4)
-+
-+FIELD(MFAR, FPA, 12, 40)
-+FIELD(MFAR, NSE, 62, 1)
-+FIELD(MFAR, NS, 63, 1)
-+
- QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
- /* If adding a feature bit which corresponds to a Linux ELF
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
-       .access = PL2_RW, .accessfn = access_esm,
+ {
-       .type = ARM_CP_CONST, .resetvalue = 0 },
+     ARMCPU *cpu = env_archcpu(env);
- };
+     uint32_t oldval = env->cp15.cnthctl_el2;
-+
++    uint32_t valid_mask =
-+static void tlbi_aa64_paall_write(CPUARMState *env, const ARMCPRegInfo *ri,
++        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
-+                                  uint64_t value)
++        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
-+{
++        R_CNTHCTL_EVNTEN_MASK |
-+    CPUState *cs = env_cpu(env);
++        R_CNTHCTL_EVNTDIR_MASK |
-+
++        R_CNTHCTL_EVNTI_MASK |
-+    tlb_flush(cs);
++        R_CNTHCTL_EL0VTEN_MASK |
-+}
++        R_CNTHCTL_EL0PTEN_MASK |
-+
++        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
-+static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri,
++        R_CNTHCTL_EL1PTEN_MASK;
 +                        uint64_t value)
 +{
 +    /* L0GPTSZ is RO; other bits not mentioned are RES0. */
 +    uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK |
 +        R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK |
 +        R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK;
 +
 +    env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask);
 +}
 +
 +static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
 +{
 +    env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ,
 +                                     env_archcpu(env)->reset_l0gptsz);
 +}
 +
 +static void tlbi_aa64_paallos_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                    uint64_t value)
 +{
 +    CPUState *cs = env_cpu(env);
 +
 +    tlb_flush_all_cpus_synced(cs);
 +}
 +
 +static const ARMCPRegInfo rme_reginfo[] = {
 +    { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6,
 +      .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset,
 +      .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) },
 +    { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4,
 +      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) },
 +    { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5,
 +      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) },
 +    { .name = "TLBI_PAALL", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 4,
 +      .access = PL3_W, .type = ARM_CP_NO_RAW,
 +      .writefn = tlbi_aa64_paall_write },
 +    { .name = "TLBI_PAALLOS", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 4,
 +      .access = PL3_W, .type = ARM_CP_NO_RAW,
 +      .writefn = tlbi_aa64_paallos_write },
 +    /*
 +     * QEMU does not have a way to invalidate by physical address, thus
 +     * invalidating a range of physical addresses is accomplished by
 +     * flushing all tlb entries in the outer sharable domain,
 +     * just like PAALLOS.
 +     */
 +    { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 7,
 +      .access = PL3_W, .type = ARM_CP_NO_RAW,
 +      .writefn = tlbi_aa64_paallos_write },
 +    { .name = "TLBI_RPAOS", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 3,
 +      .access = PL3_W, .type = ARM_CP_NO_RAW,
 +      .writefn = tlbi_aa64_paallos_write },
 +    { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1,
 +      .access = PL3_W, .type = ARM_CP_NOP },
 +};
 +
 +static const ARMCPRegInfo rme_mte_reginfo[] = {
 +    { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5,
 +      .access = PL3_W, .type = ARM_CP_NOP },
 +};
  #endif /* TARGET_AARCH64 */
  static void define_pmu_regs(ARMCPU *cpu)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (cpu_isar_feature(aa64_fgt, cpu)) {
          define_arm_cp_regs(cpu, fgt_reginfo);
      }
 +
 +    if (cpu_isar_feature(aa64_rme, cpu)) {
-+        define_arm_cp_regs(cpu, rme_reginfo);
++        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
 +        if (cpu_isar_feature(aa64_mte, cpu)) {
 +            define_arm_cp_regs(cpu, rme_mte_reginfo);
 +        }
 +    }
- #endif
++
++    /* Clear RES0 bits */
-     if (cpu_isar_feature(any_predinv, cpu)) {
++    value &= valid_mask;
 +
      raw_write(env, ri, value);
      if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
 --
 .34.1

-[PULL 05/26] target/arm: Introduce ARMSecuritySpace
+[PULL 05/14] target/arm: Implement new FEAT_ECV trap bits
-From: Richard Henderson <richard.henderson@linaro.org>
+The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
  * four new trap bits for various counter and timer registers
  * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
    scaling of the event stream. This is a no-op for us, because we don't
    implement the event stream (our WFE is a NOP): all we need to do is
    allow CNTHCTL_EL2.ENVTIS to be read and written.
  * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
    TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
    FEAT_SPE or FEAT_TRF.
  * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
    "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
    that no barriers are needed around their accesses. For us these
    are just the same as the normal views, because all our sysregs are
    inherently self-sychronizing.
-Introduce both the enumeration and functions to retrieve
+In this commit we implement the trap handling and permit the new
-the current state, and state outside of EL3.
+CNTHCTL_EL2 bits to be written.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    | 89 ++++++++++++++++++++++++++++++++++-----------
+ target/arm/cpu-features.h |  5 ++++
- target/arm/helper.c | 60 ++++++++++++++++++++++++++++++
+ target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
-files changed, 127 insertions(+), 22 deletions(-)
+files changed, 51 insertions(+), 5 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/cpu-features.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
- void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
+ }
--#if !defined(CONFIG_USER_ONLY)
++static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
  /*
 + * ARM v9 security states.
 + * The ordering of the enumeration corresponds to the low 2 bits
 + * of the GPI value, and (except for Root) the concat of NSE:NS.
 + */
 +
 +typedef enum ARMSecuritySpace {
 +    ARMSS_Secure     = 0,
 +    ARMSS_NonSecure  = 1,
 +    ARMSS_Root       = 2,
 +    ARMSS_Realm      = 3,
 +} ARMSecuritySpace;
 +
 +/* Return true if @space is secure, in the pre-v9 sense. */
 +static inline bool arm_space_is_secure(ARMSecuritySpace space)
 +{
-+    return space == ARMSS_Secure || space == ARMSS_Root;
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 +}
 +
-+/* Return the ARMSecuritySpace for @secure, assuming !RME or EL[0-2]. */
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 +static inline ARMSecuritySpace arm_secure_to_space(bool secure)
 +{
 +    return secure ? ARMSS_Secure : ARMSS_NonSecure;
 +}
 +
 +#if !defined(CONFIG_USER_ONLY)
 +/**
 + * arm_security_space_below_el3:
 + * @env: cpu context
 + *
 + * Return the security space of exception levels below EL3, following
 + * an exception return to those levels.  Unlike arm_security_space,
 + * this doesn't care about the current EL.
 + */
 +ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env);
 +
 +/**
 + * arm_is_secure_below_el3:
 + * @env: cpu context
 + *
   * Return true if exception levels below EL3 are in secure state,
 - * or would be following an exception return to that level.
 - * Unlike arm_is_secure() (which is always a question about the
 - * _current_ state of the CPU) this doesn't care about the current
 - * EL or mode.
 + * or would be following an exception return to those levels.
   */
  static inline bool arm_is_secure_below_el3(CPUARMState *env)
  {
--    assert(!arm_feature(env, ARM_FEATURE_M));
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 -    if (arm_feature(env, ARM_FEATURE_EL3)) {
 -        return !(env->cp15.scr_el3 & SCR_NS);
 -    } else {
 -        /* If EL3 is not supported then the secure state is implementation
 -         * defined, in which case QEMU defaults to non-secure.
 -         */
 -        return false;
 -    }
 +    ARMSecuritySpace ss = arm_security_space_below_el3(env);
 +    return ss == ARMSS_Secure;
  }
  /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
      return false;
  }
 -/* Return true if the processor is in secure state */
 +/**
 + * arm_security_space:
 + * @env: cpu context
 + *
 + * Return the current security space of the cpu.
 + */
 +ARMSecuritySpace arm_security_space(CPUARMState *env);
 +
 +/**
 + * arm_is_secure:
 + * @env: cpu context
 + *
 + * Return true if the processor is in secure state.
 + */
  static inline bool arm_is_secure(CPUARMState *env)
  {
 -    if (arm_feature(env, ARM_FEATURE_M)) {
 -        return env->v7m.secure;
 -    }
 -    if (arm_is_el3_or_mon(env)) {
 -        return true;
 -    }
 -    return arm_is_secure_below_el3(env);
 +    return arm_space_is_secure(arm_security_space(env));
  }
  /*
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
  }
  #else
 +static inline ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
 +{
 +    return ARMSS_NonSecure;
 +}
 +
  static inline bool arm_is_secure_below_el3(CPUARMState *env)
  {
      return false;
  }
 +static inline ARMSecuritySpace arm_security_space(CPUARMState *env)
 +{
 +    return ARMSS_NonSecure;
 +}
 +
  static inline bool arm_is_secure(CPUARMState *env)
  {
      return false;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
-     }
+              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
- }
+             return CP_ACCESS_TRAP_EL2;
- #endif
+         }
-+
++        if (has_el2 && timeridx == GTIMER_VIRT) {
-+#ifndef CONFIG_USER_ONLY
++            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
-+ARMSecuritySpace arm_security_space(CPUARMState *env)
++                return CP_ACCESS_TRAP_EL2;
 +{
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return arm_secure_to_space(env->v7m.secure);
 +    }
 +
 +    /*
 +     * If EL3 is not supported then the secure state is implementation
 +     * defined, in which case QEMU defaults to non-secure.
 +     */
 +    if (!arm_feature(env, ARM_FEATURE_EL3)) {
 +        return ARMSS_NonSecure;
 +    }
 +
 +    /* Check for AArch64 EL3 or AArch32 Mon. */
 +    if (is_a64(env)) {
 +        if (extract32(env->pstate, 2, 2) == 3) {
 +            if (cpu_isar_feature(aa64_rme, env_archcpu(env))) {
 +                return ARMSS_Root;
 +            } else {
 +                return ARMSS_Secure;
 +            }
 +        }
-+    } else {
+         break;
-+        if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
+     }
-+            return ARMSS_Secure;
+     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                  }
              }
          }
 +        if (has_el2 && timeridx == GTIMER_VIRT) {
 +            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +        }
          break;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
      if (cpu_isar_feature(aa64_rme, cpu)) {
          valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
 +        valid_mask |=
 +            R_CNTHCTL_EL1TVT_MASK |
 +            R_CNTHCTL_EL1TVCT_MASK |
 +            R_CNTHCTL_EL1NVPCT_MASK |
 +            R_CNTHCTL_EL1NVVCT_MASK |
 +            R_CNTHCTL_EVNTIS_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
  {
      if (arm_current_el(env) == 1) {
          /* This must be a FEAT_NV access */
 -        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
          return CP_ACCESS_OK;
      }
      if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
      return CP_ACCESS_OK;
  }
 +static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                      bool isread)
 +{
 +    if (arm_current_el(env) == 1) {
 +        /* This must be a FEAT_NV access with NVx == 101 */
 +        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
 +    }
-+
++    return e2h_access(env, ri, isread);
 +    return arm_security_space_below_el3(env);
 +}
 +
-+ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
++static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                      bool isread)
 +{
-+    assert(!arm_feature(env, ARM_FEATURE_M));
++    if (arm_current_el(env) == 1) {
 +        /* This must be a FEAT_NV access with NVx == 101 */
 +        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
 +    }
 +    return e2h_access(env, ri, isread);
 +}
 +
-+    /*
+ /* Test if system register redirection is to occur in the current state.  */
-+     * If EL3 is not supported then the secure state is implementation
+ static bool redirect_for_e2h(CPUARMState *env)
-+     * defined, in which case QEMU defaults to non-secure.
+ {
-+     */
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
-+    if (!arm_feature(env, ARM_FEATURE_EL3)) {
+     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
-+        return ARMSS_NonSecure;
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
-+    }
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
-+
+-      .access = PL2_RW, .accessfn = e2h_access,
-+    /*
++      .access = PL2_RW, .accessfn = access_el1nvpct,
-+     * Note NSE cannot be set without RME, and NSE & !NS is Reserved.
+       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
-+     * Ignoring NSE when !NS retains consistency without having to
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
-+     * modify other predicates.
+       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
-+     */
+     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
-+    if (!(env->cp15.scr_el3 & SCR_NS)) {
+       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
-+        return ARMSS_Secure;
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
-+    } else if (env->cp15.scr_el3 & SCR_NSE) {
+-      .access = PL2_RW, .accessfn = e2h_access,
-+        return ARMSS_Realm;
++      .access = PL2_RW, .accessfn = access_el1nvvct,
-+    } else {
+       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
-+        return ARMSS_NonSecure;
+       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
-+    }
+       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
-+}
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
-+#endif /* !CONFIG_USER_ONLY */
+       .type = ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvpct,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
      { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
        .type = ARM_CP_IO | ARM_CP_ALIAS,
        .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
 -      .access = PL2_RW, .accessfn = e2h_access,
 +      .access = PL2_RW, .accessfn = access_el1nvvct,
        .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
  #endif
  };
 --
 .34.1

-[PULL 22/26] host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
+[PULL 06/14] target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
-We use __builtin_subcll() to do a 64-bit subtract with borrow-in and
+For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
-borrow-out when the host compiler supports it.  Unfortunately some
+defined, which are "self-synchronized" views of the physical and
-versions of Apple Clang have a bug in their implementation of this
+virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
-intrinsic which means it returns the wrong value.  The effect is that
+(meaning that no barriers are needed around accesses to them to
-a QEMU built with the affected compiler will hang when emulating x86
+ensure that reads of them do not occur speculatively and out-of-order
-or m68k float80 division.
+with other instructions).
-The upstream LLVM issue is:
+For QEMU, all our system registers are self-synchronized, so we can
-https://github.com/llvm/llvm-project/issues/55253
+simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
 to the new register encodings.
-The commit that introduced the bug apparently never made it into an
+This means we now implement all the functionality required for
-upstream LLVM release without the subsequent fix
+ID_AA64MMFR0_EL1.ECV == 0b0001.
 https://github.com/llvm/llvm-project/commit/fffb6e6afdbaba563189c1f715058ed401fbc88d
 but unfortunately it did make it into Apple Clang 14.0, as shipped
 in Xcode 14.3 (14.2 is reported to be OK). The Apple bug number is
 FB12210478.
-Add ifdefs to avoid use of __builtin_subcll() on Apple Clang version
-or greater.  There is not currently a version of Apple Clang which
-has the bug fix -- when one appears we should be able to add an upper
-bound to the ifdef condition so we can start using the builtin again.
-We make the lower bound a conservative "any Apple clang with major
-version 14 or greater" because the consequences of incorrectly
-disabling the builtin when it would work are pretty small and the
-consequences of not disabling it when we should are pretty bad.
-Many thanks to those users who both reported this bug and also
-did a lot of work in identifying the root cause; in particular
-to Daniel Bertalan and osy.
-Cc: qemu-stable@nongnu.org
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1631
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1659
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
 Tested-by: Daniel Bertalan <dani@danielbertalan.dev>
 Tested-by: Tested-By: Solra Bizna <solra@bizna.name>
 Message-id: 20230622130823.1631719-1-peter.maydell@linaro.org
 ---
- include/qemu/compiler.h   | 13 +++++++++++++
+ target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
- include/qemu/host-utils.h |  2 +-
+file changed, 43 insertions(+)
 files changed, 14 insertions(+), 1 deletion(-)
-diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/compiler.h
+--- a/target/arm/helper.c
-+++ b/include/qemu/compiler.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
- #define QEMU_DISABLE_CFI
+     },
  };
 +/*
 + * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
 + * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
 + * so our implementations here are identical to the normal registers.
 + */
 +static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access,
 +      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
 +    },
 +    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
 +      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access,
 +      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
 +    },
 +    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
 +    },
 +};
 +
  #else
  /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
  };
 +/*
 + * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
 + * is exposed to userspace by Linux.
 + */
 +static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
 +    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
 +      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
 +      .readfn = gt_virt_cnt_read,
 +    },
 +};
 +
  #endif
-+/*
+ static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-+ * Apple clang version 14 has a bug in its __builtin_subcll(); define
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-+ * BUILTIN_SUBCLL_BROKEN for the offending versions so we can avoid it.
+     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
-+ * When a version of Apple clang which has this bug fixed is released
+         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
-+ * we can add an upper bound to this check.
+     }
-+ * See https://gitlab.com/qemu-project/qemu/-/issues/1631
++    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
-+ * and https://gitlab.com/qemu-project/qemu/-/issues/1659 for details.
++        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
-+ * The bug never made it into any upstream LLVM releases, only Apple ones.
++    }
-+ */
+     if (arm_feature(env, ARM_FEATURE_VAPA)) {
-+#if defined(__apple_build_version__) && __clang_major__ >= 14
+         ARMCPRegInfo vapa_cp_reginfo[] = {
-+#define BUILTIN_SUBCLL_BROKEN
+             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 +#endif
 +
  #endif /* COMPILER_H */
 diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/host-utils.h
 +++ b/include/qemu/host-utils.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t uadd64_carry(uint64_t x, uint64_t y, bool *pcarry)
   */
  static inline uint64_t usub64_borrow(uint64_t x, uint64_t y, bool *pborrow)
  {
 -#if __has_builtin(__builtin_subcll)
 +#if __has_builtin(__builtin_subcll) && !defined(BUILTIN_SUBCLL_BROKEN)
      unsigned long long b = *pborrow;
      x = __builtin_subcll(x, y, b, &b);
      *pborrow = b & 1;
 --
 .34.1

-[PULL 02/26] target/arm: Update SCR and HCR for RME
+[PULL 07/14] target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
-From: Richard Henderson <richard.henderson@linaro.org>
+When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
 implemented.  This is similar to the existing CNTVOFF_EL2, except
 that it controls a hypervisor-adjustable offset made to the physical
 counter and timer.
-Define the missing SCR and HCR bits, allow SCR_NSE and {SCR,HCR}_GPF
+Implement the handling for this register, which includes control/trap
-to be set, and invalidate TLBs when NSE changes.
+bits in SCR_EL3 and CNTHCTL_EL2.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    |  5 +++--
+ target/arm/cpu-features.h |  5 +++
- target/arm/helper.c | 10 ++++++++--
+ target/arm/cpu.h          |  1 +
-files changed, 11 insertions(+), 4 deletions(-)
+ target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
  target/arm/trace-events   |  1 +
 files changed, 73 insertions(+), 2 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+ }
++static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
++}
++
+ static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- #define HCR_TERR      (1ULL << 36)
+         uint64_t c14_cntkctl; /* Timer Control register */
- #define HCR_TEA       (1ULL << 37)
+         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
- #define HCR_MIOCNCE   (1ULL << 38)
+         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
--/* RES0 bit 39 */
++        uint64_t cntpoff_el2; /* Counter Physical Offset register */
-+#define HCR_TME       (1ULL << 39)
+         ARMGenericTimer c14_timer[NUM_GTIMERS];
- #define HCR_APK       (1ULL << 40)
+         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
- #define HCR_API       (1ULL << 41)
+         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
  #define HCR_NV        (1ULL << 42)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define HCR_NV2       (1ULL << 45)
  #define HCR_FWB       (1ULL << 46)
  #define HCR_FIEN      (1ULL << 47)
 -/* RES0 bit 48 */
 +#define HCR_GPF       (1ULL << 48)
  #define HCR_TID4      (1ULL << 49)
  #define HCR_TICAB     (1ULL << 50)
  #define HCR_AMVOFFEN  (1ULL << 51)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
  #define SCR_TRNDR             (1ULL << 40)
  #define SCR_ENTP2             (1ULL << 41)
  #define SCR_GPF               (1ULL << 48)
 +#define SCR_NSE               (1ULL << 62)
  #define HSTR_TTEE (1 << 16)
  #define HSTR_TJDBX (1 << 17)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
 @@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         if (cpu_isar_feature(aa64_fgt, cpu)) {
+         if (cpu_isar_feature(aa64_rme, cpu)) {
-             valid_mask |= SCR_FGTEN;
+             valid_mask |= SCR_NSE | SCR_GPF;
          }
-+        if (cpu_isar_feature(aa64_rme, cpu)) {
++        if (cpu_isar_feature(aa64_ecv, cpu)) {
-+            valid_mask |= SCR_NSE | SCR_GPF;
++            valid_mask |= SCR_ECVEN;
 +        }
      } else {
          valid_mask &= ~(SCR_RW | SCR_ST);
          if (cpu_isar_feature(aa32_ras, cpu)) {
-@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
-     env->cp15.scr_el3 = value;
+     gt_update_irq(cpu, GTIMER_PHYS);
+ }
-     /*
--     * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then
++static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
-+     * If SCR_EL3.{NS,NSE} changes, i.e. change of security state,
++{
-      * we must invalidate all TLBs below EL3.
++    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
-      */
++        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
--    if (changed & SCR_NS) {
++        arm_is_el2_enabled(env) &&
-+    if (changed & (SCR_NS | SCR_NSE)) {
++        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
-         tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
++        return env->cp15.cntpoff_el2;
-                                            ARMMMUIdxBit_E20_0 |
++    }
-                                            ARMMMUIdxBit_E10_1 |
++    return 0;
-@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
++}
-         if (cpu_isar_feature(aa64_fwb, cpu)) {
++
-             valid_mask |= HCR_FWB;
++static uint64_t gt_phys_cnt_offset(CPUARMState *env)
-         }
++{
-+        if (cpu_isar_feature(aa64_rme, cpu)) {
++    if (arm_current_el(env) >= 2) {
-+            valid_mask |= HCR_GPF;
++        return 0;
-+        }
++    }
 +    return gt_phys_raw_cnt_offset(env);
 +}
 +
  static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
  {
      ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
           * reset timer to when ISTATUS next has to change
           */
          uint64_t offset = timeridx == GTIMER_VIRT ?
 -                                      cpu->env.cp15.cntvoff_el2 : 0;
 +            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
          uint64_t count = gt_get_countervalue(&cpu->env);
          /* Note that this must be unsigned 64 bit arithmetic: */
          int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
  static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
  {
 -    return gt_get_countervalue(env);
 +    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
  }
  static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
-     if (cpu_isar_feature(any_evt, cpu)) {
+     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
      case GTIMER_HYPVIRT:
          offset = gt_virt_cnt_offset(env);
          break;
 +    case GTIMER_PHYS:
 +        offset = gt_phys_cnt_offset(env);
 +        break;
      }
      trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
              R_CNTHCTL_EL1NVVCT_MASK |
              R_CNTHCTL_EVNTIS_MASK;
      }
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        valid_mask |= R_CNTHCTL_ECV_MASK;
 +    }
      /* Clear RES0 bits */
      value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
      },
  };
 +static CPAccessResult gt_cntpoff_access(CPUARMState *env,
 +                                        const ARMCPRegInfo *ri,
 +                                        bool isread)
 +{
 +    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                              uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    trace_arm_gt_cntpoff_write(value);
 +    raw_write(env, ri, value);
 +    gt_recalc_timer(cpu, GTIMER_PHYS);
 +}
 +
 +static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
 +    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
 +    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
 +    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
 +    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
 +    .nv2_redirect_offset = 0x1a8,
 +    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
 +};
  #else
  /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
          define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
      }
 +#ifndef CONFIG_USER_ONLY
 +    if (cpu_isar_feature(aa64_ecv, cpu)) {
 +        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
 +    }
 +#endif
      if (arm_feature(env, ARM_FEATURE_VAPA)) {
          ARMCPRegInfo vapa_cp_reginfo[] = {
              { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
 diff --git a/target/arm/trace-events b/target/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/trace-events
 +++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
  arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
  arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
  arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
 +arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
  arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
  # kvm.c
 --
 .34.1

-[PULL 21/26] docs/system/arm: Document FEAT_RME
+[PULL 08/14] target/arm: Enable FEAT_ECV for 'max' CPU
-From: Richard Henderson <richard.henderson@linaro.org>
+Enable all FEAT_ECV features on the 'max' CPU.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20230622143046.1578160-1-richard.henderson@linaro.org
-[PMM: fixed typo; note experimental status in emulation.rst too]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
 ---
- docs/system/arm/cpu-features.rst | 23 +++++++++++++++++++++++
+ docs/system/arm/emulation.rst | 1 +
- docs/system/arm/emulation.rst    |  1 +
+ target/arm/tcg/cpu64.c        | 1 +
-files changed, 24 insertions(+)
+files changed, 2 insertions(+)
-diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/cpu-features.rst
-+++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ As with ``sve-default-vector-length``, if the default length is larger
- than the maximum vector length enabled, the actual vector length will
- be reduced.  If this property is set to ``-1`` then the default vector
- length is set to the maximum possible length.
-+
-+RME CPU Properties
-+==================
-+
-+The status of RME support with QEMU is experimental.  At this time we
-+only support RME within the CPU proper, not within the SMMU or GIC.
-+The feature is enabled by the CPU property ``x-rme``, with the ``x-``
-+prefix present as a reminder of the experimental status, and defaults off.
-+
-+The method for enabling RME will change in some future QEMU release
-+without notice or backward compatibility.
-+
-+RME Level 0 GPT Size Property
-+-----------------------------
-+
-+To aid firmware developers in testing different possible CPU
-+configurations, ``x-l0gptsz=S`` may be used to specify the value
-+to encode into ``GPCCR_EL3.L0GPTSZ``, a read-only field that
-+specifies the size of the Level 0 Granule Protection Table.
-+Legal values for ``S`` are 30, 34, 36, and 39; the default is 30.
-+
-+As with ``x-rme``, the ``x-l0gptsz`` property may be renamed or
-+removed in some future QEMU release.
 diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/emulation.rst
 +++ b/docs/system/arm/emulation.rst
 @@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_RAS (Reliability, availability, and serviceability)
+ - FEAT_DotProd (Advanced SIMD dot product instructions)
- - FEAT_RASv1p1 (RAS Extension v1.1)
+ - FEAT_DoubleFault (Double Fault Extension)
- - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
+ - FEAT_E0PD (Preventing EL0 access to halves of address maps)
-+- FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
++- FEAT_ECV (Enhanced Counter Virtualization)
- - FEAT_RNG (Random number generator)
+ - FEAT_EPAC (Enhanced pointer authentication)
- - FEAT_S2FWB (Stage 2 forced Write-Back)
+ - FEAT_ETS (Enhanced Translation Synchronization)
- - FEAT_SB (Speculation Barrier)
+ - FEAT_EVT (Enhanced Virtualization Traps)
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
      t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
      t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
      t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
 +    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
      cpu->isar.id_aa64mmfr0 = t;
      t = cpu->isar.id_aa64mmfr1;
 --
 .34.1

-[PULL 25/26] target/arm: Fix sve predicate store, 8 <= VQ <= 15
+[PULL 09/14] hw/gpio: Implement STM32L4x5 GPIO
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Brown bag time: store instead of load results in uninitialized temp.
+Features supported :
 - the 8 STM32L4x5 GPIOs are initialized with their reset values
     (except IDR, see below)
 - input mode : setting a pin in input mode "externally" (using input
     irqs) results in an out irq (transmitted to SYSCFG)
 - output mode : setting a bit in ODR sets the corresponding out irq
     (if this line is configured in output mode)
 - pull-up, pull-down
 - push-pull, open-drain
+Difference with the real GPIOs :
+- Alternate Function and Analog mode aren't implemented :
+    pins in AF/Analog behave like pins in input mode
+- floating pins stay at their last value
+- register IDR reset values differ from the real one :
+    values are coherent with the other registers reset values
+    and the fact that AF/Analog modes aren't implemented
+- setting I/O output speed isn't supported
+- locking port bits isn't supported
+- ADC function isn't supported
+- GPIOH has 16 pins instead of 2 pins
+- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1704
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-Reported-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20230620134659.817559-1-richard.henderson@linaro.org
+Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
 Fixes: e6dd5e782be ("target/arm: Use tcg_gen_qemu_{ld, st}_i128 in gen_sve_{ld, st}r")
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tcg/translate-sve.c | 2 +-
+ MAINTAINERS                        |   1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ docs/system/arm/b-l475e-iot01a.rst |   2 +-
  include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
  hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
  hw/gpio/Kconfig                    |   3 +
  hw/gpio/meson.build                |   1 +
  hw/gpio/trace-events               |   6 +
 files changed, 559 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
  create mode 100644 hw/gpio/stm32l4x5_gpio.c
-diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/translate-sve.c
+--- a/MAINTAINERS
-+++ b/target/arm/tcg/translate-sve.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
+@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
-     /* Predicate register stores can be any multiple of 2.  */
+ F: hw/misc/stm32l4x5_exti.c
-     if (len_remain >= 8) {
+ F: hw/misc/stm32l4x5_syscfg.c
-         t0 = tcg_temp_new_i64();
+ F: hw/misc/stm32l4x5_rcc.c
--        tcg_gen_st_i64(t0, base, vofs + len_align);
++F: hw/gpio/stm32l4x5_gpio.c
-+        tcg_gen_ld_i64(t0, base, vofs + len_align);
+ F: include/hw/*/stm32l4x5_*.h
-         tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUQ | MO_ATOM_NONE);
-         len_remain -= 8;
+ B-L475E-IOT01A IoT Node
-         len_align += 8;
+diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/b-l475e-iot01a.rst
 +++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
  - STM32L4x5 EXTI (Extended interrupts and events controller)
  - STM32L4x5 SYSCFG (System configuration controller)
  - STM32L4x5 RCC (Reset and clock control)
 +- STM32L4x5 GPIOs (General-purpose I/Os)
  Missing devices
  """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
  The B-L475E-IOT01A does *not* support the following devices:
  - Serial ports (UART)
 -- General-purpose I/Os (GPIO)
  - Analog to Digital Converter (ADC)
  - SPI controller
  - Timer controller (TIMER)
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#ifndef HW_STM32L4X5_GPIO_H
 +#define HW_STM32L4X5_GPIO_H
 +
 +#include "hw/sysbus.h"
 +#include "qom/object.h"
 +
 +#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 +OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +
 +#define GPIO_NUM_PINS 16
 +
 +struct Stm32l4x5GpioState {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion mmio;
 +
 +    /* GPIO registers */
 +    uint32_t moder;
 +    uint32_t otyper;
 +    uint32_t ospeedr;
 +    uint32_t pupdr;
 +    uint32_t idr;
 +    uint32_t odr;
 +    uint32_t lckr;
 +    uint32_t afrl;
 +    uint32_t afrh;
 +    uint32_t ascr;
 +
 +    /* GPIO registers reset values */
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +
 +    /*
 +     * External driving of pins.
 +     * The pins can be set externally through the device
 +     * anonymous input GPIOs lines under certain conditions.
 +     * The pin must not be in push-pull output mode,
 +     * and can't be set high in open-drain mode.
 +     * Pins driven externally and configured to
 +     * output mode will in general be "disconnected"
 +     * (see `get_gpio_pinmask_to_disconnect()`)
 +     */
 +    uint16_t disconnected_pins;
 +    uint16_t pins_connected_high;
 +
 +    char *name;
 +    Clock *clk;
 +    qemu_irq pin[GPIO_NUM_PINS];
 +};
 +
 +#endif
 diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * STM32L4x5 GPIO (General Purpose Input/Ouput)
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +/*
 + * The reference used is the STMicroElectronics RM0351 Reference manual
 + * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
 + * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
 +#include "hw/irq.h"
 +#include "hw/qdev-clock.h"
 +#include "hw/qdev-properties.h"
 +#include "qapi/visitor.h"
 +#include "qapi/error.h"
 +#include "migration/vmstate.h"
 +#include "trace.h"
 +
 +#define GPIO_MODER 0x00
 +#define GPIO_OTYPER 0x04
 +#define GPIO_OSPEEDR 0x08
 +#define GPIO_PUPDR 0x0C
 +#define GPIO_IDR 0x10
 +#define GPIO_ODR 0x14
 +#define GPIO_BSRR 0x18
 +#define GPIO_LCKR 0x1C
 +#define GPIO_AFRL 0x20
 +#define GPIO_AFRH 0x24
 +#define GPIO_BRR 0x28
 +#define GPIO_ASCR 0x2C
 +
 +/* 0b11111111_11111111_00000000_00000000 */
 +#define RESERVED_BITS_MASK 0xFFFF0000
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s);
 +
 +static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->pupdr, 2 * pin, 2) == 2;
 +}
 +
 +static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->moder, 2 * pin, 2) == 1;
 +}
 +
 +static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 1;
 +}
 +
 +static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
 +{
 +    return extract32(s->otyper, pin, 1) == 0;
 +}
 +
 +static void stm32l4x5_gpio_reset_hold(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    s->moder = s->moder_reset;
 +    s->otyper = 0x00000000;
 +    s->ospeedr = s->ospeedr_reset;
 +    s->pupdr = s->pupdr_reset;
 +    s->idr = 0x00000000;
 +    s->odr = 0x00000000;
 +    s->lckr = 0x00000000;
 +    s->afrl = 0x00000000;
 +    s->afrh = 0x00000000;
 +    s->ascr = 0x00000000;
 +
 +    s->disconnected_pins = 0xFFFF;
 +    s->pins_connected_high = 0x0000;
 +    update_gpio_idr(s);
 +}
 +
 +static void stm32l4x5_gpio_set(void *opaque, int line, int level)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +    /*
 +     * The pin isn't set if line is configured in output mode
 +     * except if level is 0 and the output is open-drain.
 +     * This way there will be no short-circuit prone situations.
 +     */
 +    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
 +                      line);
 +        return;
 +    }
 +
 +    s->disconnected_pins &= ~(1 << line);
 +    if (level) {
 +        s->pins_connected_high |= (1 << line);
 +    } else {
 +        s->pins_connected_high &= ~(1 << line);
 +    }
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +
 +static void update_gpio_idr(Stm32l4x5GpioState *s)
 +{
 +    uint32_t new_idr_mask = 0;
 +    uint32_t new_idr = s->odr;
 +    uint32_t old_idr = s->idr;
 +    int new_pin_state, old_pin_state;
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (is_output(s, i)) {
 +            if (is_push_pull(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (!(s->odr & (1 << i))) {
 +                /* open-drain ODR 0 */
 +                new_idr_mask |= (1 << i);
 +            /* open-drain ODR 1 */
 +            } else if (!(s->disconnected_pins & (1 << i)) &&
 +                       !(s->pins_connected_high & (1 << i))) {
 +                /* open-drain ODR 1 with pin connected low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            /* open-drain ODR 1 with unactive pin */
 +            } else if (is_pull_up(s, i)) {
 +                new_idr_mask |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for open-drain ODR 1
 +             * with unactive pin without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        /* input or analog mode with connected pin */
 +        } else if (!(s->disconnected_pins & (1 << i))) {
 +            if (s->pins_connected_high & (1 << i)) {
 +                /* pin high */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else {
 +                /* pin low */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +        /* input or analog mode with disconnected pin */
 +        } else {
 +            if (is_pull_up(s, i)) {
 +                /* pull-up */
 +                new_idr_mask |= (1 << i);
 +                new_idr |= (1 << i);
 +            } else if (is_pull_down(s, i)) {
 +                /* pull-down */
 +                new_idr_mask |= (1 << i);
 +                new_idr &= ~(1 << i);
 +            }
 +            /*
 +             * The only case left is for a disconnected pin
 +             * without pull-up or pull-down :
 +             * the value is floating.
 +             */
 +        }
 +    }
 +
 +    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
 +    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
 +
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        if (new_idr_mask & (1 << i)) {
 +            new_pin_state = (new_idr & (1 << i)) > 0;
 +            old_pin_state = (old_idr & (1 << i)) > 0;
 +            if (new_pin_state > old_pin_state) {
 +                qemu_irq_raise(s->pin[i]);
 +            } else if (new_pin_state < old_pin_state) {
 +                qemu_irq_lower(s->pin[i]);
 +            }
 +        }
 +    }
 +}
 +
 +/*
 + * Return mask of pins that are both configured in output
 + * mode and externally driven (except pins in open-drain
 + * mode externally set to 0).
 + */
 +static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
 +{
 +    uint32_t pins_to_disconnect = 0;
 +    for (int i = 0; i < GPIO_NUM_PINS; i++) {
 +        /* for each connected pin in output mode */
 +        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
 +            /* if either push-pull or high level */
 +            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
 +                pins_to_disconnect |= (1 << i);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Line %d can't be driven externally\n",
 +                              i);
 +            }
 +        }
 +    }
 +    return pins_to_disconnect;
 +}
 +
 +/*
 + * Set field `disconnected_pins` and call `update_gpio_idr()`
 + */
 +static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
 +{
 +    s->disconnected_pins |= lines;
 +    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
 +                              s->pins_connected_high);
 +    update_gpio_idr(s);
 +}
 +
 +static void disconnected_pins_set(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint16_t value;
 +    if (!visit_type_uint16(v, name, &value, errp)) {
 +        return;
 +    }
 +    disconnect_gpio_pins(s, value);
 +}
 +
 +static void disconnected_pins_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
 +}
 +
 +static void clock_freq_get(Object *obj, Visitor *v,
 +    const char *name, void *opaque, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +    uint32_t clock_freq_hz = clock_get_hz(s->clk);
 +    visit_type_uint32(v, name, &clock_freq_hz, errp);
 +}
 +
 +static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
 +                                 uint64_t val64, unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    uint32_t value = val64;
 +    trace_stm32l4x5_gpio_write(s->name, addr, val64);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        s->moder = value;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Analog and AF modes aren't supported\n\
 +                       Analog and AF mode behave like input mode\n",
 +                      __func__);
 +        return;
 +    case GPIO_OTYPER:
 +        s->otyper = value & ~RESERVED_BITS_MASK;
 +        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
 +        return;
 +    case GPIO_OSPEEDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Changing I/O output speed isn't supported\n\
 +                       I/O speed is already maximal\n",
 +                      __func__);
 +        s->ospeedr = value;
 +        return;
 +    case GPIO_PUPDR:
 +        s->pupdr = value;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_IDR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: GPIO->IDR is read-only\n",
 +                      __func__);
 +        return;
 +    case GPIO_ODR:
 +        s->odr = value & ~RESERVED_BITS_MASK;
 +        update_gpio_idr(s);
 +        return;
 +    case GPIO_BSRR: {
 +        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
 +        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
 +        /* If both BSx and BRx are set, BSx has priority.*/
 +        s->odr &= ~bits_to_reset;
 +        s->odr |= bits_to_set;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_LCKR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Locking port bits configuration isn't supported\n",
 +                      __func__);
 +        s->lckr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    case GPIO_AFRL:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrl = value;
 +        return;
 +    case GPIO_AFRH:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: Alternate functions aren't supported\n",
 +                      __func__);
 +        s->afrh = value;
 +        return;
 +    case GPIO_BRR: {
 +        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
 +        s->odr &= ~bits_to_reset;
 +        update_gpio_idr(s);
 +        return;
 +    }
 +    case GPIO_ASCR:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s: ADC function isn't supported\n",
 +                      __func__);
 +        s->ascr = value & ~RESERVED_BITS_MASK;
 +        return;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +    }
 +}
 +
 +static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
 +                                    unsigned int size)
 +{
 +    Stm32l4x5GpioState *s = opaque;
 +
 +    trace_stm32l4x5_gpio_read(s->name, addr);
 +
 +    switch (addr) {
 +    case GPIO_MODER:
 +        return s->moder;
 +    case GPIO_OTYPER:
 +        return s->otyper;
 +    case GPIO_OSPEEDR:
 +        return s->ospeedr;
 +    case GPIO_PUPDR:
 +        return s->pupdr;
 +    case GPIO_IDR:
 +        return s->idr;
 +    case GPIO_ODR:
 +        return s->odr;
 +    case GPIO_BSRR:
 +        return 0;
 +    case GPIO_LCKR:
 +        return s->lckr;
 +    case GPIO_AFRL:
 +        return s->afrl;
 +    case GPIO_AFRH:
 +        return s->afrh;
 +    case GPIO_BRR:
 +        return 0;
 +    case GPIO_ASCR:
 +        return s->ascr;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
 +        return 0;
 +    }
 +}
 +
 +static const MemoryRegionOps stm32l4x5_gpio_ops = {
 +    .read = stm32l4x5_gpio_read,
 +    .write = stm32l4x5_gpio_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +        .unaligned = false,
 +    },
 +};
 +
 +static void stm32l4x5_gpio_init(Object *obj)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
 +
 +    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
 +                          TYPE_STM32L4X5_GPIO, 0x400);
 +
 +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 +
 +    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
 +    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
 +
 +    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
 +
 +    object_property_add(obj, "disconnected-pins", "uint16",
 +                        disconnected_pins_get, disconnected_pins_set,
 +                        NULL, &s->disconnected_pins);
 +    object_property_add(obj, "clock-freq-hz", "uint32",
 +                        clock_freq_get, NULL, NULL, NULL);
 +}
 +
 +static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
 +    if (!clock_has_source(s->clk)) {
 +        error_setg(errp, "GPIO: clk input must be connected");
 +        return;
 +    }
 +}
 +
 +static const VMStateDescription vmstate_stm32l4x5_gpio = {
 +    .name = TYPE_STM32L4X5_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]){
 +        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
 +        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
 +        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static Property stm32l4x5_gpio_properties[] = {
 +    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
 +    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
 +    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
 +    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    device_class_set_props(dc, stm32l4x5_gpio_properties);
 +    dc->vmsd = &vmstate_stm32l4x5_gpio;
 +    dc->realize = stm32l4x5_gpio_realize;
 +    rc->phases.hold = stm32l4x5_gpio_reset_hold;
 +}
 +
 +static const TypeInfo stm32l4x5_gpio_types[] = {
 +    {
 +        .name = TYPE_STM32L4X5_GPIO,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(Stm32l4x5GpioState),
 +        .instance_init = stm32l4x5_gpio_init,
 +        .class_init = stm32l4x5_gpio_class_init,
 +    },
 +};
 +
 +DEFINE_TYPES(stm32l4x5_gpio_types)
 diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/Kconfig
 +++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
  config SIFIVE_GPIO
      bool
 +
 +config STM32L4X5_GPIO
 +    bool
 diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/meson.build
 +++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
      'bcm2835_gpio.c',
      'bcm2838_gpio.c'
  ))
 +system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
  system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
  system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
 diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/gpio/trace-events
 +++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
  # aspeed_gpio.c
  aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
  aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 +
 +# stm32l4x5_gpio.c
 +stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
 +stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
 +stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
 +stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
 --
 .34.1

-[PULL 01/26] target/arm: Add isar_feature_aa64_rme
+[PULL 10/14] hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-Add the missing field for ID_AA64PFR0, and the predicate.
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-Disable it if EL3 is forced off by the board or command-line.
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
 Message-id: 20230620124418.805717-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 6 ++++++
+ include/hw/arm/stm32l4x5_soc.h     |  2 +
- target/arm/cpu.c | 4 ++++
+ include/hw/gpio/stm32l4x5_gpio.h   |  1 +
-files changed, 10 insertions(+)
+ include/hw/misc/stm32l4x5_syscfg.h |  3 +-
+ hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+ hw/misc/stm32l4x5_syscfg.c         |  1 +
-index XXXXXXX..XXXXXXX 100644
+ hw/arm/Kconfig                     |  3 +-
---- a/target/arm/cpu.h
+files changed, 63 insertions(+), 18 deletions(-)
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, SEL2, 36, 4)
+diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
- FIELD(ID_AA64PFR0, MPAM, 40, 4)
+index XXXXXXX..XXXXXXX 100644
- FIELD(ID_AA64PFR0, AMU, 44, 4)
+--- a/include/hw/arm/stm32l4x5_soc.h
- FIELD(ID_AA64PFR0, DIT, 48, 4)
++++ b/include/hw/arm/stm32l4x5_soc.h
-+FIELD(ID_AA64PFR0, RME, 52, 4)
+@@ -XXX,XX +XXX,XX @@
- FIELD(ID_AA64PFR0, CSV2, 56, 4)
+ #include "hw/misc/stm32l4x5_syscfg.h"
- FIELD(ID_AA64PFR0, CSV3, 60, 4)
+ #include "hw/misc/stm32l4x5_exti.h"
+ #include "hw/misc/stm32l4x5_rcc.h"
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
++#include "hw/gpio/stm32l4x5_gpio.h"
-     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
+ #include "qom/object.h"
  #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
      OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
      Stm32l4x5SyscfgState syscfg;
      Stm32l4x5RccState rcc;
 +    Stm32l4x5GpioState gpio[NUM_GPIOS];
      MemoryRegion sram1;
      MemoryRegion sram2;
 diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/gpio/stm32l4x5_gpio.h
 +++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
  #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 +#define NUM_GPIOS 8
  #define GPIO_NUM_PINS 16
  struct Stm32l4x5GpioState {
 diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/stm32l4x5_syscfg.h
 +++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qom/object.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
  OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 -#define NUM_GPIOS 8
 -#define GPIO_NUM_PINS 16
  #define SYSCFG_NUM_EXTICR 4
  struct Stm32l4x5SyscfgState {
 diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32l4x5_soc.c
 +++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/sysemu.h"
  #include "hw/or-irq.h"
  #include "hw/arm/stm32l4x5_soc.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #include "hw/qdev-clock.h"
  #include "hw/misc/unimp.h"
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
 , 35, 36, 37, 38,
  };
 +static const struct {
 +    uint32_t addr;
 +    uint32_t moder_reset;
 +    uint32_t ospeedr_reset;
 +    uint32_t pupdr_reset;
 +} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
 +    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
 +    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
 +    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
 +    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
 +};
 +
  static void stm32l4x5_soc_initfn(Object *obj)
  {
      Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
      }
      object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
      object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
 +        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
 +    }
  }
-+static inline bool isar_feature_aa64_rme(const ARMISARegisters *id)
+ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+{
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RME) != 0;
+     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
-+}
+     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
-+
+     MemoryRegion *system_memory = get_system_memory();
- static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
+-    DeviceState *armv7m;
- {
++    DeviceState *armv7m, *dev;
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
+     SysBusDevice *busdev;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
++    uint32_t pin_index;
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
-+++ b/target/arm/cpu.c
+                                 sc->flash_size, errp)) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
-         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
+         return;
-         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
+     }
-                                            ID_AA64PFR0, EL3, 0);
-+
++    /* GPIOs */
-+        /* Disable the realm management extension, which requires EL3. */
++    for (unsigned i = 0; i < NUM_GPIOS; i++) {
-+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
++        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
-+                                           ID_AA64PFR0, RME, 0);
++        dev = DEVICE(&s->gpio[i]);
-     }
++        qdev_prop_set_string(dev, "name", name);
++        qdev_prop_set_uint32(dev, "mode-reset",
-     if (!cpu->has_el2) {
++                             stm32l4x5_gpio_cfg[i].moder_reset);
 +        qdev_prop_set_uint32(dev, "ospeed-reset",
 +                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
 +        qdev_prop_set_uint32(dev, "pupd-reset",
 +                            stm32l4x5_gpio_cfg[i].pupdr_reset);
 +        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
 +        g_free(name);
 +        name = g_strdup_printf("gpio%c-out", 'a' + i);
 +        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
 +            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
 +        if (!sysbus_realize(busdev, errp)) {
 +            return;
 +        }
 +        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
 +    }
 +
      /* System configuration controller */
      busdev = SYS_BUS_DEVICE(&s->syscfg);
      if (!sysbus_realize(busdev, errp)) {
          return;
      }
      sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
 -    /*
 -     * TODO: when the GPIO device is implemented, connect it
 -     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
 -     * GPIO_NUM_PINS.
 -     */
 +
 +    for (unsigned i = 0; i < NUM_GPIOS; i++) {
 +        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
 +            pin_index = GPIO_NUM_PINS * i + j;
 +            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
 +                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
 +                                  pin_index));
 +        }
 +    }
      /* EXTI device */
      busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
          }
      }
 -    for (unsigned i = 0; i < 16; i++) {
 +    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
          qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                                qdev_get_gpio_in(DEVICE(&s->exti), i));
      }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
      /* RESERVED:    0x40024400, 0x7FDBC00 */
      /* AHB2 BUS */
 -    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
 -    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
 -    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
 -    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
 -    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
 -    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
 -    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
 -    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
      /* RESERVED:    0x48002000, 0x7FDBC00 */
      create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
      create_unimplemented_device("ADC",       0x50040000, 0x400);
 diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32l4x5_syscfg.c
 +++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "migration/vmstate.h"
  #include "hw/misc/stm32l4x5_syscfg.h"
 +#include "hw/gpio/stm32l4x5_gpio.h"
  #define SYSCFG_MEMRMP 0x00
  #define SYSCFG_CFGR1 0x04
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
      bool
      select ARM_V7M
      select OR_IRQ
 -    select STM32L4X5_SYSCFG
      select STM32L4X5_EXTI
 +    select STM32L4X5_SYSCFG
      select STM32L4X5_RCC
 +    select STM32L4X5_GPIO
  config XLNX_ZYNQMP_ARM
      bool
 --
 .34.1

-[PULL 06/26] include/exec/memattrs: Add two bits of space to MemTxAttrs
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-We will need 2 bits to represent ARMSecurityState.
-Do not attempt to replace or widen secure, even though it
-logically overlaps the new field -- there are uses within
-e.g. hw/block/pflash_cfi01.c, which don't know anything
-specific about ARM.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-7-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/exec/memattrs.h | 9 ++++++++-
-file changed, 8 insertions(+), 1 deletion(-)
-diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/exec/memattrs.h
-+++ b/include/exec/memattrs.h
-@@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs {
-      * "didn't specify" if necessary.
-      */
-     unsigned int unspecified:1;
--    /* ARM/AMBA: TrustZone Secure access
-+    /*
-+     * ARM/AMBA: TrustZone Secure access
-      * x86: System Management Mode access
-      */
-     unsigned int secure:1;
-+    /*
-+     * ARM: ArmSecuritySpace.  This partially overlaps secure, but it is
-+     * easier to have both fields to assist code that does not understand
-+     * ARMv9 RME, or no specific knowledge of ARM at all (e.g. pflash).
-+     */
-+    unsigned int space:2;
-     /* Memory access is usermode (unprivileged) */
-     unsigned int user:1;
-     /*
---
-.34.1

-[PULL 07/26] target/arm: Adjust the order of Phys and Stage2 ARMMMUIdx
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-It will be helpful to have ARMMMUIdx_Phys_* to be in the same
-relative order as ARMSecuritySpace enumerators. This requires
-the adjustment to the nstable check. While there, check for being
-in secure state rather than rely on clearing the low bit making
-no change to non-secure state.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-8-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 12 ++++++------
- target/arm/ptw.c | 12 +++++-------
-files changed, 11 insertions(+), 13 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
-     ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
--    /* TLBs with 1-1 mapping to the physical address spaces. */
--    ARMMMUIdx_Phys_NS   = 8 | ARM_MMU_IDX_A,
--    ARMMMUIdx_Phys_S    = 9 | ARM_MMU_IDX_A,
--
-     /*
-      * Used for second stage of an S12 page table walk, or for descriptor
-      * loads during first stage of an S1 page table walk.  Note that both
-      * are in use simultaneously for SecureEL2: the security state for
-      * the S2 ptw is selected by the NS bit from the S1 ptw.
-      */
--    ARMMMUIdx_Stage2    = 10 | ARM_MMU_IDX_A,
--    ARMMMUIdx_Stage2_S  = 11 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_Stage2_S  = 8 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
-+
-+    /* TLBs with 1-1 mapping to the physical address spaces. */
-+    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
-     /*
-      * These are not allocated TLBs and are used only for AT system
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     descaddr |= (address >> (stride * (4 - level))) & indexmask;
-     descaddr &= ~7ULL;
-     nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
--    if (nstable) {
-+    if (nstable && ptw->in_secure) {
-         /*
-          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
--         * Assert that the non-secure idx are even, and relative order.
-+         * Assert the relative order of the secure/non-secure indexes.
-          */
--        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
--        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
--        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
--        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
--        ptw->in_ptw_idx &= ~1;
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
-+        ptw->in_ptw_idx += 1;
-         ptw->in_secure = false;
-     }
-     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
---
-.34.1

-[PULL 09/26] target/arm: Remove __attribute__((nonnull)) from ptw.c
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-This was added in 7e98e21c098 as part of a reorg in which
-one of the argument had been legally NULL, and this caught
-actual instances.  Now that the reorg is complete, this
-serves little purpose.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-10-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 6 ++----
-file changed, 2 insertions(+), 4 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
- static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                                uint64_t address,
-                                MMUAccessType access_type, bool s1_is_el0,
--                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
--    __attribute__((nonnull));
-+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
- static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-                                       target_ulong address,
-                                       MMUAccessType access_type,
-                                       GetPhysAddrResult *result,
--                                      ARMMMUFaultInfo *fi)
--    __attribute__((nonnull));
-+                                      ARMMMUFaultInfo *fi);
- /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
- static const uint8_t pamax_map[] = {
---
-.34.1

-[PULL 10/26] target/arm: Pipe ARMSecuritySpace through ptw.c
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Add input and output space members to S1Translate.  Set and adjust
-them in S1_ptw_translate, and the various points at which we drop
-secure state.  Initialize the space in get_phys_addr; for now leave
-get_phys_addr_with_secure considering only secure vs non-secure spaces.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-11-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 86 +++++++++++++++++++++++++++++++++++++++---------
-file changed, 71 insertions(+), 15 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@
- typedef struct S1Translate {
-     ARMMMUIdx in_mmu_idx;
-     ARMMMUIdx in_ptw_idx;
-+    ARMSecuritySpace in_space;
-     bool in_secure;
-     bool in_debug;
-     bool out_secure;
-     bool out_rw;
-     bool out_be;
-+    ARMSecuritySpace out_space;
-     hwaddr out_virt;
-     hwaddr out_phys;
-     void *out_host;
-@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
- static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-                              hwaddr addr, ARMMMUFaultInfo *fi)
- {
-+    ARMSecuritySpace space = ptw->in_space;
-     bool is_secure = ptw->in_secure;
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-                 .in_mmu_idx = s2_mmu_idx,
-                 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-                 .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-+                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-+                             : space == ARMSS_Realm ? ARMSS_Realm
-+                             : ARMSS_NonSecure),
-                 .in_debug = true,
-             };
-             GetPhysAddrResult s2 = { };
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-             ptw->out_phys = s2.f.phys_addr;
-             pte_attrs = s2.cacheattrs.attrs;
-             ptw->out_secure = s2.f.attrs.secure;
-+            ptw->out_space = s2.f.attrs.space;
-         } else {
-             /* Regime is physical. */
-             ptw->out_phys = addr;
-             pte_attrs = 0;
-             ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
-+            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
-+                              : space == ARMSS_Realm ? ARMSS_Realm
-+                              : ARMSS_NonSecure);
-         }
-         ptw->out_host = NULL;
-         ptw->out_rw = false;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-         ptw->out_rw = full->prot & PAGE_WRITE;
-         pte_attrs = full->pte_attrs;
-         ptw->out_secure = full->attrs.secure;
-+        ptw->out_space = full->attrs.space;
- #else
-         g_assert_not_reached();
- #endif
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
-         }
-     } else {
-         /* Page tables are in MMIO. */
--        MemTxAttrs attrs = { .secure = ptw->out_secure };
-+        MemTxAttrs attrs = {
-+            .secure = ptw->out_secure,
-+            .space = ptw->out_space,
-+        };
-         AddressSpace *as = arm_addressspace(cs, attrs);
-         MemTxResult result = MEMTX_OK;
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
- #endif
-     } else {
-         /* Page tables are in MMIO. */
--        MemTxAttrs attrs = { .secure = ptw->out_secure };
-+        MemTxAttrs attrs = {
-+            .secure = ptw->out_secure,
-+            .space = ptw->out_space,
-+        };
-         AddressSpace *as = arm_addressspace(cs, attrs);
-         MemTxResult result = MEMTX_OK;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-          * regime, because the attribute will already be non-secure.
-          */
-         result->f.attrs.secure = false;
-+        result->f.attrs.space = ARMSS_NonSecure;
-     }
-     result->f.phys_addr = phys_addr;
-     return false;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-          * regime, because the attribute will already be non-secure.
-          */
-         result->f.attrs.secure = false;
-+        result->f.attrs.space = ARMSS_NonSecure;
-     }
-     if (regime_is_stage2(mmu_idx)) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
-              */
-             if (sattrs.ns) {
-                 result->f.attrs.secure = false;
-+                result->f.attrs.space = ARMSS_NonSecure;
-             } else if (!secure) {
-                 /*
-                  * NS access to S memory must fault.
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     bool is_secure = ptw->in_secure;
-     bool ret, ipa_secure;
-     ARMCacheAttrs cacheattrs1;
-+    ARMSecuritySpace ipa_space;
-     bool is_el0;
-     uint64_t hcr;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     ipa = result->f.phys_addr;
-     ipa_secure = result->f.attrs.secure;
-+    ipa_space = result->f.attrs.space;
-     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
-     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-     ptw->in_secure = ipa_secure;
-+    ptw->in_space = ipa_space;
-     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
-     /*
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-     ARMMMUIdx s1_mmu_idx;
-     /*
--     * The page table entries may downgrade secure to non-secure, but
--     * cannot upgrade an non-secure translation regime's attributes
--     * to secure.
-+     * The page table entries may downgrade Secure to NonSecure, but
-+     * cannot upgrade a NonSecure translation regime's attributes
-+     * to Secure or Realm.
-      */
-     result->f.attrs.secure = is_secure;
-+    result->f.attrs.space = ptw->in_space;
-     switch (mmu_idx) {
-     case ARMMMUIdx_Phys_S:
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-     default:
-         /* Single stage uses physical for ptw. */
--        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
-+        ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
-         break;
-     }
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
-     S1Translate ptw = {
-         .in_mmu_idx = mmu_idx,
-         .in_secure = is_secure,
-+        .in_space = arm_secure_to_space(is_secure),
-     };
-     return get_phys_addr_with_struct(env, &ptw, address, access_type,
-                                      result, fi);
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
- {
--    bool is_secure;
-+    S1Translate ptw = {
-+        .in_mmu_idx = mmu_idx,
-+    };
-+    ARMSecuritySpace ss;
-     switch (mmu_idx) {
-     case ARMMMUIdx_E10_0:
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-     case ARMMMUIdx_Stage1_E1:
-     case ARMMMUIdx_Stage1_E1_PAN:
-     case ARMMMUIdx_E2:
--        is_secure = arm_is_secure_below_el3(env);
-+        ss = arm_security_space_below_el3(env);
-         break;
-     case ARMMMUIdx_Stage2:
-+        /*
-+         * For Secure EL2, we need this index to be NonSecure;
-+         * otherwise this will already be NonSecure or Realm.
-+         */
-+        ss = arm_security_space_below_el3(env);
-+        if (ss == ARMSS_Secure) {
-+            ss = ARMSS_NonSecure;
-+        }
-+        break;
-     case ARMMMUIdx_Phys_NS:
-     case ARMMMUIdx_MPrivNegPri:
-     case ARMMMUIdx_MUserNegPri:
-     case ARMMMUIdx_MPriv:
-     case ARMMMUIdx_MUser:
--        is_secure = false;
-+        ss = ARMSS_NonSecure;
-         break;
--    case ARMMMUIdx_E3:
-     case ARMMMUIdx_Stage2_S:
-     case ARMMMUIdx_Phys_S:
-     case ARMMMUIdx_MSPrivNegPri:
-     case ARMMMUIdx_MSUserNegPri:
-     case ARMMMUIdx_MSPriv:
-     case ARMMMUIdx_MSUser:
--        is_secure = true;
-+        ss = ARMSS_Secure;
-+        break;
-+    case ARMMMUIdx_E3:
-+        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
-+            cpu_isar_feature(aa64_rme, env_archcpu(env))) {
-+            ss = ARMSS_Root;
-+        } else {
-+            ss = ARMSS_Secure;
-+        }
-+        break;
-+    case ARMMMUIdx_Phys_Root:
-+        ss = ARMSS_Root;
-+        break;
-+    case ARMMMUIdx_Phys_Realm:
-+        ss = ARMSS_Realm;
-         break;
-     default:
-         g_assert_not_reached();
-     }
--    return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
--                                     is_secure, result, fi);
-+
-+    ptw.in_space = ss;
-+    ptw.in_secure = arm_space_is_secure(ss);
-+    return get_phys_addr_with_struct(env, &ptw, address, access_type,
-+                                     result, fi);
- }
- hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
-+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
-+    ARMSecuritySpace ss = arm_security_space(env);
-     S1Translate ptw = {
--        .in_mmu_idx = arm_mmu_idx(env),
--        .in_secure = arm_is_secure(env),
-+        .in_mmu_idx = mmu_idx,
-+        .in_space = ss,
-+        .in_secure = arm_space_is_secure(ss),
-         .in_debug = true,
-     };
-     GetPhysAddrResult res = {};
---
-.34.1

-[PULL 11/26] target/arm: NSTable is RES0 for the RME EL3 regime
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Test in_space instead of in_secure so that we don't
-switch out of Root space.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-12-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 28 ++++++++++++++--------------
-file changed, 14 insertions(+), 14 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
- {
-     ARMCPU *cpu = env_archcpu(env);
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
--    bool is_secure = ptw->in_secure;
-     int32_t level;
-     ARMVAParameters param;
-     uint64_t ttbr;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
-     uint64_t descriptor, new_descriptor;
--    bool nstable;
-     /* TODO: This code does not support shareability levels. */
-     if (aarch64) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         descaddrmask = MAKE_64BIT_MASK(0, 40);
-     }
-     descaddrmask &= ~indexmask_grainsize;
--
--    /*
--     * Secure stage 1 accesses start with the page table in secure memory and
--     * can be downgraded to non-secure at any step. Non-secure accesses
--     * remain non-secure. We implement this by just ORing in the NSTable/NS
--     * bits at each step.
--     * Stage 2 never gets this kind of downgrade.
--     */
--    tableattrs = is_secure ? 0 : (1 << 4);
-+    tableattrs = 0;
-  next_level:
-     descaddr |= (address >> (stride * (4 - level))) & indexmask;
-     descaddr &= ~7ULL;
--    nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
--    if (nstable && ptw->in_secure) {
-+
-+    /*
-+     * Process the NSTable bit from the previous level.  This changes
-+     * the table address space and the output space from Secure to
-+     * NonSecure.  With RME, the EL3 translation regime does not change
-+     * from Root to NonSecure.
-+     */
-+    if (ptw->in_space == ARMSS_Secure
-+        && !regime_is_stage2(mmu_idx)
-+        && extract32(tableattrs, 4, 1)) {
-         /*
-          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-          * Assert the relative order of the secure/non-secure indexes.
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
-         ptw->in_ptw_idx += 1;
-         ptw->in_secure = false;
-+        ptw->in_space = ARMSS_NonSecure;
-     }
-+
-     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-         goto do_fault;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-      */
-     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-     if (!regime_is_stage2(mmu_idx)) {
--        attrs |= nstable << 5; /* NS */
-+        attrs |= !ptw->in_secure << 5; /* NS */
-         if (!param.hpd) {
-             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-             /*
---
-.34.1

-[PULL 12/26] target/arm: Handle Block and Page bits for security space
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-With Realm security state, bit 55 of a block or page descriptor during
-the stage2 walk becomes the NS bit; during the stage1 walk the bit 5
-NS bit is RES0.  With Root security state, bit 11 of the block or page
-descriptor during the stage1 walk becomes the NSE bit.
-Rather than collecting an NS bit and applying it later, compute the
-output pa space from the input pa space and unconditionally assign.
-This means that we no longer need to adjust the output space earlier
-for the NSTable bit.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-13-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 89 +++++++++++++++++++++++++++++++++++++++---------
-file changed, 73 insertions(+), 16 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
-  * @mmu_idx: MMU index indicating required translation regime
-  * @is_aa64: TRUE if AArch64
-  * @ap:      The 2-bit simple AP (AP[2:1])
-- * @ns:      NS (non-secure) bit
-  * @xn:      XN (execute-never) bit
-  * @pxn:     PXN (privileged execute-never) bit
-+ * @in_pa:   The original input pa space
-+ * @out_pa:  The output pa space, modified by NSTable, NS, and NSE
-  */
- static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
--                      int ap, int ns, int xn, int pxn)
-+                      int ap, int xn, int pxn,
-+                      ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
- {
-     ARMCPU *cpu = env_archcpu(env);
-     bool is_user = regime_is_user(env, mmu_idx);
-@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-         }
-     }
--    if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
-+    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
-+        (env->cp15.scr_el3 & SCR_SIF)) {
-         return prot_rw;
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     int32_t stride;
-     int addrsize, inputsize, outputsize;
-     uint64_t tcr = regime_tcr(env, mmu_idx);
--    int ap, ns, xn, pxn;
-+    int ap, xn, pxn;
-     uint32_t el = regime_el(env, mmu_idx);
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
-     uint64_t descriptor, new_descriptor;
-+    ARMSecuritySpace out_space;
-     /* TODO: This code does not support shareability levels. */
-     if (aarch64) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     }
-     ap = extract32(attrs, 6, 2);
-+    out_space = ptw->in_space;
-     if (regime_is_stage2(mmu_idx)) {
--        ns = mmu_idx == ARMMMUIdx_Stage2;
-+        /*
-+         * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
-+         * The bit remains ignored for other security states.
-+         */
-+        if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
-+            out_space = ARMSS_NonSecure;
-+        }
-         xn = extract64(attrs, 53, 2);
-         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-     } else {
--        ns = extract32(attrs, 5, 1);
-+        int nse, ns = extract32(attrs, 5, 1);
-+        switch (out_space) {
-+        case ARMSS_Root:
-+            /*
-+             * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
-+             * R_XTYPW: NSE and NS together select the output pa space.
-+             */
-+            nse = extract32(attrs, 11, 1);
-+            out_space = (nse << 1) | ns;
-+            if (out_space == ARMSS_Secure &&
-+                !cpu_isar_feature(aa64_sel2, cpu)) {
-+                out_space = ARMSS_NonSecure;
-+            }
-+            break;
-+        case ARMSS_Secure:
-+            if (ns) {
-+                out_space = ARMSS_NonSecure;
-+            }
-+            break;
-+        case ARMSS_Realm:
-+            switch (mmu_idx) {
-+            case ARMMMUIdx_Stage1_E0:
-+            case ARMMMUIdx_Stage1_E1:
-+            case ARMMMUIdx_Stage1_E1_PAN:
-+                /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
-+                break;
-+            case ARMMMUIdx_E2:
-+            case ARMMMUIdx_E20_0:
-+            case ARMMMUIdx_E20_2:
-+            case ARMMMUIdx_E20_2_PAN:
-+                /*
-+                 * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
-+                 * NS changes the output to non-secure space.
-+                 */
-+                if (ns) {
-+                    out_space = ARMSS_NonSecure;
-+                }
-+                break;
-+            default:
-+                g_assert_not_reached();
-+            }
-+            break;
-+        case ARMSS_NonSecure:
-+            /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
-+            break;
-+        default:
-+            g_assert_not_reached();
-+        }
-         xn = extract64(attrs, 54, 1);
-         pxn = extract64(attrs, 53, 1);
--        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
-+
-+        /*
-+         * Note that we modified ptw->in_space earlier for NSTable, but
-+         * result->f.attrs retains a copy of the original security space.
-+         */
-+        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
-+                                    result->f.attrs.space, out_space);
-     }
-     if (!(result->f.prot & (1 << access_type))) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         }
-     }
--    if (ns) {
--        /*
--         * The NS bit will (as required by the architecture) have no effect if
--         * the CPU doesn't support TZ or this is a non-secure translation
--         * regime, because the attribute will already be non-secure.
--         */
--        result->f.attrs.secure = false;
--        result->f.attrs.space = ARMSS_NonSecure;
--    }
-+    result->f.attrs.space = out_space;
-+    result->f.attrs.secure = arm_space_is_secure(out_space);
-     if (regime_is_stage2(mmu_idx)) {
-         result->cacheattrs.is_s2_format = true;
---
-.34.1

-[PULL 13/26] target/arm: Handle no-execute for Realm and Root regimes
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-While Root and Realm may read and write data from other spaces,
-neither may execute from other pa spaces.
-This happens for Stage1 EL3, EL2, EL2&0, and Stage2 EL1&0.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-14-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 52 ++++++++++++++++++++++++++++++++++++++++++------
-file changed, 46 insertions(+), 6 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ do_fault:
-  * @xn:      XN (execute-never) bits
-  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
-  */
--static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
-+static int get_S2prot_noexecute(int s2ap)
- {
-     int prot = 0;
-@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
-     if (s2ap & 2) {
-         prot |= PAGE_WRITE;
-     }
-+    return prot;
-+}
-+
-+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
-+{
-+    int prot = get_S2prot_noexecute(s2ap);
-     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
-         switch (xn) {
-@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-         }
-     }
--    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
--        (env->cp15.scr_el3 & SCR_SIF)) {
--        return prot_rw;
-+    if (in_pa != out_pa) {
-+        switch (in_pa) {
-+        case ARMSS_Root:
-+            /*
-+             * R_ZWRVD: permission fault for insn fetched from non-Root,
-+             * I_WWBFB: SIF has no effect in EL3.
-+             */
-+            return prot_rw;
-+        case ARMSS_Realm:
-+            /*
-+             * R_PKTDS: permission fault for insn fetched from non-Realm,
-+             * for Realm EL2 or EL2&0.  The corresponding fault for EL1&0
-+             * happens during any stage2 translation.
-+             */
-+            switch (mmu_idx) {
-+            case ARMMMUIdx_E2:
-+            case ARMMMUIdx_E20_0:
-+            case ARMMMUIdx_E20_2:
-+            case ARMMMUIdx_E20_2_PAN:
-+                return prot_rw;
-+            default:
-+                break;
-+            }
-+            break;
-+        case ARMSS_Secure:
-+            if (env->cp15.scr_el3 & SCR_SIF) {
-+                return prot_rw;
-+            }
-+            break;
-+        default:
-+            /* Input NonSecure must have output NonSecure. */
-+            g_assert_not_reached();
-+        }
-     }
-     /* TODO have_wxn should be replaced with
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         /*
-          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
-          * The bit remains ignored for other security states.
-+         * R_YMCSL: Executing an insn fetched from non-Realm causes
-+         * a stage2 permission fault.
-          */
-         if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
-             out_space = ARMSS_NonSecure;
-+            result->f.prot = get_S2prot_noexecute(ap);
-+        } else {
-+            xn = extract64(attrs, 53, 2);
-+            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-         }
--        xn = extract64(attrs, 53, 2);
--        result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-     } else {
-         int nse, ns = extract32(attrs, 5, 1);
-         switch (out_space) {
---
-.34.1

-[PULL 14/26] target/arm: Use get_phys_addr_with_struct in S1_ptw_translate
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Do not provide a fast-path for physical addresses,
-as those will need to be validated for GPC.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-15-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 44 +++++++++++++++++---------------------------
-file changed, 17 insertions(+), 27 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-          * From gdbstub, do not use softmmu so that we don't modify the
-          * state of the cpu at all, including softmmu tlb contents.
-          */
--        if (regime_is_stage2(s2_mmu_idx)) {
--            S1Translate s2ptw = {
--                .in_mmu_idx = s2_mmu_idx,
--                .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
--                .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
--                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
--                             : space == ARMSS_Realm ? ARMSS_Realm
--                             : ARMSS_NonSecure),
--                .in_debug = true,
--            };
--            GetPhysAddrResult s2 = { };
-+        S1Translate s2ptw = {
-+            .in_mmu_idx = s2_mmu_idx,
-+            .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-+            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-+            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-+                         : space == ARMSS_Realm ? ARMSS_Realm
-+                         : ARMSS_NonSecure),
-+            .in_debug = true,
-+        };
-+        GetPhysAddrResult s2 = { };
--            if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
--                                   false, &s2, fi)) {
--                goto fail;
--            }
--            ptw->out_phys = s2.f.phys_addr;
--            pte_attrs = s2.cacheattrs.attrs;
--            ptw->out_secure = s2.f.attrs.secure;
--            ptw->out_space = s2.f.attrs.space;
--        } else {
--            /* Regime is physical. */
--            ptw->out_phys = addr;
--            pte_attrs = 0;
--            ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
--            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
--                              : space == ARMSS_Realm ? ARMSS_Realm
--                              : ARMSS_NonSecure);
-+        if (get_phys_addr_with_struct(env, &s2ptw, addr,
-+                                      MMU_DATA_LOAD, &s2, fi)) {
-+            goto fail;
-         }
-+        ptw->out_phys = s2.f.phys_addr;
-+        pte_attrs = s2.cacheattrs.attrs;
-         ptw->out_host = NULL;
-         ptw->out_rw = false;
-+        ptw->out_secure = s2.f.attrs.secure;
-+        ptw->out_space = s2.f.attrs.space;
-     } else {
- #ifdef CONFIG_TCG
-         CPUTLBEntryFull *full;
---
-.34.1

-[PULL 15/26] target/arm: Move s1_is_el0 into S1Translate
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Instead of passing this to get_phys_addr_lpae, stash it
-in the S1Translate structure.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-16-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 27 ++++++++++++---------------
-file changed, 12 insertions(+), 15 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
-     ARMSecuritySpace in_space;
-     bool in_secure;
-     bool in_debug;
-+    /*
-+     * If this is stage 2 of a stage 1+2 page table walk, then this must
-+     * be true if stage 1 is an EL0 access; otherwise this is ignored.
-+     * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
-+     */
-+    bool in_s1_is_el0;
-     bool out_secure;
-     bool out_rw;
-     bool out_be;
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
- } S1Translate;
- static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
--                               uint64_t address,
--                               MMUAccessType access_type, bool s1_is_el0,
-+                               uint64_t address, MMUAccessType access_type,
-                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
- static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-@@ -XXX,XX +XXX,XX @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
-  * @ptw: Current and next stage parameters for the walk.
-  * @address: virtual address to get physical address for
-  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
-- * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
-- *             (so this is a stage 2 page table walk),
-- *             must be true if this is stage 2 of a stage 1+2
-- *             walk for an EL0 access. If @mmu_idx is anything else,
-- *             @s1_is_el0 is ignored.
-  * @result: set on translation success,
-  * @fi: set to fault info if the translation fails
-  */
- static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                                uint64_t address,
--                               MMUAccessType access_type, bool s1_is_el0,
-+                               MMUAccessType access_type,
-                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
- {
-     ARMCPU *cpu = env_archcpu(env);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-             result->f.prot = get_S2prot_noexecute(ap);
-         } else {
-             xn = extract64(attrs, 53, 2);
--            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-+            result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
-         }
-     } else {
-         int nse, ns = extract32(attrs, 5, 1);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     bool ret, ipa_secure;
-     ARMCacheAttrs cacheattrs1;
-     ARMSecuritySpace ipa_space;
--    bool is_el0;
-     uint64_t hcr;
-     ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     ipa_secure = result->f.attrs.secure;
-     ipa_space = result->f.attrs.space;
--    is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
-+    ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
-     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-     ptw->in_secure = ipa_secure;
-     ptw->in_space = ipa_space;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-         ret = get_phys_addr_pmsav8(env, ipa, access_type,
-                                    ptw->in_mmu_idx, is_secure, result, fi);
-     } else {
--        ret = get_phys_addr_lpae(env, ptw, ipa, access_type,
--                                 is_el0, result, fi);
-+        ret = get_phys_addr_lpae(env, ptw, ipa, access_type, result, fi);
-     }
-     fi->s2addr = ipa;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-     }
-     if (regime_using_lpae_format(env, mmu_idx)) {
--        return get_phys_addr_lpae(env, ptw, address, access_type, false,
--                                  result, fi);
-+        return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
-     } else if (arm_feature(env, ARM_FEATURE_V7) ||
-                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
-         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
---
-.34.1

-[PULL 16/26] target/arm: Use get_phys_addr_with_struct for stage2
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-This fixes a bug in which we failed to initialize
-the result attributes properly after the memset.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-17-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 11 +----------
-file changed, 1 insertion(+), 10 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
-     void *out_host;
- } S1Translate;
--static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
--                               uint64_t address, MMUAccessType access_type,
--                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
--
- static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-                                       target_ulong address,
-                                       MMUAccessType access_type,
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     cacheattrs1 = result->cacheattrs;
-     memset(result, 0, sizeof(*result));
--    if (arm_feature(env, ARM_FEATURE_PMSA)) {
--        ret = get_phys_addr_pmsav8(env, ipa, access_type,
--                                   ptw->in_mmu_idx, is_secure, result, fi);
--    } else {
--        ret = get_phys_addr_lpae(env, ptw, ipa, access_type, result, fi);
--    }
-+    ret = get_phys_addr_with_struct(env, ptw, ipa, access_type, result, fi);
-     fi->s2addr = ipa;
-     /* Combine the S1 and S2 perms.  */
---
-.34.1

-[PULL 17/26] target/arm: Add GPC syndrome
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The function takes the fields as filled in by
-the Arm ARM pseudocode for TakeGPCException.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-18-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/syndrome.h | 10 ++++++++++
-file changed, 10 insertions(+)
-diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/syndrome.h
-+++ b/target/arm/syndrome.h
-@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
-     EC_SVEACCESSTRAP          = 0x19,
-     EC_ERETTRAP               = 0x1a,
-     EC_SMETRAP                = 0x1d,
-+    EC_GPC                    = 0x1e,
-     EC_INSNABORT              = 0x20,
-     EC_INSNABORT_SAME_EL      = 0x21,
-     EC_PCALIGNMENT            = 0x22,
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_bxjtrap(int cv, int cond, int rm)
-         (cv << 24) | (cond << 20) | rm;
- }
-+static inline uint32_t syn_gpc(int s2ptw, int ind, int gpcsc,
-+                               int cm, int s1ptw, int wnr, int fsc)
-+{
-+    /* TODO: FEAT_NV2 adds VNCR */
-+    return (EC_GPC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (s2ptw << 21)
-+            | (ind << 20) | (gpcsc << 14) | (cm << 8) | (s1ptw << 7)
-+            | (wnr << 6) | fsc;
-+}
-+
- static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
- {
-     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
---
-.34.1

-[PULL 23/26] target/arm: Restructure has_vfp_d32 test
+[PULL 11/14] tests/qtest: Add STM32L4x5 GPIO QTest testcase
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Inès Varhol <ines.varhol@telecom-paris.fr>
-One cannot test for feature aa32_simd_r32 without first
+The testcase contains :
-testing if AArch32 mode is supported at all.  This leads to
+- `test_idr_reset_value()` :
 Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
 - `test_gpio_output_mode()` :
 Checks that writing a bit in register ODR results in the corresponding
 pin rising or lowering, if this pin is configured in output mode.
 - `test_gpio_input_mode()` :
 Checks that a input pin set high or low externally results
 in the pin rising and lowering.
 - `test_pull_up_pull_down()` :
 Checks that a floating pin in pull-up/down mode is actually high/down.
 - `test_push_pull()` :
 Checks that a pin set externally is disconnected when configured in
 push-pull output mode, and can't be set externally while in this mode.
 - `test_open_drain()` :
 Checks that a pin set externally high is disconnected when configured
 in open-drain output mode, and can't be set high while in this mode.
 - `test_bsrr_brr()` :
 Checks that writing to BSRR and BRR has the desired result in ODR.
 - `test_clock_enable()` :
 Checks that GPIO clock is at the right frequency after enabling it.
-qemu-system-aarch64: ARM CPUs must have both VFP-D32 and Neon or neither
+Acked-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
-for Apple M1 cpus.
+Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
+Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
 We already have a check for ARMv8-A never setting vfp-d32 true,
 so restructure the code so that AArch64 avoids the test entirely.
 Reported-by: Mads Ynddal <mads@ynddal.dk>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Mads Ynddal <m.ynddal@samsung.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Mads Ynddal <m.ynddal@samsung.com>
 Message-id: 20230619140216.402530-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.c | 28 +++++++++++++++-------------
+ tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
-file changed, 15 insertions(+), 13 deletions(-)
+ tests/qtest/meson.build           |   3 +-
 files changed, 553 insertions(+), 1 deletion(-)
  create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for STM32L4x5_GPIO
 + *
 + * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
 + * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "libqtest-single.h"
 +
 +#define GPIO_BASE_ADDR 0x48000000
 +#define GPIO_SIZE      0x400
 +#define NUM_GPIOS      8
 +#define NUM_GPIO_PINS  16
 +
 +#define GPIO_A 0x48000000
 +#define GPIO_B 0x48000400
 +#define GPIO_C 0x48000800
 +#define GPIO_D 0x48000C00
 +#define GPIO_E 0x48001000
 +#define GPIO_F 0x48001400
 +#define GPIO_G 0x48001800
 +#define GPIO_H 0x48001C00
 +
 +#define MODER 0x00
 +#define OTYPER 0x04
 +#define PUPDR 0x0C
 +#define IDR 0x10
 +#define ODR 0x14
 +#define BSRR 0x18
 +#define BRR 0x28
 +
 +#define MODER_INPUT 0
 +#define MODER_OUTPUT 1
 +
 +#define PUPDR_NONE 0
 +#define PUPDR_PULLUP 1
 +#define PUPDR_PULLDOWN 2
 +
 +#define OTYPER_PUSH_PULL 0
 +#define OTYPER_OPEN_DRAIN 1
 +
 +const uint32_t moder_reset[NUM_GPIOS] = {
 +    0xABFFFFFF,
 +    0xFFFFFEBF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0xFFFFFFFF,
 +    0x0000000F
 +};
 +
 +const uint32_t pupdr_reset[NUM_GPIOS] = {
 +    0x64000000,
 +    0x00000100,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +const uint32_t idr_reset[NUM_GPIOS] = {
 +    0x0000A000,
 +    0x00000010,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000,
 +    0x00000000
 +};
 +
 +static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
 +{
 +    return readl(gpio + offset);
 +}
 +
 +static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
 +{
 +    writel(gpio + offset, value);
 +}
 +
 +static void gpio_set_bit(unsigned int gpio, unsigned int reg,
 +                         unsigned int pin, uint32_t value)
 +{
 +    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
 +}
 +
 +static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
 +                           unsigned int pin, uint32_t value)
 +{
 +    uint32_t offset = 2 * pin;
 +    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
 +    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
 +}
 +
 +static unsigned int get_gpio_id(uint32_t gpio_addr)
 +{
 +    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
 +}
 +
 +static void gpio_set_irq(unsigned int gpio, int num, int level)
 +{
 +    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    qtest_set_irq_in(global_qtest, name, NULL, num, level);
 +}
 +
 +static void disconnect_all_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
 +        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
 +        path, 0xFFFF);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static uint32_t get_disconnected_pins(unsigned int gpio)
 +{
 +    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
 +                                            get_gpio_id(gpio) + 'a');
 +    uint32_t disconnected_pins = 0;
 +    QDict *r;
 +
 +    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
 +        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
 +    g_assert_false(qdict_haskey(r, "error"));
 +    disconnected_pins = qdict_get_int(r, "return");
 +    qobject_unref(r);
 +    return disconnected_pins;
 +}
 +
 +static uint32_t reset(uint32_t gpio, unsigned int offset)
 +{
 +    switch (offset) {
 +    case MODER:
 +        return moder_reset[get_gpio_id(gpio)];
 +    case PUPDR:
 +        return pupdr_reset[get_gpio_id(gpio)];
 +    case IDR:
 +        return idr_reset[get_gpio_id(gpio)];
 +    }
 +    return 0x0;
 +}
 +
 +static void system_reset(void)
 +{
 +    QDict *r;
 +    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
 +    g_assert_false(qdict_haskey(r, "error"));
 +    qobject_unref(r);
 +}
 +
 +static void test_idr_reset_value(void)
 +{
 +    /*
 +     * Checks that the values in MODER, OTYPER, PUPDR and ODR
 +     * after reset are correct, and that the value in IDR is
 +     * coherent.
 +     * Since AF and analog modes aren't implemented, IDR reset
 +     * values aren't the same as with a real board.
 +     *
 +     * Register IDR contains the actual values of all GPIO pins.
 +     * Its value depends on the pins' configuration
 +     * (intput/output/analog : register MODER, push-pull/open-drain :
 +     * register OTYPER, pull-up/pull-down/none : register PUPDR)
 +     * and on the values stored in register ODR
 +     * (in case the pin is in output mode).
 +     */
 +
 +    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
 +
 +    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
 +    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
 +
 +    system_reset();
 +
 +    uint32_t moder = gpio_readl(GPIO_A, MODER);
 +    uint32_t odr = gpio_readl(GPIO_A, ODR);
 +    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
 +    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
 +    uint32_t idr = gpio_readl(GPIO_A, IDR);
 +    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
 +    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
 +    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
 +
 +    moder = gpio_readl(GPIO_B, MODER);
 +    odr = gpio_readl(GPIO_B, ODR);
 +    otyper = gpio_readl(GPIO_B, OTYPER);
 +    pupdr = gpio_readl(GPIO_B, PUPDR);
 +    idr = gpio_readl(GPIO_B, IDR);
 +    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
 +    /* here AF is the same as Analog and Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
 +    /* ... 5: neither, 4: pull-up, 3: neither ... */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
 +    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
 +    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
 +
 +    moder = gpio_readl(GPIO_C, MODER);
 +    odr = gpio_readl(GPIO_C, ODR);
 +    otyper = gpio_readl(GPIO_C, OTYPER);
 +    pupdr = gpio_readl(GPIO_C, PUPDR);
 +    idr = gpio_readl(GPIO_C, IDR);
 +    /* Analog, same as Input mode*/
 +    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
 +
 +    moder = gpio_readl(GPIO_H, MODER);
 +    odr = gpio_readl(GPIO_H, ODR);
 +    otyper = gpio_readl(GPIO_H, OTYPER);
 +    pupdr = gpio_readl(GPIO_H, PUPDR);
 +    idr = gpio_readl(GPIO_H, IDR);
 +    /* Analog, same as Input mode */
 +    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
 +    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
 +    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
 +    /* no pull-up or pull-down */
 +    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
 +    /* reset value */
 +    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
 +}
 +
 +static void test_gpio_output_mode(const void *data)
 +{
 +    /*
 +     * Checks that setting a bit in ODR sets the corresponding
 +     * GPIO line high : it should set the right bit in IDR
 +     * and send an irq to syscfg.
 +     * Additionally, it checks that values written to ODR
 +     * when not in output mode are stored and not discarded.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Set a bit in ODR and check nothing happens */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the relevant line as output and check the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Reset the bit in ODR and check the pin is low */
 +    gpio_set_bit(gpio, ODR, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +}
 +
 +static void test_gpio_input_mode(const void *data)
 +{
 +    /*
 +     * Test that setting a line high/low externally sets the
 +     * corresponding GPIO line high/low : it should set the
 +     * right bit in IDR and send an irq to syscfg.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input, raise it, and check that the pin is high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Lower the line and check that the pin is low */
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    disconnect_all_pins(gpio);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_pull_up_pull_down(const void *data)
 +{
 +    /*
 +     * Test that a floating pin with pull-up sets the pin
 +     * high and vice-versa.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    unsigned int gpio_id = get_gpio_id(gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Configure a line as input with pull-up, check the line is set high */
 +    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
 +    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Configure the line with pull-down, check the line is low */
 +    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_push_pull(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in push-pull output mode
 +     * disconnects the pin, that the pin can't be set or reset
 +     * externally afterwards.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in push-pull output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Trying to set a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a push-pull output pin, checking it doesn't work */
 +    gpio_set_irq(gpio2, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
 +
 +    /* Clean the test */
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +}
 +
 +static void test_open_drain(const void *data)
 +{
 +    /*
 +     * Test that configuring a line in open-drain output mode
 +     * disconnects a pin set high externally and that the pin
 +     * can't be set high externally while configured in open-drain.
 +     *
 +     * However a pin set low externally shouldn't be disconnected,
 +     * and it can be set low externally when in open-drain mode.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 +
 +    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
 +
 +    /* Setting a line high externally, configuring it in open-drain output */
 +    /* And checking the pin was disconnected */
 +    gpio_set_irq(gpio, pin, 1);
 +    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Setting a line low externally, configuring it in open-drain output */
 +    /* And checking the pin wasn't disconnected */
 +    gpio_set_irq(gpio2, pin, 0);
 +    gpio_set_bit(gpio2, ODR, pin, 1);
 +    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
 +    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Trying to set a open-drain output pin, checking it doesn't work */
 +    gpio_set_irq(gpio, pin, 1);
 +    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
 +
 +    /* Trying to reset a open-drain output pin, checking it works */
 +    gpio_set_bit(gpio, ODR, pin, 1);
 +    gpio_set_irq(gpio, pin, 0);
 +    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
 +                               reset(gpio2, IDR) & ~(1 << pin));
 +
 +    /* Clean the test */
 +    disconnect_all_pins(gpio2);
 +    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
 +    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
 +    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
 +    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
 +    disconnect_all_pins(gpio);
 +    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +    gpio_writel(gpio, MODER, reset(gpio, MODER));
 +    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
 +}
 +
 +static void test_bsrr_brr(const void *data)
 +{
 +    /*
 +     * Test that writing a '1' in BSS and BSRR
 +     * has the desired effect on ODR.
 +     * In BSRR, BSx has priority over BRx.
 +     */
 +    unsigned int pin = ((uint64_t)data) & 0xF;
 +    uint32_t gpio = ((uint64_t)data) >> 32;
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, BSRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    /* BSx should have priority over BRx */
 +    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
 +
 +    gpio_writel(gpio, BRR, (1 << pin));
 +    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
 +
 +    gpio_writel(gpio, ODR, reset(gpio, ODR));
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    int ret;
 +
 +    g_test_init(&argc, &argv, NULL);
 +    g_test_set_nonfatal_assertions();
 +    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
 +                   test_idr_reset_value);
 +    /*
 +     * The inputs for the tests (gpio and pin) can be changed,
 +     * but the tests don't work for pins that are high at reset
 +     * (GPIOA15, GPIO13 and GPIOB5).
 +     * Specifically, rising the pin then checking `get_irq()`
 +     * is problematic since the pin was already high.
 +     */
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
 +                        (void *)((uint64_t)GPIO_C << 32 | 5),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_gpio_output_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
 +                        (void *)((uint64_t)GPIO_D << 32 | 6),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
 +                        (void *)((uint64_t)GPIO_C << 32 | 10),
 +                        test_gpio_input_mode);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
 +                        (void *)((uint64_t)GPIO_B << 32 | 5),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
 +                        (void *)((uint64_t)GPIO_F << 32 | 1),
 +                        test_pull_up_pull_down);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
 +                        (void *)((uint64_t)GPIO_G << 32 | 6),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
 +                        (void *)((uint64_t)GPIO_H << 32 | 3),
 +                        test_push_pull);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
 +                        (void *)((uint64_t)GPIO_C << 32 | 4),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
 +                        (void *)((uint64_t)GPIO_E << 32 | 11),
 +                        test_open_drain);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
 +                        (void *)((uint64_t)GPIO_A << 32 | 12),
 +                        test_bsrr_brr);
 +    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
 +                        (void *)((uint64_t)GPIO_D << 32 | 0),
 +                        test_bsrr_brr);
 +
 +    qtest_start("-machine b-l475e-iot01a");
 +    ret = g_test_run();
 +    qtest_end();
 +
 +    return ret;
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/tests/qtest/meson.build
-+++ b/target/arm/cpu.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
-      * KVM does not currently allow us to lie to the guest about its
+ qtests_stm32l4x5 = \
-      * ID/feature registers, so the guest always sees what the host has.
+   ['stm32l4x5_exti-test',
-      */
+    'stm32l4x5_syscfg-test',
--    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
+-   'stm32l4x5_rcc-test']
--        ? cpu_isar_feature(aa64_fp_simd, cpu)
++   'stm32l4x5_rcc-test',
--        : cpu_isar_feature(aa32_vfp, cpu)) {
++   'stm32l4x5_gpio-test']
--        cpu->has_vfp = true;
--        if (!kvm_enabled()) {
+ qtests_arm = \
--            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
+   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +        if (cpu_isar_feature(aa64_fp_simd, cpu)) {
 +            cpu->has_vfp = true;
 +            cpu->has_vfp_d32 = true;
 +            if (tcg_enabled() || qtest_enabled()) {
 +                qdev_property_add_static(DEVICE(obj),
 +                                         &arm_cpu_has_vfp_property);
 +            }
          }
 -    }
 -
 -    if (cpu->has_vfp && cpu_isar_feature(aa32_simd_r32, cpu)) {
 -        cpu->has_vfp_d32 = true;
 -        if (!kvm_enabled()) {
 +    } else if (cpu_isar_feature(aa32_vfp, cpu)) {
 +        cpu->has_vfp = true;
 +        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
 +            cpu->has_vfp_d32 = true;
              /*
               * The permitted values of the SIMDReg bits [3:0] on
               * Armv8-A are either 0b0000 and 0b0010. On such CPUs,
               * make sure that has_vfp_d32 can not be set to false.
               */
 -            if (!(arm_feature(&cpu->env, ARM_FEATURE_V8) &&
 -                  !arm_feature(&cpu->env, ARM_FEATURE_M))) {
 +            if ((tcg_enabled() || qtest_enabled())
 +                && !(arm_feature(&cpu->env, ARM_FEATURE_V8)
 +                     && !arm_feature(&cpu->env, ARM_FEATURE_M))) {
                  qdev_property_add_static(DEVICE(obj),
                                           &arm_cpu_has_vfp_d32_property);
              }
 --
 .34.1

-[PULL 19/26] target/arm: Implement the granule protection check
+[PULL 12/14] target/arm: Fix 32-bit SMOPA
 From: Richard Henderson <richard.henderson@linaro.org>
-Place the check at the end of get_phys_addr_with_struct,
+While the 8-bit input elements are sequential in the input vector,
-so that we check all physical results.
+the 32-bit output elements are not sequential in the output matrix.
+Do not attempt to compute 2 32-bit outputs at the same time.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Cc: qemu-stable@nongnu.org
 Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230620124418.805717-20-richard.henderson@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 249 +++++++++++++++++++++++++++++++++++++++++++----
+ target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
-file changed, 232 insertions(+), 17 deletions(-)
+ tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
+ tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+ tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 147 insertions(+), 33 deletions(-)
  create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
  create mode 100644 tests/tcg/aarch64/sme-smopa-2.c
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/target/arm/tcg/sme_helper.c
-+++ b/target/arm/ptw.c
++++ b/target/arm/tcg/sme_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
      void *out_host;
  } S1Translate;
 -static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
 -                                      target_ulong address,
 -                                      MMUAccessType access_type,
 -                                      GetPhysAddrResult *result,
 -                                      ARMMMUFaultInfo *fi);
 +static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
 +                                target_ulong address,
 +                                MMUAccessType access_type,
 +                                GetPhysAddrResult *result,
 +                                ARMMMUFaultInfo *fi);
 +
 +static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
 +                              target_ulong address,
 +                              MMUAccessType access_type,
 +                              GetPhysAddrResult *result,
 +                              ARMMMUFaultInfo *fi);
  /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
  static const uint8_t pamax_map[] = {
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
      return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
  }
 +static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
 +                                     ARMSecuritySpace pspace,
 +                                     ARMMMUFaultInfo *fi)
 +{
 +    MemTxAttrs attrs = {
 +        .secure = true,
 +        .space = ARMSS_Root,
 +    };
 +    ARMCPU *cpu = env_archcpu(env);
 +    uint64_t gpccr = env->cp15.gpccr_el3;
 +    unsigned pps, pgs, l0gptsz, level = 0;
 +    uint64_t tableaddr, pps_mask, align, entry, index;
 +    AddressSpace *as;
 +    MemTxResult result;
 +    int gpi;
 +
 +    if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
 +        return true;
 +    }
 +
 +    /*
 +     * GPC Priority 1 (R_GMGRR):
 +     * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
 +     * the access fails as GPT walk fault at level 0.
 +     */
 +
 +    /*
 +     * Configuration of PPS to a value exceeding the implemented
 +     * physical address size is invalid.
 +     */
 +    pps = FIELD_EX64(gpccr, GPCCR, PPS);
 +    if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
 +        goto fault_walk;
 +    }
 +    pps = pamax_map[pps];
 +    pps_mask = MAKE_64BIT_MASK(0, pps);
 +
 +    switch (FIELD_EX64(gpccr, GPCCR, SH)) {
 +    case 0b10: /* outer shareable */
 +        break;
 +    case 0b00: /* non-shareable */
 +    case 0b11: /* inner shareable */
 +        /* Inner and Outer non-cacheable requires Outer shareable. */
 +        if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
 +            FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
 +            goto fault_walk;
 +        }
 +        break;
 +    default:   /* reserved */
 +        goto fault_walk;
 +    }
 +
 +    switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
 +    case 0b00: /* 4KB */
 +        pgs = 12;
 +        break;
 +    case 0b01: /* 64KB */
 +        pgs = 16;
 +        break;
 +    case 0b10: /* 16KB */
 +        pgs = 14;
 +        break;
 +    default: /* reserved */
 +        goto fault_walk;
 +    }
 +
 +    /* Note this field is read-only and fixed at reset. */
 +    l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
 +
 +    /*
 +     * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
 +     * R_CPDSB: A NonSecure physical address input exceeding PPS
 +     * does not experience any fault.
 +     */
 +    if (paddress & ~pps_mask) {
 +        if (pspace == ARMSS_NonSecure) {
 +            return true;
 +        }
 +        goto fault_size;
 +    }
 +
 +    /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
 +    tableaddr = env->cp15.gptbr_el3 << 12;
 +    if (tableaddr & ~pps_mask) {
 +        goto fault_size;
 +    }
 +
 +    /*
 +     * BADDR is aligned per a function of PPS and L0GPTSZ.
 +     * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
 +     * unlike the RES0 bits of the GPT entries (R_XNKFZ).
 +     */
 +    align = MAX(pps - l0gptsz + 3, 12);
 +    align = MAKE_64BIT_MASK(0, align);
 +    tableaddr &= ~align;
 +
 +    as = arm_addressspace(env_cpu(env), attrs);
 +
 +    /* Level 0 lookup. */
 +    index = extract64(paddress, l0gptsz, pps - l0gptsz);
 +    tableaddr += index * 8;
 +    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
 +    if (result != MEMTX_OK) {
 +        goto fault_eabt;
 +    }
 +
 +    switch (extract32(entry, 0, 4)) {
 +    case 1: /* block descriptor */
 +        if (entry >> 8) {
 +            goto fault_walk; /* RES0 bits not 0 */
 +        }
 +        gpi = extract32(entry, 4, 4);
 +        goto found;
 +    case 3: /* table descriptor */
 +        tableaddr = entry & ~0xf;
 +        align = MAX(l0gptsz - pgs - 1, 12);
 +        align = MAKE_64BIT_MASK(0, align);
 +        if (tableaddr & (~pps_mask | align)) {
 +            goto fault_walk; /* RES0 bits not 0 */
 +        }
 +        break;
 +    default: /* invalid */
 +        goto fault_walk;
 +    }
 +
 +    /* Level 1 lookup */
 +    level = 1;
 +    index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
 +    tableaddr += index * 8;
 +    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
 +    if (result != MEMTX_OK) {
 +        goto fault_eabt;
 +    }
 +
 +    switch (extract32(entry, 0, 4)) {
 +    case 1: /* contiguous descriptor */
 +        if (entry >> 10) {
 +            goto fault_walk; /* RES0 bits not 0 */
 +        }
 +        /*
 +         * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
 +         * and because we cannot invalidate by pa, and thus will always
 +         * flush entire tlbs, we don't actually care about the range here
 +         * and can simply extract the GPI as the result.
 +         */
 +        if (extract32(entry, 8, 2) == 0) {
 +            goto fault_walk; /* reserved contig */
 +        }
 +        gpi = extract32(entry, 4, 4);
 +        break;
 +    default:
 +        index = extract64(paddress, pgs, 4);
 +        gpi = extract64(entry, index * 4, 4);
 +        break;
 +    }
 +
 + found:
 +    switch (gpi) {
 +    case 0b0000: /* no access */
 +        break;
 +    case 0b1111: /* all access */
 +        return true;
 +    case 0b1000:
 +    case 0b1001:
 +    case 0b1010:
 +    case 0b1011:
 +        if (pspace == (gpi & 3)) {
 +            return true;
 +        }
 +        break;
 +    default:
 +        goto fault_walk; /* reserved */
 +    }
 +
 +    fi->gpcf = GPCF_Fail;
 +    goto fault_common;
 + fault_eabt:
 +    fi->gpcf = GPCF_EABT;
 +    goto fault_common;
 + fault_size:
 +    fi->gpcf = GPCF_AddressSize;
 +    goto fault_common;
 + fault_walk:
 +    fi->gpcf = GPCF_Walk;
 + fault_common:
 +    fi->level = level;
 +    fi->paddr = paddress;
 +    fi->paddr_space = pspace;
 +    return false;
 +}
 +
  static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
  {
      /*
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          };
          GetPhysAddrResult s2 = { };
 -        if (get_phys_addr_with_struct(env, &s2ptw, addr,
 -                                      MMU_DATA_LOAD, &s2, fi)) {
 +        if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
              goto fail;
          }
 +
          ptw->out_phys = s2.f.phys_addr;
          pte_attrs = s2.cacheattrs.attrs;
          ptw->out_host = NULL;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
   fail:
      assert(fi->type != ARMFault_None);
 +    if (fi->type == ARMFault_GPCFOnOutput) {
 +        fi->type = ARMFault_GPCFOnWalk;
 +    }
      fi->s2addr = addr;
      fi->stage2 = true;
      fi->s1ptw = true;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
                                     ARMMMUFaultInfo *fi)
  {
      uint8_t memattr = 0x00;    /* Device nGnRnE */
 -    uint8_t shareability = 0;  /* non-sharable */
 +    uint8_t shareability = 0;  /* non-shareable */
      int r_el;
      switch (mmu_idx) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
              } else {
                  memattr = 0x44;  /* Normal, NC, No */
              }
 -            shareability = 2; /* outer sharable */
 +            shareability = 2; /* outer shareable */
          }
          result->cacheattrs.is_s2_format = false;
          break;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      ARMSecuritySpace ipa_space;
      uint64_t hcr;
 -    ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
 +    ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
      /* If S1 fails, return early.  */
      if (ret) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      cacheattrs1 = result->cacheattrs;
      memset(result, 0, sizeof(*result));
 -    ret = get_phys_addr_with_struct(env, ptw, ipa, access_type, result, fi);
 +    ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
      fi->s2addr = ipa;
      /* Combine the S1 and S2 perms.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      return false;
  }
 -static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
 +static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
                                        target_ulong address,
                                        MMUAccessType access_type,
                                        GetPhysAddrResult *result,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
      }
  }
-+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
+-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
-+                              target_ulong address,
++typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
-+                              MMUAccessType access_type,
++static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
-+                              GetPhysAddrResult *result,
++                              uint8_t *pn, uint8_t *pm,
-+                              ARMMMUFaultInfo *fi)
++                              uint32_t desc, IMOPFn32 *fn)
 +{
-+    if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
++    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
-+        return true;
++    bool neg = simd_data(desc);
-+    }
-+    if (!granule_protection_check(env, result->f.phys_addr,
+-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-+                                  result->f.attrs.space, fi)) {
+-                            uint8_t *pn, uint8_t *pm,
-+        fi->type = ARMFault_GPCFOnOutput;
+-                            uint32_t desc, IMOPFn *fn)
-+        return true;
++    for (row = 0; row < oprsz; ++row) {
-+    }
++        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
-+    return false;
++        uint32_t *za_row = &za[tile_vslice_index(row)];
 +        uint32_t n = zn[H4(row)];
 +
 +        for (col = 0; col < oprsz; ++col) {
 +            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
 +            uint32_t *a = &za_row[H4(col)];
 +
 +            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
 +        }
 +    }
 +}
 +
- bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
++typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
-                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
++static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                                bool is_secure, GetPhysAddrResult *result,
++                              uint8_t *pn, uint8_t *pm,
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
++                              uint32_t desc, IMOPFn64 *fn)
-         .in_secure = is_secure,
+ {
-         .in_space = arm_secure_to_space(is_secure),
+     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
-     };
+     bool neg = simd_data(desc);
--    return get_phys_addr_with_struct(env, &ptw, address, access_type,
+@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 -                                     result, fi);
 +    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
  }
- bool get_phys_addr(CPUARMState *env, target_ulong address,
+ #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
++static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
-     ptw.in_space = ss;
+ {                                                                           \
-     ptw.in_secure = arm_space_is_secure(ss);
+-    uint32_t sum0 = 0, sum1 = 0;                                            \
--    return get_phys_addr_with_struct(env, &ptw, address, access_type,
++    uint32_t sum = 0;                                                       \
--                                     result, fi);
+     /* Apply P to N as a mask, making the inactive elements 0. */           \
-+    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
+     n &= expand_pred_b(p);                                                  \
 -    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
 -    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
 -    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
 -    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
 -    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
 -    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
 -    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
 -    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
 -    if (neg) {                                                              \
 -        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
 -    } else {                                                                \
 -        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
 -    }                                                                       \
 -    return ((uint64_t)sum1 << 32) | sum0;                                   \
 +    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
 +    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
 +    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
 +    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
 +    return neg ? a - sum : a + sum;                                         \
  }
- hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
+ #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
+@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
-     ARMMMUFaultInfo fi = {};
+ DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
-     bool ret;
+ DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
--    ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
+-#define DEF_IMOPH(NAME) \
-+    ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
+-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-     *attrs = res.f.attrs;
+-                            void *vpm, uint32_t desc)                        \
+-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
-     if (ret) {
++#define DEF_IMOPH(NAME, S) \
 +    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
 +                                  void *vpn, void *vpm, uint32_t desc)      \
 +    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 -DEF_IMOPH(smopa_s)
 -DEF_IMOPH(umopa_s)
 -DEF_IMOPH(sumopa_s)
 -DEF_IMOPH(usmopa_s)
 -DEF_IMOPH(smopa_d)
 -DEF_IMOPH(umopa_d)
 -DEF_IMOPH(sumopa_d)
 -DEF_IMOPH(usmopa_d)
 +DEF_IMOPH(smopa, s)
 +DEF_IMOPH(umopa, s)
 +DEF_IMOPH(sumopa, s)
 +DEF_IMOPH(usmopa, s)
 +
 +DEF_IMOPH(smopa, d)
 +DEF_IMOPH(umopa, d)
 +DEF_IMOPH(sumopa, d)
 +DEF_IMOPH(usmopa, d)
 diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const int cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    int dst[4][4];
 +    int *tmp = &dst[0][0];
 +
 +    asm volatile(
 +        ".arch armv8-r+sme\n\t"
 +        "smstart\n\t"
 +        "index z0.b, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.b, z1.b, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
 +        "ptrue p0.s, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
 +        "add %0, %0, #16\n\t"
 +        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6d", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
 +#include <stdio.h>
 +#include <string.h>
 +
 +int main()
 +{
 +    static const long cmp[4][4] = {
 +        {  110,  134,  158,  182 },
 +        {  390,  478,  566,  654 },
 +        {  670,  822,  974, 1126 },
 +        {  950, 1166, 1382, 1598 }
 +    };
 +    long dst[4][4];
 +    long *tmp = &dst[0][0];
 +    long svl;
 +
 +    /* Validate that we have a wide enough vector for 4 elements. */
 +    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
 +    if (svl < 32) {
 +        return 0;
 +    }
 +
 +    asm volatile(
 +        "smstart\n\t"
 +        "index z0.h, #0, #1\n\t"
 +        "movprfx z1, z0\n\t"
 +        "add z1.h, z1.h, #16\n\t"
 +        "ptrue p0.b\n\t"
 +        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
 +        "ptrue p0.d, vl4\n\t"
 +        "mov w12, #0\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "mov w12, #2\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
 +        "add %0, %0, #32\n\t"
 +        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
 +        "smstop"
 +        : "+r"(tmp) : : "memory");
 +
 +    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
 +        return 0;
 +    }
 +
 +    /* See above for correct results. */
 +    for (int i = 0; i < 4; ++i) {
 +        for (int j = 0; j < 4; ++j) {
 +            printf("%6ld", dst[i][j]);
 +        }
 +        printf("\n");
 +    }
 +    return 1;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
  # SME Tests
  ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
 -AARCH64_TESTS += sme-outprod1
 +AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
  endif
  # System Registers Tests
 --
 .34.1

-[PULL 26/26] pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym
+[PULL 13/14] hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later
-The xkb official name for the Arabic keyboard layout is 'ara'.
+The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
-However xkb has for at least the past 15 years also permitted it to
+was unfortunately added with a license of GPL-v3-or-later, which is
-be named via the legacy synonym 'ar'.  In xkeyboard-config 2.39 this
+not compatible with other QEMU code which has a GPL-v2-only license.
 synoynm was removed, which breaks compilation of QEMU:
-FAILED: pc-bios/keymaps/ar
+Relicense the code in the .c and the .h file to GPL-v2-or-later,
-/home/fred/qemu-git/src/qemu/build-full/qemu-keymap -f pc-bios/keymaps/ar -l ar
+to make it compatible with the rest of QEMU.
 xkbcommon: ERROR: Couldn't find file "symbols/ar" in include paths
 xkbcommon: ERROR: 1 include paths searched:
 xkbcommon: ERROR:     /usr/share/X11/xkb
 xkbcommon: ERROR: 3 include paths could not be added:
 xkbcommon: ERROR:     /home/fred/.config/xkb
 xkbcommon: ERROR:     /home/fred/.xkb
 xkbcommon: ERROR:     /etc/xkb
 xkbcommon: ERROR: Abandoning symbols file "(unnamed)"
 xkbcommon: ERROR: Failed to compile xkb_symbols
 xkbcommon: ERROR: Failed to compile keymap
 The upstream xkeyboard-config change removing the compat
 mapping is:
 https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/470ad2cd8fea84d7210377161d86b31999bb5ea6
 Make QEMU always ask for the 'ara' xkb layout, which should work on
 both older and newer xkeyboard-config.  We leave the QEMU name for
 this keyboard layout as 'ar'; it is not the only one where our name
 for it deviates from the xkb standard name.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Signed-off-by: Markus Armbruster <armbru@redhat.com>
-Message-id: 20230620162024.1132013-1-peter.maydell@linaro.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1709
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
 Acked-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- pc-bios/keymaps/meson.build | 2 +-
+ include/hw/rtc/sun4v-rtc.h | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/rtc/sun4v-rtc.c         | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
+diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
 index XXXXXXX..XXXXXXX 100644
---- a/pc-bios/keymaps/meson.build
+--- a/include/hw/rtc/sun4v-rtc.h
-+++ b/pc-bios/keymaps/meson.build
++++ b/include/hw/rtc/sun4v-rtc.h
 @@ -XXX,XX +XXX,XX @@
- keymaps = {
+  *
--  'ar': '-l ar',
+  * Copyright (c) 2016 Artyom Tarasenko
-+  'ar': '-l ara',
+  *
-   'bepo': '-l fr -v dvorak',
+- * This code is licensed under the GNU GPL v3 or (at your option) any later
-   'cz': '-l cz',
++ * This code is licensed under the GNU GPL v2 or (at your option) any later
-   'da': '-l dk',
+  * version.
   */
 diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/sun4v-rtc.c
 +++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
   *
   * Copyright (c) 2016 Artyom Tarasenko
   *
 - * This code is licensed under the GNU GPL v3 or (at your option) any later
 + * This code is licensed under the GNU GPL v2 or (at your option) any later
   * version.
   */
 --
 .34.1

-[PULL 20/26] target/arm: Add cpu properties for enabling FEAT_RME
+[PULL 14/14] target/arm: Move v7m-related code from cpu32.c into a separate file
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Thomas Huth <thuth@redhat.com>
-Add an x-rme cpu property to enable FEAT_RME.
+Move the code to a separate file so that we do not have to compile
-Add an x-l0gptsz property to set GPCCR_EL3.L0GPTSZ,
+it anymore if CONFIG_ARM_V7M is not set.
 for testing various possible configurations.
-We're not currently completely sure whether FEAT_RME will
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-be OK to enable purely as a CPU-level property, or if it will
+Message-id: 20240308141051.536599-2-thuth@redhat.com
 need board co-operation, so we're making these experimental
 x- properties, so that the people developing the system
 level software for RME can try to start using this and let
 us know how it goes. The command line syntax for enabling
 this will change in future, without backwards-compatibility.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230620124418.805717-21-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tcg/cpu64.c | 53 ++++++++++++++++++++++++++++++++++++++++++
+ target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
-file changed, 53 insertions(+)
+ target/arm/tcg/cpu32.c     | 261 ---------------------------------
  target/arm/meson.build     |   3 +
  target/arm/tcg/meson.build |   3 +
 files changed, 296 insertions(+), 261 deletions(-)
  create mode 100644 target/arm/tcg/cpu-v7m.c
-diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
+diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU ARMv7-M TCG-only CPUs.
 + *
 + * Copyright (c) 2012 SUSE LINUX Products GmbH
 + *
 + * This code is licensed under the GNU GPL v2 or later.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +#include "cpu.h"
 +#include "hw/core/tcg-cpu-ops.h"
 +#include "internals.h"
 +
 +#if !defined(CONFIG_USER_ONLY)
 +
 +#include "hw/intc/armv7m_nvic.h"
 +
 +static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 +{
 +    CPUClass *cc = CPU_GET_CLASS(cs);
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    bool ret = false;
 +
 +    /*
 +     * ARMv7-M interrupt masking works differently than -A or -R.
 +     * There is no FIQ/IRQ distinction. Instead of I and F bits
 +     * masking FIQ and IRQ interrupts, an exception is taken only
 +     * if it is higher priority than the current execution priority
 +     * (which depends on state like BASEPRI, FAULTMASK and the
 +     * currently active exception).
 +     */
 +    if (interrupt_request & CPU_INTERRUPT_HARD
 +        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 +        cs->exception_index = EXCP_IRQ;
 +        cc->tcg_ops->do_interrupt(cs);
 +        ret = true;
 +    }
 +    return ret;
 +}
 +
 +#endif /* !CONFIG_USER_ONLY */
 +
 +static void cortex_m0_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V6);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +
 +    cpu->midr = 0x410cc200;
 +
 +    /*
 +     * These ID register values are not guest visible, because
 +     * we do not implement the Main Extension. They must be set
 +     * to values corresponding to the Cortex-M0's implemented
 +     * features, because QEMU generally controls its emulation
 +     * by looking at ID register fields. We use the same values as
 +     * for the M3.
 +     */
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m3_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    cpu->midr = 0x410fc231;
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m4_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fc240; /* r0p0 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000000;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00000030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x00000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01141110;
 +    cpu->isar.id_isar1 = 0x02111000;
 +    cpu->isar.id_isar2 = 0x21112231;
 +    cpu->isar.id_isar3 = 0x01111110;
 +    cpu->isar.id_isar4 = 0x01310102;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m7_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V7);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x411fc272; /* r1p2 */
 +    cpu->pmsav7_dregion = 8;
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000200;
 +    cpu->isar.id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00100030;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02112000;
 +    cpu->isar.id_isar2 = 0x20232231;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +}
 +
 +static void cortex_m33_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd213; /* r0p3 */
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    cpu->isar.mvfr0 = 0x10110021;
 +    cpu->isar.mvfr1 = 0x11000011;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x00000030;
 +    cpu->isar.id_pfr1 = 0x00000210;
 +    cpu->isar.id_dfr0 = 0x00200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00101F40;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000000;
 +    cpu->isar.id_isar0 = 0x01101110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000;
 +    cpu->ctr = 0x8000c000;
 +}
 +
 +static void cortex_m55_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 +    set_feature(&cpu->env, ARM_FEATURE_M);
 +    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 +    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 +    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 +    cpu->midr = 0x410fd221; /* r0p1 */
 +    cpu->revidr = 0;
 +    cpu->pmsav7_dregion = 16;
 +    cpu->sau_sregion = 8;
 +    /* These are the MVFR* values for the FPU + full MVE configuration */
 +    cpu->isar.mvfr0 = 0x10110221;
 +    cpu->isar.mvfr1 = 0x12100211;
 +    cpu->isar.mvfr2 = 0x00000040;
 +    cpu->isar.id_pfr0 = 0x20000030;
 +    cpu->isar.id_pfr1 = 0x00000230;
 +    cpu->isar.id_dfr0 = 0x10200000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->isar.id_mmfr0 = 0x00111040;
 +    cpu->isar.id_mmfr1 = 0x00000000;
 +    cpu->isar.id_mmfr2 = 0x01000000;
 +    cpu->isar.id_mmfr3 = 0x00000011;
 +    cpu->isar.id_isar0 = 0x01103110;
 +    cpu->isar.id_isar1 = 0x02212000;
 +    cpu->isar.id_isar2 = 0x20232232;
 +    cpu->isar.id_isar3 = 0x01111131;
 +    cpu->isar.id_isar4 = 0x01310132;
 +    cpu->isar.id_isar5 = 0x00000000;
 +    cpu->isar.id_isar6 = 0x00000000;
 +    cpu->clidr = 0x00000000; /* caches not implemented */
 +    cpu->ctr = 0x8303c003;
 +}
 +
 +static const TCGCPUOps arm_v7m_tcg_ops = {
 +    .initialize = arm_translate_init,
 +    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
 +    .debug_excp_handler = arm_debug_excp_handler,
 +    .restore_state_to_opc = arm_restore_state_to_opc,
 +
 +#ifdef CONFIG_USER_ONLY
 +    .record_sigsegv = arm_cpu_record_sigsegv,
 +    .record_sigbus = arm_cpu_record_sigbus,
 +#else
 +    .tlb_fill = arm_cpu_tlb_fill,
 +    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
 +    .do_interrupt = arm_v7m_cpu_do_interrupt,
 +    .do_transaction_failed = arm_cpu_do_transaction_failed,
 +    .do_unaligned_access = arm_cpu_do_unaligned_access,
 +    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
 +    .debug_check_watchpoint = arm_debug_check_watchpoint,
 +    .debug_check_breakpoint = arm_debug_check_breakpoint,
 +#endif /* !CONFIG_USER_ONLY */
 +};
 +
 +static void arm_v7m_class_init(ObjectClass *oc, void *data)
 +{
 +    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
 +    CPUClass *cc = CPU_CLASS(oc);
 +
 +    acc->info = data;
 +    cc->tcg_ops = &arm_v7m_tcg_ops;
 +    cc->gdb_core_xml_file = "arm-m-profile.xml";
 +}
 +
 +static const ARMCPUInfo arm_v7m_cpus[] = {
 +    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
 +                             .class_init = arm_v7m_class_init },
 +    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
 +                             .class_init = arm_v7m_class_init },
 +};
 +
 +static void arm_v7m_cpu_register_types(void)
 +{
 +    size_t i;
 +
 +    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
 +        arm_cpu_register(&arm_v7m_cpus[i]);
 +    }
 +}
 +
 +type_init(arm_v7m_cpu_register_types)
 diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/cpu64.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/target/arm/tcg/cpu64.c
++++ b/target/arm/tcg/cpu32.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
+@@ -XXX,XX +XXX,XX @@
-     cpu->sve_max_vq = max_vq;
+ #include "hw/boards.h"
  #endif
  #include "cpregs.h"
 -#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 -#include "hw/intc/armv7m_nvic.h"
 -#endif
  /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 -#if !defined(CONFIG_USER_ONLY)
 -static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 -{
 -    CPUClass *cc = CPU_GET_CLASS(cs);
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    CPUARMState *env = &cpu->env;
 -    bool ret = false;
 -
 -    /*
 -     * ARMv7-M interrupt masking works differently than -A or -R.
 -     * There is no FIQ/IRQ distinction. Instead of I and F bits
 -     * masking FIQ and IRQ interrupts, an exception is taken only
 -     * if it is higher priority than the current execution priority
 -     * (which depends on state like BASEPRI, FAULTMASK and the
 -     * currently active exception).
 -     */
 -    if (interrupt_request & CPU_INTERRUPT_HARD
 -        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
 -        cs->exception_index = EXCP_IRQ;
 -        cc->tcg_ops->do_interrupt(cs);
 -        ret = true;
 -    }
 -    return ret;
 -}
 -#endif /* !CONFIG_USER_ONLY */
 -
  static void arm926_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
-+static bool cpu_arm_get_rme(Object *obj, Error **errp)
+-static void cortex_m0_initfn(Object *obj)
-+{
+-{
-+    ARMCPU *cpu = ARM_CPU(obj);
+-    ARMCPU *cpu = ARM_CPU(obj);
-+    return cpu_isar_feature(aa64_rme, cpu);
+-    set_feature(&cpu->env, ARM_FEATURE_V6);
-+}
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-+
+-
-+static void cpu_arm_set_rme(Object *obj, bool value, Error **errp)
+-    cpu->midr = 0x410cc200;
-+{
+-
-+    ARMCPU *cpu = ARM_CPU(obj);
+-    /*
-+    uint64_t t;
+-     * These ID register values are not guest visible, because
-+
+-     * we do not implement the Main Extension. They must be set
-+    t = cpu->isar.id_aa64pfr0;
+-     * to values corresponding to the Cortex-M0's implemented
-+    t = FIELD_DP64(t, ID_AA64PFR0, RME, value);
+-     * features, because QEMU generally controls its emulation
-+    cpu->isar.id_aa64pfr0 = t;
+-     * by looking at ID register fields. We use the same values as
-+}
+-     * for the M3.
-+
+-     */
-+static void cpu_max_set_l0gptsz(Object *obj, Visitor *v, const char *name,
+-    cpu->isar.id_pfr0 = 0x00000030;
-+                                void *opaque, Error **errp)
+-    cpu->isar.id_pfr1 = 0x00000200;
-+{
+-    cpu->isar.id_dfr0 = 0x00100000;
-+    ARMCPU *cpu = ARM_CPU(obj);
+-    cpu->id_afr0 = 0x00000000;
-+    uint32_t value;
+-    cpu->isar.id_mmfr0 = 0x00000030;
-+
+-    cpu->isar.id_mmfr1 = 0x00000000;
-+    if (!visit_type_uint32(v, name, &value, errp)) {
+-    cpu->isar.id_mmfr2 = 0x00000000;
-+        return;
+-    cpu->isar.id_mmfr3 = 0x00000000;
-+    }
+-    cpu->isar.id_isar0 = 0x01141110;
-+
+-    cpu->isar.id_isar1 = 0x02111000;
-+    /* Encode the value for the GPCCR_EL3 field. */
+-    cpu->isar.id_isar2 = 0x21112231;
-+    switch (value) {
+-    cpu->isar.id_isar3 = 0x01111110;
-+    case 30:
+-    cpu->isar.id_isar4 = 0x01310102;
-+    case 34:
+-    cpu->isar.id_isar5 = 0x00000000;
-+    case 36:
+-    cpu->isar.id_isar6 = 0x00000000;
-+    case 39:
+-}
-+        cpu->reset_l0gptsz = value - 30;
+-
-+        break;
+-static void cortex_m3_initfn(Object *obj)
-+    default:
+-{
-+        error_setg(errp, "invalid value for l0gptsz");
+-    ARMCPU *cpu = ARM_CPU(obj);
-+        error_append_hint(errp, "valid values are 30, 34, 36, 39\n");
+-    set_feature(&cpu->env, ARM_FEATURE_V7);
-+        break;
+-    set_feature(&cpu->env, ARM_FEATURE_M);
-+    }
+-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-+}
+-    cpu->midr = 0x410fc231;
-+
+-    cpu->pmsav7_dregion = 8;
-+static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+-    cpu->isar.id_pfr0 = 0x00000030;
-+                                void *opaque, Error **errp)
+-    cpu->isar.id_pfr1 = 0x00000200;
-+{
+-    cpu->isar.id_dfr0 = 0x00100000;
-+    ARMCPU *cpu = ARM_CPU(obj);
+-    cpu->id_afr0 = 0x00000000;
-+    uint32_t value = cpu->reset_l0gptsz + 30;
+-    cpu->isar.id_mmfr0 = 0x00000030;
-+
+-    cpu->isar.id_mmfr1 = 0x00000000;
-+    visit_type_uint32(v, name, &value, errp);
+-    cpu->isar.id_mmfr2 = 0x00000000;
-+}
+-    cpu->isar.id_mmfr3 = 0x00000000;
-+
+-    cpu->isar.id_isar0 = 0x01141110;
- static Property arm_cpu_lpa2_property =
+-    cpu->isar.id_isar1 = 0x02111000;
-     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
+-    cpu->isar.id_isar2 = 0x21112231;
+-    cpu->isar.id_isar3 = 0x01111110;
-@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
+-    cpu->isar.id_isar4 = 0x01310102;
-     aarch64_add_sme_properties(obj);
+-    cpu->isar.id_isar5 = 0x00000000;
-     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+-    cpu->isar.id_isar6 = 0x00000000;
-                         cpu_max_set_sve_max_vq, NULL, NULL);
+-}
-+    object_property_add_bool(obj, "x-rme", cpu_arm_get_rme, cpu_arm_set_rme);
+-
-+    object_property_add(obj, "x-l0gptsz", "uint32", cpu_max_get_l0gptsz,
+-static void cortex_m4_initfn(Object *obj)
-+                        cpu_max_set_l0gptsz, NULL, NULL);
+-{
-     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
+-    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fc240; /* r0p0 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000000;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00000030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x00000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01141110;
 -    cpu->isar.id_isar1 = 0x02111000;
 -    cpu->isar.id_isar2 = 0x21112231;
 -    cpu->isar.id_isar3 = 0x01111110;
 -    cpu->isar.id_isar4 = 0x01310102;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m7_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x411fc272; /* r1p2 */
 -    cpu->pmsav7_dregion = 8;
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000200;
 -    cpu->isar.id_dfr0 = 0x00100000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00100030;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02112000;
 -    cpu->isar.id_isar2 = 0x20232231;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -}
 -
 -static void cortex_m33_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd213; /* r0p3 */
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    cpu->isar.mvfr0 = 0x10110021;
 -    cpu->isar.mvfr1 = 0x11000011;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x00000030;
 -    cpu->isar.id_pfr1 = 0x00000210;
 -    cpu->isar.id_dfr0 = 0x00200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00101F40;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000000;
 -    cpu->isar.id_isar0 = 0x01101110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000;
 -    cpu->ctr = 0x8000c000;
 -}
 -
 -static void cortex_m55_initfn(Object *obj)
 -{
 -    ARMCPU *cpu = ARM_CPU(obj);
 -
 -    set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
 -    set_feature(&cpu->env, ARM_FEATURE_M);
 -    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
 -    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
 -    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    cpu->midr = 0x410fd221; /* r0p1 */
 -    cpu->revidr = 0;
 -    cpu->pmsav7_dregion = 16;
 -    cpu->sau_sregion = 8;
 -    /* These are the MVFR* values for the FPU + full MVE configuration */
 -    cpu->isar.mvfr0 = 0x10110221;
 -    cpu->isar.mvfr1 = 0x12100211;
 -    cpu->isar.mvfr2 = 0x00000040;
 -    cpu->isar.id_pfr0 = 0x20000030;
 -    cpu->isar.id_pfr1 = 0x00000230;
 -    cpu->isar.id_dfr0 = 0x10200000;
 -    cpu->id_afr0 = 0x00000000;
 -    cpu->isar.id_mmfr0 = 0x00111040;
 -    cpu->isar.id_mmfr1 = 0x00000000;
 -    cpu->isar.id_mmfr2 = 0x01000000;
 -    cpu->isar.id_mmfr3 = 0x00000011;
 -    cpu->isar.id_isar0 = 0x01103110;
 -    cpu->isar.id_isar1 = 0x02212000;
 -    cpu->isar.id_isar2 = 0x20232232;
 -    cpu->isar.id_isar3 = 0x01111131;
 -    cpu->isar.id_isar4 = 0x01310132;
 -    cpu->isar.id_isar5 = 0x00000000;
 -    cpu->isar.id_isar6 = 0x00000000;
 -    cpu->clidr = 0x00000000; /* caches not implemented */
 -    cpu->ctr = 0x8303c003;
 -}
 -
  static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
      /* Dummy the TCM region regs for the moment */
      { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
      cpu->reset_sctlr = 0x00000078;
  }
+-static const TCGCPUOps arm_v7m_tcg_ops = {
+-    .initialize = arm_translate_init,
+-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+-    .debug_excp_handler = arm_debug_excp_handler,
+-    .restore_state_to_opc = arm_restore_state_to_opc,
+-
+-#ifdef CONFIG_USER_ONLY
+-    .record_sigsegv = arm_cpu_record_sigsegv,
+-    .record_sigbus = arm_cpu_record_sigbus,
+-#else
+-    .tlb_fill = arm_cpu_tlb_fill,
+-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+-    .do_interrupt = arm_v7m_cpu_do_interrupt,
+-    .do_transaction_failed = arm_cpu_do_transaction_failed,
+-    .do_unaligned_access = arm_cpu_do_unaligned_access,
+-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+-    .debug_check_watchpoint = arm_debug_check_watchpoint,
+-    .debug_check_breakpoint = arm_debug_check_breakpoint,
+-#endif /* !CONFIG_USER_ONLY */
+-};
+-
+-static void arm_v7m_class_init(ObjectClass *oc, void *data)
+-{
+-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+-    CPUClass *cc = CPU_CLASS(oc);
+-
+-    acc->info = data;
+-    cc->tcg_ops = &arm_v7m_tcg_ops;
+-    cc->gdb_core_xml_file = "arm-m-profile.xml";
+-}
+-
+ #ifndef TARGET_AARCH64
+ /*
+  * -cpu max: a CPU with as many features enabled as our emulation supports.
+@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
+     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
+     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
+     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
+-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+-                             .class_init = arm_v7m_class_init },
+-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+-                             .class_init = arm_v7m_class_init },
+     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
+     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
+     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
+   'ptw.c',
+ ))
++arm_user_ss = ss.source_set()
++
+ subdir('hvf')
+ if 'CONFIG_TCG' in config_all_accel
+@@ -XXX,XX +XXX,XX @@ endif
+ target_arch += {'arm': arm_ss}
+ target_system_arch += {'arm': arm_system_ss}
++target_user_arch += {'arm': arm_user_ss}
+diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/meson.build
++++ b/target/arm/tcg/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+ arm_system_ss.add(files(
+   'psci.c',
+ ))
++
++arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
++arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
 --
 .34.1

-[PULL 24/26] hw/arm/sbsa-ref: add ITS support in SBSA GIC
+Deleted patch
-From: Shashi Mallela <shashi.mallela@linaro.org>
-Create ITS as part of SBSA platform GIC initialization.
-GIC ITS information is in DeviceTree so TF-A can pass it to EDK2.
-Bumping platform version to 0.2 as this is important hardware change.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Message-id: 20230619170913.517373-2-marcin.juszkiewicz@linaro.org
-Co-authored-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/sbsa.rst | 14 ++++++++++++++
- hw/arm/sbsa-ref.c        | 33 ++++++++++++++++++++++++++++++---
-files changed, 44 insertions(+), 3 deletions(-)
-diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/sbsa.rst
-+++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ to be a complete compliant DT. It currently reports:
-    - platform version
-    - GIC addresses
-+Platform version
-+''''''''''''''''
-+
- The platform version is only for informing platform firmware about
- what kind of ``sbsa-ref`` board it is running on. It is neither
- a QEMU versioned machine type nor a reflection of the level of the
-@@ -XXX,XX +XXX,XX @@ SBSA/SystemReady SR support provided.
- The ``machine-version-major`` value is updated when changes breaking
- fw compatibility are introduced. The ``machine-version-minor`` value
- is updated when features are added that don't break fw compatibility.
-+
-+Platform version changes:
-+
-+0.0
-+  Devicetree holds information about CPUs, memory and platform version.
-+
-+0.1
-+  GIC information is present in devicetree.
-+
-+0.2
-+  GIC ITS information is present in devicetree.
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ enum {
-     SBSA_CPUPERIPHS,
-     SBSA_GIC_DIST,
-     SBSA_GIC_REDIST,
-+    SBSA_GIC_ITS,
-     SBSA_SECURE_EC,
-     SBSA_GWDT_WS0,
-     SBSA_GWDT_REFRESH,
-@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sbsa_ref_memmap[] = {
-     [SBSA_CPUPERIPHS] =         { 0x40000000, 0x00040000 },
-     [SBSA_GIC_DIST] =           { 0x40060000, 0x00010000 },
-     [SBSA_GIC_REDIST] =         { 0x40080000, 0x04000000 },
-+    [SBSA_GIC_ITS] =            { 0x44081000, 0x00020000 },
-     [SBSA_SECURE_EC] =          { 0x50000000, 0x00001000 },
-     [SBSA_GWDT_REFRESH] =       { 0x50010000, 0x00001000 },
-     [SBSA_GWDT_CONTROL] =       { 0x50011000, 0x00001000 },
-@@ -XXX,XX +XXX,XX @@ static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
-, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
-, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
-+    nodename = g_strdup_printf("/intc/its");
-+    qemu_fdt_add_subnode(sms->fdt, nodename);
-+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
-+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].base,
-+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].size);
-+
-     g_free(nodename);
- }
-+
- /*
-  * Firmware on this machine only uses ACPI table to load OS, these limited
-  * device tree nodes are just to let firmware know the info which varies from
-@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
-      *                        fw compatibility.
-      */
-     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
--    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
-+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
-     if (ms->numa_state->have_numa_distance) {
-         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
-@@ -XXX,XX +XXX,XX @@ static void create_secure_ram(SBSAMachineState *sms,
-     memory_region_add_subregion(secure_sysmem, base, secram);
- }
--static void create_gic(SBSAMachineState *sms)
-+static void create_its(SBSAMachineState *sms)
-+{
-+    const char *itsclass = its_class_name();
-+    DeviceState *dev;
-+
-+    dev = qdev_new(itsclass);
-+
-+    object_property_set_link(OBJECT(dev), "parent-gicv3", OBJECT(sms->gic),
-+                             &error_abort);
-+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, sbsa_ref_memmap[SBSA_GIC_ITS].base);
-+}
-+
-+static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
- {
-     unsigned int smp_cpus = MACHINE(sms)->smp.cpus;
-     SysBusDevice *gicbusdev;
-@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms)
-     qdev_prop_set_uint32(sms->gic, "len-redist-region-count", 1);
-     qdev_prop_set_uint32(sms->gic, "redist-region-count[0]", redist0_count);
-+    object_property_set_link(OBJECT(sms->gic), "sysmem",
-+                             OBJECT(mem), &error_fatal);
-+    qdev_prop_set_bit(sms->gic, "has-lpi", true);
-+
-     gicbusdev = SYS_BUS_DEVICE(sms->gic);
-     sysbus_realize_and_unref(gicbusdev, &error_fatal);
-     sysbus_mmio_map(gicbusdev, 0, sbsa_ref_memmap[SBSA_GIC_DIST].base);
-@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms)
-         sysbus_connect_irq(gicbusdev, i + 3 * smp_cpus,
-                            qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
-     }
-+    create_its(sms);
- }
- static void create_uart(const SBSAMachineState *sms, int uart,
-@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
-     create_secure_ram(sms, secure_sysmem);
--    create_gic(sms);
-+    create_gic(sms, sysmem);
-     create_uart(sms, SBSA_UART, sysmem, serial_hd(0));
-     create_uart(sms, SBSA_SECURE_UART, secure_sysmem, serial_hd(1));
---
-.34.1

Hi; here's a target-arm pullreq. Mostly this is RTH's FEAT_RME
series; there are also a handful of bug fixes including some
which aren't arm-specific but which it's convenient to include
here.

thanks
-- PMM

The following changes since commit b455ce4c2f300c8ba47cba7232dd03261368a4cb:

Merge tag 'q800-for-8.1-pull-request' of https://github.com/vivier/qemu-m68k into staging (2023-06-22 10:18:32 +0200)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230623

for you to fetch changes up to 497fad38979c16b6412388927401e577eba43d26:

pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym (2023-06-23 11:46:02 +0100)

----------------------------------------------------------------
target-arm queue:
 * Add (experimental) support for FEAT_RME
 * host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
 * target/arm: Restructure has_vfp_d32 test
 * hw/arm/sbsa-ref: add ITS support in SBSA GIC
 * target/arm: Fix sve predicate store, 8 <= VQ <= 15
 * pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym

----------------------------------------------------------------
Peter Maydell (2):
      host-utils: Avoid using __builtin_subcll on buggy versions of Apple Clang
      pc-bios/keymaps: Use the official xkb name for Arabic layout, not the legacy synonym

Richard Henderson (23):
      target/arm: Add isar_feature_aa64_rme
      target/arm: Update SCR and HCR for RME
      target/arm: SCR_EL3.NS may be RES1
      target/arm: Add RME cpregs
      target/arm: Introduce ARMSecuritySpace
      include/exec/memattrs: Add two bits of space to MemTxAttrs
      target/arm: Adjust the order of Phys and Stage2 ARMMMUIdx
      target/arm: Introduce ARMMMUIdx_Phys_{Realm,Root}
      target/arm: Remove __attribute__((nonnull)) from ptw.c
      target/arm: Pipe ARMSecuritySpace through ptw.c
      target/arm: NSTable is RES0 for the RME EL3 regime
      target/arm: Handle Block and Page bits for security space
      target/arm: Handle no-execute for Realm and Root regimes
      target/arm: Use get_phys_addr_with_struct in S1_ptw_translate
      target/arm: Move s1_is_el0 into S1Translate
      target/arm: Use get_phys_addr_with_struct for stage2
      target/arm: Add GPC syndrome
      target/arm: Implement GPC exceptions
      target/arm: Implement the granule protection check
      target/arm: Add cpu properties for enabling FEAT_RME
      docs/system/arm: Document FEAT_RME
      target/arm: Restructure has_vfp_d32 test
      target/arm: Fix sve predicate store, 8 <= VQ <= 15

Shashi Mallela (1):
      hw/arm/sbsa-ref: add ITS support in SBSA GIC

From: Richard Henderson <richard.henderson@linaro.org>

Add the missing field for ID_AA64PFR0, and the predicate.
Disable it if EL3 is forced off by the board or command-line.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 6 ++++++
 target/arm/cpu.c | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR0, SEL2, 36, 4)
 FIELD(ID_AA64PFR0, MPAM, 40, 4)
 FIELD(ID_AA64PFR0, AMU, 44, 4)
 FIELD(ID_AA64PFR0, DIT, 48, 4)
+FIELD(ID_AA64PFR0, RME, 52, 4)
 FIELD(ID_AA64PFR0, CSV2, 56, 4)
 FIELD(ID_AA64PFR0, CSV3, 60, 4)
 
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
 }
 
+static inline bool isar_feature_aa64_rme(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, RME) != 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
                                            ID_AA64PFR0, EL3, 0);
+
+        /* Disable the realm management extension, which requires EL3. */
+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
+                                           ID_AA64PFR0, RME, 0);
     }
 
     if (!cpu->has_el2) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Define the missing SCR and HCR bits, allow SCR_NSE and {SCR,HCR}_GPF
to be set, and invalidate TLBs when NSE changes.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  5 +++--
 target/arm/helper.c | 10 ++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TERR      (1ULL << 36)
 #define HCR_TEA       (1ULL << 37)
 #define HCR_MIOCNCE   (1ULL << 38)
-/* RES0 bit 39 */
+#define HCR_TME       (1ULL << 39)
 #define HCR_APK       (1ULL << 40)
 #define HCR_API       (1ULL << 41)
 #define HCR_NV        (1ULL << 42)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_NV2       (1ULL << 45)
 #define HCR_FWB       (1ULL << 46)
 #define HCR_FIEN      (1ULL << 47)
-/* RES0 bit 48 */
+#define HCR_GPF       (1ULL << 48)
 #define HCR_TID4      (1ULL << 49)
 #define HCR_TICAB     (1ULL << 50)
 #define HCR_AMVOFFEN  (1ULL << 51)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_TRNDR             (1ULL << 40)
 #define SCR_ENTP2             (1ULL << 41)
 #define SCR_GPF               (1ULL << 48)
+#define SCR_NSE               (1ULL << 62)
 
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_fgt, cpu)) {
             valid_mask |= SCR_FGTEN;
         }
+        if (cpu_isar_feature(aa64_rme, cpu)) {
+            valid_mask |= SCR_NSE | SCR_GPF;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     env->cp15.scr_el3 = value;
 
     /*
-     * If SCR_EL3.NS changes, i.e. arm_is_secure_below_el3, then
+     * If SCR_EL3.{NS,NSE} changes, i.e. change of security state,
      * we must invalidate all TLBs below EL3.
      */
-    if (changed & SCR_NS) {
+    if (changed & (SCR_NS | SCR_NSE)) {
         tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
                                            ARMMMUIdxBit_E20_0 |
                                            ARMMMUIdxBit_E10_1 |
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
         if (cpu_isar_feature(aa64_fwb, cpu)) {
             valid_mask |= HCR_FWB;
         }
+        if (cpu_isar_feature(aa64_rme, cpu)) {
+            valid_mask |= HCR_GPF;
+        }
     }
 
     if (cpu_isar_feature(any_evt, cpu)) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

With RME, SEL2 must also be present to support secure state.
The NS bit is RES1 if SEL2 is not present.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         }
         if (cpu_isar_feature(aa64_sel2, cpu)) {
             valid_mask |= SCR_EEL2;
+        } else if (cpu_isar_feature(aa64_rme, cpu)) {
+            /* With RME and without SEL2, NS is RES1 (R_GSWWH, I_DJJQJ). */
+            value |= SCR_NS;
         }
         if (cpu_isar_feature(aa64_mte, cpu)) {
             valid_mask |= SCR_ATA;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This includes GPCCR, GPTBR, MFAR, the TLB flush insns PAALL, PAALLOS,
RPALOS, RPAOS, and the cache flush insns CIPAPA and CIGDPAPA.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 19 ++++++++++
 target/arm/helper.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t fgt_read[2]; /* HFGRTR, HDFGRTR */
         uint64_t fgt_write[2]; /* HFGWTR, HDFGWTR */
         uint64_t fgt_exec[1]; /* HFGITR */
+
+        /* RME registers */
+        uint64_t gpccr_el3;
+        uint64_t gptbr_el3;
+        uint64_t mfar_el3;
     } cp15;
 
     struct {
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint64_t reset_cbar;
     uint32_t reset_auxcr;
     bool reset_hivecs;
+    uint8_t reset_l0gptsz;
 
     /*
      * Intermediate values used during property parsing.
@@ -XXX,XX +XXX,XX @@ FIELD(MVFR1, SIMDFMAC, 28, 4)
 FIELD(MVFR2, SIMDMISC, 0, 4)
 FIELD(MVFR2, FPMISC, 4, 4)
 
+FIELD(GPCCR, PPS, 0, 3)
+FIELD(GPCCR, IRGN, 8, 2)
+FIELD(GPCCR, ORGN, 10, 2)
+FIELD(GPCCR, SH, 12, 2)
+FIELD(GPCCR, PGS, 14, 2)
+FIELD(GPCCR, GPC, 16, 1)
+FIELD(GPCCR, GPCP, 17, 1)
+FIELD(GPCCR, L0GPTSZ, 20, 4)
+
+FIELD(MFAR, FPA, 12, 40)
+FIELD(MFAR, NSE, 62, 1)
+FIELD(MFAR, NS, 63, 1)
+
 QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
 
 /* If adding a feature bit which corresponds to a Linux ELF
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL2_RW, .accessfn = access_esm,
       .type = ARM_CP_CONST, .resetvalue = 0 },
 };
+
+static void tlbi_aa64_paall_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  uint64_t value)
+{
+    CPUState *cs = env_cpu(env);
+
+    tlb_flush(cs);
+}
+
+static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    /* L0GPTSZ is RO; other bits not mentioned are RES0. */
+    uint64_t rw_mask = R_GPCCR_PPS_MASK | R_GPCCR_IRGN_MASK |
+        R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK |
+        R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK;
+
+    env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask);
+}
+
+static void gpccr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    env->cp15.gpccr_el3 = FIELD_DP64(0, GPCCR, L0GPTSZ,
+                                     env_archcpu(env)->reset_l0gptsz);
+}
+
+static void tlbi_aa64_paallos_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                                    uint64_t value)
+{
+    CPUState *cs = env_cpu(env);
+
+    tlb_flush_all_cpus_synced(cs);
+}
+
+static const ARMCPRegInfo rme_reginfo[] = {
+    { .name = "GPCCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 6,
+      .access = PL3_RW, .writefn = gpccr_write, .resetfn = gpccr_reset,
+      .fieldoffset = offsetof(CPUARMState, cp15.gpccr_el3) },
+    { .name = "GPTBR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 1, .opc2 = 4,
+      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.gptbr_el3) },
+    { .name = "MFAR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 6, .crm = 0, .opc2 = 5,
+      .access = PL3_RW, .fieldoffset = offsetof(CPUARMState, cp15.mfar_el3) },
+    { .name = "TLBI_PAALL", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 7, .opc2 = 4,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paall_write },
+    { .name = "TLBI_PAALLOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 4,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    /*
+     * QEMU does not have a way to invalidate by physical address, thus
+     * invalidating a range of physical addresses is accomplished by
+     * flushing all tlb entries in the outer sharable domain,
+     * just like PAALLOS.
+     */
+    { .name = "TLBI_RPALOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 7,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    { .name = "TLBI_RPAOS", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 4, .opc2 = 3,
+      .access = PL3_W, .type = ARM_CP_NO_RAW,
+      .writefn = tlbi_aa64_paallos_write },
+    { .name = "DC_CIPAPA", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 1,
+      .access = PL3_W, .type = ARM_CP_NOP },
+};
+
+static const ARMCPRegInfo rme_mte_reginfo[] = {
+    { .name = "DC_CIGDPAPA", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 14, .opc2 = 5,
+      .access = PL3_W, .type = ARM_CP_NOP },
+};
 #endif /* TARGET_AARCH64 */
 
 static void define_pmu_regs(ARMCPU *cpu)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_fgt, cpu)) {
         define_arm_cp_regs(cpu, fgt_reginfo);
     }
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        define_arm_cp_regs(cpu, rme_reginfo);
+        if (cpu_isar_feature(aa64_mte, cpu)) {
+            define_arm_cp_regs(cpu, rme_mte_reginfo);
+        }
+    }
 #endif
 
     if (cpu_isar_feature(any_predinv, cpu)) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Introduce both the enumeration and functions to retrieve
the current state, and state outside of EL3.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 89 ++++++++++++++++++++++++++++++++++-----------
 target/arm/helper.c | 60 ++++++++++++++++++++++++++++++
 2 files changed, 127 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
 
 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
 
-#if !defined(CONFIG_USER_ONLY)
 /*
+ * ARM v9 security states.
+ * The ordering of the enumeration corresponds to the low 2 bits
+ * of the GPI value, and (except for Root) the concat of NSE:NS.
+ */
+
+typedef enum ARMSecuritySpace {
+    ARMSS_Secure     = 0,
+    ARMSS_NonSecure  = 1,
+    ARMSS_Root       = 2,
+    ARMSS_Realm      = 3,
+} ARMSecuritySpace;
+
+/* Return true if @space is secure, in the pre-v9 sense. */
+static inline bool arm_space_is_secure(ARMSecuritySpace space)
+{
+    return space == ARMSS_Secure || space == ARMSS_Root;
+}
+
+/* Return the ARMSecuritySpace for @secure, assuming !RME or EL[0-2]. */
+static inline ARMSecuritySpace arm_secure_to_space(bool secure)
+{
+    return secure ? ARMSS_Secure : ARMSS_NonSecure;
+}
+
+#if !defined(CONFIG_USER_ONLY)
+/**
+ * arm_security_space_below_el3:
+ * @env: cpu context
+ *
+ * Return the security space of exception levels below EL3, following
+ * an exception return to those levels.  Unlike arm_security_space,
+ * this doesn't care about the current EL.
+ */
+ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env);
+
+/**
+ * arm_is_secure_below_el3:
+ * @env: cpu context
+ *
  * Return true if exception levels below EL3 are in secure state,
- * or would be following an exception return to that level.
- * Unlike arm_is_secure() (which is always a question about the
- * _current_ state of the CPU) this doesn't care about the current
- * EL or mode.
+ * or would be following an exception return to those levels.
  */
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
-    assert(!arm_feature(env, ARM_FEATURE_M));
-    if (arm_feature(env, ARM_FEATURE_EL3)) {
-        return !(env->cp15.scr_el3 & SCR_NS);
-    } else {
-        /* If EL3 is not supported then the secure state is implementation
-         * defined, in which case QEMU defaults to non-secure.
-         */
-        return false;
-    }
+    ARMSecuritySpace ss = arm_security_space_below_el3(env);
+    return ss == ARMSS_Secure;
 }
 
 /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
     return false;
 }
 
-/* Return true if the processor is in secure state */
+/**
+ * arm_security_space:
+ * @env: cpu context
+ *
+ * Return the current security space of the cpu.
+ */
+ARMSecuritySpace arm_security_space(CPUARMState *env);
+
+/**
+ * arm_is_secure:
+ * @env: cpu context
+ *
+ * Return true if the processor is in secure state.
+ */
 static inline bool arm_is_secure(CPUARMState *env)
 {
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        return env->v7m.secure;
-    }
-    if (arm_is_el3_or_mon(env)) {
-        return true;
-    }
-    return arm_is_secure_below_el3(env);
+    return arm_space_is_secure(arm_security_space(env));
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
 }
 
 #else
+static inline ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
+{
+    return ARMSS_NonSecure;
+}
+
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
     return false;
 }
 
+static inline ARMSecuritySpace arm_security_space(CPUARMState *env)
+{
+    return ARMSS_NonSecure;
+}
+
 static inline bool arm_is_secure(CPUARMState *env)
 {
     return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
     }
 }
 #endif
+
+#ifndef CONFIG_USER_ONLY
+ARMSecuritySpace arm_security_space(CPUARMState *env)
+{
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return arm_secure_to_space(env->v7m.secure);
+    }
+
+    /*
+     * If EL3 is not supported then the secure state is implementation
+     * defined, in which case QEMU defaults to non-secure.
+     */
+    if (!arm_feature(env, ARM_FEATURE_EL3)) {
+        return ARMSS_NonSecure;
+    }
+
+    /* Check for AArch64 EL3 or AArch32 Mon. */
+    if (is_a64(env)) {
+        if (extract32(env->pstate, 2, 2) == 3) {
+            if (cpu_isar_feature(aa64_rme, env_archcpu(env))) {
+                return ARMSS_Root;
+            } else {
+                return ARMSS_Secure;
+            }
+        }
+    } else {
+        if ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_MON) {
+            return ARMSS_Secure;
+        }
+    }
+
+    return arm_security_space_below_el3(env);
+}
+
+ARMSecuritySpace arm_security_space_below_el3(CPUARMState *env)
+{
+    assert(!arm_feature(env, ARM_FEATURE_M));
+
+    /*
+     * If EL3 is not supported then the secure state is implementation
+     * defined, in which case QEMU defaults to non-secure.
+     */
+    if (!arm_feature(env, ARM_FEATURE_EL3)) {
+        return ARMSS_NonSecure;
+    }
+
+    /*
+     * Note NSE cannot be set without RME, and NSE & !NS is Reserved.
+     * Ignoring NSE when !NS retains consistency without having to
+     * modify other predicates.
+     */
+    if (!(env->cp15.scr_el3 & SCR_NS)) {
+        return ARMSS_Secure;
+    } else if (env->cp15.scr_el3 & SCR_NSE) {
+        return ARMSS_Realm;
+    } else {
+        return ARMSS_NonSecure;
+    }
+}
+#endif /* !CONFIG_USER_ONLY */
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

We will need 2 bits to represent ARMSecurityState.

Do not attempt to replace or widen secure, even though it
logically overlaps the new field -- there are uses within
e.g. hw/block/pflash_cfi01.c, which don't know anything
specific about ARM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/memattrs.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/memattrs.h
+++ b/include/exec/memattrs.h
@@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs {
      * "didn't specify" if necessary.
      */
     unsigned int unspecified:1;
-    /* ARM/AMBA: TrustZone Secure access
+    /*
+     * ARM/AMBA: TrustZone Secure access
      * x86: System Management Mode access
      */
     unsigned int secure:1;
+    /*
+     * ARM: ArmSecuritySpace.  This partially overlaps secure, but it is
+     * easier to have both fields to assist code that does not understand
+     * ARMv9 RME, or no specific knowledge of ARM at all (e.g. pflash).
+     */
+    unsigned int space:2;
     /* Memory access is usermode (unprivileged) */
     unsigned int user:1;
     /*
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

It will be helpful to have ARMMMUIdx_Phys_* to be in the same
relative order as ARMSecuritySpace enumerators. This requires
the adjustment to the nstable check. While there, check for being
in secure state rather than rely on clearing the low bit making
no change to non-secure state.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 12 ++++++------
 target/arm/ptw.c | 12 +++++-------
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
     ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
 
-    /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_NS   = 8 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_S    = 9 | ARM_MMU_IDX_A,
-
     /*
      * Used for second stage of an S12 page table walk, or for descriptor
      * loads during first stage of an S1 page table walk.  Note that both
      * are in use simultaneously for SecureEL2: the security state for
      * the S2 ptw is selected by the NS bit from the S1 ptw.
      */
-    ARMMMUIdx_Stage2    = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Stage2_S  = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2_S  = 8 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
+
+    /* TLBs with 1-1 mapping to the physical address spaces. */
+    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr |= (address >> (stride * (4 - level))) & indexmask;
     descaddr &= ~7ULL;
     nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
-    if (nstable) {
+    if (nstable && ptw->in_secure) {
         /*
          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-         * Assert that the non-secure idx are even, and relative order.
+         * Assert the relative order of the secure/non-secure indexes.
          */
-        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-        ptw->in_ptw_idx &= ~1;
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
+        ptw->in_ptw_idx += 1;
         ptw->in_secure = false;
     }
     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

With FEAT_RME, there are four physical address spaces.
For now, just define the symbols, and mention them in
the same spots as the other Phys indexes in ptw.c.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 23 +++++++++++++++++++++--
 target/arm/ptw.c | 10 ++++++++--
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage2    = 9 | ARM_MMU_IDX_A,
 
     /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_S    = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_NS   = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_S     = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS    = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Root  = 12 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Realm = 13 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
@@ -XXX,XX +XXX,XX @@ typedef enum ARMASIdx {
     ARMASIdx_TagS = 3,
 } ARMASIdx;
 
+static inline ARMMMUIdx arm_space_to_phys(ARMSecuritySpace space)
+{
+    /* Assert the relative order of the physical mmu indexes. */
+    QEMU_BUILD_BUG_ON(ARMSS_Secure != 0);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS != ARMMMUIdx_Phys_S + ARMSS_NonSecure);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Root != ARMMMUIdx_Phys_S + ARMSS_Root);
+    QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_Realm != ARMMMUIdx_Phys_S + ARMSS_Realm);
+
+    return ARMMMUIdx_Phys_S + space;
+}
+
+static inline ARMSecuritySpace arm_phys_to_space(ARMMMUIdx idx)
+{
+    assert(idx >= ARMMMUIdx_Phys_S && idx <= ARMMMUIdx_Phys_Realm);
+    return idx - ARMMMUIdx_Phys_S;
+}
+
 static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
 {
     /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     case ARMMMUIdx_E3:
         break;
 
-    case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         /* No translation for physical address spaces. */
         return true;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
     switch (mmu_idx) {
     case ARMMMUIdx_Stage2:
     case ARMMMUIdx_Stage2_S:
-    case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         break;
 
     default:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
     case ARMMMUIdx_Phys_NS:
+    case ARMMMUIdx_Phys_Root:
+    case ARMMMUIdx_Phys_Realm:
         /* Checking Phys early avoids special casing later vs regime_el. */
         return get_phys_addr_disabled(env, address, access_type, mmu_idx,
                                       is_secure, result, fi);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This was added in 7e98e21c098 as part of a reorg in which
one of the argument had been legally NULL, and this caught
actual instances.  Now that the reorg is complete, this
serves little purpose.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                uint64_t address,
                                MMUAccessType access_type, bool s1_is_el0,
-                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
-    __attribute__((nonnull));
+                               GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
 
 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                       target_ulong address,
                                       MMUAccessType access_type,
                                       GetPhysAddrResult *result,
-                                      ARMMMUFaultInfo *fi)
-    __attribute__((nonnull));
+                                      ARMMMUFaultInfo *fi);
 
 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
 static const uint8_t pamax_map[] = {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Add input and output space members to S1Translate.  Set and adjust
them in S1_ptw_translate, and the various points at which we drop
secure state.  Initialize the space in get_phys_addr; for now leave
get_phys_addr_with_secure considering only secure vs non-secure spaces.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 86 +++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 71 insertions(+), 15 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 typedef struct S1Translate {
     ARMMMUIdx in_mmu_idx;
     ARMMMUIdx in_ptw_idx;
+    ARMSecuritySpace in_space;
     bool in_secure;
     bool in_debug;
     bool out_secure;
     bool out_rw;
     bool out_be;
+    ARMSecuritySpace out_space;
     hwaddr out_virt;
     hwaddr out_phys;
     void *out_host;
@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
+    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                 .in_mmu_idx = s2_mmu_idx,
                 .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
                 .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
+                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
+                             : space == ARMSS_Realm ? ARMSS_Realm
+                             : ARMSS_NonSecure),
                 .in_debug = true,
             };
             GetPhysAddrResult s2 = { };
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             ptw->out_phys = s2.f.phys_addr;
             pte_attrs = s2.cacheattrs.attrs;
             ptw->out_secure = s2.f.attrs.secure;
+            ptw->out_space = s2.f.attrs.space;
         } else {
             /* Regime is physical. */
             ptw->out_phys = addr;
             pte_attrs = 0;
             ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
+            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
+                              : space == ARMSS_Realm ? ARMSS_Realm
+                              : ARMSS_NonSecure);
         }
         ptw->out_host = NULL;
         ptw->out_rw = false;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         ptw->out_rw = full->prot & PAGE_WRITE;
         pte_attrs = full->pte_attrs;
         ptw->out_secure = full->attrs.secure;
+        ptw->out_space = full->attrs.space;
 #else
         g_assert_not_reached();
 #endif
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
         }
     } else {
         /* Page tables are in MMIO. */
-        MemTxAttrs attrs = { .secure = ptw->out_secure };
+        MemTxAttrs attrs = {
+            .secure = ptw->out_secure,
+            .space = ptw->out_space,
+        };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
 #endif
     } else {
         /* Page tables are in MMIO. */
-        MemTxAttrs attrs = { .secure = ptw->out_secure };
+        MemTxAttrs attrs = {
+            .secure = ptw->out_secure,
+            .space = ptw->out_space,
+        };
         AddressSpace *as = arm_addressspace(cs, attrs);
         MemTxResult result = MEMTX_OK;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
          * regime, because the attribute will already be non-secure.
          */
         result->f.attrs.secure = false;
+        result->f.attrs.space = ARMSS_NonSecure;
     }
     result->f.phys_addr = phys_addr;
     return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * regime, because the attribute will already be non-secure.
          */
         result->f.attrs.secure = false;
+        result->f.attrs.space = ARMSS_NonSecure;
     }
 
     if (regime_is_stage2(mmu_idx)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
              */
             if (sattrs.ns) {
                 result->f.attrs.secure = false;
+                result->f.attrs.space = ARMSS_NonSecure;
             } else if (!secure) {
                 /*
                  * NS access to S memory must fault.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     bool is_secure = ptw->in_secure;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
+    ARMSecuritySpace ipa_space;
     bool is_el0;
     uint64_t hcr;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 
     ipa = result->f.phys_addr;
     ipa_secure = result->f.attrs.secure;
+    ipa_space = result->f.attrs.space;
 
     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
     ptw->in_secure = ipa_secure;
+    ptw->in_space = ipa_space;
     ptw->in_ptw_idx = ptw_idx_for_stage_2(env, ptw->in_mmu_idx);
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     ARMMMUIdx s1_mmu_idx;
 
     /*
-     * The page table entries may downgrade secure to non-secure, but
-     * cannot upgrade an non-secure translation regime's attributes
-     * to secure.
+     * The page table entries may downgrade Secure to NonSecure, but
+     * cannot upgrade a NonSecure translation regime's attributes
+     * to Secure or Realm.
      */
     result->f.attrs.secure = is_secure;
+    result->f.attrs.space = ptw->in_space;
 
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
 
     default:
         /* Single stage uses physical for ptw. */
-        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
+        ptw->in_ptw_idx = arm_space_to_phys(ptw->in_space);
         break;
     }
 
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_secure = is_secure,
+        .in_space = arm_secure_to_space(is_secure),
     };
     return get_phys_addr_with_struct(env, &ptw, address, access_type,
                                      result, fi);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                    MMUAccessType access_type, ARMMMUIdx mmu_idx,
                    GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
-    bool is_secure;
+    S1Translate ptw = {
+        .in_mmu_idx = mmu_idx,
+    };
+    ARMSecuritySpace ss;
 
     switch (mmu_idx) {
     case ARMMMUIdx_E10_0:
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
     case ARMMMUIdx_E2:
-        is_secure = arm_is_secure_below_el3(env);
+        ss = arm_security_space_below_el3(env);
         break;
     case ARMMMUIdx_Stage2:
+        /*
+         * For Secure EL2, we need this index to be NonSecure;
+         * otherwise this will already be NonSecure or Realm.
+         */
+        ss = arm_security_space_below_el3(env);
+        if (ss == ARMSS_Secure) {
+            ss = ARMSS_NonSecure;
+        }
+        break;
     case ARMMMUIdx_Phys_NS:
     case ARMMMUIdx_MPrivNegPri:
     case ARMMMUIdx_MUserNegPri:
     case ARMMMUIdx_MPriv:
     case ARMMMUIdx_MUser:
-        is_secure = false;
+        ss = ARMSS_NonSecure;
         break;
-    case ARMMMUIdx_E3:
     case ARMMMUIdx_Stage2_S:
     case ARMMMUIdx_Phys_S:
     case ARMMMUIdx_MSPrivNegPri:
     case ARMMMUIdx_MSUserNegPri:
     case ARMMMUIdx_MSPriv:
     case ARMMMUIdx_MSUser:
-        is_secure = true;
+        ss = ARMSS_Secure;
+        break;
+    case ARMMMUIdx_E3:
+        if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+            cpu_isar_feature(aa64_rme, env_archcpu(env))) {
+            ss = ARMSS_Root;
+        } else {
+            ss = ARMSS_Secure;
+        }
+        break;
+    case ARMMMUIdx_Phys_Root:
+        ss = ARMSS_Root;
+        break;
+    case ARMMMUIdx_Phys_Realm:
+        ss = ARMSS_Realm;
         break;
     default:
         g_assert_not_reached();
     }
-    return get_phys_addr_with_secure(env, address, access_type, mmu_idx,
-                                     is_secure, result, fi);
+
+    ptw.in_space = ss;
+    ptw.in_secure = arm_space_is_secure(ss);
+    return get_phys_addr_with_struct(env, &ptw, address, access_type,
+                                     result, fi);
 }
 
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
+    ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+    ARMSecuritySpace ss = arm_security_space(env);
     S1Translate ptw = {
-        .in_mmu_idx = arm_mmu_idx(env),
-        .in_secure = arm_is_secure(env),
+        .in_mmu_idx = mmu_idx,
+        .in_space = ss,
+        .in_secure = arm_space_is_secure(ss),
         .in_debug = true,
     };
     GetPhysAddrResult res = {};
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Test in_space instead of in_secure so that we don't
switch out of Root space.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 {
     ARMCPU *cpu = env_archcpu(env);
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_secure = ptw->in_secure;
     int32_t level;
     ARMVAParameters param;
     uint64_t ttbr;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     uint64_t descriptor, new_descriptor;
-    bool nstable;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddrmask = MAKE_64BIT_MASK(0, 40);
     }
     descaddrmask &= ~indexmask_grainsize;
-
-    /*
-     * Secure stage 1 accesses start with the page table in secure memory and
-     * can be downgraded to non-secure at any step. Non-secure accesses
-     * remain non-secure. We implement this by just ORing in the NSTable/NS
-     * bits at each step.
-     * Stage 2 never gets this kind of downgrade.
-     */
-    tableattrs = is_secure ? 0 : (1 << 4);
+    tableattrs = 0;
 
  next_level:
     descaddr |= (address >> (stride * (4 - level))) & indexmask;
     descaddr &= ~7ULL;
-    nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);
-    if (nstable && ptw->in_secure) {
+
+    /*
+     * Process the NSTable bit from the previous level.  This changes
+     * the table address space and the output space from Secure to
+     * NonSecure.  With RME, the EL3 translation regime does not change
+     * from Root to NonSecure.
+     */
+    if (ptw->in_space == ARMSS_Secure
+        && !regime_is_stage2(mmu_idx)
+        && extract32(tableattrs, 4, 1)) {
         /*
          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
          * Assert the relative order of the secure/non-secure indexes.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
         ptw->in_ptw_idx += 1;
         ptw->in_secure = false;
+        ptw->in_space = ARMSS_NonSecure;
     }
+
     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
         goto do_fault;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      */
     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
     if (!regime_is_stage2(mmu_idx)) {
-        attrs |= nstable << 5; /* NS */
+        attrs |= !ptw->in_secure << 5; /* NS */
         if (!param.hpd) {
             attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
             /*
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

With Realm security state, bit 55 of a block or page descriptor during
the stage2 walk becomes the NS bit; during the stage1 walk the bit 5
NS bit is RES0.  With Root security state, bit 11 of the block or page
descriptor during the stage1 walk becomes the NSE bit.

Rather than collecting an NS bit and applying it later, compute the
output pa space from the input pa space and unconditionally assign.
This means that we no longer need to adjust the output space earlier
for the NSTable bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 89 +++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 73 insertions(+), 16 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
  * @mmu_idx: MMU index indicating required translation regime
  * @is_aa64: TRUE if AArch64
  * @ap:      The 2-bit simple AP (AP[2:1])
- * @ns:      NS (non-secure) bit
  * @xn:      XN (execute-never) bit
  * @pxn:     PXN (privileged execute-never) bit
+ * @in_pa:   The original input pa space
+ * @out_pa:  The output pa space, modified by NSTable, NS, and NSE
  */
 static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-                      int ap, int ns, int xn, int pxn)
+                      int ap, int xn, int pxn,
+                      ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
 {
     ARMCPU *cpu = env_archcpu(env);
     bool is_user = regime_is_user(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         }
     }
 
-    if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
+    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
+        (env->cp15.scr_el3 & SCR_SIF)) {
         return prot_rw;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    int ap, ns, xn, pxn;
+    int ap, xn, pxn;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     uint64_t descriptor, new_descriptor;
+    ARMSecuritySpace out_space;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     }
 
     ap = extract32(attrs, 6, 2);
+    out_space = ptw->in_space;
     if (regime_is_stage2(mmu_idx)) {
-        ns = mmu_idx == ARMMMUIdx_Stage2;
+        /*
+         * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
+         * The bit remains ignored for other security states.
+         */
+        if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
+            out_space = ARMSS_NonSecure;
+        }
         xn = extract64(attrs, 53, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
-        ns = extract32(attrs, 5, 1);
+        int nse, ns = extract32(attrs, 5, 1);
+        switch (out_space) {
+        case ARMSS_Root:
+            /*
+             * R_GVZML: Bit 11 becomes the NSE field in the EL3 regime.
+             * R_XTYPW: NSE and NS together select the output pa space.
+             */
+            nse = extract32(attrs, 11, 1);
+            out_space = (nse << 1) | ns;
+            if (out_space == ARMSS_Secure &&
+                !cpu_isar_feature(aa64_sel2, cpu)) {
+                out_space = ARMSS_NonSecure;
+            }
+            break;
+        case ARMSS_Secure:
+            if (ns) {
+                out_space = ARMSS_NonSecure;
+            }
+            break;
+        case ARMSS_Realm:
+            switch (mmu_idx) {
+            case ARMMMUIdx_Stage1_E0:
+            case ARMMMUIdx_Stage1_E1:
+            case ARMMMUIdx_Stage1_E1_PAN:
+                /* I_CZPRF: For Realm EL1&0 stage1, NS bit is RES0. */
+                break;
+            case ARMMMUIdx_E2:
+            case ARMMMUIdx_E20_0:
+            case ARMMMUIdx_E20_2:
+            case ARMMMUIdx_E20_2_PAN:
+                /*
+                 * R_LYKFZ, R_WGRZN: For Realm EL2 and EL2&1,
+                 * NS changes the output to non-secure space.
+                 */
+                if (ns) {
+                    out_space = ARMSS_NonSecure;
+                }
+                break;
+            default:
+                g_assert_not_reached();
+            }
+            break;
+        case ARMSS_NonSecure:
+            /* R_QRMFF: For NonSecure state, the NS bit is RES0. */
+            break;
+        default:
+            g_assert_not_reached();
+        }
         xn = extract64(attrs, 54, 1);
         pxn = extract64(attrs, 53, 1);
-        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
+
+        /*
+         * Note that we modified ptw->in_space earlier for NSTable, but
+         * result->f.attrs retains a copy of the original security space.
+         */
+        result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, xn, pxn,
+                                    result->f.attrs.space, out_space);
     }
 
     if (!(result->f.prot & (1 << access_type))) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         }
     }
 
-    if (ns) {
-        /*
-         * The NS bit will (as required by the architecture) have no effect if
-         * the CPU doesn't support TZ or this is a non-secure translation
-         * regime, because the attribute will already be non-secure.
-         */
-        result->f.attrs.secure = false;
-        result->f.attrs.space = ARMSS_NonSecure;
-    }
+    result->f.attrs.space = out_space;
+    result->f.attrs.secure = arm_space_is_secure(out_space);
 
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While Root and Realm may read and write data from other spaces,
neither may execute from other pa spaces.

This happens for Stage1 EL3, EL2, EL2&0, and Stage2 EL1&0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 52 ++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 46 insertions(+), 6 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ do_fault:
  * @xn:      XN (execute-never) bits
  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
  */
-static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
+static int get_S2prot_noexecute(int s2ap)
 {
     int prot = 0;
 
@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
     if (s2ap & 2) {
         prot |= PAGE_WRITE;
     }
+    return prot;
+}
+
+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
+{
+    int prot = get_S2prot_noexecute(s2ap);
 
     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
         switch (xn) {
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         }
     }
 
-    if (out_pa == ARMSS_NonSecure && in_pa == ARMSS_Secure &&
-        (env->cp15.scr_el3 & SCR_SIF)) {
-        return prot_rw;
+    if (in_pa != out_pa) {
+        switch (in_pa) {
+        case ARMSS_Root:
+            /*
+             * R_ZWRVD: permission fault for insn fetched from non-Root,
+             * I_WWBFB: SIF has no effect in EL3.
+             */
+            return prot_rw;
+        case ARMSS_Realm:
+            /*
+             * R_PKTDS: permission fault for insn fetched from non-Realm,
+             * for Realm EL2 or EL2&0.  The corresponding fault for EL1&0
+             * happens during any stage2 translation.
+             */
+            switch (mmu_idx) {
+            case ARMMMUIdx_E2:
+            case ARMMMUIdx_E20_0:
+            case ARMMMUIdx_E20_2:
+            case ARMMMUIdx_E20_2_PAN:
+                return prot_rw;
+            default:
+                break;
+            }
+            break;
+        case ARMSS_Secure:
+            if (env->cp15.scr_el3 & SCR_SIF) {
+                return prot_rw;
+            }
+            break;
+        default:
+            /* Input NonSecure must have output NonSecure. */
+            g_assert_not_reached();
+        }
     }
 
     /* TODO have_wxn should be replaced with
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         /*
          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
          * The bit remains ignored for other security states.
+         * R_YMCSL: Executing an insn fetched from non-Realm causes
+         * a stage2 permission fault.
          */
         if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
             out_space = ARMSS_NonSecure;
+            result->f.prot = get_S2prot_noexecute(ap);
+        } else {
+            xn = extract64(attrs, 53, 2);
+            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
         }
-        xn = extract64(attrs, 53, 2);
-        result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
         int nse, ns = extract32(attrs, 5, 1);
         switch (out_space) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Do not provide a fast-path for physical addresses,
as those will need to be validated for GPC.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 44 +++++++++++++++++---------------------------
 1 file changed, 17 insertions(+), 27 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
-        if (regime_is_stage2(s2_mmu_idx)) {
-            S1Translate s2ptw = {
-                .in_mmu_idx = s2_mmu_idx,
-                .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-                .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-                .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                             : space == ARMSS_Realm ? ARMSS_Realm
-                             : ARMSS_NonSecure),
-                .in_debug = true,
-            };
-            GetPhysAddrResult s2 = { };
+        S1Translate s2ptw = {
+            .in_mmu_idx = s2_mmu_idx,
+            .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
+            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
+            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
+                         : space == ARMSS_Realm ? ARMSS_Realm
+                         : ARMSS_NonSecure),
+            .in_debug = true,
+        };
+        GetPhysAddrResult s2 = { };
 
-            if (get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
-                                   false, &s2, fi)) {
-                goto fail;
-            }
-            ptw->out_phys = s2.f.phys_addr;
-            pte_attrs = s2.cacheattrs.attrs;
-            ptw->out_secure = s2.f.attrs.secure;
-            ptw->out_space = s2.f.attrs.space;
-        } else {
-            /* Regime is physical. */
-            ptw->out_phys = addr;
-            pte_attrs = 0;
-            ptw->out_secure = s2_mmu_idx == ARMMMUIdx_Phys_S;
-            ptw->out_space = (s2_mmu_idx == ARMMMUIdx_Phys_S ? ARMSS_Secure
-                              : space == ARMSS_Realm ? ARMSS_Realm
-                              : ARMSS_NonSecure);
+        if (get_phys_addr_with_struct(env, &s2ptw, addr,
+                                      MMU_DATA_LOAD, &s2, fi)) {
+            goto fail;
         }
+        ptw->out_phys = s2.f.phys_addr;
+        pte_attrs = s2.cacheattrs.attrs;
         ptw->out_host = NULL;
         ptw->out_rw = false;
+        ptw->out_secure = s2.f.attrs.secure;
+        ptw->out_space = s2.f.attrs.space;
     } else {
 #ifdef CONFIG_TCG
         CPUTLBEntryFull *full;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Instead of passing this to get_phys_addr_lpae, stash it
in the S1Translate structure.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
     ARMSecuritySpace in_space;
     bool in_secure;
     bool in_debug;
+    /*
+     * If this is stage 2 of a stage 1+2 page table walk, then this must
+     * be true if stage 1 is an EL0 access; otherwise this is ignored.
+     * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
+     */
+    bool in_s1_is_el0;
     bool out_secure;
     bool out_rw;
     bool out_be;
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
 } S1Translate;
 
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-                               uint64_t address,
-                               MMUAccessType access_type, bool s1_is_el0,
+                               uint64_t address, MMUAccessType access_type,
                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi);
 
 static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
@@ -XXX,XX +XXX,XX @@ static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
  * @ptw: Current and next stage parameters for the walk.
  * @address: virtual address to get physical address for
  * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
- * @s1_is_el0: if @ptw->in_mmu_idx is ARMMMUIdx_Stage2
- *             (so this is a stage 2 page table walk),
- *             must be true if this is stage 2 of a stage 1+2
- *             walk for an EL0 access. If @mmu_idx is anything else,
- *             @s1_is_el0 is ignored.
  * @result: set on translation success,
  * @fi: set to fault info if the translation fails
  */
 static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                uint64_t address,
-                               MMUAccessType access_type, bool s1_is_el0,
+                               MMUAccessType access_type,
                                GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
 {
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             result->f.prot = get_S2prot_noexecute(ap);
         } else {
             xn = extract64(attrs, 53, 2);
-            result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
+            result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
         }
     } else {
         int nse, ns = extract32(attrs, 5, 1);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
-    bool is_el0;
     uint64_t hcr;
 
     ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     ipa_secure = result->f.attrs.secure;
     ipa_space = result->f.attrs.space;
 
-    is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
+    ptw->in_s1_is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = ipa_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
     ptw->in_secure = ipa_secure;
     ptw->in_space = ipa_space;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
         ret = get_phys_addr_pmsav8(env, ipa, access_type,
                                    ptw->in_mmu_idx, is_secure, result, fi);
     } else {
-        ret = get_phys_addr_lpae(env, ptw, ipa, access_type,
-                                 is_el0, result, fi);
+        ret = get_phys_addr_lpae(env, ptw, ipa, access_type, result, fi);
     }
     fi->s2addr = ipa;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     }
 
     if (regime_using_lpae_format(env, mmu_idx)) {
-        return get_phys_addr_lpae(env, ptw, address, access_type, false,
-                                  result, fi);
+        return get_phys_addr_lpae(env, ptw, address, access_type, result, fi);
     } else if (arm_feature(env, ARM_FEATURE_V7) ||
                regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This fixes a bug in which we failed to initialize
the result attributes properly after the memset.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

The function takes the fields as filled in by
the Arm ARM pseudocode for TakeGPCException.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_SVEACCESSTRAP          = 0x19,
     EC_ERETTRAP               = 0x1a,
     EC_SMETRAP                = 0x1d,
+    EC_GPC                    = 0x1e,
     EC_INSNABORT              = 0x20,
     EC_INSNABORT_SAME_EL      = 0x21,
     EC_PCALIGNMENT            = 0x22,
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_bxjtrap(int cv, int cond, int rm)
         (cv << 24) | (cond << 20) | rm;
 }
 
+static inline uint32_t syn_gpc(int s2ptw, int ind, int gpcsc,
+                               int cm, int s1ptw, int wnr, int fsc)
+{
+    /* TODO: FEAT_NV2 adds VNCR */
+    return (EC_GPC << ARM_EL_EC_SHIFT) | ARM_EL_IL | (s2ptw << 21)
+            | (ind << 20) | (gpcsc << 14) | (cm << 8) | (s1ptw << 7)
+            | (wnr << 6) | fsc;
+}
+
 static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
 {
     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle GPC Fault types in arm_deliver_fault, reporting as
either a GPC exception at EL3, or falling through to insn
or data aborts at various exception levels.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 +
 target/arm/internals.h      | 27 +++++++++++
 target/arm/helper.c         |  5 ++
 target/arm/tcg/tlb_helper.c | 96 +++++++++++++++++++++++++++++++++++--
 4 files changed, 126 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define EXCP_UNALIGNED      22   /* v7M UNALIGNED UsageFault */
 #define EXCP_DIVBYZERO      23   /* v7M DIVBYZERO UsageFault */
 #define EXCP_VSERR          24
+#define EXCP_GPC            25   /* v9 Granule Protection Check Fault */
 /* NB: add new EXCP_ defines to the array in arm_log_exception() too */
 
 #define ARMV7M_EXCP_RESET   1
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
     ARMFault_ICacheMaint,
     ARMFault_QEMU_NSCExec, /* v8M: NS executing in S&NSC memory */
     ARMFault_QEMU_SFault, /* v8M: SecureFault INVTRAN, INVEP or AUVIOL */
+    ARMFault_GPCFOnWalk,
+    ARMFault_GPCFOnOutput,
 } ARMFaultType;
 
+typedef enum ARMGPCF {
+    GPCF_None,
+    GPCF_AddressSize,
+    GPCF_Walk,
+    GPCF_EABT,
+    GPCF_Fail,
+} ARMGPCF;
+
 /**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @type: Type of fault
+ * @gpcf: Subtype of ARMFault_GPCFOn{Walk,Output}.
  * @level: Table walk level (for translation, access flag and permission faults)
  * @domain: Domain of the fault address (for non-LPAE CPUs only)
  * @s2addr: Address that caused a fault at stage 2
+ * @paddr: physical address that caused a fault for gpc
+ * @paddr_space: physical address space that caused a fault for gpc
  * @stage2: True if we faulted at stage 2
  * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
  * @s1ns: True if we faulted on a non-secure IPA while in secure state
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
 struct ARMMMUFaultInfo {
     ARMFaultType type;
+    ARMGPCF gpcf;
     target_ulong s2addr;
+    target_ulong paddr;
+    ARMSecuritySpace paddr_space;
     int level;
     int domain;
     bool stage2;
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     case ARMFault_Exclusive:
         fsc = 0x35;
         break;
+    case ARMFault_GPCFOnWalk:
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b100011;
+        } else {
+            fsc = 0b100100 | fi->level;
+        }
+        break;
+    case ARMFault_GPCFOnOutput:
+        fsc = 0b101000;
+        break;
     default:
         /* Other faults can't occur in a context that requires a
          * long-format status code.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_log_exception(CPUState *cs)
             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
             [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
             [EXCP_VSERR] = "Virtual SERR",
+            [EXCP_GPC] = "Granule Protection Check",
         };
 
         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     }
 
     switch (cs->exception_index) {
+    case EXCP_GPC:
+        qemu_log_mask(CPU_LOG_INT, "...with MFAR 0x%" PRIx64 "\n",
+                      env->cp15.mfar_el3);
+        /* fall through */
     case EXCP_PREFETCH_ABORT:
     case EXCP_DATA_ABORT:
         /*
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     return fsr;
 }
 
+static bool report_as_gpc_exception(ARMCPU *cpu, int current_el,
+                                    ARMMMUFaultInfo *fi)
+{
+    bool ret;
+
+    switch (fi->gpcf) {
+    case GPCF_None:
+        return false;
+    case GPCF_AddressSize:
+    case GPCF_Walk:
+    case GPCF_EABT:
+        /* R_PYTGX: GPT faults are reported as GPC. */
+        ret = true;
+        break;
+    case GPCF_Fail:
+        /*
+         * R_BLYPM: A GPF at EL3 is reported as insn or data abort.
+         * R_VBZMW, R_LXHQR: A GPF at EL[0-2] is reported as a GPC
+         * if SCR_EL3.GPF is set, otherwise an insn or data abort.
+         */
+        ret = (cpu->env.cp15.scr_el3 & SCR_GPF) && current_el != 3;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    assert(cpu_isar_feature(aa64_rme, cpu));
+    assert(fi->type == ARMFault_GPCFOnWalk ||
+           fi->type == ARMFault_GPCFOnOutput);
+    if (fi->gpcf == GPCF_AddressSize) {
+        assert(fi->level == 0);
+    } else {
+        assert(fi->level >= 0 && fi->level <= 1);
+    }
+
+    return ret;
+}
+
+static unsigned encode_gpcsc(ARMMMUFaultInfo *fi)
+{
+    static uint8_t const gpcsc[] = {
+        [GPCF_AddressSize] = 0b000000,
+        [GPCF_Walk]        = 0b000100,
+        [GPCF_Fail]        = 0b001100,
+        [GPCF_EABT]        = 0b010100,
+    };
+
+    /* Note that we've validated fi->gpcf and fi->level above. */
+    return gpcsc[fi->gpcf] | fi->level;
+}
+
 static G_NORETURN
 void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
                        MMUAccessType access_type,
                        int mmu_idx, ARMMMUFaultInfo *fi)
 {
     CPUARMState *env = &cpu->env;
-    int target_el;
+    int target_el = exception_target_el(env);
+    int current_el = arm_current_el(env);
     bool same_el;
     uint32_t syn, exc, fsr, fsc;
 
-    target_el = exception_target_el(env);
+    if (report_as_gpc_exception(cpu, current_el, fi)) {
+        target_el = 3;
+
+        fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
+
+        syn = syn_gpc(fi->stage2 && fi->type == ARMFault_GPCFOnWalk,
+                      access_type == MMU_INST_FETCH,
+                      encode_gpcsc(fi), 0, fi->s1ptw,
+                      access_type == MMU_DATA_STORE, fsc);
+
+        env->cp15.mfar_el3 = fi->paddr;
+        switch (fi->paddr_space) {
+        case ARMSS_Secure:
+            break;
+        case ARMSS_NonSecure:
+            env->cp15.mfar_el3 |= R_MFAR_NS_MASK;
+            break;
+        case ARMSS_Root:
+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK;
+            break;
+        case ARMSS_Realm:
+            env->cp15.mfar_el3 |= R_MFAR_NSE_MASK | R_MFAR_NS_MASK;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
+        exc = EXCP_GPC;
+        goto do_raise;
+    }
+
+    /* If SCR_EL3.GPF is unset, GPF may still be routed to EL2. */
+    if (fi->gpcf == GPCF_Fail && target_el < 2) {
+        if (arm_hcr_el2_eff(env) & HCR_GPF) {
+            target_el = 2;
+        }
+    }
+
     if (fi->stage2) {
         target_el = 2;
         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
@@ -XXX,XX +XXX,XX @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
             env->cp15.hpfar_el2 |= HPFAR_NS;
         }
     }
-    same_el = (arm_current_el(env) == target_el);
 
+    same_el = current_el == target_el;
     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
 
     if (access_type == MMU_INST_FETCH) {
@@ -XXX,XX +XXX,XX @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
         exc = EXCP_DATA_ABORT;
     }
 
+ do_raise:
     env->exception.vaddress = addr;
     env->exception.fsr = fsr;
     raise_exception(env, exc, syn, target_el);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Place the check at the end of get_phys_addr_with_struct,
so that we check all physical results.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 249 +++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 232 insertions(+), 17 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
     void *out_host;
 } S1Translate;
 
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
-                                      target_ulong address,
-                                      MMUAccessType access_type,
-                                      GetPhysAddrResult *result,
-                                      ARMMMUFaultInfo *fi);
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
+                                target_ulong address,
+                                MMUAccessType access_type,
+                                GetPhysAddrResult *result,
+                                ARMMMUFaultInfo *fi);
+
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
+                              target_ulong address,
+                              MMUAccessType access_type,
+                              GetPhysAddrResult *result,
+                              ARMMMUFaultInfo *fi);
 
 /* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
 static const uint8_t pamax_map[] = {
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
     return (regime_sctlr(env, mmu_idx) & SCTLR_M) == 0;
 }
 
+static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
+                                     ARMSecuritySpace pspace,
+                                     ARMMMUFaultInfo *fi)
+{
+    MemTxAttrs attrs = {
+        .secure = true,
+        .space = ARMSS_Root,
+    };
+    ARMCPU *cpu = env_archcpu(env);
+    uint64_t gpccr = env->cp15.gpccr_el3;
+    unsigned pps, pgs, l0gptsz, level = 0;
+    uint64_t tableaddr, pps_mask, align, entry, index;
+    AddressSpace *as;
+    MemTxResult result;
+    int gpi;
+
+    if (!FIELD_EX64(gpccr, GPCCR, GPC)) {
+        return true;
+    }
+
+    /*
+     * GPC Priority 1 (R_GMGRR):
+     * R_JWCSM: If the configuration of GPCCR_EL3 is invalid,
+     * the access fails as GPT walk fault at level 0.
+     */
+
+    /*
+     * Configuration of PPS to a value exceeding the implemented
+     * physical address size is invalid.
+     */
+    pps = FIELD_EX64(gpccr, GPCCR, PPS);
+    if (pps > FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE)) {
+        goto fault_walk;
+    }
+    pps = pamax_map[pps];
+    pps_mask = MAKE_64BIT_MASK(0, pps);
+
+    switch (FIELD_EX64(gpccr, GPCCR, SH)) {
+    case 0b10: /* outer shareable */
+        break;
+    case 0b00: /* non-shareable */
+    case 0b11: /* inner shareable */
+        /* Inner and Outer non-cacheable requires Outer shareable. */
+        if (FIELD_EX64(gpccr, GPCCR, ORGN) == 0 &&
+            FIELD_EX64(gpccr, GPCCR, IRGN) == 0) {
+            goto fault_walk;
+        }
+        break;
+    default:   /* reserved */
+        goto fault_walk;
+    }
+
+    switch (FIELD_EX64(gpccr, GPCCR, PGS)) {
+    case 0b00: /* 4KB */
+        pgs = 12;
+        break;
+    case 0b01: /* 64KB */
+        pgs = 16;
+        break;
+    case 0b10: /* 16KB */
+        pgs = 14;
+        break;
+    default: /* reserved */
+        goto fault_walk;
+    }
+
+    /* Note this field is read-only and fixed at reset. */
+    l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
+
+    /*
+     * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
+     * R_CPDSB: A NonSecure physical address input exceeding PPS
+     * does not experience any fault.
+     */
+    if (paddress & ~pps_mask) {
+        if (pspace == ARMSS_NonSecure) {
+            return true;
+        }
+        goto fault_size;
+    }
+
+    /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
+    tableaddr = env->cp15.gptbr_el3 << 12;
+    if (tableaddr & ~pps_mask) {
+        goto fault_size;
+    }
+
+    /*
+     * BADDR is aligned per a function of PPS and L0GPTSZ.
+     * These bits of GPTBR_EL3 are RES0, but are not a configuration error,
+     * unlike the RES0 bits of the GPT entries (R_XNKFZ).
+     */
+    align = MAX(pps - l0gptsz + 3, 12);
+    align = MAKE_64BIT_MASK(0, align);
+    tableaddr &= ~align;
+
+    as = arm_addressspace(env_cpu(env), attrs);
+
+    /* Level 0 lookup. */
+    index = extract64(paddress, l0gptsz, pps - l0gptsz);
+    tableaddr += index * 8;
+    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
+    if (result != MEMTX_OK) {
+        goto fault_eabt;
+    }
+
+    switch (extract32(entry, 0, 4)) {
+    case 1: /* block descriptor */
+        if (entry >> 8) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        gpi = extract32(entry, 4, 4);
+        goto found;
+    case 3: /* table descriptor */
+        tableaddr = entry & ~0xf;
+        align = MAX(l0gptsz - pgs - 1, 12);
+        align = MAKE_64BIT_MASK(0, align);
+        if (tableaddr & (~pps_mask | align)) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        break;
+    default: /* invalid */
+        goto fault_walk;
+    }
+
+    /* Level 1 lookup */
+    level = 1;
+    index = extract64(paddress, pgs + 4, l0gptsz - pgs - 4);
+    tableaddr += index * 8;
+    entry = address_space_ldq_le(as, tableaddr, attrs, &result);
+    if (result != MEMTX_OK) {
+        goto fault_eabt;
+    }
+
+    switch (extract32(entry, 0, 4)) {
+    case 1: /* contiguous descriptor */
+        if (entry >> 10) {
+            goto fault_walk; /* RES0 bits not 0 */
+        }
+        /*
+         * Because the softmmu tlb only works on units of TARGET_PAGE_SIZE,
+         * and because we cannot invalidate by pa, and thus will always
+         * flush entire tlbs, we don't actually care about the range here
+         * and can simply extract the GPI as the result.
+         */
+        if (extract32(entry, 8, 2) == 0) {
+            goto fault_walk; /* reserved contig */
+        }
+        gpi = extract32(entry, 4, 4);
+        break;
+    default:
+        index = extract64(paddress, pgs, 4);
+        gpi = extract64(entry, index * 4, 4);
+        break;
+    }
+
+ found:
+    switch (gpi) {
+    case 0b0000: /* no access */
+        break;
+    case 0b1111: /* all access */
+        return true;
+    case 0b1000:
+    case 0b1001:
+    case 0b1010:
+    case 0b1011:
+        if (pspace == (gpi & 3)) {
+            return true;
+        }
+        break;
+    default:
+        goto fault_walk; /* reserved */
+    }
+
+    fi->gpcf = GPCF_Fail;
+    goto fault_common;
+ fault_eabt:
+    fi->gpcf = GPCF_EABT;
+    goto fault_common;
+ fault_size:
+    fi->gpcf = GPCF_AddressSize;
+    goto fault_common;
+ fault_walk:
+    fi->gpcf = GPCF_Walk;
+ fault_common:
+    fi->level = level;
+    fi->paddr = paddress;
+    fi->paddr_space = pspace;
+    return false;
+}
+
 static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         };
         GetPhysAddrResult s2 = { };
 
-        if (get_phys_addr_with_struct(env, &s2ptw, addr,
-                                      MMU_DATA_LOAD, &s2, fi)) {
+        if (get_phys_addr_gpc(env, &s2ptw, addr, MMU_DATA_LOAD, &s2, fi)) {
             goto fail;
         }
+
         ptw->out_phys = s2.f.phys_addr;
         pte_attrs = s2.cacheattrs.attrs;
         ptw->out_host = NULL;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 
  fail:
     assert(fi->type != ARMFault_None);
+    if (fi->type == ARMFault_GPCFOnOutput) {
+        fi->type = ARMFault_GPCFOnWalk;
+    }
     fi->s2addr = addr;
     fi->stage2 = true;
     fi->s1ptw = true;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
                                    ARMMMUFaultInfo *fi)
 {
     uint8_t memattr = 0x00;    /* Device nGnRnE */
-    uint8_t shareability = 0;  /* non-sharable */
+    uint8_t shareability = 0;  /* non-shareable */
     int r_el;
 
     switch (mmu_idx) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_disabled(CPUARMState *env, target_ulong address,
             } else {
                 memattr = 0x44;  /* Normal, NC, No */
             }
-            shareability = 2; /* outer sharable */
+            shareability = 2; /* outer shareable */
         }
         result->cacheattrs.is_s2_format = false;
         break;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     ARMSecuritySpace ipa_space;
     uint64_t hcr;
 
-    ret = get_phys_addr_with_struct(env, ptw, address, access_type, result, fi);
+    ret = get_phys_addr_nogpc(env, ptw, address, access_type, result, fi);
 
     /* If S1 fails, return early.  */
     if (ret) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     cacheattrs1 = result->cacheattrs;
     memset(result, 0, sizeof(*result));
 
-    ret = get_phys_addr_with_struct(env, ptw, ipa, access_type, result, fi);
+    ret = get_phys_addr_nogpc(env, ptw, ipa, access_type, result, fi);
     fi->s2addr = ipa;
 
     /* Combine the S1 and S2 perms.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     return false;
 }
 
-static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
+static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
                                       target_ulong address,
                                       MMUAccessType access_type,
                                       GetPhysAddrResult *result,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     }
 }
 
+static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
+                              target_ulong address,
+                              MMUAccessType access_type,
+                              GetPhysAddrResult *result,
+                              ARMMMUFaultInfo *fi)
+{
+    if (get_phys_addr_nogpc(env, ptw, address, access_type, result, fi)) {
+        return true;
+    }
+    if (!granule_protection_check(env, result->f.phys_addr,
+                                  result->f.attrs.space, fi)) {
+        fi->type = ARMFault_GPCFOnOutput;
+        return true;
+    }
+    return false;
+}
+
 bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool is_secure, GetPhysAddrResult *result,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr_with_secure(CPUARMState *env, target_ulong address,
         .in_secure = is_secure,
         .in_space = arm_secure_to_space(is_secure),
     };
-    return get_phys_addr_with_struct(env, &ptw, address, access_type,
-                                     result, fi);
+    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
 bool get_phys_addr(CPUARMState *env, target_ulong address,
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     ptw.in_space = ss;
     ptw.in_secure = arm_space_is_secure(ss);
-    return get_phys_addr_with_struct(env, &ptw, address, access_type,
-                                     result, fi);
+    return get_phys_addr_gpc(env, &ptw, address, access_type, result, fi);
 }
 
 hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     ARMMMUFaultInfo fi = {};
     bool ret;
 
-    ret = get_phys_addr_with_struct(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
+    ret = get_phys_addr_gpc(env, &ptw, addr, MMU_DATA_LOAD, &res, &fi);
     *attrs = res.f.attrs;
 
     if (ret) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Add an x-rme cpu property to enable FEAT_RME.
Add an x-l0gptsz property to set GPCCR_EL3.L0GPTSZ,
for testing various possible configurations.

We're not currently completely sure whether FEAT_RME will
be OK to enable purely as a CPU-level property, or if it will
need board co-operation, so we're making these experimental
x- properties, so that the people developing the system
level software for RME can try to start using this and let
us know how it goes. The command line syntax for enabling
this will change in future, without backwards-compatibility.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620124418.805717-21-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 53 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
     cpu->sve_max_vq = max_vq;
 }
 
+static bool cpu_arm_get_rme(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_rme, cpu);
+}
+
+static void cpu_arm_set_rme(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64pfr0;
+    t = FIELD_DP64(t, ID_AA64PFR0, RME, value);
+    cpu->isar.id_aa64pfr0 = t;
+}
+
+static void cpu_max_set_l0gptsz(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t value;
+
+    if (!visit_type_uint32(v, name, &value, errp)) {
+        return;
+    }
+
+    /* Encode the value for the GPCCR_EL3 field. */
+    switch (value) {
+    case 30:
+    case 34:
+    case 36:
+    case 39:
+        cpu->reset_l0gptsz = value - 30;
+        break;
+    default:
+        error_setg(errp, "invalid value for l0gptsz");
+        error_append_hint(errp, "valid values are 30, 34, 36, 39\n");
+        break;
+    }
+}
+
+static void cpu_max_get_l0gptsz(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t value = cpu->reset_l0gptsz + 30;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
 static Property arm_cpu_lpa2_property =
     DEFINE_PROP_BOOL("lpa2", ARMCPU, prop_lpa2, true);
 
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     aarch64_add_sme_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL);
+    object_property_add_bool(obj, "x-rme", cpu_arm_get_rme, cpu_arm_set_rme);
+    object_property_add(obj, "x-l0gptsz", "uint32", cpu_max_get_l0gptsz,
+                        cpu_max_set_l0gptsz, NULL, NULL);
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
 }
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20230622143046.1578160-1-richard.henderson@linaro.org
[PMM: fixed typo; note experimental status in emulation.rst too]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 23 +++++++++++++++++++++++
 docs/system/arm/emulation.rst    |  1 +
 2 files changed, 24 insertions(+)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ As with ``sve-default-vector-length``, if the default length is larger
 than the maximum vector length enabled, the actual vector length will
 be reduced.  If this property is set to ``-1`` then the default vector
 length is set to the maximum possible length.
+
+RME CPU Properties
+==================
+
+The status of RME support with QEMU is experimental.  At this time we
+only support RME within the CPU proper, not within the SMMU or GIC.
+The feature is enabled by the CPU property ``x-rme``, with the ``x-``
+prefix present as a reminder of the experimental status, and defaults off.
+
+The method for enabling RME will change in some future QEMU release
+without notice or backward compatibility.
+
+RME Level 0 GPT Size Property
+-----------------------------
+
+To aid firmware developers in testing different possible CPU
+configurations, ``x-l0gptsz=S`` may be used to specify the value
+to encode into ``GPCCR_EL3.L0GPTSZ``, a read-only field that
+specifies the size of the Level 0 Granule Protection Table.
+Legal values for ``S`` are 30, 34, 36, and 39; the default is 30.
+
+As with ``x-rme``, the ``x-l0gptsz`` property may be renamed or
+removed in some future QEMU release.
diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_RAS (Reliability, availability, and serviceability)
 - FEAT_RASv1p1 (RAS Extension v1.1)
 - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
+- FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
 - FEAT_RNG (Random number generator)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
 - FEAT_SB (Speculation Barrier)
-- 
2.34.1

We use __builtin_subcll() to do a 64-bit subtract with borrow-in and
borrow-out when the host compiler supports it.  Unfortunately some
versions of Apple Clang have a bug in their implementation of this
intrinsic which means it returns the wrong value.  The effect is that
a QEMU built with the affected compiler will hang when emulating x86
or m68k float80 division.

The upstream LLVM issue is:
https://github.com/llvm/llvm-project/issues/55253

The commit that introduced the bug apparently never made it into an
upstream LLVM release without the subsequent fix
https://github.com/llvm/llvm-project/commit/fffb6e6afdbaba563189c1f715058ed401fbc88d
but unfortunately it did make it into Apple Clang 14.0, as shipped
in Xcode 14.3 (14.2 is reported to be OK). The Apple bug number is
FB12210478.

Add ifdefs to avoid use of __builtin_subcll() on Apple Clang version
14 or greater.  There is not currently a version of Apple Clang which
has the bug fix -- when one appears we should be able to add an upper
bound to the ifdef condition so we can start using the builtin again.
We make the lower bound a conservative "any Apple clang with major
version 14 or greater" because the consequences of incorrectly
disabling the builtin when it would work are pretty small and the
consequences of not disabling it when we should are pretty bad.

Many thanks to those users who both reported this bug and also
did a lot of work in identifying the root cause; in particular
to Daniel Bertalan and osy.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1631
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1659
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Daniel Bertalan <dani@danielbertalan.dev>
Tested-by: Tested-By: Solra Bizna <solra@bizna.name>
Message-id: 20230622130823.1631719-1-peter.maydell@linaro.org
---
 include/qemu/compiler.h   | 13 +++++++++++++
 include/qemu/host-utils.h |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_DISABLE_CFI
 #endif
 
+/*
+ * Apple clang version 14 has a bug in its __builtin_subcll(); define
+ * BUILTIN_SUBCLL_BROKEN for the offending versions so we can avoid it.
+ * When a version of Apple clang which has this bug fixed is released
+ * we can add an upper bound to this check.
+ * See https://gitlab.com/qemu-project/qemu/-/issues/1631
+ * and https://gitlab.com/qemu-project/qemu/-/issues/1659 for details.
+ * The bug never made it into any upstream LLVM releases, only Apple ones.
+ */
+#if defined(__apple_build_version__) && __clang_major__ >= 14
+#define BUILTIN_SUBCLL_BROKEN
+#endif
+
 #endif /* COMPILER_H */
diff --git a/include/qemu/host-utils.h b/include/qemu/host-utils.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/host-utils.h
+++ b/include/qemu/host-utils.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t uadd64_carry(uint64_t x, uint64_t y, bool *pcarry)
  */
 static inline uint64_t usub64_borrow(uint64_t x, uint64_t y, bool *pborrow)
 {
-#if __has_builtin(__builtin_subcll)
+#if __has_builtin(__builtin_subcll) && !defined(BUILTIN_SUBCLL_BROKEN)
     unsigned long long b = *pborrow;
     x = __builtin_subcll(x, y, b, &b);
     *pborrow = b & 1;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

One cannot test for feature aa32_simd_r32 without first
testing if AArch32 mode is supported at all.  This leads to

qemu-system-aarch64: ARM CPUs must have both VFP-D32 and Neon or neither

for Apple M1 cpus.

We already have a check for ARMv8-A never setting vfp-d32 true,
so restructure the code so that AArch64 avoids the test entirely.

Reported-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Mads Ynddal <m.ynddal@samsung.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Mads Ynddal <m.ynddal@samsung.com>
Message-id: 20230619140216.402530-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      * KVM does not currently allow us to lie to the guest about its
      * ID/feature registers, so the guest always sees what the host has.
      */
-    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
-        ? cpu_isar_feature(aa64_fp_simd, cpu)
-        : cpu_isar_feature(aa32_vfp, cpu)) {
-        cpu->has_vfp = true;
-        if (!kvm_enabled()) {
-            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        if (cpu_isar_feature(aa64_fp_simd, cpu)) {
+            cpu->has_vfp = true;
+            cpu->has_vfp_d32 = true;
+            if (tcg_enabled() || qtest_enabled()) {
+                qdev_property_add_static(DEVICE(obj),
+                                         &arm_cpu_has_vfp_property);
+            }
         }
-    }
-
-    if (cpu->has_vfp && cpu_isar_feature(aa32_simd_r32, cpu)) {
-        cpu->has_vfp_d32 = true;
-        if (!kvm_enabled()) {
+    } else if (cpu_isar_feature(aa32_vfp, cpu)) {
+        cpu->has_vfp = true;
+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
+            cpu->has_vfp_d32 = true;
             /*
              * The permitted values of the SIMDReg bits [3:0] on
              * Armv8-A are either 0b0000 and 0b0010. On such CPUs,
              * make sure that has_vfp_d32 can not be set to false.
              */
-            if (!(arm_feature(&cpu->env, ARM_FEATURE_V8) &&
-                  !arm_feature(&cpu->env, ARM_FEATURE_M))) {
+            if ((tcg_enabled() || qtest_enabled())
+                && !(arm_feature(&cpu->env, ARM_FEATURE_V8)
+                     && !arm_feature(&cpu->env, ARM_FEATURE_M))) {
                 qdev_property_add_static(DEVICE(obj),
                                          &arm_cpu_has_vfp_d32_property);
             }
-- 
2.34.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Create ITS as part of SBSA platform GIC initialization.

GIC ITS information is in DeviceTree so TF-A can pass it to EDK2.

Bumping platform version to 0.2 as this is important hardware change.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230619170913.517373-2-marcin.juszkiewicz@linaro.org
Co-authored-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst | 14 ++++++++++++++
 hw/arm/sbsa-ref.c        | 33 ++++++++++++++++++++++++++++++---
 2 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@ to be a complete compliant DT. It currently reports:
    - platform version
    - GIC addresses
 
+Platform version
+''''''''''''''''
+
 The platform version is only for informing platform firmware about
 what kind of ``sbsa-ref`` board it is running on. It is neither
 a QEMU versioned machine type nor a reflection of the level of the
@@ -XXX,XX +XXX,XX @@ SBSA/SystemReady SR support provided.
 The ``machine-version-major`` value is updated when changes breaking
 fw compatibility are introduced. The ``machine-version-minor`` value
 is updated when features are added that don't break fw compatibility.
+
+Platform version changes:
+
+0.0
+  Devicetree holds information about CPUs, memory and platform version.
+
+0.1
+  GIC information is present in devicetree.
+
+0.2
+  GIC ITS information is present in devicetree.
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ enum {
     SBSA_CPUPERIPHS,
     SBSA_GIC_DIST,
     SBSA_GIC_REDIST,
+    SBSA_GIC_ITS,
     SBSA_SECURE_EC,
     SBSA_GWDT_WS0,
     SBSA_GWDT_REFRESH,
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry sbsa_ref_memmap[] = {
     [SBSA_CPUPERIPHS] =         { 0x40000000, 0x00040000 },
     [SBSA_GIC_DIST] =           { 0x40060000, 0x00010000 },
     [SBSA_GIC_REDIST] =         { 0x40080000, 0x04000000 },
+    [SBSA_GIC_ITS] =            { 0x44081000, 0x00020000 },
     [SBSA_SECURE_EC] =          { 0x50000000, 0x00001000 },
     [SBSA_GWDT_REFRESH] =       { 0x50010000, 0x00001000 },
     [SBSA_GWDT_CONTROL] =       { 0x50011000, 0x00001000 },
@@ -XXX,XX +XXX,XX @@ static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
                                  2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
                                  2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
 
+    nodename = g_strdup_printf("/intc/its");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_ITS].size);
+
     g_free(nodename);
 }
+
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 2);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_secure_ram(SBSAMachineState *sms,
     memory_region_add_subregion(secure_sysmem, base, secram);
 }
 
-static void create_gic(SBSAMachineState *sms)
+static void create_its(SBSAMachineState *sms)
+{
+    const char *itsclass = its_class_name();
+    DeviceState *dev;
+
+    dev = qdev_new(itsclass);
+
+    object_property_set_link(OBJECT(dev), "parent-gicv3", OBJECT(sms->gic),
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, sbsa_ref_memmap[SBSA_GIC_ITS].base);
+}
+
+static void create_gic(SBSAMachineState *sms, MemoryRegion *mem)
 {
     unsigned int smp_cpus = MACHINE(sms)->smp.cpus;
     SysBusDevice *gicbusdev;
@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms)
     qdev_prop_set_uint32(sms->gic, "len-redist-region-count", 1);
     qdev_prop_set_uint32(sms->gic, "redist-region-count[0]", redist0_count);
 
+    object_property_set_link(OBJECT(sms->gic), "sysmem",
+                             OBJECT(mem), &error_fatal);
+    qdev_prop_set_bit(sms->gic, "has-lpi", true);
+
     gicbusdev = SYS_BUS_DEVICE(sms->gic);
     sysbus_realize_and_unref(gicbusdev, &error_fatal);
     sysbus_mmio_map(gicbusdev, 0, sbsa_ref_memmap[SBSA_GIC_DIST].base);
@@ -XXX,XX +XXX,XX @@ static void create_gic(SBSAMachineState *sms)
         sysbus_connect_irq(gicbusdev, i + 3 * smp_cpus,
                            qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
     }
+    create_its(sms);
 }
 
 static void create_uart(const SBSAMachineState *sms, int uart,
@@ -XXX,XX +XXX,XX @@ static void sbsa_ref_init(MachineState *machine)
 
     create_secure_ram(sms, secure_sysmem);
 
-    create_gic(sms);
+    create_gic(sms, sysmem);
 
     create_uart(sms, SBSA_UART, sysmem, serial_hd(0));
     create_uart(sms, SBSA_SECURE_UART, secure_sysmem, serial_hd(1));
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Brown bag time: store instead of load results in uninitialized temp.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1704
Reported-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230620134659.817559-1-richard.henderson@linaro.org
Fixes: e6dd5e782be ("target/arm: Use tcg_gen_qemu_{ld, st}_i128 in gen_sve_{ld, st}r")
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-sve.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ void gen_sve_str(DisasContext *s, TCGv_ptr base, int vofs,
     /* Predicate register stores can be any multiple of 2.  */
     if (len_remain >= 8) {
         t0 = tcg_temp_new_i64();
-        tcg_gen_st_i64(t0, base, vofs + len_align);
+        tcg_gen_ld_i64(t0, base, vofs + len_align);
         tcg_gen_qemu_st_i64(t0, clean_addr, midx, MO_LEUQ | MO_ATOM_NONE);
         len_remain -= 8;
         len_align += 8;
-- 
2.34.1

The xkb official name for the Arabic keyboard layout is 'ara'.
However xkb has for at least the past 15 years also permitted it to
be named via the legacy synonym 'ar'.  In xkeyboard-config 2.39 this
synoynm was removed, which breaks compilation of QEMU:

FAILED: pc-bios/keymaps/ar
/home/fred/qemu-git/src/qemu/build-full/qemu-keymap -f pc-bios/keymaps/ar -l ar
xkbcommon: ERROR: Couldn't find file "symbols/ar" in include paths
xkbcommon: ERROR: 1 include paths searched:
xkbcommon: ERROR: 	/usr/share/X11/xkb
xkbcommon: ERROR: 3 include paths could not be added:
xkbcommon: ERROR: 	/home/fred/.config/xkb
xkbcommon: ERROR: 	/home/fred/.xkb
xkbcommon: ERROR: 	/etc/xkb
xkbcommon: ERROR: Abandoning symbols file "(unnamed)"
xkbcommon: ERROR: Failed to compile xkb_symbols
xkbcommon: ERROR: Failed to compile keymap

The upstream xkeyboard-config change removing the compat
mapping is:
https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/470ad2cd8fea84d7210377161d86b31999bb5ea6

Make QEMU always ask for the 'ara' xkb layout, which should work on
both older and newer xkeyboard-config.  We leave the QEMU name for
this keyboard layout as 'ar'; it is not the only one where our name
for it deviates from the xkb standard name.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20230620162024.1132013-1-peter.maydell@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1709
---
 pc-bios/keymaps/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/pc-bios/keymaps/meson.build
+++ b/pc-bios/keymaps/meson.build
@@ -XXX,XX +XXX,XX @@
 keymaps = {
-  'ar': '-l ar',
+  'ar': '-l ara',
   'bepo': '-l fr -v dvorak',
   'cz': '-l cz',
   'da': '-l dk',
-- 
2.34.1

The following changes since commit 8f6330a807f2642dc2a3cdf33347aa28a4c00a87:

Merge tag 'pull-maintainer-updates-060324-1' of https://gitlab.com/stsquad/qemu into staging (2024-03-06 16:56:20 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240308

for you to fetch changes up to bbf6c6dbead82292a20951eb1204442a6b838de9:

target/arm: Move v7m-related code from cpu32.c into a separate file (2024-03-08 14:45:03 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_ECV
 * STM32L4x5: Implement GPIO device
 * Fix 32-bit SMOPA
 * Refactor v7m related code from cpu32.c into its own file
 * hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

----------------------------------------------------------------
Inès Varhol (3):
      hw/gpio: Implement STM32L4x5 GPIO
      hw/arm: Connect STM32L4x5 GPIO to STM32L4x5 SoC
      tests/qtest: Add STM32L4x5 GPIO QTest testcase

Peter Maydell (9):
      target/arm: Move some register related defines to internals.h
      target/arm: Timer _EL02 registers UNDEF for E2H == 0
      target/arm: use FIELD macro for CNTHCTL bit definitions
      target/arm: Don't allow RES0 CNTHCTL_EL2 bits to be written
      target/arm: Implement new FEAT_ECV trap bits
      target/arm: Define CNTPCTSS_EL0 and CNTVCTSS_EL0
      target/arm: Implement FEAT_ECV CNTPOFF_EL2 handling
      target/arm: Enable FEAT_ECV for 'max' CPU
      hw/rtc/sun4v-rtc: Relicense to GPLv2-or-later

Richard Henderson (1):
      target/arm: Fix 32-bit SMOPA

Thomas Huth (1):
      target/arm: Move v7m-related code from cpu32.c into a separate file

MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 docs/system/arm/emulation.rst      |   1 +
 include/hw/arm/stm32l4x5_soc.h     |   2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  71 +++++
 include/hw/misc/stm32l4x5_syscfg.h |   3 +-
 include/hw/rtc/sun4v-rtc.h         |   2 +-
 target/arm/cpu-features.h          |  10 +
 target/arm/cpu.h                   | 129 +--------
 target/arm/internals.h             | 151 ++++++++++
 hw/arm/stm32l4x5_soc.c             |  71 ++++-
 hw/gpio/stm32l4x5_gpio.c           | 477 ++++++++++++++++++++++++++++++++
 hw/misc/stm32l4x5_syscfg.c         |   1 +
 hw/rtc/sun4v-rtc.c                 |   2 +-
 target/arm/helper.c                | 189 ++++++++++++-
 target/arm/tcg/cpu-v7m.c           | 290 +++++++++++++++++++
 target/arm/tcg/cpu32.c             | 261 ------------------
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/sme_helper.c        |  77 +++---
 tests/qtest/stm32l4x5_gpio-test.c  | 551 +++++++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-1.c    |  47 ++++
 tests/tcg/aarch64/sme-smopa-2.c    |  54 ++++
 hw/arm/Kconfig                     |   3 +-
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 target/arm/meson.build             |   3 +
 target/arm/tcg/meson.build         |   3 +
 target/arm/trace-events            |   1 +
 tests/qtest/meson.build            |   3 +-
 tests/tcg/aarch64/Makefile.target  |   2 +-
 31 files changed, 1962 insertions(+), 456 deletions(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c
 create mode 100644 target/arm/tcg/cpu-v7m.c
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

cpu.h has a lot of #defines relating to CPU register fields.
Most of these aren't actually used outside target/arm code,
so there's no point in cluttering up the cpu.h file with them.
Move some easy ones to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 128 -----------------------------------------
 target/arm/internals.h | 128 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 128 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMGenericTimer {
     uint64_t ctl; /* Timer Control register */
 } ARMGenericTimer;
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
-/* Bit definitions for CPACR (AArch32 only) */
-FIELD(CPACR, CP10, 20, 2)
-FIELD(CPACR, CP11, 22, 2)
-FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
-FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
-FIELD(CPACR, ASEDIS, 31, 1)
-
-/* Bit definitions for CPACR_EL1 (AArch64 only) */
-FIELD(CPACR_EL1, ZEN, 16, 2)
-FIELD(CPACR_EL1, FPEN, 20, 2)
-FIELD(CPACR_EL1, SMEN, 24, 2)
-FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
-
-/* Bit definitions for HCPTR (AArch32 only) */
-FIELD(HCPTR, TCP10, 10, 1)
-FIELD(HCPTR, TCP11, 11, 1)
-FIELD(HCPTR, TASE, 15, 1)
-FIELD(HCPTR, TTA, 20, 1)
-FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
-FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
-
-/* Bit definitions for CPTR_EL2 (AArch64 only) */
-FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
-FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
-FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
-FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
-FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
-FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
-FIELD(CPTR_EL2, TTA, 28, 1)
-FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
-FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
-
-/* Bit definitions for CPTR_EL3 (AArch64 only) */
-FIELD(CPTR_EL3, EZ, 8, 1)
-FIELD(CPTR_EL3, TFP, 10, 1)
-FIELD(CPTR_EL3, ESM, 12, 1)
-FIELD(CPTR_EL3, TTA, 20, 1)
-FIELD(CPTR_EL3, TAM, 30, 1)
-FIELD(CPTR_EL3, TCPAC, 31, 1)
-
-#define MDCR_MTPME    (1U << 28)
-#define MDCR_TDCC     (1U << 27)
-#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
-#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
-#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
-#define MDCR_EPMAD    (1U << 21)
-#define MDCR_EDAD     (1U << 20)
-#define MDCR_TTRF     (1U << 19)
-#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
-#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
-#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
-#define MDCR_SDD      (1U << 16)
-#define MDCR_SPD      (3U << 14)
-#define MDCR_TDRA     (1U << 11)
-#define MDCR_TDOSA    (1U << 10)
-#define MDCR_TDA      (1U << 9)
-#define MDCR_TDE      (1U << 8)
-#define MDCR_HPME     (1U << 7)
-#define MDCR_TPM      (1U << 6)
-#define MDCR_TPMCR    (1U << 5)
-#define MDCR_HPMN     (0x1fU)
-
-/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
-#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
-                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
-                         MDCR_STE | MDCR_SPME | MDCR_SPD)
-
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define XPSR_NZCV CPSR_NZCV
 #define XPSR_IT CPSR_IT
 
-#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
-#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
-#define TTBCR_PD0    (1U << 4)
-#define TTBCR_PD1    (1U << 5)
-#define TTBCR_EPD0   (1U << 7)
-#define TTBCR_IRGN0  (3U << 8)
-#define TTBCR_ORGN0  (3U << 10)
-#define TTBCR_SH0    (3U << 12)
-#define TTBCR_T1SZ   (3U << 16)
-#define TTBCR_A1     (1U << 22)
-#define TTBCR_EPD1   (1U << 23)
-#define TTBCR_IRGN1  (3U << 24)
-#define TTBCR_ORGN1  (3U << 26)
-#define TTBCR_SH1    (1U << 28)
-#define TTBCR_EAE    (1U << 31)
-
-FIELD(VTCR, T0SZ, 0, 6)
-FIELD(VTCR, SL0, 6, 2)
-FIELD(VTCR, IRGN0, 8, 2)
-FIELD(VTCR, ORGN0, 10, 2)
-FIELD(VTCR, SH0, 12, 2)
-FIELD(VTCR, TG0, 14, 2)
-FIELD(VTCR, PS, 16, 3)
-FIELD(VTCR, VS, 19, 1)
-FIELD(VTCR, HA, 21, 1)
-FIELD(VTCR, HD, 22, 1)
-FIELD(VTCR, HWU59, 25, 1)
-FIELD(VTCR, HWU60, 26, 1)
-FIELD(VTCR, HWU61, 27, 1)
-FIELD(VTCR, HWU62, 28, 1)
-FIELD(VTCR, NSW, 29, 1)
-FIELD(VTCR, NSA, 30, 1)
-FIELD(VTCR, DS, 32, 1)
-FIELD(VTCR, SL2, 33, 1)
-
 /* Bit definitions for ARMv8 SPSR (PSTATE) format.
  * Only these are valid when in AArch64 mode; in
  * AArch32 mode SPSRs are basically CPSR-format.
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
-#define HCRX_ENAS0    (1ULL << 0)
-#define HCRX_ENALS    (1ULL << 1)
-#define HCRX_ENASR    (1ULL << 2)
-#define HCRX_FNXS     (1ULL << 3)
-#define HCRX_FGTNXS   (1ULL << 4)
-#define HCRX_SMPME    (1ULL << 5)
-#define HCRX_TALLINT  (1ULL << 6)
-#define HCRX_VINMI    (1ULL << 7)
-#define HCRX_VFNMI    (1ULL << 8)
-#define HCRX_CMOW     (1ULL << 9)
-#define HCRX_MCE2     (1ULL << 10)
-#define HCRX_MSCEN    (1ULL << 11)
-
-#define HPFAR_NS      (1ULL << 63)
-
 #define SCR_NS                (1ULL << 0)
 #define SCR_IRQ               (1ULL << 1)
 #define SCR_FIQ               (1ULL << 2)
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
-#define HSTR_TTEE (1 << 16)
-#define HSTR_TJDBX (1 << 17)
-
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
-
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
+/* Bit definitions for CPACR (AArch32 only) */
+FIELD(CPACR, CP10, 20, 2)
+FIELD(CPACR, CP11, 22, 2)
+FIELD(CPACR, TRCDIS, 28, 1)    /* matches CPACR_EL1.TTA */
+FIELD(CPACR, D32DIS, 30, 1)    /* up to v7; RAZ in v8 */
+FIELD(CPACR, ASEDIS, 31, 1)
+
+/* Bit definitions for CPACR_EL1 (AArch64 only) */
+FIELD(CPACR_EL1, ZEN, 16, 2)
+FIELD(CPACR_EL1, FPEN, 20, 2)
+FIELD(CPACR_EL1, SMEN, 24, 2)
+FIELD(CPACR_EL1, TTA, 28, 1)   /* matches CPACR.TRCDIS */
+
+/* Bit definitions for HCPTR (AArch32 only) */
+FIELD(HCPTR, TCP10, 10, 1)
+FIELD(HCPTR, TCP11, 11, 1)
+FIELD(HCPTR, TASE, 15, 1)
+FIELD(HCPTR, TTA, 20, 1)
+FIELD(HCPTR, TAM, 30, 1)       /* matches CPTR_EL2.TAM */
+FIELD(HCPTR, TCPAC, 31, 1)     /* matches CPTR_EL2.TCPAC */
+
+/* Bit definitions for CPTR_EL2 (AArch64 only) */
+FIELD(CPTR_EL2, TZ, 8, 1)      /* !E2H */
+FIELD(CPTR_EL2, TFP, 10, 1)    /* !E2H, matches HCPTR.TCP10 */
+FIELD(CPTR_EL2, TSM, 12, 1)    /* !E2H */
+FIELD(CPTR_EL2, ZEN, 16, 2)    /* E2H */
+FIELD(CPTR_EL2, FPEN, 20, 2)   /* E2H */
+FIELD(CPTR_EL2, SMEN, 24, 2)   /* E2H */
+FIELD(CPTR_EL2, TTA, 28, 1)
+FIELD(CPTR_EL2, TAM, 30, 1)    /* matches HCPTR.TAM */
+FIELD(CPTR_EL2, TCPAC, 31, 1)  /* matches HCPTR.TCPAC */
+
+/* Bit definitions for CPTR_EL3 (AArch64 only) */
+FIELD(CPTR_EL3, EZ, 8, 1)
+FIELD(CPTR_EL3, TFP, 10, 1)
+FIELD(CPTR_EL3, ESM, 12, 1)
+FIELD(CPTR_EL3, TTA, 20, 1)
+FIELD(CPTR_EL3, TAM, 30, 1)
+FIELD(CPTR_EL3, TCPAC, 31, 1)
+
+#define MDCR_MTPME    (1U << 28)
+#define MDCR_TDCC     (1U << 27)
+#define MDCR_HLP      (1U << 26)  /* MDCR_EL2 */
+#define MDCR_SCCD     (1U << 23)  /* MDCR_EL3 */
+#define MDCR_HCCD     (1U << 23)  /* MDCR_EL2 */
+#define MDCR_EPMAD    (1U << 21)
+#define MDCR_EDAD     (1U << 20)
+#define MDCR_TTRF     (1U << 19)
+#define MDCR_STE      (1U << 18)  /* MDCR_EL3 */
+#define MDCR_SPME     (1U << 17)  /* MDCR_EL3 */
+#define MDCR_HPMD     (1U << 17)  /* MDCR_EL2 */
+#define MDCR_SDD      (1U << 16)
+#define MDCR_SPD      (3U << 14)
+#define MDCR_TDRA     (1U << 11)
+#define MDCR_TDOSA    (1U << 10)
+#define MDCR_TDA      (1U << 9)
+#define MDCR_TDE      (1U << 8)
+#define MDCR_HPME     (1U << 7)
+#define MDCR_TPM      (1U << 6)
+#define MDCR_TPMCR    (1U << 5)
+#define MDCR_HPMN     (0x1fU)
+
+/* Not all of the MDCR_EL3 bits are present in the 32-bit SDCR */
+#define SDCR_VALID_MASK (MDCR_MTPME | MDCR_TDCC | MDCR_SCCD | \
+                         MDCR_EPMAD | MDCR_EDAD | MDCR_TTRF | \
+                         MDCR_STE | MDCR_SPME | MDCR_SPD)
+
+#define TTBCR_N      (7U << 0) /* TTBCR.EAE==0 */
+#define TTBCR_T0SZ   (7U << 0) /* TTBCR.EAE==1 */
+#define TTBCR_PD0    (1U << 4)
+#define TTBCR_PD1    (1U << 5)
+#define TTBCR_EPD0   (1U << 7)
+#define TTBCR_IRGN0  (3U << 8)
+#define TTBCR_ORGN0  (3U << 10)
+#define TTBCR_SH0    (3U << 12)
+#define TTBCR_T1SZ   (3U << 16)
+#define TTBCR_A1     (1U << 22)
+#define TTBCR_EPD1   (1U << 23)
+#define TTBCR_IRGN1  (3U << 24)
+#define TTBCR_ORGN1  (3U << 26)
+#define TTBCR_SH1    (1U << 28)
+#define TTBCR_EAE    (1U << 31)
+
+FIELD(VTCR, T0SZ, 0, 6)
+FIELD(VTCR, SL0, 6, 2)
+FIELD(VTCR, IRGN0, 8, 2)
+FIELD(VTCR, ORGN0, 10, 2)
+FIELD(VTCR, SH0, 12, 2)
+FIELD(VTCR, TG0, 14, 2)
+FIELD(VTCR, PS, 16, 3)
+FIELD(VTCR, VS, 19, 1)
+FIELD(VTCR, HA, 21, 1)
+FIELD(VTCR, HD, 22, 1)
+FIELD(VTCR, HWU59, 25, 1)
+FIELD(VTCR, HWU60, 26, 1)
+FIELD(VTCR, HWU61, 27, 1)
+FIELD(VTCR, HWU62, 28, 1)
+FIELD(VTCR, NSW, 29, 1)
+FIELD(VTCR, NSA, 30, 1)
+FIELD(VTCR, DS, 32, 1)
+FIELD(VTCR, SL2, 33, 1)
+
+#define HCRX_ENAS0    (1ULL << 0)
+#define HCRX_ENALS    (1ULL << 1)
+#define HCRX_ENASR    (1ULL << 2)
+#define HCRX_FNXS     (1ULL << 3)
+#define HCRX_FGTNXS   (1ULL << 4)
+#define HCRX_SMPME    (1ULL << 5)
+#define HCRX_TALLINT  (1ULL << 6)
+#define HCRX_VINMI    (1ULL << 7)
+#define HCRX_VFNMI    (1ULL << 8)
+#define HCRX_CMOW     (1ULL << 9)
+#define HCRX_MCE2     (1ULL << 10)
+#define HCRX_MSCEN    (1ULL << 11)
+
+#define HPFAR_NS      (1ULL << 63)
+
+#define HSTR_TTEE (1 << 16)
+#define HSTR_TJDBX (1 << 17)
+
+#define CNTHCTL_CNTVMASK      (1 << 18)
+#define CNTHCTL_CNTPMASK      (1 << 19)
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
-- 
2.34.1

We prefer the FIELD macro over ad-hoc #defines for register bits;
switch CNTHCTL to that style before we add any more bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 27 +++++++++++++++++++++++++--
 target/arm/helper.c    |  9 ++++-----
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(VTCR, SL2, 33, 1)
 #define HSTR_TTEE (1 << 16)
 #define HSTR_TJDBX (1 << 17)
 
-#define CNTHCTL_CNTVMASK      (1 << 18)
-#define CNTHCTL_CNTPMASK      (1 << 19)
+/*
+ * Depending on the value of HCR_EL2.E2H, bits 0 and 1
+ * have different bit definitions, and EL1PCTEN might be
+ * bit 0 or bit 10. We use _E2H1 and _E2H0 suffixes to
+ * disambiguate if necessary.
+ */
+FIELD(CNTHCTL, EL0PCTEN_E2H1, 0, 1)
+FIELD(CNTHCTL, EL0VCTEN_E2H1, 1, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H0, 0, 1)
+FIELD(CNTHCTL, EL1PCEN_E2H0, 1, 1)
+FIELD(CNTHCTL, EVNTEN, 2, 1)
+FIELD(CNTHCTL, EVNTDIR, 3, 1)
+FIELD(CNTHCTL, EVNTI, 4, 4)
+FIELD(CNTHCTL, EL0VTEN, 8, 1)
+FIELD(CNTHCTL, EL0PTEN, 9, 1)
+FIELD(CNTHCTL, EL1PCTEN_E2H1, 10, 1)
+FIELD(CNTHCTL, EL1PTEN, 11, 1)
+FIELD(CNTHCTL, ECV, 12, 1)
+FIELD(CNTHCTL, EL1TVT, 13, 1)
+FIELD(CNTHCTL, EL1TVCT, 14, 1)
+FIELD(CNTHCTL, EL1NVPCT, 15, 1)
+FIELD(CNTHCTL, EL1NVVCT, 16, 1)
+FIELD(CNTHCTL, EVNTIS, 17, 1)
+FIELD(CNTHCTL, CNTVMASK, 18, 1)
+FIELD(CNTHCTL, CNTPMASK, 19, 1)
 
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_update_irq(ARMCPU *cpu, int timeridx)
      * It is RES0 in Secure and NonSecure state.
      */
     if ((ss == ARMSS_Root || ss == ARMSS_Realm) &&
-        ((timeridx == GTIMER_VIRT && (cnthctl & CNTHCTL_CNTVMASK)) ||
-         (timeridx == GTIMER_PHYS && (cnthctl & CNTHCTL_CNTPMASK)))) {
+        ((timeridx == GTIMER_VIRT && (cnthctl & R_CNTHCTL_CNTVMASK_MASK)) ||
+         (timeridx == GTIMER_PHYS && (cnthctl & R_CNTHCTL_CNTPMASK_MASK)))) {
         irqstate = 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
-
     raw_write(env, ri, value);
 
-    if ((oldval ^ value) & CNTHCTL_CNTVMASK) {
+    if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
         gt_update_irq(cpu, GTIMER_VIRT);
-    } else if ((oldval ^ value) & CNTHCTL_CNTPMASK) {
+    } else if ((oldval ^ value) & R_CNTHCTL_CNTPMASK_MASK) {
         gt_update_irq(cpu, GTIMER_PHYS);
     }
 }
-- 
2.34.1

Don't allow the guest to write CNTHCTL_EL2 bits which don't exist.
This is not strictly architecturally required, but it is how we've
tended to implement registers more recently.

In particular, bits [19:18] are only present with FEAT_RME,
and bits [17:12] will only be present with FEAT_ECV.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-5-peter.maydell@linaro.org
---
 target/arm/helper.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     ARMCPU *cpu = env_archcpu(env);
     uint32_t oldval = env->cp15.cnthctl_el2;
+    uint32_t valid_mask =
+        R_CNTHCTL_EL0PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL0VCTEN_E2H1_MASK |
+        R_CNTHCTL_EVNTEN_MASK |
+        R_CNTHCTL_EVNTDIR_MASK |
+        R_CNTHCTL_EVNTI_MASK |
+        R_CNTHCTL_EL0VTEN_MASK |
+        R_CNTHCTL_EL0PTEN_MASK |
+        R_CNTHCTL_EL1PCTEN_E2H1_MASK |
+        R_CNTHCTL_EL1PTEN_MASK;
+
+    if (cpu_isar_feature(aa64_rme, cpu)) {
+        valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
+    }
+
+    /* Clear RES0 bits */
+    value &= valid_mask;
+
     raw_write(env, ri, value);
 
     if ((oldval ^ value) & R_CNTHCTL_CNTVMASK_MASK) {
-- 
2.34.1

The functionality defined by ID_AA64MMFR0_EL1.ECV == 1 is:
 * four new trap bits for various counter and timer registers
 * the CNTHCTL_EL2.EVNTIS and CNTKCTL_EL1.EVNTIS bits which control
   scaling of the event stream. This is a no-op for us, because we don't
   implement the event stream (our WFE is a NOP): all we need to do is
   allow CNTHCTL_EL2.ENVTIS to be read and written.
 * extensions to PMSCR_EL1.PCT, PMSCR_EL2.PCT, TRFCR_EL1.TS and
   TRFCR_EL2.TS: these are all no-ops for us, because we don't implement
   FEAT_SPE or FEAT_TRF.
 * new registers CNTPCTSS_EL0 and NCTVCTSS_EL0 which are
   "self-sychronizing" views of the CNTPCT_EL0 and CNTVCT_EL0, meaning
   that no barriers are needed around their accesses. For us these
   are just the same as the normal views, because all our sysregs are
   inherently self-sychronizing.

In this commit we implement the trap handling and permit the new
CNTHCTL_EL2 bits to be written.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-6-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 ++++
 target/arm/helper.c       | 51 +++++++++++++++++++++++++++++++++++----
 2 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fgt(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, FGT) != 0;
 }
 
+static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
             return CP_ACCESS_TRAP_EL2;
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVCT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                 }
             }
         }
+        if (has_el2 && timeridx == GTIMER_VIRT) {
+            if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1TVT)) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+        }
         break;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_rme, cpu)) {
         valid_mask |= R_CNTHCTL_CNTVMASK_MASK | R_CNTHCTL_CNTPMASK_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        valid_mask |=
+            R_CNTHCTL_EL1TVT_MASK |
+            R_CNTHCTL_EL1TVCT_MASK |
+            R_CNTHCTL_EL1NVPCT_MASK |
+            R_CNTHCTL_EL1NVVCT_MASK |
+            R_CNTHCTL_EVNTIS_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_current_el(env) == 1) {
         /* This must be a FEAT_NV access */
-        /* TODO: FEAT_ECV will need to check CNTHCTL_EL2 here */
         return CP_ACCESS_OK;
     }
     if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult e2h_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_el1nvpct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVPCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
+static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        /* This must be a FEAT_NV access with NVx == 101 */
+        if (FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, EL1NVVCT)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+    }
+    return e2h_access(env, ri, isread);
+}
+
 /* Test if system register redirection is to occur in the current state.  */
 static bool redirect_for_e2h(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
     { .name = "CNTP_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 2, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .nv2_redirect_offset = 0x180 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write },
     { .name = "CNTV_CTL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 1,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .nv2_redirect_offset = 0x170 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .writefn = gt_virt_ctl_write, .raw_writefn = raw_write },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo vhe_reginfo[] = {
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .nv2_redirect_offset = 0x178 | NV2_REDIR_NO_NV1,
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvpct,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write },
     { .name = "CNTV_CVAL_EL02", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 5, .crn = 14, .crm = 3, .opc2 = 2,
       .type = ARM_CP_IO | ARM_CP_ALIAS,
       .nv2_redirect_offset = 0x168 | NV2_REDIR_NO_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
-      .access = PL2_RW, .accessfn = e2h_access,
+      .access = PL2_RW, .accessfn = access_el1nvvct,
       .writefn = gt_virt_cval_write, .raw_writefn = raw_write },
 #endif
 };
-- 
2.34.1

For FEAT_ECV, new registers CNTPCTSS_EL0 and CNTVCTSS_EL0 are
defined, which are "self-synchronized" views of the physical and
virtual counts as seen in the CNTPCT_EL0 and CNTVCT_EL0 registers
(meaning that no barriers are needed around accesses to them to
ensure that reads of them do not occur speculatively and out-of-order
with other instructions).

For QEMU, all our system registers are self-synchronized, so we can
simply copy the existing implementation of CNTPCT_EL0 and CNTVCT_EL0
to the new register encodings.

This means we now implement all the functionality required for
ID_AA64MMFR0_EL1.ECV == 0b0001.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-7-peter.maydell@linaro.org
---
 target/arm/helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * FEAT_ECV adds extra views of CNTVCT_EL0 and CNTPCT_EL0 which
+ * are "self-synchronizing". For QEMU all sysregs are self-synchronizing,
+ * so our implementations here are identical to the normal registers.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS", .cp = 15, .crm = 14, .opc1 = 9,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access,
+      .readfn = gt_virt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_vct_access, .readfn = gt_virt_cnt_read,
+    },
+    { .name = "CNTPCTSS", .cp = 15, .crm = 14, .opc1 = 8,
+      .access = PL0_R, .type = ARM_CP_64BIT | ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access,
+      .readfn = gt_cnt_read, .resetfn = arm_cp_reset_ignore,
+    },
+    { .name = "CNTPCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 5,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .accessfn = gt_pct_access, .readfn = gt_cnt_read,
+    },
+};
+
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
 };
 
+/*
+ * CNTVCTSS_EL0 has the same trap conditions as CNTVCT_EL0, so it also
+ * is exposed to userspace by Linux.
+ */
+static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
+    { .name = "CNTVCTSS_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 6,
+      .access = PL0_R, .type = ARM_CP_NO_RAW | ARM_CP_IO,
+      .readfn = gt_virt_cnt_read,
+    },
+};
+
 #endif
 
 static void par_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_GENERIC_TIMER)) {
         define_arm_cp_regs(cpu, generic_timer_cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
+        define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
+    }
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
-- 
2.34.1

When ID_AA64MMFR0_EL1.ECV is 0b0010, a new register CNTPOFF_EL2 is
implemented.  This is similar to the existing CNTVOFF_EL2, except
that it controls a hypervisor-adjustable offset made to the physical
counter and timer.

Implement the handling for this register, which includes control/trap
bits in SCR_EL3 and CNTHCTL_EL2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-8-peter.maydell@linaro.org
---
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.h          |  1 +
 target/arm/helper.c       | 68 +++++++++++++++++++++++++++++++++++++--
 target/arm/trace-events   |  1 +
 4 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ecv_traps(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 0;
 }
 
+static inline bool isar_feature_aa64_ecv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, ECV) > 1;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t c14_cntkctl; /* Timer Control register */
         uint64_t cnthctl_el2; /* Counter/Timer Hyp Control register */
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
+        uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
         uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_rme, cpu)) {
             valid_mask |= SCR_NSE | SCR_GPF;
         }
+        if (cpu_isar_feature(aa64_ecv, cpu)) {
+            valid_mask |= SCR_ECVEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ void gt_rme_post_el_change(ARMCPU *cpu, void *ignored)
     gt_update_irq(cpu, GTIMER_PHYS);
 }
 
+static uint64_t gt_phys_raw_cnt_offset(CPUARMState *env)
+{
+    if ((env->cp15.scr_el3 & SCR_ECVEN) &&
+        FIELD_EX64(env->cp15.cnthctl_el2, CNTHCTL, ECV) &&
+        arm_is_el2_enabled(env) &&
+        (arm_hcr_el2_eff(env) & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+        return env->cp15.cntpoff_el2;
+    }
+    return 0;
+}
+
+static uint64_t gt_phys_cnt_offset(CPUARMState *env)
+{
+    if (arm_current_el(env) >= 2) {
+        return 0;
+    }
+    return gt_phys_raw_cnt_offset(env);
+}
+
 static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
 {
     ARMGenericTimer *gt = &cpu->env.cp15.c14_timer[timeridx];
@@ -XXX,XX +XXX,XX @@ static void gt_recalc_timer(ARMCPU *cpu, int timeridx)
          * reset timer to when ISTATUS next has to change
          */
         uint64_t offset = timeridx == GTIMER_VIRT ?
-                                      cpu->env.cp15.cntvoff_el2 : 0;
+            cpu->env.cp15.cntvoff_el2 : gt_phys_raw_cnt_offset(&cpu->env);
         uint64_t count = gt_get_countervalue(&cpu->env);
         /* Note that this must be unsigned 64 bit arithmetic: */
         int istatus = count - offset >= gt->cval;
@@ -XXX,XX +XXX,XX @@ static void gt_timer_reset(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static uint64_t gt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    return gt_get_countervalue(env);
+    return gt_get_countervalue(env) - gt_phys_cnt_offset(env);
 }
 
 static uint64_t gt_virt_cnt_offset(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint64_t gt_tval_read(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     return (uint32_t)(env->cp15.c14_timer[timeridx].cval -
@@ -XXX,XX +XXX,XX @@ static void gt_tval_write(CPUARMState *env, const ARMCPRegInfo *ri,
     case GTIMER_HYPVIRT:
         offset = gt_virt_cnt_offset(env);
         break;
+    case GTIMER_PHYS:
+        offset = gt_phys_cnt_offset(env);
+        break;
     }
 
     trace_arm_gt_tval_write(timeridx, value);
@@ -XXX,XX +XXX,XX @@ static void gt_cnthctl_write(CPUARMState *env, const ARMCPRegInfo *ri,
             R_CNTHCTL_EL1NVVCT_MASK |
             R_CNTHCTL_EVNTIS_MASK;
     }
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        valid_mask |= R_CNTHCTL_ECV_MASK;
+    }
 
     /* Clear RES0 bits */
     value &= valid_mask;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo gen_timer_ecv_cp_reginfo[] = {
     },
 };
 
+static CPAccessResult gt_cntpoff_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) == 2 && !(env->cp15.scr_el3 & SCR_ECVEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void gt_cntpoff_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                              uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    trace_arm_gt_cntpoff_write(value);
+    raw_write(env, ri, value);
+    gt_recalc_timer(cpu, GTIMER_PHYS);
+}
+
+static const ARMCPRegInfo gen_timer_cntpoff_reginfo = {
+    .name = "CNTPOFF_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 6,
+    .access = PL2_RW, .type = ARM_CP_IO, .resetvalue = 0,
+    .accessfn = gt_cntpoff_access, .writefn = gt_cntpoff_write,
+    .nv2_redirect_offset = 0x1a8,
+    .fieldoffset = offsetof(CPUARMState, cp15.cntpoff_el2),
+};
 #else
 
 /*
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ecv_traps, cpu)) {
         define_arm_cp_regs(cpu, gen_timer_ecv_cp_reginfo);
     }
+#ifndef CONFIG_USER_ONLY
+    if (cpu_isar_feature(aa64_ecv, cpu)) {
+        define_one_arm_cp_reg(cpu, &gen_timer_cntpoff_reginfo);
+    }
+#endif
     if (arm_feature(env, ARM_FEATURE_VAPA)) {
         ARMCPRegInfo vapa_cp_reginfo[] = {
             { .name = "PAR", .cp = 15, .crn = 7, .crm = 4, .opc1 = 0, .opc2 = 0,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer) "gt_ctl_write: timer %d IMASK toggle"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+arm_gt_cntpoff_write(uint64_t value) "gt_cntpoff_write: value 0x%" PRIx64
 arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
-- 
2.34.1

Enable all FEAT_ECV features on the 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20240301183219.2424889-9-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_DotProd (Advanced SIMD dot product instructions)
 - FEAT_DoubleFault (Double Fault Extension)
 - FEAT_E0PD (Preventing EL0 access to halves of address maps)
+- FEAT_ECV (Enhanced Counter Virtualization)
 - FEAT_EPAC (Enhanced pointer authentication)
 - FEAT_ETS (Enhanced Translation Synchronization)
 - FEAT_EVT (Enhanced Virtualization Traps)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     t = FIELD_DP64(t, ID_AA64MMFR0, FGT, 1);       /* FEAT_FGT */
+    t = FIELD_DP64(t, ID_AA64MMFR0, ECV, 2);       /* FEAT_ECV */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Features supported :
- the 8 STM32L4x5 GPIOs are initialized with their reset values
    (except IDR, see below)
- input mode : setting a pin in input mode "externally" (using input
    irqs) results in an out irq (transmitted to SYSCFG)
- output mode : setting a bit in ODR sets the corresponding out irq
    (if this line is configured in output mode)
- pull-up, pull-down
- push-pull, open-drain

Difference with the real GPIOs :
- Alternate Function and Analog mode aren't implemented :
    pins in AF/Analog behave like pins in input mode
- floating pins stay at their last value
- register IDR reset values differ from the real one :
    values are coherent with the other registers reset values
    and the fact that AF/Analog modes aren't implemented
- setting I/O output speed isn't supported
- locking port bits isn't supported
- ADC function isn't supported
- GPIOH has 16 pins instead of 2 pins
- writing to registers LCKR, AFRL, AFRH and ASCR is ineffective

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-2-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                        |   1 +
 docs/system/arm/b-l475e-iot01a.rst |   2 +-
 include/hw/gpio/stm32l4x5_gpio.h   |  70 +++++
 hw/gpio/stm32l4x5_gpio.c           | 477 +++++++++++++++++++++++++++++
 hw/gpio/Kconfig                    |   3 +
 hw/gpio/meson.build                |   1 +
 hw/gpio/trace-events               |   6 +
 7 files changed, 559 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/gpio/stm32l4x5_gpio.h
 create mode 100644 hw/gpio/stm32l4x5_gpio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/arm/stm32l4x5_soc.c
 F: hw/misc/stm32l4x5_exti.c
 F: hw/misc/stm32l4x5_syscfg.c
 F: hw/misc/stm32l4x5_rcc.c
+F: hw/gpio/stm32l4x5_gpio.c
 F: include/hw/*/stm32l4x5_*.h
 
 B-L475E-IOT01A IoT Node
diff --git a/docs/system/arm/b-l475e-iot01a.rst b/docs/system/arm/b-l475e-iot01a.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/b-l475e-iot01a.rst
+++ b/docs/system/arm/b-l475e-iot01a.rst
@@ -XXX,XX +XXX,XX @@ Currently B-L475E-IOT01A machine's only supports the following devices:
 - STM32L4x5 EXTI (Extended interrupts and events controller)
 - STM32L4x5 SYSCFG (System configuration controller)
 - STM32L4x5 RCC (Reset and clock control)
+- STM32L4x5 GPIOs (General-purpose I/Os)
 
 Missing devices
 """""""""""""""
@@ -XXX,XX +XXX,XX @@ Missing devices
 The B-L475E-IOT01A does *not* support the following devices:
 
 - Serial ports (UART)
-- General-purpose I/Os (GPIO)
 - Analog to Digital Converter (ADC)
 - SPI controller
 - Timer controller (TIMER)
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#ifndef HW_STM32L4X5_GPIO_H
+#define HW_STM32L4X5_GPIO_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
+OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
+
+#define GPIO_NUM_PINS 16
+
+struct Stm32l4x5GpioState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+
+    /* GPIO registers */
+    uint32_t moder;
+    uint32_t otyper;
+    uint32_t ospeedr;
+    uint32_t pupdr;
+    uint32_t idr;
+    uint32_t odr;
+    uint32_t lckr;
+    uint32_t afrl;
+    uint32_t afrh;
+    uint32_t ascr;
+
+    /* GPIO registers reset values */
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+
+    /*
+     * External driving of pins.
+     * The pins can be set externally through the device
+     * anonymous input GPIOs lines under certain conditions.
+     * The pin must not be in push-pull output mode,
+     * and can't be set high in open-drain mode.
+     * Pins driven externally and configured to
+     * output mode will in general be "disconnected"
+     * (see `get_gpio_pinmask_to_disconnect()`)
+     */
+    uint16_t disconnected_pins;
+    uint16_t pins_connected_high;
+
+    char *name;
+    Clock *clk;
+    qemu_irq pin[GPIO_NUM_PINS];
+};
+
+#endif
diff --git a/hw/gpio/stm32l4x5_gpio.c b/hw/gpio/stm32l4x5_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/stm32l4x5_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * STM32L4x5 GPIO (General Purpose Input/Ouput)
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * The reference used is the STMicroElectronics RM0351 Reference manual
+ * for STM32L4x5 and STM32L4x6 advanced Arm ® -based 32-bit MCUs.
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32l4x5/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
+#include "hw/irq.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "qapi/visitor.h"
+#include "qapi/error.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+
+#define GPIO_MODER 0x00
+#define GPIO_OTYPER 0x04
+#define GPIO_OSPEEDR 0x08
+#define GPIO_PUPDR 0x0C
+#define GPIO_IDR 0x10
+#define GPIO_ODR 0x14
+#define GPIO_BSRR 0x18
+#define GPIO_LCKR 0x1C
+#define GPIO_AFRL 0x20
+#define GPIO_AFRH 0x24
+#define GPIO_BRR 0x28
+#define GPIO_ASCR 0x2C
+
+/* 0b11111111_11111111_00000000_00000000 */
+#define RESERVED_BITS_MASK 0xFFFF0000
+
+static void update_gpio_idr(Stm32l4x5GpioState *s);
+
+static bool is_pull_up(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 1;
+}
+
+static bool is_pull_down(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->pupdr, 2 * pin, 2) == 2;
+}
+
+static bool is_output(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->moder, 2 * pin, 2) == 1;
+}
+
+static bool is_open_drain(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 1;
+}
+
+static bool is_push_pull(Stm32l4x5GpioState *s, unsigned pin)
+{
+    return extract32(s->otyper, pin, 1) == 0;
+}
+
+static void stm32l4x5_gpio_reset_hold(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    s->moder = s->moder_reset;
+    s->otyper = 0x00000000;
+    s->ospeedr = s->ospeedr_reset;
+    s->pupdr = s->pupdr_reset;
+    s->idr = 0x00000000;
+    s->odr = 0x00000000;
+    s->lckr = 0x00000000;
+    s->afrl = 0x00000000;
+    s->afrh = 0x00000000;
+    s->ascr = 0x00000000;
+
+    s->disconnected_pins = 0xFFFF;
+    s->pins_connected_high = 0x0000;
+    update_gpio_idr(s);
+}
+
+static void stm32l4x5_gpio_set(void *opaque, int line, int level)
+{
+    Stm32l4x5GpioState *s = opaque;
+    /*
+     * The pin isn't set if line is configured in output mode
+     * except if level is 0 and the output is open-drain.
+     * This way there will be no short-circuit prone situations.
+     */
+    if (is_output(s, line) && !(is_open_drain(s, line) && (level == 0))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Line %d can't be driven externally\n",
+                      line);
+        return;
+    }
+
+    s->disconnected_pins &= ~(1 << line);
+    if (level) {
+        s->pins_connected_high |= (1 << line);
+    } else {
+        s->pins_connected_high &= ~(1 << line);
+    }
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+
+static void update_gpio_idr(Stm32l4x5GpioState *s)
+{
+    uint32_t new_idr_mask = 0;
+    uint32_t new_idr = s->odr;
+    uint32_t old_idr = s->idr;
+    int new_pin_state, old_pin_state;
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (is_output(s, i)) {
+            if (is_push_pull(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (!(s->odr & (1 << i))) {
+                /* open-drain ODR 0 */
+                new_idr_mask |= (1 << i);
+            /* open-drain ODR 1 */
+            } else if (!(s->disconnected_pins & (1 << i)) &&
+                       !(s->pins_connected_high & (1 << i))) {
+                /* open-drain ODR 1 with pin connected low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            /* open-drain ODR 1 with unactive pin */
+            } else if (is_pull_up(s, i)) {
+                new_idr_mask |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for open-drain ODR 1
+             * with unactive pin without pull-up or pull-down :
+             * the value is floating.
+             */
+        /* input or analog mode with connected pin */
+        } else if (!(s->disconnected_pins & (1 << i))) {
+            if (s->pins_connected_high & (1 << i)) {
+                /* pin high */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else {
+                /* pin low */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+        /* input or analog mode with disconnected pin */
+        } else {
+            if (is_pull_up(s, i)) {
+                /* pull-up */
+                new_idr_mask |= (1 << i);
+                new_idr |= (1 << i);
+            } else if (is_pull_down(s, i)) {
+                /* pull-down */
+                new_idr_mask |= (1 << i);
+                new_idr &= ~(1 << i);
+            }
+            /*
+             * The only case left is for a disconnected pin
+             * without pull-up or pull-down :
+             * the value is floating.
+             */
+        }
+    }
+
+    s->idr = (old_idr & ~new_idr_mask) | (new_idr & new_idr_mask);
+    trace_stm32l4x5_gpio_update_idr(s->name, old_idr, s->idr);
+
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        if (new_idr_mask & (1 << i)) {
+            new_pin_state = (new_idr & (1 << i)) > 0;
+            old_pin_state = (old_idr & (1 << i)) > 0;
+            if (new_pin_state > old_pin_state) {
+                qemu_irq_raise(s->pin[i]);
+            } else if (new_pin_state < old_pin_state) {
+                qemu_irq_lower(s->pin[i]);
+            }
+        }
+    }
+}
+
+/*
+ * Return mask of pins that are both configured in output
+ * mode and externally driven (except pins in open-drain
+ * mode externally set to 0).
+ */
+static uint32_t get_gpio_pinmask_to_disconnect(Stm32l4x5GpioState *s)
+{
+    uint32_t pins_to_disconnect = 0;
+    for (int i = 0; i < GPIO_NUM_PINS; i++) {
+        /* for each connected pin in output mode */
+        if (!(s->disconnected_pins & (1 << i)) && is_output(s, i)) {
+            /* if either push-pull or high level */
+            if (is_push_pull(s, i) || s->pins_connected_high & (1 << i)) {
+                pins_to_disconnect |= (1 << i);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Line %d can't be driven externally\n",
+                              i);
+            }
+        }
+    }
+    return pins_to_disconnect;
+}
+
+/*
+ * Set field `disconnected_pins` and call `update_gpio_idr()`
+ */
+static void disconnect_gpio_pins(Stm32l4x5GpioState *s, uint16_t lines)
+{
+    s->disconnected_pins |= lines;
+    trace_stm32l4x5_gpio_pins(s->name, s->disconnected_pins,
+                              s->pins_connected_high);
+    update_gpio_idr(s);
+}
+
+static void disconnected_pins_set(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint16_t value;
+    if (!visit_type_uint16(v, name, &value, errp)) {
+        return;
+    }
+    disconnect_gpio_pins(s, value);
+}
+
+static void disconnected_pins_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    visit_type_uint16(v, name, (uint16_t *)opaque, errp);
+}
+
+static void clock_freq_get(Object *obj, Visitor *v,
+    const char *name, void *opaque, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+    uint32_t clock_freq_hz = clock_get_hz(s->clk);
+    visit_type_uint32(v, name, &clock_freq_hz, errp);
+}
+
+static void stm32l4x5_gpio_write(void *opaque, hwaddr addr,
+                                 uint64_t val64, unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    uint32_t value = val64;
+    trace_stm32l4x5_gpio_write(s->name, addr, val64);
+
+    switch (addr) {
+    case GPIO_MODER:
+        s->moder = value;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Analog and AF modes aren't supported\n\
+                       Analog and AF mode behave like input mode\n",
+                      __func__);
+        return;
+    case GPIO_OTYPER:
+        s->otyper = value & ~RESERVED_BITS_MASK;
+        disconnect_gpio_pins(s, get_gpio_pinmask_to_disconnect(s));
+        return;
+    case GPIO_OSPEEDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Changing I/O output speed isn't supported\n\
+                       I/O speed is already maximal\n",
+                      __func__);
+        s->ospeedr = value;
+        return;
+    case GPIO_PUPDR:
+        s->pupdr = value;
+        update_gpio_idr(s);
+        return;
+    case GPIO_IDR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: GPIO->IDR is read-only\n",
+                      __func__);
+        return;
+    case GPIO_ODR:
+        s->odr = value & ~RESERVED_BITS_MASK;
+        update_gpio_idr(s);
+        return;
+    case GPIO_BSRR: {
+        uint32_t bits_to_reset = (value & RESERVED_BITS_MASK) >> GPIO_NUM_PINS;
+        uint32_t bits_to_set = value & ~RESERVED_BITS_MASK;
+        /* If both BSx and BRx are set, BSx has priority.*/
+        s->odr &= ~bits_to_reset;
+        s->odr |= bits_to_set;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_LCKR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Locking port bits configuration isn't supported\n",
+                      __func__);
+        s->lckr = value & ~RESERVED_BITS_MASK;
+        return;
+    case GPIO_AFRL:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrl = value;
+        return;
+    case GPIO_AFRH:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: Alternate functions aren't supported\n",
+                      __func__);
+        s->afrh = value;
+        return;
+    case GPIO_BRR: {
+        uint32_t bits_to_reset = value & ~RESERVED_BITS_MASK;
+        s->odr &= ~bits_to_reset;
+        update_gpio_idr(s);
+        return;
+    }
+    case GPIO_ASCR:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s: ADC function isn't supported\n",
+                      __func__);
+        s->ascr = value & ~RESERVED_BITS_MASK;
+        return;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+    }
+}
+
+static uint64_t stm32l4x5_gpio_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    Stm32l4x5GpioState *s = opaque;
+
+    trace_stm32l4x5_gpio_read(s->name, addr);
+
+    switch (addr) {
+    case GPIO_MODER:
+        return s->moder;
+    case GPIO_OTYPER:
+        return s->otyper;
+    case GPIO_OSPEEDR:
+        return s->ospeedr;
+    case GPIO_PUPDR:
+        return s->pupdr;
+    case GPIO_IDR:
+        return s->idr;
+    case GPIO_ODR:
+        return s->odr;
+    case GPIO_BSRR:
+        return 0;
+    case GPIO_LCKR:
+        return s->lckr;
+    case GPIO_AFRL:
+        return s->afrl;
+    case GPIO_AFRH:
+        return s->afrh;
+    case GPIO_BRR:
+        return 0;
+    case GPIO_ASCR:
+        return s->ascr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Bad offset 0x%" HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static const MemoryRegionOps stm32l4x5_gpio_ops = {
+    .read = stm32l4x5_gpio_read,
+    .write = stm32l4x5_gpio_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+        .unaligned = false,
+    },
+};
+
+static void stm32l4x5_gpio_init(Object *obj)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32l4x5_gpio_ops, s,
+                          TYPE_STM32L4X5_GPIO, 0x400);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+
+    qdev_init_gpio_out(DEVICE(obj), s->pin, GPIO_NUM_PINS);
+    qdev_init_gpio_in(DEVICE(obj), stm32l4x5_gpio_set, GPIO_NUM_PINS);
+
+    s->clk = qdev_init_clock_in(DEVICE(s), "clk", NULL, s, 0);
+
+    object_property_add(obj, "disconnected-pins", "uint16",
+                        disconnected_pins_get, disconnected_pins_set,
+                        NULL, &s->disconnected_pins);
+    object_property_add(obj, "clock-freq-hz", "uint32",
+                        clock_freq_get, NULL, NULL, NULL);
+}
+
+static void stm32l4x5_gpio_realize(DeviceState *dev, Error **errp)
+{
+    Stm32l4x5GpioState *s = STM32L4X5_GPIO(dev);
+    if (!clock_has_source(s->clk)) {
+        error_setg(errp, "GPIO: clk input must be connected");
+        return;
+    }
+}
+
+static const VMStateDescription vmstate_stm32l4x5_gpio = {
+    .name = TYPE_STM32L4X5_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]){
+        VMSTATE_UINT32(moder, Stm32l4x5GpioState),
+        VMSTATE_UINT32(otyper, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ospeedr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(pupdr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(idr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(odr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(lckr, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrl, Stm32l4x5GpioState),
+        VMSTATE_UINT32(afrh, Stm32l4x5GpioState),
+        VMSTATE_UINT32(ascr, Stm32l4x5GpioState),
+        VMSTATE_UINT16(disconnected_pins, Stm32l4x5GpioState),
+        VMSTATE_UINT16(pins_connected_high, Stm32l4x5GpioState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property stm32l4x5_gpio_properties[] = {
+    DEFINE_PROP_STRING("name", Stm32l4x5GpioState, name),
+    DEFINE_PROP_UINT32("mode-reset", Stm32l4x5GpioState, moder_reset, 0),
+    DEFINE_PROP_UINT32("ospeed-reset", Stm32l4x5GpioState, ospeedr_reset, 0),
+    DEFINE_PROP_UINT32("pupd-reset", Stm32l4x5GpioState, pupdr_reset, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void stm32l4x5_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    device_class_set_props(dc, stm32l4x5_gpio_properties);
+    dc->vmsd = &vmstate_stm32l4x5_gpio;
+    dc->realize = stm32l4x5_gpio_realize;
+    rc->phases.hold = stm32l4x5_gpio_reset_hold;
+}
+
+static const TypeInfo stm32l4x5_gpio_types[] = {
+    {
+        .name = TYPE_STM32L4X5_GPIO,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Stm32l4x5GpioState),
+        .instance_init = stm32l4x5_gpio_init,
+        .class_init = stm32l4x5_gpio_class_init,
+    },
+};
+
+DEFINE_TYPES(stm32l4x5_gpio_types)
diff --git a/hw/gpio/Kconfig b/hw/gpio/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Kconfig
+++ b/hw/gpio/Kconfig
@@ -XXX,XX +XXX,XX @@ config GPIO_PWR
 
 config SIFIVE_GPIO
     bool
+
+config STM32L4X5_GPIO
+    bool
diff --git a/hw/gpio/meson.build b/hw/gpio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/meson.build
+++ b/hw/gpio/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
     'bcm2835_gpio.c',
     'bcm2838_gpio.c'
 ))
+system_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_gpio.c'))
 system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_gpio.c'))
 system_ss.add(when: 'CONFIG_SIFIVE_GPIO', if_true: files('sifive_gpio.c'))
diff --git a/hw/gpio/trace-events b/hw/gpio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/trace-events
+++ b/hw/gpio/trace-events
@@ -XXX,XX +XXX,XX @@ sifive_gpio_update_output_irq(int64_t line, int64_t value) "line %" PRIi64 " val
 # aspeed_gpio.c
 aspeed_gpio_read(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
 aspeed_gpio_write(uint64_t offset, uint64_t value) "offset: 0x%" PRIx64 " value 0x%" PRIx64
+
+# stm32l4x5_gpio.c
+stm32l4x5_gpio_read(char *gpio, uint64_t addr) "GPIO%s addr: 0x%" PRIx64 " "
+stm32l4x5_gpio_write(char *gpio, uint64_t addr, uint64_t data) "GPIO%s addr: 0x%" PRIx64 " val: 0x%" PRIx64 ""
+stm32l4x5_gpio_update_idr(char *gpio, uint32_t old_idr, uint32_t new_idr) "GPIO%s from: 0x%x to: 0x%x"
+stm32l4x5_gpio_pins(char *gpio, uint16_t disconnected, uint16_t high) "GPIO%s disconnected pins: 0x%x levels: 0x%x"
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20240305210444.310665-3-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/stm32l4x5_soc.h     |  2 +
 include/hw/gpio/stm32l4x5_gpio.h   |  1 +
 include/hw/misc/stm32l4x5_syscfg.h |  3 +-
 hw/arm/stm32l4x5_soc.c             | 71 +++++++++++++++++++++++-------
 hw/misc/stm32l4x5_syscfg.c         |  1 +
 hw/arm/Kconfig                     |  3 +-
 6 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/include/hw/arm/stm32l4x5_soc.h b/include/hw/arm/stm32l4x5_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/stm32l4x5_soc.h
+++ b/include/hw/arm/stm32l4x5_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/stm32l4x5_syscfg.h"
 #include "hw/misc/stm32l4x5_exti.h"
 #include "hw/misc/stm32l4x5_rcc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "qom/object.h"
 
 #define TYPE_STM32L4X5_SOC "stm32l4x5-soc"
@@ -XXX,XX +XXX,XX @@ struct Stm32l4x5SocState {
     OrIRQState exti_or_gates[NUM_EXTI_OR_GATES];
     Stm32l4x5SyscfgState syscfg;
     Stm32l4x5RccState rcc;
+    Stm32l4x5GpioState gpio[NUM_GPIOS];
 
     MemoryRegion sram1;
     MemoryRegion sram2;
diff --git a/include/hw/gpio/stm32l4x5_gpio.h b/include/hw/gpio/stm32l4x5_gpio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/gpio/stm32l4x5_gpio.h
+++ b/include/hw/gpio/stm32l4x5_gpio.h
@@ -XXX,XX +XXX,XX @@
 #define TYPE_STM32L4X5_GPIO "stm32l4x5-gpio"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5GpioState, STM32L4X5_GPIO)
 
+#define NUM_GPIOS 8
 #define GPIO_NUM_PINS 16
 
 struct Stm32l4x5GpioState {
diff --git a/include/hw/misc/stm32l4x5_syscfg.h b/include/hw/misc/stm32l4x5_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32l4x5_syscfg.h
+++ b/include/hw/misc/stm32l4x5_syscfg.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "qom/object.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define TYPE_STM32L4X5_SYSCFG "stm32l4x5-syscfg"
 OBJECT_DECLARE_SIMPLE_TYPE(Stm32l4x5SyscfgState, STM32L4X5_SYSCFG)
 
-#define NUM_GPIOS 8
-#define GPIO_NUM_PINS 16
 #define SYSCFG_NUM_EXTICR 4
 
 struct Stm32l4x5SyscfgState {
diff --git a/hw/arm/stm32l4x5_soc.c b/hw/arm/stm32l4x5_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32l4x5_soc.c
+++ b/hw/arm/stm32l4x5_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/or-irq.h"
 #include "hw/arm/stm32l4x5_soc.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 
@@ -XXX,XX +XXX,XX @@ static const int exti_or_gate1_lines_in[EXTI_OR_GATE1_NUM_LINES_IN] = {
     16, 35, 36, 37, 38,
 };
 
+static const struct {
+    uint32_t addr;
+    uint32_t moder_reset;
+    uint32_t ospeedr_reset;
+    uint32_t pupdr_reset;
+} stm32l4x5_gpio_cfg[NUM_GPIOS] = {
+    { 0x48000000, 0xABFFFFFF, 0x0C000000, 0x64000000 },
+    { 0x48000400, 0xFFFFFEBF, 0x00000000, 0x00000100 },
+    { 0x48000800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48000C00, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001000, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001400, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001800, 0xFFFFFFFF, 0x00000000, 0x00000000 },
+    { 0x48001C00, 0x0000000F, 0x00000000, 0x00000000 },
+};
+
 static void stm32l4x5_soc_initfn(Object *obj)
 {
     Stm32l4x5SocState *s = STM32L4X5_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_initfn(Object *obj)
     }
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32L4X5_SYSCFG);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32L4X5_RCC);
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("gpio%c", 'a' + i);
+        object_initialize_child(obj, name, &s->gpio[i], TYPE_STM32L4X5_GPIO);
+    }
 }
 
 static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     Stm32l4x5SocState *s = STM32L4X5_SOC(dev_soc);
     const Stm32l4x5SocClass *sc = STM32L4X5_SOC_GET_CLASS(dev_soc);
     MemoryRegion *system_memory = get_system_memory();
-    DeviceState *armv7m;
+    DeviceState *armv7m, *dev;
     SysBusDevice *busdev;
+    uint32_t pin_index;
 
     if (!memory_region_init_rom(&s->flash, OBJECT(dev_soc), "flash",
                                 sc->flash_size, errp)) {
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    /* GPIOs */
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        g_autofree char *name = g_strdup_printf("%c", 'A' + i);
+        dev = DEVICE(&s->gpio[i]);
+        qdev_prop_set_string(dev, "name", name);
+        qdev_prop_set_uint32(dev, "mode-reset",
+                             stm32l4x5_gpio_cfg[i].moder_reset);
+        qdev_prop_set_uint32(dev, "ospeed-reset",
+                             stm32l4x5_gpio_cfg[i].ospeedr_reset);
+        qdev_prop_set_uint32(dev, "pupd-reset",
+                            stm32l4x5_gpio_cfg[i].pupdr_reset);
+        busdev = SYS_BUS_DEVICE(&s->gpio[i]);
+        g_free(name);
+        name = g_strdup_printf("gpio%c-out", 'a' + i);
+        qdev_connect_clock_in(DEVICE(&s->gpio[i]), "clk",
+            qdev_get_clock_out(DEVICE(&(s->rcc)), name));
+        if (!sysbus_realize(busdev, errp)) {
+            return;
+        }
+        sysbus_mmio_map(busdev, 0, stm32l4x5_gpio_cfg[i].addr);
+    }
+
     /* System configuration controller */
     busdev = SYS_BUS_DEVICE(&s->syscfg);
     if (!sysbus_realize(busdev, errp)) {
         return;
     }
     sysbus_mmio_map(busdev, 0, SYSCFG_ADDR);
-    /*
-     * TODO: when the GPIO device is implemented, connect it
-     * to SYCFG using `qdev_connect_gpio_out`, NUM_GPIOS and
-     * GPIO_NUM_PINS.
-     */
+
+    for (unsigned i = 0; i < NUM_GPIOS; i++) {
+        for (unsigned j = 0; j < GPIO_NUM_PINS; j++) {
+            pin_index = GPIO_NUM_PINS * i + j;
+            qdev_connect_gpio_out(DEVICE(&s->gpio[i]), j,
+                                  qdev_get_gpio_in(DEVICE(&s->syscfg),
+                                  pin_index));
+        }
+    }
 
     /* EXTI device */
     busdev = SYS_BUS_DEVICE(&s->exti);
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
         }
     }
 
-    for (unsigned i = 0; i < 16; i++) {
+    for (unsigned i = 0; i < GPIO_NUM_PINS; i++) {
         qdev_connect_gpio_out(DEVICE(&s->syscfg), i,
                               qdev_get_gpio_in(DEVICE(&s->exti), i));
     }
@@ -XXX,XX +XXX,XX @@ static void stm32l4x5_soc_realize(DeviceState *dev_soc, Error **errp)
     /* RESERVED:    0x40024400, 0x7FDBC00 */
 
     /* AHB2 BUS */
-    create_unimplemented_device("GPIOA",     0x48000000, 0x400);
-    create_unimplemented_device("GPIOB",     0x48000400, 0x400);
-    create_unimplemented_device("GPIOC",     0x48000800, 0x400);
-    create_unimplemented_device("GPIOD",     0x48000C00, 0x400);
-    create_unimplemented_device("GPIOE",     0x48001000, 0x400);
-    create_unimplemented_device("GPIOF",     0x48001400, 0x400);
-    create_unimplemented_device("GPIOG",     0x48001800, 0x400);
-    create_unimplemented_device("GPIOH",     0x48001C00, 0x400);
     /* RESERVED:    0x48002000, 0x7FDBC00 */
     create_unimplemented_device("OTG_FS",    0x50000000, 0x40000);
     create_unimplemented_device("ADC",       0x50040000, 0x400);
diff --git a/hw/misc/stm32l4x5_syscfg.c b/hw/misc/stm32l4x5_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32l4x5_syscfg.c
+++ b/hw/misc/stm32l4x5_syscfg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "migration/vmstate.h"
 #include "hw/misc/stm32l4x5_syscfg.h"
+#include "hw/gpio/stm32l4x5_gpio.h"
 
 #define SYSCFG_MEMRMP 0x00
 #define SYSCFG_CFGR1 0x04
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config STM32L4X5_SOC
     bool
     select ARM_V7M
     select OR_IRQ
-    select STM32L4X5_SYSCFG
     select STM32L4X5_EXTI
+    select STM32L4X5_SYSCFG
     select STM32L4X5_RCC
+    select STM32L4X5_GPIO
 
 config XLNX_ZYNQMP_ARM
     bool
-- 
2.34.1

From: Inès Varhol <ines.varhol@telecom-paris.fr>

The testcase contains :
- `test_idr_reset_value()` :
Checks the reset values of MODER, OTYPER, PUPDR, ODR and IDR.
- `test_gpio_output_mode()` :
Checks that writing a bit in register ODR results in the corresponding
pin rising or lowering, if this pin is configured in output mode.
- `test_gpio_input_mode()` :
Checks that a input pin set high or low externally results
in the pin rising and lowering.
- `test_pull_up_pull_down()` :
Checks that a floating pin in pull-up/down mode is actually high/down.
- `test_push_pull()` :
Checks that a pin set externally is disconnected when configured in
push-pull output mode, and can't be set externally while in this mode.
- `test_open_drain()` :
Checks that a pin set externally high is disconnected when configured
in open-drain output mode, and can't be set high while in this mode.
- `test_bsrr_brr()` :
Checks that writing to BSRR and BRR has the desired result in ODR.
- `test_clock_enable()` :
Checks that GPIO clock is at the right frequency after enabling it.

Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Arnaud Minier <arnaud.minier@telecom-paris.fr>
Signed-off-by: Inès Varhol <ines.varhol@telecom-paris.fr>
Message-id: 20240305210444.310665-4-ines.varhol@telecom-paris.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/stm32l4x5_gpio-test.c | 551 ++++++++++++++++++++++++++++++
 tests/qtest/meson.build           |   3 +-
 2 files changed, 553 insertions(+), 1 deletion(-)
 create mode 100644 tests/qtest/stm32l4x5_gpio-test.c

diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for STM32L4x5_GPIO
+ *
+ * Copyright (c) 2024 Arnaud Minier <arnaud.minier@telecom-paris.fr>
+ * Copyright (c) 2024 Inès Varhol <ines.varhol@telecom-paris.fr>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+
+#define GPIO_BASE_ADDR 0x48000000
+#define GPIO_SIZE      0x400
+#define NUM_GPIOS      8
+#define NUM_GPIO_PINS  16
+
+#define GPIO_A 0x48000000
+#define GPIO_B 0x48000400
+#define GPIO_C 0x48000800
+#define GPIO_D 0x48000C00
+#define GPIO_E 0x48001000
+#define GPIO_F 0x48001400
+#define GPIO_G 0x48001800
+#define GPIO_H 0x48001C00
+
+#define MODER 0x00
+#define OTYPER 0x04
+#define PUPDR 0x0C
+#define IDR 0x10
+#define ODR 0x14
+#define BSRR 0x18
+#define BRR 0x28
+
+#define MODER_INPUT 0
+#define MODER_OUTPUT 1
+
+#define PUPDR_NONE 0
+#define PUPDR_PULLUP 1
+#define PUPDR_PULLDOWN 2
+
+#define OTYPER_PUSH_PULL 0
+#define OTYPER_OPEN_DRAIN 1
+
+const uint32_t moder_reset[NUM_GPIOS] = {
+    0xABFFFFFF,
+    0xFFFFFEBF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0xFFFFFFFF,
+    0x0000000F
+};
+
+const uint32_t pupdr_reset[NUM_GPIOS] = {
+    0x64000000,
+    0x00000100,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+const uint32_t idr_reset[NUM_GPIOS] = {
+    0x0000A000,
+    0x00000010,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000,
+    0x00000000
+};
+
+static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
+{
+    return readl(gpio + offset);
+}
+
+static void gpio_writel(unsigned int gpio, unsigned int offset, uint32_t value)
+{
+    writel(gpio + offset, value);
+}
+
+static void gpio_set_bit(unsigned int gpio, unsigned int reg,
+                         unsigned int pin, uint32_t value)
+{
+    uint32_t mask = 0xFFFFFFFF & ~(0x1 << pin);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << pin);
+}
+
+static void gpio_set_2bits(unsigned int gpio, unsigned int reg,
+                           unsigned int pin, uint32_t value)
+{
+    uint32_t offset = 2 * pin;
+    uint32_t mask = 0xFFFFFFFF & ~(0x3 << offset);
+    gpio_writel(gpio, reg, (gpio_readl(gpio, reg) & mask) | value << offset);
+}
+
+static unsigned int get_gpio_id(uint32_t gpio_addr)
+{
+    return (gpio_addr - GPIO_BASE_ADDR) / GPIO_SIZE;
+}
+
+static void gpio_set_irq(unsigned int gpio, int num, int level)
+{
+    g_autofree char *name = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    qtest_set_irq_in(global_qtest, name, NULL, num, level);
+}
+
+static void disconnect_all_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-set', 'arguments': "
+        "{ 'path': %s, 'property': 'disconnected-pins', 'value': %d } }",
+        path, 0xFFFF);
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static uint32_t get_disconnected_pins(unsigned int gpio)
+{
+    g_autofree char *path = g_strdup_printf("/machine/soc/gpio%c",
+                                            get_gpio_id(gpio) + 'a');
+    uint32_t disconnected_pins = 0;
+    QDict *r;
+
+    r = qtest_qmp(global_qtest, "{ 'execute': 'qom-get', 'arguments':"
+        " { 'path': %s, 'property': 'disconnected-pins'} }", path);
+    g_assert_false(qdict_haskey(r, "error"));
+    disconnected_pins = qdict_get_int(r, "return");
+    qobject_unref(r);
+    return disconnected_pins;
+}
+
+static uint32_t reset(uint32_t gpio, unsigned int offset)
+{
+    switch (offset) {
+    case MODER:
+        return moder_reset[get_gpio_id(gpio)];
+    case PUPDR:
+        return pupdr_reset[get_gpio_id(gpio)];
+    case IDR:
+        return idr_reset[get_gpio_id(gpio)];
+    }
+    return 0x0;
+}
+
+static void system_reset(void)
+{
+    QDict *r;
+    r = qtest_qmp(global_qtest, "{'execute': 'system_reset'}");
+    g_assert_false(qdict_haskey(r, "error"));
+    qobject_unref(r);
+}
+
+static void test_idr_reset_value(void)
+{
+    /*
+     * Checks that the values in MODER, OTYPER, PUPDR and ODR
+     * after reset are correct, and that the value in IDR is
+     * coherent.
+     * Since AF and analog modes aren't implemented, IDR reset
+     * values aren't the same as with a real board.
+     *
+     * Register IDR contains the actual values of all GPIO pins.
+     * Its value depends on the pins' configuration
+     * (intput/output/analog : register MODER, push-pull/open-drain :
+     * register OTYPER, pull-up/pull-down/none : register PUPDR)
+     * and on the values stored in register ODR
+     * (in case the pin is in output mode).
+     */
+
+    gpio_writel(GPIO_A, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_A, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_A, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_B, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_B, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_B, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_C, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_C, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_C, PUPDR, 0xDEADBEEF);
+
+    gpio_writel(GPIO_H, MODER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, ODR, 0xDEADBEEF);
+    gpio_writel(GPIO_H, OTYPER, 0xDEADBEEF);
+    gpio_writel(GPIO_H, PUPDR, 0xDEADBEEF);
+
+    system_reset();
+
+    uint32_t moder = gpio_readl(GPIO_A, MODER);
+    uint32_t odr = gpio_readl(GPIO_A, ODR);
+    uint32_t otyper = gpio_readl(GPIO_A, OTYPER);
+    uint32_t pupdr = gpio_readl(GPIO_A, PUPDR);
+    uint32_t idr = gpio_readl(GPIO_A, IDR);
+    /* 15: AF, 14: AF, 13: AF, 12: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_A, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_A, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_A, OTYPER));
+    /* 15: pull-up, 14: pull-down, 13: pull-up, 12: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_A, PUPDR));
+    /* 15 : 1, 14: 0, 13: 1, 12 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_A, IDR));
+
+    moder = gpio_readl(GPIO_B, MODER);
+    odr = gpio_readl(GPIO_B, ODR);
+    otyper = gpio_readl(GPIO_B, OTYPER);
+    pupdr = gpio_readl(GPIO_B, PUPDR);
+    idr = gpio_readl(GPIO_B, IDR);
+    /* ... 5: Analog, 4: AF, 3: AF, 2: Analog ... */
+    /* here AF is the same as Analog and Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_B, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_B, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_B, OTYPER));
+    /* ... 5: neither, 4: pull-up, 3: neither ... */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_B, PUPDR));
+    /* ... 5 : reset value, 4 : 1, 3 : reset value ... */
+    g_assert_cmphex(idr, ==, reset(GPIO_B, IDR));
+
+    moder = gpio_readl(GPIO_C, MODER);
+    odr = gpio_readl(GPIO_C, ODR);
+    otyper = gpio_readl(GPIO_C, OTYPER);
+    pupdr = gpio_readl(GPIO_C, PUPDR);
+    idr = gpio_readl(GPIO_C, IDR);
+    /* Analog, same as Input mode*/
+    g_assert_cmphex(moder, ==, reset(GPIO_C, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_C, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_C, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_C, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_C, IDR));
+
+    moder = gpio_readl(GPIO_H, MODER);
+    odr = gpio_readl(GPIO_H, ODR);
+    otyper = gpio_readl(GPIO_H, OTYPER);
+    pupdr = gpio_readl(GPIO_H, PUPDR);
+    idr = gpio_readl(GPIO_H, IDR);
+    /* Analog, same as Input mode */
+    g_assert_cmphex(moder, ==, reset(GPIO_H, MODER));
+    g_assert_cmphex(odr, ==, reset(GPIO_H, ODR));
+    g_assert_cmphex(otyper, ==, reset(GPIO_H, OTYPER));
+    /* no pull-up or pull-down */
+    g_assert_cmphex(pupdr, ==, reset(GPIO_H, PUPDR));
+    /* reset value */
+    g_assert_cmphex(idr, ==, reset(GPIO_H, IDR));
+}
+
+static void test_gpio_output_mode(const void *data)
+{
+    /*
+     * Checks that setting a bit in ODR sets the corresponding
+     * GPIO line high : it should set the right bit in IDR
+     * and send an irq to syscfg.
+     * Additionally, it checks that values written to ODR
+     * when not in output mode are stored and not discarded.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Set a bit in ODR and check nothing happens */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the relevant line as output and check the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Reset the bit in ODR and check the pin is low */
+    gpio_set_bit(gpio, ODR, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+}
+
+static void test_gpio_input_mode(const void *data)
+{
+    /*
+     * Test that setting a line high/low externally sets the
+     * corresponding GPIO line high/low : it should set the
+     * right bit in IDR and send an irq to syscfg.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input, raise it, and check that the pin is high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Lower the line and check that the pin is low */
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    disconnect_all_pins(gpio);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_pull_up_pull_down(const void *data)
+{
+    /*
+     * Test that a floating pin with pull-up sets the pin
+     * high and vice-versa.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int gpio_id = get_gpio_id(gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Configure a line as input with pull-up, check the line is set high */
+    gpio_set_2bits(gpio, MODER, pin, MODER_INPUT);
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLUP);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) | (1 << pin));
+    g_assert_true(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Configure the line with pull-down, check the line is low */
+    gpio_set_2bits(gpio, PUPDR, pin, PUPDR_PULLDOWN);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+    g_assert_false(get_irq(gpio_id * NUM_GPIO_PINS + pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio, PUPDR, reset(gpio, PUPDR));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_push_pull(const void *data)
+{
+    /*
+     * Test that configuring a line in push-pull output mode
+     * disconnects the pin, that the pin can't be set or reset
+     * externally afterwards.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in push-pull output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Trying to set a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a push-pull output pin, checking it doesn't work */
+    gpio_set_irq(gpio2, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR) | (1 << pin));
+
+    /* Clean the test */
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+}
+
+static void test_open_drain(const void *data)
+{
+    /*
+     * Test that configuring a line in open-drain output mode
+     * disconnects a pin set high externally and that the pin
+     * can't be set high externally while configured in open-drain.
+     *
+     * However a pin set low externally shouldn't be disconnected,
+     * and it can be set low externally when in open-drain mode.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+    uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
+
+    qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
+
+    /* Setting a line high externally, configuring it in open-drain output */
+    /* And checking the pin was disconnected */
+    gpio_set_irq(gpio, pin, 1);
+    gpio_set_bit(gpio, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Setting a line low externally, configuring it in open-drain output */
+    /* And checking the pin wasn't disconnected */
+    gpio_set_irq(gpio2, pin, 0);
+    gpio_set_bit(gpio2, ODR, pin, 1);
+    gpio_set_bit(gpio2, OTYPER, pin, OTYPER_OPEN_DRAIN);
+    gpio_set_2bits(gpio2, MODER, pin, MODER_OUTPUT);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Trying to set a open-drain output pin, checking it doesn't work */
+    gpio_set_irq(gpio, pin, 1);
+    g_assert_cmphex(get_disconnected_pins(gpio), ==, 0xFFFF);
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR) & ~(1 << pin));
+
+    /* Trying to reset a open-drain output pin, checking it works */
+    gpio_set_bit(gpio, ODR, pin, 1);
+    gpio_set_irq(gpio, pin, 0);
+    g_assert_cmphex(get_disconnected_pins(gpio2), ==, 0xFFFF & ~(1 << pin));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==,
+                               reset(gpio2, IDR) & ~(1 << pin));
+
+    /* Clean the test */
+    disconnect_all_pins(gpio2);
+    gpio_writel(gpio2, OTYPER, reset(gpio2, OTYPER));
+    gpio_writel(gpio2, ODR, reset(gpio2, ODR));
+    gpio_writel(gpio2, MODER, reset(gpio2, MODER));
+    g_assert_cmphex(gpio_readl(gpio2, IDR), ==, reset(gpio2, IDR));
+    disconnect_all_pins(gpio);
+    gpio_writel(gpio, OTYPER, reset(gpio, OTYPER));
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+    gpio_writel(gpio, MODER, reset(gpio, MODER));
+    g_assert_cmphex(gpio_readl(gpio, IDR), ==, reset(gpio, IDR));
+}
+
+static void test_bsrr_brr(const void *data)
+{
+    /*
+     * Test that writing a '1' in BSS and BSRR
+     * has the desired effect on ODR.
+     * In BSRR, BSx has priority over BRx.
+     */
+    unsigned int pin = ((uint64_t)data) & 0xF;
+    uint32_t gpio = ((uint64_t)data) >> 32;
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BSRR, (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, BSRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    /* BSx should have priority over BRx */
+    gpio_writel(gpio, BSRR, (1 << pin) | (1 << (pin + NUM_GPIO_PINS)));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
+
+    gpio_writel(gpio, BRR, (1 << pin));
+    g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR));
+
+    gpio_writel(gpio, ODR, reset(gpio, ODR));
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    g_test_set_nonfatal_assertions();
+    qtest_add_func("stm32l4x5/gpio/test_idr_reset_value",
+                   test_idr_reset_value);
+    /*
+     * The inputs for the tests (gpio and pin) can be changed,
+     * but the tests don't work for pins that are high at reset
+     * (GPIOA15, GPIO13 and GPIOB5).
+     * Specifically, rising the pin then checking `get_irq()`
+     * is problematic since the pin was already high.
+     */
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
+                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_gpio_output_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
+                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
+                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_gpio_input_mode);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
+                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
+                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_pull_up_pull_down);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
+                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
+                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_push_pull);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
+                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
+                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_open_drain);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
+                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_bsrr_brr);
+    qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
+                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_bsrr_brr);
+
+    qtest_start("-machine b-l475e-iot01a");
+    ret = g_test_run();
+    qtest_end();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aspeed = \
 qtests_stm32l4x5 = \
   ['stm32l4x5_exti-test',
    'stm32l4x5_syscfg-test',
-   'stm32l4x5_rcc-test']
+   'stm32l4x5_rcc-test',
+   'stm32l4x5_gpio-test']
 
 qtests_arm = \
   (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While the 8-bit input elements are sequential in the input vector,
the 32-bit output elements are not sequential in the output matrix.
Do not attempt to compute 2 32-bit outputs at the same time.

Cc: qemu-stable@nongnu.org
Fixes: 23a5e3859f5 ("target/arm: Implement SME integer outer product")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2083
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240305163931.242795-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sme_helper.c       | 77 ++++++++++++++++++-------------
 tests/tcg/aarch64/sme-smopa-1.c   | 47 +++++++++++++++++++
 tests/tcg/aarch64/sme-smopa-2.c   | 54 ++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 4 files changed, 147 insertions(+), 33 deletions(-)
 create mode 100644 tests/tcg/aarch64/sme-smopa-1.c
 create mode 100644 tests/tcg/aarch64/sme-smopa-2.c

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_bfmopa)(void *vza, void *vzn, void *vzm, void *vpn,
     }
 }
 
-typedef uint64_t IMOPFn(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+typedef uint32_t IMOPFn32(uint32_t, uint32_t, uint32_t, uint8_t, bool);
+static inline void do_imopa_s(uint32_t *za, uint32_t *zn, uint32_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn32 *fn)
+{
+    intptr_t row, col, oprsz = simd_oprsz(desc) / 4;
+    bool neg = simd_data(desc);
 
-static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
-                            uint8_t *pn, uint8_t *pm,
-                            uint32_t desc, IMOPFn *fn)
+    for (row = 0; row < oprsz; ++row) {
+        uint8_t pa = (pn[H1(row >> 1)] >> ((row & 1) * 4)) & 0xf;
+        uint32_t *za_row = &za[tile_vslice_index(row)];
+        uint32_t n = zn[H4(row)];
+
+        for (col = 0; col < oprsz; ++col) {
+            uint8_t pb = pm[H1(col >> 1)] >> ((col & 1) * 4);
+            uint32_t *a = &za_row[H4(col)];
+
+            *a = fn(n, zm[H4(col)], *a, pa & pb, neg);
+        }
+    }
+}
+
+typedef uint64_t IMOPFn64(uint64_t, uint64_t, uint64_t, uint8_t, bool);
+static inline void do_imopa_d(uint64_t *za, uint64_t *zn, uint64_t *zm,
+                              uint8_t *pn, uint8_t *pm,
+                              uint32_t desc, IMOPFn64 *fn)
 {
     intptr_t row, col, oprsz = simd_oprsz(desc) / 8;
     bool neg = simd_data(desc);
@@ -XXX,XX +XXX,XX @@ static inline void do_imopa(uint64_t *za, uint64_t *zn, uint64_t *zm,
 }
 
 #define DEF_IMOP_32(NAME, NTYPE, MTYPE) \
-static uint64_t NAME(uint64_t n, uint64_t m, uint64_t a, uint8_t p, bool neg) \
+static uint32_t NAME(uint32_t n, uint32_t m, uint32_t a, uint8_t p, bool neg) \
 {                                                                           \
-    uint32_t sum0 = 0, sum1 = 0;                                            \
+    uint32_t sum = 0;                                                       \
     /* Apply P to N as a mask, making the inactive elements 0. */           \
     n &= expand_pred_b(p);                                                  \
-    sum0 += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                              \
-    sum0 += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                              \
-    sum0 += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                            \
-    sum0 += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                            \
-    sum1 += (NTYPE)(n >> 32) * (MTYPE)(m >> 32);                            \
-    sum1 += (NTYPE)(n >> 40) * (MTYPE)(m >> 40);                            \
-    sum1 += (NTYPE)(n >> 48) * (MTYPE)(m >> 48);                            \
-    sum1 += (NTYPE)(n >> 56) * (MTYPE)(m >> 56);                            \
-    if (neg) {                                                              \
-        sum0 = (uint32_t)a - sum0, sum1 = (uint32_t)(a >> 32) - sum1;       \
-    } else {                                                                \
-        sum0 = (uint32_t)a + sum0, sum1 = (uint32_t)(a >> 32) + sum1;       \
-    }                                                                       \
-    return ((uint64_t)sum1 << 32) | sum0;                                   \
+    sum += (NTYPE)(n >> 0) * (MTYPE)(m >> 0);                               \
+    sum += (NTYPE)(n >> 8) * (MTYPE)(m >> 8);                               \
+    sum += (NTYPE)(n >> 16) * (MTYPE)(m >> 16);                             \
+    sum += (NTYPE)(n >> 24) * (MTYPE)(m >> 24);                             \
+    return neg ? a - sum : a + sum;                                         \
 }
 
 #define DEF_IMOP_64(NAME, NTYPE, MTYPE) \
@@ -XXX,XX +XXX,XX @@ DEF_IMOP_64(umopa_d, uint16_t, uint16_t)
 DEF_IMOP_64(sumopa_d, int16_t, uint16_t)
 DEF_IMOP_64(usmopa_d, uint16_t, int16_t)
 
-#define DEF_IMOPH(NAME) \
-    void HELPER(sme_##NAME)(void *vza, void *vzn, void *vzm, void *vpn,      \
-                            void *vpm, uint32_t desc)                        \
-    { do_imopa(vza, vzn, vzm, vpn, vpm, desc, NAME); }
+#define DEF_IMOPH(NAME, S) \
+    void HELPER(sme_##NAME##_##S)(void *vza, void *vzn, void *vzm,          \
+                                  void *vpn, void *vpm, uint32_t desc)      \
+    { do_imopa_##S(vza, vzn, vzm, vpn, vpm, desc, NAME##_##S); }
 
-DEF_IMOPH(smopa_s)
-DEF_IMOPH(umopa_s)
-DEF_IMOPH(sumopa_s)
-DEF_IMOPH(usmopa_s)
-DEF_IMOPH(smopa_d)
-DEF_IMOPH(umopa_d)
-DEF_IMOPH(sumopa_d)
-DEF_IMOPH(usmopa_d)
+DEF_IMOPH(smopa, s)
+DEF_IMOPH(umopa, s)
+DEF_IMOPH(sumopa, s)
+DEF_IMOPH(usmopa, s)
+
+DEF_IMOPH(smopa, d)
+DEF_IMOPH(umopa, d)
+DEF_IMOPH(sumopa, d)
+DEF_IMOPH(usmopa, d)
diff --git a/tests/tcg/aarch64/sme-smopa-1.c b/tests/tcg/aarch64/sme-smopa-1.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-1.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const int cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    int dst[4][4];
+    int *tmp = &dst[0][0];
+
+    asm volatile(
+        ".arch armv8-r+sme\n\t"
+        "smstart\n\t"
+        "index z0.b, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.b, z1.b, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.s, p0/m, p0/m, z0.b, z1.b\n\t"
+        "ptrue p0.s, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1w { za0h.s[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #1] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #2] }, p0, [%0]\n\t"
+        "add %0, %0, #16\n\t"
+        "st1w { za0h.s[w12, #3] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6d", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/sme-smopa-2.c b/tests/tcg/aarch64/sme-smopa-2.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/sme-smopa-2.c
@@ -XXX,XX +XXX,XX @@
+#include <stdio.h>
+#include <string.h>
+
+int main()
+{
+    static const long cmp[4][4] = {
+        {  110,  134,  158,  182 },
+        {  390,  478,  566,  654 },
+        {  670,  822,  974, 1126 },
+        {  950, 1166, 1382, 1598 }
+    };
+    long dst[4][4];
+    long *tmp = &dst[0][0];
+    long svl;
+
+    /* Validate that we have a wide enough vector for 4 elements. */
+    asm(".arch armv8-r+sme-i64\n\trdsvl %0, #1" : "=r"(svl));
+    if (svl < 32) {
+        return 0;
+    }
+
+    asm volatile(
+        "smstart\n\t"
+        "index z0.h, #0, #1\n\t"
+        "movprfx z1, z0\n\t"
+        "add z1.h, z1.h, #16\n\t"
+        "ptrue p0.b\n\t"
+        "smopa za0.d, p0/m, p0/m, z0.h, z1.h\n\t"
+        "ptrue p0.d, vl4\n\t"
+        "mov w12, #0\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "mov w12, #2\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #0] }, p0, [%0]\n\t"
+        "add %0, %0, #32\n\t"
+        "st1d { za0h.d[w12, #1] }, p0, [%0]\n\t"
+        "smstop"
+        : "+r"(tmp) : : "memory");
+
+    if (memcmp(cmp, dst, sizeof(dst)) == 0) {
+        return 0;
+    }
+
+    /* See above for correct results. */
+    for (int i = 0; i < 4; ++i) {
+        for (int j = 0; j < 4; ++j) {
+            printf("%6ld", dst[i][j]);
+        }
+        printf("\n");
+    }
+    return 1;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ endif
 
 # SME Tests
 ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
-AARCH64_TESTS += sme-outprod1
+AARCH64_TESTS += sme-outprod1 sme-smopa-1 sme-smopa-2
 endif
 
 # System Registers Tests
-- 
2.34.1

The sun4v RTC device model added under commit a0e893039cf2ce0 in 2016
was unfortunately added with a license of GPL-v3-or-later, which is
not compatible with other QEMU code which has a GPL-v2-only license.

Relicense the code in the .c and the .h file to GPL-v2-or-later,
to make it compatible with the rest of QEMU.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini (for Red Hat) <pbonzini@redhat.com>
Signed-off-by: Artyom Tarasenko <atar4qemu@gmail.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20240223161300.938542-1-peter.maydell@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/rtc/sun4v-rtc.h | 2 +-
 hw/rtc/sun4v-rtc.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/rtc/sun4v-rtc.h b/include/hw/rtc/sun4v-rtc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/rtc/sun4v-rtc.h
+++ b/include/hw/rtc/sun4v-rtc.h
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
diff --git a/hw/rtc/sun4v-rtc.c b/hw/rtc/sun4v-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/sun4v-rtc.c
+++ b/hw/rtc/sun4v-rtc.c
@@ -XXX,XX +XXX,XX @@
  *
  * Copyright (c) 2016 Artyom Tarasenko
  *
- * This code is licensed under the GNU GPL v3 or (at your option) any later
+ * This code is licensed under the GNU GPL v2 or (at your option) any later
  * version.
  */
 
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

Move the code to a separate file so that we do not have to compile
it anymore if CONFIG_ARM_V7M is not set.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240308141051.536599-2-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu-v7m.c   | 290 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu32.c     | 261 ---------------------------------
 target/arm/meson.build     |   3 +
 target/arm/tcg/meson.build |   3 +
 4 files changed, 296 insertions(+), 261 deletions(-)
 create mode 100644 target/arm/tcg/cpu-v7m.c

diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/tcg/cpu-v7m.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU ARMv7-M TCG-only CPUs.
+ *
+ * Copyright (c) 2012 SUSE LINUX Products GmbH
+ *
+ * This code is licensed under the GNU GPL v2 or later.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "hw/core/tcg-cpu-ops.h"
+#include "internals.h"
+
+#if !defined(CONFIG_USER_ONLY)
+
+#include "hw/intc/armv7m_nvic.h"
+
+static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUClass *cc = CPU_GET_CLASS(cs);
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    bool ret = false;
+
+    /*
+     * ARMv7-M interrupt masking works differently than -A or -R.
+     * There is no FIQ/IRQ distinction. Instead of I and F bits
+     * masking FIQ and IRQ interrupts, an exception is taken only
+     * if it is higher priority than the current execution priority
+     * (which depends on state like BASEPRI, FAULTMASK and the
+     * currently active exception).
+     */
+    if (interrupt_request & CPU_INTERRUPT_HARD
+        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
+        cs->exception_index = EXCP_IRQ;
+        cc->tcg_ops->do_interrupt(cs);
+        ret = true;
+    }
+    return ret;
+}
+
+#endif /* !CONFIG_USER_ONLY */
+
+static void cortex_m0_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V6);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+
+    cpu->midr = 0x410cc200;
+
+    /*
+     * These ID register values are not guest visible, because
+     * we do not implement the Main Extension. They must be set
+     * to values corresponding to the Cortex-M0's implemented
+     * features, because QEMU generally controls its emulation
+     * by looking at ID register fields. We use the same values as
+     * for the M3.
+     */
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m3_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    cpu->midr = 0x410fc231;
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m4_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fc240; /* r0p0 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000000;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00000030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x00000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01141110;
+    cpu->isar.id_isar1 = 0x02111000;
+    cpu->isar.id_isar2 = 0x21112231;
+    cpu->isar.id_isar3 = 0x01111110;
+    cpu->isar.id_isar4 = 0x01310102;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m7_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V7);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x411fc272; /* r1p2 */
+    cpu->pmsav7_dregion = 8;
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000200;
+    cpu->isar.id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00100030;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02112000;
+    cpu->isar.id_isar2 = 0x20232231;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+}
+
+static void cortex_m33_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd213; /* r0p3 */
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    cpu->isar.mvfr0 = 0x10110021;
+    cpu->isar.mvfr1 = 0x11000011;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x00000030;
+    cpu->isar.id_pfr1 = 0x00000210;
+    cpu->isar.id_dfr0 = 0x00200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00101F40;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000000;
+    cpu->isar.id_isar0 = 0x01101110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000;
+    cpu->ctr = 0x8000c000;
+}
+
+static void cortex_m55_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+    set_feature(&cpu->env, ARM_FEATURE_M);
+    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+    cpu->midr = 0x410fd221; /* r0p1 */
+    cpu->revidr = 0;
+    cpu->pmsav7_dregion = 16;
+    cpu->sau_sregion = 8;
+    /* These are the MVFR* values for the FPU + full MVE configuration */
+    cpu->isar.mvfr0 = 0x10110221;
+    cpu->isar.mvfr1 = 0x12100211;
+    cpu->isar.mvfr2 = 0x00000040;
+    cpu->isar.id_pfr0 = 0x20000030;
+    cpu->isar.id_pfr1 = 0x00000230;
+    cpu->isar.id_dfr0 = 0x10200000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x00111040;
+    cpu->isar.id_mmfr1 = 0x00000000;
+    cpu->isar.id_mmfr2 = 0x01000000;
+    cpu->isar.id_mmfr3 = 0x00000011;
+    cpu->isar.id_isar0 = 0x01103110;
+    cpu->isar.id_isar1 = 0x02212000;
+    cpu->isar.id_isar2 = 0x20232232;
+    cpu->isar.id_isar3 = 0x01111131;
+    cpu->isar.id_isar4 = 0x01310132;
+    cpu->isar.id_isar5 = 0x00000000;
+    cpu->isar.id_isar6 = 0x00000000;
+    cpu->clidr = 0x00000000; /* caches not implemented */
+    cpu->ctr = 0x8303c003;
+}
+
+static const TCGCPUOps arm_v7m_tcg_ops = {
+    .initialize = arm_translate_init,
+    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
+    .debug_excp_handler = arm_debug_excp_handler,
+    .restore_state_to_opc = arm_restore_state_to_opc,
+
+#ifdef CONFIG_USER_ONLY
+    .record_sigsegv = arm_cpu_record_sigsegv,
+    .record_sigbus = arm_cpu_record_sigbus,
+#else
+    .tlb_fill = arm_cpu_tlb_fill,
+    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
+    .do_interrupt = arm_v7m_cpu_do_interrupt,
+    .do_transaction_failed = arm_cpu_do_transaction_failed,
+    .do_unaligned_access = arm_cpu_do_unaligned_access,
+    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
+    .debug_check_watchpoint = arm_debug_check_watchpoint,
+    .debug_check_breakpoint = arm_debug_check_breakpoint,
+#endif /* !CONFIG_USER_ONLY */
+};
+
+static void arm_v7m_class_init(ObjectClass *oc, void *data)
+{
+    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
+
+    acc->info = data;
+    cc->tcg_ops = &arm_v7m_tcg_ops;
+    cc->gdb_core_xml_file = "arm-m-profile.xml";
+}
+
+static const ARMCPUInfo arm_v7m_cpus[] = {
+    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
+                             .class_init = arm_v7m_class_init },
+    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
+                             .class_init = arm_v7m_class_init },
+};
+
+static void arm_v7m_cpu_register_types(void)
+{
+    size_t i;
+
+    for (i = 0; i < ARRAY_SIZE(arm_v7m_cpus); ++i) {
+        arm_cpu_register(&arm_v7m_cpus[i]);
+    }
+}
+
+type_init(arm_v7m_cpu_register_types)
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
-#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
-#include "hw/intc/armv7m_nvic.h"
-#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-#if !defined(CONFIG_USER_ONLY)
-static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUClass *cc = CPU_GET_CLASS(cs);
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
-    bool ret = false;
-
-    /*
-     * ARMv7-M interrupt masking works differently than -A or -R.
-     * There is no FIQ/IRQ distinction. Instead of I and F bits
-     * masking FIQ and IRQ interrupts, an exception is taken only
-     * if it is higher priority than the current execution priority
-     * (which depends on state like BASEPRI, FAULTMASK and the
-     * currently active exception).
-     */
-    if (interrupt_request & CPU_INTERRUPT_HARD
-        && (armv7m_nvic_can_take_pending_exception(env->nvic))) {
-        cs->exception_index = EXCP_IRQ;
-        cc->tcg_ops->do_interrupt(cs);
-        ret = true;
-    }
-    return ret;
-}
-#endif /* !CONFIG_USER_ONLY */
-
 static void arm926_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
-static void cortex_m0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-
-    cpu->midr = 0x410cc200;
-
-    /*
-     * These ID register values are not guest visible, because
-     * we do not implement the Main Extension. They must be set
-     * to values corresponding to the Cortex-M0's implemented
-     * features, because QEMU generally controls its emulation
-     * by looking at ID register fields. We use the same values as
-     * for the M3.
-     */
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m3_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    cpu->midr = 0x410fc231;
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m4_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fc240; /* r0p0 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000000;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00000030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x00000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01141110;
-    cpu->isar.id_isar1 = 0x02111000;
-    cpu->isar.id_isar2 = 0x21112231;
-    cpu->isar.id_isar3 = 0x01111110;
-    cpu->isar.id_isar4 = 0x01310102;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m7_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x411fc272; /* r1p2 */
-    cpu->pmsav7_dregion = 8;
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000200;
-    cpu->isar.id_dfr0 = 0x00100000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00100030;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02112000;
-    cpu->isar.id_isar2 = 0x20232231;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-}
-
-static void cortex_m33_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd213; /* r0p3 */
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    cpu->isar.mvfr0 = 0x10110021;
-    cpu->isar.mvfr1 = 0x11000011;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x00000030;
-    cpu->isar.id_pfr1 = 0x00000210;
-    cpu->isar.id_dfr0 = 0x00200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00101F40;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000000;
-    cpu->isar.id_isar0 = 0x01101110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000;
-    cpu->ctr = 0x8000c000;
-}
-
-static void cortex_m55_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_V8_1M);
-    set_feature(&cpu->env, ARM_FEATURE_M);
-    set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-    set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-    set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    cpu->midr = 0x410fd221; /* r0p1 */
-    cpu->revidr = 0;
-    cpu->pmsav7_dregion = 16;
-    cpu->sau_sregion = 8;
-    /* These are the MVFR* values for the FPU + full MVE configuration */
-    cpu->isar.mvfr0 = 0x10110221;
-    cpu->isar.mvfr1 = 0x12100211;
-    cpu->isar.mvfr2 = 0x00000040;
-    cpu->isar.id_pfr0 = 0x20000030;
-    cpu->isar.id_pfr1 = 0x00000230;
-    cpu->isar.id_dfr0 = 0x10200000;
-    cpu->id_afr0 = 0x00000000;
-    cpu->isar.id_mmfr0 = 0x00111040;
-    cpu->isar.id_mmfr1 = 0x00000000;
-    cpu->isar.id_mmfr2 = 0x01000000;
-    cpu->isar.id_mmfr3 = 0x00000011;
-    cpu->isar.id_isar0 = 0x01103110;
-    cpu->isar.id_isar1 = 0x02212000;
-    cpu->isar.id_isar2 = 0x20232232;
-    cpu->isar.id_isar3 = 0x01111131;
-    cpu->isar.id_isar4 = 0x01310132;
-    cpu->isar.id_isar5 = 0x00000000;
-    cpu->isar.id_isar6 = 0x00000000;
-    cpu->clidr = 0x00000000; /* caches not implemented */
-    cpu->ctr = 0x8303c003;
-}
-
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
     { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
@@ -XXX,XX +XXX,XX @@ static void pxa270c5_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000078;
 }
 
-static const TCGCPUOps arm_v7m_tcg_ops = {
-    .initialize = arm_translate_init,
-    .synchronize_from_tb = arm_cpu_synchronize_from_tb,
-    .debug_excp_handler = arm_debug_excp_handler,
-    .restore_state_to_opc = arm_restore_state_to_opc,
-
-#ifdef CONFIG_USER_ONLY
-    .record_sigsegv = arm_cpu_record_sigsegv,
-    .record_sigbus = arm_cpu_record_sigbus,
-#else
-    .tlb_fill = arm_cpu_tlb_fill,
-    .cpu_exec_interrupt = arm_v7m_cpu_exec_interrupt,
-    .do_interrupt = arm_v7m_cpu_do_interrupt,
-    .do_transaction_failed = arm_cpu_do_transaction_failed,
-    .do_unaligned_access = arm_cpu_do_unaligned_access,
-    .adjust_watchpoint_address = arm_adjust_watchpoint_address,
-    .debug_check_watchpoint = arm_debug_check_watchpoint,
-    .debug_check_breakpoint = arm_debug_check_breakpoint,
-#endif /* !CONFIG_USER_ONLY */
-};
-
-static void arm_v7m_class_init(ObjectClass *oc, void *data)
-{
-    ARMCPUClass *acc = ARM_CPU_CLASS(oc);
-    CPUClass *cc = CPU_CLASS(oc);
-
-    acc->info = data;
-    cc->tcg_ops = &arm_v7m_tcg_ops;
-    cc->gdb_core_xml_file = "arm-m-profile.xml";
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "cortex-a8",   .initfn = cortex_a8_initfn },
     { .name = "cortex-a9",   .initfn = cortex_a9_initfn },
     { .name = "cortex-a15",  .initfn = cortex_a15_initfn },
-    { .name = "cortex-m0",   .initfn = cortex_m0_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m3",   .initfn = cortex_m3_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m4",   .initfn = cortex_m4_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m7",   .initfn = cortex_m7_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m33",  .initfn = cortex_m33_initfn,
-                             .class_init = arm_v7m_class_init },
-    { .name = "cortex-m55",  .initfn = cortex_m55_initfn,
-                             .class_init = arm_v7m_class_init },
     { .name = "cortex-r5",   .initfn = cortex_r5_initfn },
     { .name = "cortex-r5f",  .initfn = cortex_r5f_initfn },
     { .name = "cortex-r52",  .initfn = cortex_r52_initfn },
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_system_ss.add(files(
   'ptw.c',
 ))
 
+arm_user_ss = ss.source_set()
+
 subdir('hvf')
 
 if 'CONFIG_TCG' in config_all_accel
@@ -XXX,XX +XXX,XX @@ endif
 
 target_arch += {'arm': arm_ss}
 target_system_arch += {'arm': arm_system_ss}
+target_user_arch += {'arm': arm_user_ss}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
 arm_system_ss.add(files(
   'psci.c',
 ))
+
+arm_system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('cpu-v7m.c'))
+arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files('cpu-v7m.c'))
-- 
2.34.1