Series comparison

-[Qemu-devel] [PULL 00/21] target-arm queue
+[PULL 00/21] target-arm queue
-Arm queue built up to a point where it seems worth sending:
+The following changes since commit f003dd8d81f7d88f4b1f8802309eaa76f6eb223a:
 various bug fixes, plus RTH's refactoring in preparation for SVE.
-thanks
+  Merge tag 'pull-tcg-20230305' of https://gitlab.com/rth7680/qemu into staging (2023-03-06 10:20:04 +0000)
 -- PMM
 The following changes since commit 0f79bfe38a2cf0f43c7ea4959da7f8ebd7858f3d:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging (2018-01-25 09:53:53 +0000)
+are available in the Git repository at:
-are available in the git repository at:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230306
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180125
+for you to fetch changes up to 2ddc45954f97cd1d7ee5cbca0def05e980d1da9f:
-for you to fetch changes up to 24da047af0e99a83fcc0d50b86c0f2627f7418b3:
+  hw: arm: allwinner-h3: Fix and complete H3 i2c devices (2023-03-06 15:31:24 +0000)
   pl110: Implement vertical compare/next base interrupts (2018-01-25 11:45:30 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * target/arm: Fix address truncation in 64-bit pagetable walks
+ * allwinner-h3: Fix I2C controller model for Sun6i SoCs
- * i.MX: Fix FEC/ENET receive functions
+ * allwinner-h3: Add missing i2c controllers
- * target/arm: preparatory refactoring for SVE emulation
+ * Expose M-profile system registers to gdbstub
- * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
+ * Expose pauth information to gdbstub
- * hw/intc/arm_gic: Fix C_RPR value on idle priority
+ * Support direct boot for Linux/arm64 EFI zboot images
- * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
+ * Fix incorrect stage 2 MMU setup validation
  * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
  * hw/arm/virt: Check that the CPU realize method succeeded
  * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object
  * xilinx_spips: Correct usage of an uninitialized local variable
  * pl110: Implement vertical compare/next base interrupts
 ----------------------------------------------------------------
 Ard Biesheuvel (1):
-      target/arm: Fix 32-bit address truncation
+      hw: arm: Support direct boot for Linux/arm64 EFI zboot images
-Francisco Iglesias (1):
+David Reiss (2):
-      xilinx_spips: Correct usage of an uninitialized local variable
+      target/arm: Export arm_v7m_mrs_control
       target/arm: Export arm_v7m_get_sp_ptr
-Jean-Christophe Dubois (1):
+Richard Henderson (16):
-      i.MX: Fix FEC/ENET receive funtions
+      target/arm: Normalize aarch64 gdbstub get/set function names
       target/arm: Unexport arm_gen_dynamic_sysreg_xml
       target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
       target/arm: Split out output_vector_union_type
       target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
       target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
       target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
       target/arm: Add name argument to output_vector_union_type
       target/arm: Simplify iteration over bit widths
       target/arm: Create pauth_ptr_mask
       target/arm: Implement gdbstub pauth extension
       target/arm: Implement gdbstub m-profile systemreg and secext
       target/arm: Handle m-profile in arm_is_secure
       target/arm: Stub arm_hcr_el2_eff for m-profile
       target/arm: Diagnose incorrect usage of arm_is_secure subroutines
       target/arm: Rewrite check_s2_mmu_setup
-Linus Walleij (1):
+qianfan Zhao (2):
-      pl110: Implement vertical compare/next base interrupts
+      hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
       hw: arm: allwinner-h3: Fix and complete H3 i2c devices
-Luc MICHEL (4):
+ configs/targets/aarch64-linux-user.mak    |   2 +-
-      hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
+ configs/targets/aarch64-softmmu.mak       |   2 +-
-      hw/intc/arm_gic: Fix C_RPR value on idle priority
+ configs/targets/aarch64_be-linux-user.mak |   2 +-
-      hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
+ include/hw/arm/allwinner-h3.h             |   6 +
-      hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
+ include/hw/i2c/allwinner-i2c.h            |   6 +
+ include/hw/loader.h                       |  19 ++
-Peter Maydell (1):
+ target/arm/cpu.h                          |  17 +-
-      hw/arm/virt: Check that the CPU realize method succeeded
+ target/arm/internals.h                    |  34 +++-
+ hw/arm/allwinner-h3.c                     |  29 +++-
-Philippe Mathieu-Daudé (1):
+ hw/arm/boot.c                             |   6 +
-      sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object
+ hw/core/loader.c                          |  91 ++++++++++
+ hw/i2c/allwinner-i2c.c                    |  26 ++-
-Richard Henderson (11):
+ target/arm/gdbstub.c                      | 278 ++++++++++++++++++------------
-      target/arm: Mark disas_set_insn_syndrome inline
+ target/arm/gdbstub64.c                    | 175 ++++++++++++++++++-
-      target/arm: Use pointers in crypto helpers
+ target/arm/helper.c                       |   3 +
-      target/arm: Use pointers in neon zip/uzp helpers
+ target/arm/ptw.c                          | 173 +++++++++++--------
-      target/arm: Use pointers in neon tbl helper
+ target/arm/tcg/m_helper.c                 |  90 +++++-----
-      target/arm: Change the type of vfp.regs
+ target/arm/tcg/pauth_helper.c             |  26 ++-
-      target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
+ gdb-xml/aarch64-pauth.xml                 |  15 ++
-      vmstate: Add VMSTATE_UINT64_SUB_ARRAY
+files changed, 742 insertions(+), 258 deletions(-)
-      target/arm: Add ARM_FEATURE_SVE
+ create mode 100644 gdb-xml/aarch64-pauth.xml
       target/arm: Move cpu_get_tb_cpu_state out of line
       target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
       target/arm: Simplify fp_exception_el for user-only
  include/hw/sd/sdhci.h       |   1 +
  include/migration/vmstate.h |   9 ++-
  target/arm/cpu.h            | 157 ++++++++-----------------------------
  target/arm/helper.h         |  46 +++++------
  target/arm/translate.h      |   2 +-
  hw/arm/virt.c               |   2 +-
  hw/display/pl110.c          |  30 +++++++-
  hw/intc/arm_gic.c           |  25 +++++-
  hw/net/imx_fec.c            |   8 +-
  hw/sd/sdhci.c               |   1 +
  hw/ssi/xilinx_spips.c       |  18 ++++-
  linux-user/signal.c         |  22 +++---
  target/arm/arch_dump.c      |   8 +-
  target/arm/crypto_helper.c  | 184 +++++++++++++++++---------------------------
  target/arm/helper-a64.c     |   5 +-
  target/arm/helper.c         | 164 +++++++++++++++++++++++++++++++++++----
  target/arm/kvm32.c          |   4 +-
  target/arm/kvm64.c          |  31 +++-----
  target/arm/machine.c        |   2 +-
  target/arm/neon_helper.c    | 162 ++++++++++++++++++++------------------
  target/arm/op_helper.c      |  17 ++--
  target/arm/translate-a64.c  | 100 ++++++++++++------------
  target/arm/translate.c      | 134 +++++++++++++++++---------------
 files changed, 607 insertions(+), 525 deletions(-)

-[Qemu-devel] [PULL 05/21] target/arm: Use pointers in neon zip/uzp helpers
+[PULL 01/21] target/arm: Normalize aarch64 gdbstub get/set function names
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than passing regnos to the helpers, pass pointers to the
+Make the form of the function names between fp and sve the same:
-vector registers directly.  This eliminates the need to pass in
+  - arm_gdb_*_svereg -> aarch64_gdb_*_sve_reg.
-the environment pointer and reduces the number of places that
+  - aarch64_fpu_gdb_*_reg -> aarch64_gdb_*_fpu_reg.
 directly access env->vfp.regs[].
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230227213329.793795-2-richard.henderson@linaro.org
 Message-id: 20180119045438.28582-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h      |  20 +++---
+ target/arm/internals.h | 8 ++++----
- target/arm/neon_helper.c | 162 +++++++++++++++++++++++++----------------------
+ target/arm/gdbstub.c   | 9 +++++----
- target/arm/translate.c   |  42 ++++++------
+ target/arm/gdbstub64.c | 8 ++++----
-files changed, 120 insertions(+), 104 deletions(-)
+files changed, 13 insertions(+), 12 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/internals.h
-+++ b/target/arm/helper.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
- DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
+ }
- DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
+ #ifdef TARGET_AARCH64
--DEF_HELPER_3(neon_unzip8, void, env, i32, i32)
+-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
--DEF_HELPER_3(neon_unzip16, void, env, i32, i32)
+-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
--DEF_HELPER_3(neon_qunzip8, void, env, i32, i32)
+-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
--DEF_HELPER_3(neon_qunzip16, void, env, i32, i32)
+-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
--DEF_HELPER_3(neon_qunzip32, void, env, i32, i32)
++int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
--DEF_HELPER_3(neon_zip8, void, env, i32, i32)
++int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
--DEF_HELPER_3(neon_zip16, void, env, i32, i32)
++int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
--DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
++int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
--DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
+ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
--DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
+ void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
-+DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
-+DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 +DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
  DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
  DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/neon_helper.c
+--- a/target/arm/gdbstub.c
-+++ b/target/arm/neon_helper.c
++++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_acgt_f64)(uint64_t a, uint64_t b, void *fpstp)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
+          */
- #define ELEM(V, N, SIZE) (((V) >> ((N) * (SIZE))) & ((1ull << (SIZE)) - 1))
+ #ifdef TARGET_AARCH64
+         if (isar_feature_aa64_sve(&cpu->isar)) {
--void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+-            gdb_register_coprocessor(cs, arm_gdb_get_svereg, arm_gdb_set_svereg,
-+void HELPER(neon_qunzip8)(void *vd, void *vm)
+-                                     arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs),
- {
++            int nreg = arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs);
--    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
++            gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
--    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
++                                     aarch64_gdb_set_sve_reg, nreg,
--    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
+                                      "sve-registers.xml", 0);
--    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+         } else {
-+    uint64_t *rd = vd, *rm = vm;
+-            gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
-+    uint64_t zd0 = rd[0], zd1 = rd[1];
+-                                     aarch64_fpu_gdb_set_reg,
-+    uint64_t zm0 = rm[0], zm1 = rm[1];
++            gdb_register_coprocessor(cs, aarch64_gdb_get_fpu_reg,
-+
++                                     aarch64_gdb_set_fpu_reg,
-     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zd0, 2, 8) << 8)
+, "aarch64-fpu.xml", 0);
-         | (ELEM(zd0, 4, 8) << 16) | (ELEM(zd0, 6, 8) << 24)
+         }
-         | (ELEM(zd1, 0, 8) << 32) | (ELEM(zd1, 2, 8) << 40)
+ #endif
-@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
          | (ELEM(zm0, 5, 8) << 16) | (ELEM(zm0, 7, 8) << 24)
          | (ELEM(zm1, 1, 8) << 32) | (ELEM(zm1, 3, 8) << 40)
          | (ELEM(zm1, 5, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qunzip16)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zd0, 2, 16) << 16)
          | (ELEM(zd1, 0, 16) << 32) | (ELEM(zd1, 2, 16) << 48);
      uint64_t d1 = ELEM(zm0, 0, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 1, 16) << 32) | (ELEM(zd1, 3, 16) << 48);
      uint64_t m1 = ELEM(zm0, 1, 16) | (ELEM(zm0, 3, 16) << 16)
          | (ELEM(zm1, 1, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qunzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qunzip32)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zd1, 0, 32) << 32);
      uint64_t d1 = ELEM(zm0, 0, 32) | (ELEM(zm1, 0, 32) << 32);
      uint64_t m0 = ELEM(zd0, 1, 32) | (ELEM(zd1, 1, 32) << 32);
      uint64_t m1 = ELEM(zm0, 1, 32) | (ELEM(zm1, 1, 32) << 32);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_unzip8)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zd, 2, 8) << 8)
          | (ELEM(zd, 4, 8) << 16) | (ELEM(zd, 6, 8) << 24)
          | (ELEM(zm, 0, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd, 5, 8) << 16) | (ELEM(zd, 7, 8) << 24)
          | (ELEM(zm, 1, 8) << 32) | (ELEM(zm, 3, 8) << 40)
          | (ELEM(zm, 5, 8) << 48) | (ELEM(zm, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_unzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_unzip16)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zd, 2, 16) << 16)
          | (ELEM(zm, 0, 16) << 32) | (ELEM(zm, 2, 16) << 48);
      uint64_t m0 = ELEM(zd, 1, 16) | (ELEM(zd, 3, 16) << 16)
          | (ELEM(zm, 1, 16) << 32) | (ELEM(zm, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip8)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zm0, 0, 8) << 8)
          | (ELEM(zd0, 1, 8) << 16) | (ELEM(zm0, 1, 8) << 24)
          | (ELEM(zd0, 2, 8) << 32) | (ELEM(zm0, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 5, 8) << 16) | (ELEM(zm1, 5, 8) << 24)
          | (ELEM(zd1, 6, 8) << 32) | (ELEM(zm1, 6, 8) << 40)
          | (ELEM(zd1, 7, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip16)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zm0, 0, 16) << 16)
          | (ELEM(zd0, 1, 16) << 32) | (ELEM(zm0, 1, 16) << 48);
      uint64_t d1 = ELEM(zd0, 2, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 1, 16) << 32) | (ELEM(zm1, 1, 16) << 48);
      uint64_t m1 = ELEM(zd1, 2, 16) | (ELEM(zm1, 2, 16) << 16)
          | (ELEM(zd1, 3, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip32)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zm0, 0, 32) << 32);
      uint64_t d1 = ELEM(zd0, 1, 32) | (ELEM(zm0, 1, 32) << 32);
      uint64_t m0 = ELEM(zd1, 0, 32) | (ELEM(zm1, 0, 32) << 32);
      uint64_t m1 = ELEM(zd1, 1, 32) | (ELEM(zm1, 1, 32) << 32);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_zip8)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zm, 0, 8) << 8)
          | (ELEM(zd, 1, 8) << 16) | (ELEM(zm, 1, 8) << 24)
          | (ELEM(zd, 2, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd, 5, 8) << 16) | (ELEM(zm, 5, 8) << 24)
          | (ELEM(zd, 6, 8) << 32) | (ELEM(zm, 6, 8) << 40)
          | (ELEM(zd, 7, 8) << 48) | (ELEM(zm, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_zip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_zip16)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zm, 0, 16) << 16)
          | (ELEM(zd, 1, 16) << 32) | (ELEM(zm, 1, 16) << 48);
      uint64_t m0 = ELEM(zd, 2, 16) | (ELEM(zm, 2, 16) << 16)
          | (ELEM(zd, 3, 16) << 32) | (ELEM(zm, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
  /* Helper function for 64 bit polynomial multiply case:
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/gdbstub64.c
-+++ b/target/arm/translate.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 neon_get_scalar(int size, int reg)
+@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
  static int gen_neon_unzip(int rd, int rm, int size, int q)
  {
 -    TCGv_i32 tmp, tmp2;
 +    TCGv_ptr pd, pm;
 +
      if (!q && size == 2) {
          return 1;
      }
 -    tmp = tcg_const_i32(rd);
 -    tmp2 = tcg_const_i32(rm);
 +    pd = vfp_reg_ptr(true, rd);
 +    pm = vfp_reg_ptr(true, rm);
      if (q) {
          switch (size) {
          case 0:
 -            gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip16(pd, pm);
              break;
          case 2:
 -            gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip32(pd, pm);
              break;
          default:
              abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_unzip(int rd, int rm, int size, int q)
      } else {
          switch (size) {
          case 0:
 -            gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
 +            gen_helper_neon_unzip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_unzip16(pd, pm);
              break;
          default:
              abort();
          }
      }
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp2);
 +    tcg_temp_free_ptr(pd);
 +    tcg_temp_free_ptr(pm);
      return 0;
  }
- static int gen_neon_zip(int rd, int rm, int size, int q)
+-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
 +int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg)
  {
--    TCGv_i32 tmp, tmp2;
+     switch (reg) {
-+    TCGv_ptr pd, pm;
+     case 0 ... 31:
-+
+@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
      if (!q && size == 2) {
          return 1;
      }
--    tmp = tcg_const_i32(rd);
+ }
--    tmp2 = tcg_const_i32(rm);
-+    pd = vfp_reg_ptr(true, rd);
+-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
-+    pm = vfp_reg_ptr(true, rm);
++int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg)
-     if (q) {
+ {
-         switch (size) {
+     switch (reg) {
-         case 0:
+     case 0 ... 31:
--            gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
+@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 +            gen_helper_neon_qzip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qzip16(pd, pm);
              break;
          case 2:
 -            gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qzip32(pd, pm);
              break;
          default:
              abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_zip(int rd, int rm, int size, int q)
      } else {
          switch (size) {
          case 0:
 -            gen_helper_neon_zip8(cpu_env, tmp, tmp2);
 +            gen_helper_neon_zip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_zip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_zip16(pd, pm);
              break;
          default:
              abort();
          }
      }
--    tcg_temp_free_i32(tmp);
+ }
--    tcg_temp_free_i32(tmp2);
-+    tcg_temp_free_ptr(pd);
+-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
-+    tcg_temp_free_ptr(pm);
++int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg)
  {
      ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
      return 0;
  }
+-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg)
++int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
+ {
+     ARMCPU *cpu = env_archcpu(env);
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 08/21] target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
+[PULL 02/21] target/arm: Unexport arm_gen_dynamic_sysreg_xml
 From: Richard Henderson <richard.henderson@linaro.org>
-Helpers that return a pointer into env->vfp.regs so that we isolate
+This function is not used outside gdbstub.c.
 the logic of how to index the regs array for different cpu modes.
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-7-richard.henderson@linaro.org
+Message-id: 20230227213329.793795-3-richard.henderson@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h           | 27 +++++++++++++++++++++++++++
+ target/arm/cpu.h     | 1 -
- linux-user/signal.c        | 22 ++++++++++++----------
+ target/arm/gdbstub.c | 2 +-
- target/arm/arch_dump.c     |  8 +++++---
+files changed, 1 insertion(+), 2 deletions(-)
  target/arm/helper-a64.c    |  5 +++--
  target/arm/helper.c        | 32 ++++++++++++++++++++------------
  target/arm/kvm32.c         |  4 ++--
  target/arm/kvm64.c         | 31 ++++++++++---------------------
  target/arm/translate-a64.c | 25 ++++++++-----------------
  target/arm/translate.c     | 16 +++++++++-------
 files changed, 96 insertions(+), 74 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-     return cpu->el_change_hook_opaque;
+  * Helpers to dynamically generates XML descriptions of the sysregs
- }
+  * and SVE registers. Returns the number of registers in each set.
+  */
-+/**
+-int arm_gen_dynamic_sysreg_xml(CPUState *cpu, int base_reg);
-+ * aa32_vfp_dreg:
+ int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
-+ * Return a pointer to the Dn register within env in 32-bit mode.
-+ */
+ /* Returns the dynamically generated XML for the gdb stub.
-+static inline uint64_t *aa32_vfp_dreg(CPUARMState *env, unsigned regno)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 +{
 +    return &env->vfp.regs[regno];
 +}
 +
 +/**
 + * aa32_vfp_qreg:
 + * Return a pointer to the Qn register within env in 32-bit mode.
 + */
 +static inline uint64_t *aa32_vfp_qreg(CPUARMState *env, unsigned regno)
 +{
 +    return &env->vfp.regs[2 * regno];
 +}
 +
 +/**
 + * aa64_vfp_qreg:
 + * Return a pointer to the Qn register within env in 64-bit mode.
 + */
 +static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
 +{
 +    return &env->vfp.regs[2 * regno];
 +}
 +
  #endif
 diff --git a/linux-user/signal.c b/linux-user/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/signal.c
+--- a/target/arm/gdbstub.c
-+++ b/linux-user/signal.c
++++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static int target_setup_sigframe(struct target_rt_sigframe *sf,
+@@ -XXX,XX +XXX,XX @@ static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
      }
      for (i = 0; i < 32; i++) {
 +        uint64_t *q = aa64_vfp_qreg(env, i);
  #ifdef TARGET_WORDS_BIGENDIAN
 -        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
 -        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
 +        __put_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __put_user(q[1], &aux->fpsimd.vregs[i * 2]);
  #else
 -        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
 -        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __put_user(q[0], &aux->fpsimd.vregs[i * 2]);
 +        __put_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
  #endif
      }
      __put_user(vfp_get_fpsr(env), &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static int target_restore_sigframe(CPUARMState *env,
      }
      for (i = 0; i < 32; i++) {
 +        uint64_t *q = aa64_vfp_qreg(env, i);
  #ifdef TARGET_WORDS_BIGENDIAN
 -        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
 -        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
 +        __get_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __get_user(q[1], &aux->fpsimd.vregs[i * 2]);
  #else
 -        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
 -        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __get_user(q[0], &aux->fpsimd.vregs[i * 2]);
 +        __get_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
  #endif
      }
      __get_user(fpsr, &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *setup_sigframe_v2_vfp(abi_ulong *regspace, CPUARMState *env)
      __put_user(TARGET_VFP_MAGIC, &vfpframe->magic);
      __put_user(sizeof(*vfpframe), &vfpframe->size);
      for (i = 0; i < 32; i++) {
 -        __put_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
 +        __put_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
      }
      __put_user(vfp_get_fpscr(env), &vfpframe->ufp.fpscr);
      __put_user(env->vfp.xregs[ARM_VFP_FPEXC], &vfpframe->ufp_exc.fpexc);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *restore_sigframe_v2_vfp(CPUARMState *env, abi_ulong *regspace)
          return 0;
      }
      for (i = 0; i < 32; i++) {
 -        __get_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
 +        __get_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
      }
      __get_user(fpscr, &vfpframe->ufp.fpscr);
      vfp_set_fpscr(env, fpscr);
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arch_dump.c
 +++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
      aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 -    for (i = 0; i < 64; ++i) {
 -        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
 +    for (i = 0; i < 32; ++i) {
 +        uint64_t *q = aa64_vfp_qreg(env, i);
 +        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
 +        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
      }
      if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
      arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
      for (i = 0; i < 32; ++i) {
 -        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
 +        note.vfp.vregs[i] = cpu_to_dump64(s, *aa32_vfp_dreg(env, i));
      }
      note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(simd_tbl)(CPUARMState *env, uint64_t result, uint64_t indices,
          if (index < 16 * numregs) {
              /* Convert index (a byte offset into the virtual table
               * which is a series of 128-bit vectors concatenated)
 -             * into the correct vfp.regs[] element plus a bit offset
 +             * into the correct register element plus a bit offset
               * into that element, bearing in mind that the table
               * can wrap around from V31 to V0.
               */
              int elt = (rn * 2 + (index >> 3)) % 64;
              int bitidx = (index & 7) * 8;
 -            uint64_t val = extract64(env->vfp.regs[elt], bitidx, 8);
 +            uint64_t *q = aa64_vfp_qreg(env, elt >> 1);
 +            uint64_t val = extract64(q[elt & 1], bitidx, 8);
              result = deposit64(result, shift, 8, val);
          }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      /* VFP data registers are always little-endian.  */
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        stq_le_p(buf, env->vfp.regs[reg]);
 +        stq_le_p(buf, *aa32_vfp_dreg(env, reg));
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          /* Aliases for Q regs.  */
          nregs += 16;
          if (reg < nregs) {
 -            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 -            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 +            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
 +            stq_le_p(buf, q[0]);
 +            stq_le_p(buf + 8, q[1]);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        env->vfp.regs[reg] = ldq_le_p(buf);
 +        *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          nregs += 16;
          if (reg < nregs) {
 -            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
 -            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
 +            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
 +            q[0] = ldq_le_p(buf);
 +            q[1] = ldq_le_p(buf + 8);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        stq_le_p(buf, env->vfp.regs[reg * 2]);
 -        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
 -        return 16;
 +        {
 +            uint64_t *q = aa64_vfp_qreg(env, reg);
 +            stq_le_p(buf, q[0]);
 +            stq_le_p(buf + 8, q[1]);
 +            return 16;
 +        }
      case 32:
          /* FPSR */
          stl_p(buf, vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        env->vfp.regs[reg * 2] = ldq_le_p(buf);
 -        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
 -        return 16;
 +        {
 +            uint64_t *q = aa64_vfp_qreg(env, reg);
 +            q[0] = ldq_le_p(buf);
 +            q[1] = ldq_le_p(buf + 8);
 +            return 16;
 +        }
      case 32:
          /* FPSR */
          vfp_set_fpsr(env, ldl_p(buf));
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
      /* VFP registers */
      r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
      for (i = 0; i < 32; i++) {
 -        r.addr = (uintptr_t)(&env->vfp.regs[i]);
 +        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
          ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
          if (ret) {
              return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      /* VFP registers */
      r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
      for (i = 0; i < 32; i++) {
 -        r.addr = (uintptr_t)(&env->vfp.regs[i]);
 +        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
          ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
          if (ret) {
              return ret;
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          }
      }
 -    /* Advanced SIMD and FP registers
 -     * We map Qn = regs[2n+1]:regs[2n]
 -     */
 +    /* Advanced SIMD and FP registers. */
      for (i = 0; i < 32; i++) {
 -        int rd = i << 1;
 -        uint64_t fp_val[2];
 +        uint64_t *q = aa64_vfp_qreg(env, i);
  #ifdef HOST_WORDS_BIGENDIAN
 -        fp_val[0] = env->vfp.regs[rd + 1];
 -        fp_val[1] = env->vfp.regs[rd];
 +        uint64_t fp_val[2] = { q[1], q[0] };
 +        reg.addr = (uintptr_t)fp_val;
  #else
 -        fp_val[1] = env->vfp.regs[rd + 1];
 -        fp_val[0] = env->vfp.regs[rd];
 +        reg.addr = (uintptr_t)q;
  #endif
          reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        reg.addr = (uintptr_t)(&fp_val);
          ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
          if (ret) {
              return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          env->spsr = env->banked_spsr[i];
      }
 -    /* Advanced SIMD and FP registers
 -     * We map Qn = regs[2n+1]:regs[2n]
 -     */
 +    /* Advanced SIMD and FP registers */
      for (i = 0; i < 32; i++) {
 -        uint64_t fp_val[2];
 +        uint64_t *q = aa64_vfp_qreg(env, i);
          reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        reg.addr = (uintptr_t)(&fp_val);
 +        reg.addr = (uintptr_t)q;
          ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
          if (ret) {
              return ret;
          } else {
 -            int rd = i << 1;
  #ifdef HOST_WORDS_BIGENDIAN
 -            env->vfp.regs[rd + 1] = fp_val[0];
 -            env->vfp.regs[rd] = fp_val[1];
 -#else
 -            env->vfp.regs[rd + 1] = fp_val[1];
 -            env->vfp.regs[rd] = fp_val[0];
 +            uint64_t t;
 +            t = q[0], q[0] = q[1], q[1] = t;
  #endif
          }
      }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
      if (flags & CPU_DUMP_FPU) {
          int numvfpregs = 32;
 -        for (i = 0; i < numvfpregs; i += 2) {
 -            uint64_t vlo = env->vfp.regs[i * 2];
 -            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
 -            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
 -                        i, vhi, vlo);
 -            vlo = env->vfp.regs[(i + 1) * 2];
 -            vhi = env->vfp.regs[((i + 1) * 2) + 1];
 -            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
 -                        i + 1, vhi, vlo);
 +        for (i = 0; i < numvfpregs; i++) {
 +            uint64_t *q = aa64_vfp_qreg(env, i);
 +            uint64_t vlo = q[0];
 +            uint64_t vhi = q[1];
 +            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "%c",
 +                        i, vhi, vlo, (i & 1 ? '\n' : ' '));
          }
          cpu_fprintf(f, "FPCR: %08x  FPSR: %08x\n",
                      vfp_get_fpcr(env), vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
   */
  static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
  {
 -    int offs = offsetof(CPUARMState, vfp.regs[regno * 2]);
 -#ifdef HOST_WORDS_BIGENDIAN
 -    offs += (8 - (1 << size));
 -#endif
 -    assert_fp_access_checked(s);
 -    return offs;
 +    return vec_reg_offset(s, regno, 0, size);
  }
  /* Offset of the high half of the 128 bit vector Qn */
  static inline int fp_reg_hi_offset(DisasContext *s, int regno)
  {
 -    assert_fp_access_checked(s);
 -    return offsetof(CPUARMState, vfp.regs[regno * 2 + 1]);
 +    return vec_reg_offset(s, regno, 1, MO_64);
  }
  /* Convenience accessors for reading and writing single and double
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
  static inline long
  vfp_reg_offset (int dp, int reg)
  {
 -    if (dp)
 +    if (dp) {
          return offsetof(CPUARMState, vfp.regs[reg]);
 -    else if (reg & 1) {
 -        return offsetof(CPUARMState, vfp.regs[reg >> 1])
 -          + offsetof(CPU_DoubleU, l.upper);
      } else {
 -        return offsetof(CPUARMState, vfp.regs[reg >> 1])
 -          + offsetof(CPU_DoubleU, l.lower);
 +        long ofs = offsetof(CPUARMState, vfp.regs[reg >> 1]);
 +        if (reg & 1) {
 +            ofs += offsetof(CPU_DoubleU, l.upper);
 +        } else {
 +            ofs += offsetof(CPU_DoubleU, l.lower);
 +        }
 +        return ofs;
      }
  }
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+-int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
-             numvfpregs += 16;
++static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
-         }
+ {
-         for (i = 0; i < numvfpregs; i++) {
+     ARMCPU *cpu = ARM_CPU(cs);
--            uint64_t v = env->vfp.regs[i];
+     GString *s = g_string_new(NULL);
 +            uint64_t v = *aa32_vfp_dreg(env, i);
              cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                          i * 2, (uint32_t)v,
                          i * 2 + 1, (uint32_t)(v >> 32),
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 11/21] target/arm: Move cpu_get_tb_cpu_state out of line
+[PULL 03/21] target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
 From: Richard Henderson <richard.henderson@linaro.org>
+The function is only used for aarch64, so move it to the
+file that has the other aarch64 gdbstub stuff.  Move the
+declaration to internals.h.
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-14-richard.henderson@linaro.org
+Message-id: 20230227213329.793795-4-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h    | 127 +---------------------------------------------------
+ target/arm/cpu.h       |   6 ---
- target/arm/helper.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/internals.h |   1 +
-files changed, 128 insertions(+), 125 deletions(-)
+ target/arm/gdbstub.c   | 120 -----------------------------------------
  target/arm/gdbstub64.c | 118 ++++++++++++++++++++++++++++++++++++++++
 files changed, 119 insertions(+), 126 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
+@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
- #endif
+ int arm_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
  int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 -/*
 - * Helpers to dynamically generates XML descriptions of the sysregs
 - * and SVE registers. Returns the number of registers in each set.
 - */
 -int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
 -
  /* Returns the dynamically generated XML for the gdb stub.
   * Returns a pointer to the XML contents for the specified XML file or NULL
   * if the XML name doesn't match the predefined one.
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
  }
--/* Return the exception level to which FP-disabled exceptions should
+ #ifdef TARGET_AARCH64
-- * be taken, or 0 if FP is enabled.
++int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
-- */
+ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
--static inline int fp_exception_el(CPUARMState *env)
+ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
  int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
      return cpu->dyn_sysreg_xml.num;
  }
 -struct TypeSize {
 -    const char *gdb_type;
 -    int  size;
 -    const char sz, suffix;
 -};
 -
 -static const struct TypeSize vec_lanes[] = {
 -    /* quads */
 -    { "uint128", 128, 'q', 'u' },
 -    { "int128", 128, 'q', 's' },
 -    /* 64 bit */
 -    { "ieee_double", 64, 'd', 'f' },
 -    { "uint64", 64, 'd', 'u' },
 -    { "int64", 64, 'd', 's' },
 -    /* 32 bit */
 -    { "ieee_single", 32, 's', 'f' },
 -    { "uint32", 32, 's', 'u' },
 -    { "int32", 32, 's', 's' },
 -    /* 16 bit */
 -    { "ieee_half", 16, 'h', 'f' },
 -    { "uint16", 16, 'h', 'u' },
 -    { "int16", 16, 'h', 's' },
 -    /* bytes */
 -    { "uint8", 8, 'b', 'u' },
 -    { "int8", 8, 'b', 's' },
 -};
 -
 -
 -int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 -{
--    int fpen;
+-    ARMCPU *cpu = ARM_CPU(cs);
--    int cur_el = arm_current_el(env);
+-    GString *s = g_string_new(NULL);
--
+-    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
--    /* CPACR and the CPTR registers don't exist before v6, so FP is
+-    g_autoptr(GString) ts = g_string_new("");
--     * always accessible
+-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
 -    info->num = 0;
 -    g_string_printf(s, "<?xml version=\"1.0\"?>");
 -    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 -    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 -
 -    /* First define types and totals in a whole VL */
 -    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 -        int count = reg_width / vec_lanes[i].size;
 -        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
 -        g_string_append_printf(s,
 -                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
 -                               ts->str, vec_lanes[i].gdb_type, count);
 -    }
 -    /*
 -     * Now define a union for each size group containing unsigned and
 -     * signed and potentially float versions of each size from 128 to
 -     * 8 bits.
 -     */
--    if (!arm_feature(env, ARM_FEATURE_V6)) {
+-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
--        return 0;
+-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
--    }
+-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
--
+-        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
--    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
+-            if (vec_lanes[j].size == bits) {
--     * 0, 2 : trap EL0 and EL1/PL1 accesses
+-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
--     * 1    : trap only EL0 accesses
+-                                       vec_lanes[j].suffix,
--     * 3    : trap no accesses
+-                                       vec_lanes[j].sz, vec_lanes[j].suffix);
 -     */
 -    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
 -    switch (fpen) {
 -    case 0:
 -    case 2:
 -        if (cur_el == 0 || cur_el == 1) {
 -            /* Trap to PL1, which might be EL1 or EL3 */
 -            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 -                return 3;
 -            }
 -            return 1;
 -        }
 -        if (cur_el == 3 && !is_a64(env)) {
 -            /* Secure PL1 running at EL3 */
 -            return 3;
 -        }
 -        break;
 -    case 1:
 -        if (cur_el == 0) {
 -            return 1;
 -        }
 -        break;
 -    case 3:
 -        break;
 -    }
 -
 -    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
 -     * check because zero bits in the registers mean "don't trap".
 -     */
 -
 -    /* CPTR_EL2 : present in v7VE or v8 */
 -    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
 -        && !arm_is_secure_below_el3(env)) {
 -        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
 -        return 2;
 -    }
 -
 -    /* CPTR_EL3 : present in v8 */
 -    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
 -        /* Trap all FP ops to EL3 */
 -        return 3;
 -    }
 -
 -    return 0;
 -}
 -
  #ifdef CONFIG_USER_ONLY
  static inline bool arm_cpu_bswap_data(CPUARMState *env)
  {
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
  }
  #endif
 -static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
 -                                        target_ulong *cs_base, uint32_t *flags)
 -{
 -    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
 -    if (is_a64(env)) {
 -        *pc = env->pc;
 -        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
 -        /* Get control bits for tagged addresses */
 -        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
 -        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
 -    } else {
 -        *pc = env->regs[15];
 -        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
 -            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
 -            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
 -            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
 -            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
 -        if (!(access_secure_reg(env))) {
 -            *flags |= ARM_TBFLAG_NS_MASK;
 -        }
 -        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
 -            || arm_el_is_aa64(env, 1)) {
 -            *flags |= ARM_TBFLAG_VFPEN_MASK;
 -        }
 -        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 -                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 -    }
 -
 -    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 -
 -    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
 -     * states defined in the ARM ARM for software singlestep:
 -     *  SS_ACTIVE   PSTATE.SS   State
 -     *     0            x       Inactive (the TB flag for SS is always 0)
 -     *     1            0       Active-pending
 -     *     1            1       Active-not-pending
 -     */
 -    if (arm_singlestep_active(env)) {
 -        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
 -        if (is_a64(env)) {
 -            if (env->pstate & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 -            }
 -        } else {
 -            if (env->uncached_cpsr & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 -            }
 -        }
--    }
+-        g_string_append(s, "</union>");
--    if (arm_cpu_data_is_big_endian(env)) {
+-    }
--        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+-    /* And now the final union of unions */
--    }
+-    g_string_append(s, "<union id=\"svev\">");
--    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
--
+-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
--    if (arm_v7m_is_handler_mode(env)) {
+-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
--        *flags |= ARM_TBFLAG_HANDLER_MASK;
+-                               suf[i], suf[i]);
 -    }
--
+-    g_string_append(s, "</union>");
--    *cs_base = 0;
+-
 -    /* Finally the sve prefix type */
 -    g_string_append_printf(s,
 -                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
 -                           reg_width / 8);
 -
 -    /* Then define each register in parts for each vq */
 -    for (i = 0; i < 32; i++) {
 -        g_string_append_printf(s,
 -                               "<reg name=\"z%d\" bitsize=\"%d\""
 -                               " regnum=\"%d\" type=\"svev\"/>",
 -                               i, reg_width, base_reg++);
 -        info->num++;
 -    }
 -    /* fpscr & status registers */
 -    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
 -                           " regnum=\"%d\" group=\"float\""
 -                           " type=\"int\"/>", base_reg++);
 -    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
 -                           " regnum=\"%d\" group=\"float\""
 -                           " type=\"int\"/>", base_reg++);
 -    info->num += 2;
 -
 -    for (i = 0; i < 16; i++) {
 -        g_string_append_printf(s,
 -                               "<reg name=\"p%d\" bitsize=\"%d\""
 -                               " regnum=\"%d\" type=\"svep\"/>",
 -                               i, cpu->sve_max_vq * 16, base_reg++);
 -        info->num++;
 -    }
 -    g_string_append_printf(s,
 -                           "<reg name=\"ffr\" bitsize=\"%d\""
 -                           " regnum=\"%d\" group=\"vector\""
 -                           " type=\"svep\"/>",
 -                           cpu->sve_max_vq * 16, base_reg++);
 -    g_string_append_printf(s,
 -                           "<reg name=\"vg\" bitsize=\"64\""
 -                           " regnum=\"%d\" type=\"int\"/>",
 -                           base_reg++);
 -    info->num += 2;
 -    g_string_append_printf(s, "</feature>");
 -    cpu->dyn_svereg_xml.desc = g_string_free(s, false);
 -
 -    return cpu->dyn_svereg_xml.num;
 -}
-+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+-
-+                          target_ulong *cs_base, uint32_t *flags);
+-
+ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
- enum {
+ {
-     QEMU_PSCI_CONDUIT_DISABLED = 0,
+     ARMCPU *cpu = ARM_CPU(cs);
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/gdbstub64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
+@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
-     /* Linux crc32c converts the output to one's complement.  */
-     return crc32c(acc, buf, bytes) ^ 0xffffffff;
+     return 0;
  }
 +
-+/* Return the exception level to which FP-disabled exceptions should
++struct TypeSize {
-+ * be taken, or 0 if FP is enabled.
++    const char *gdb_type;
-+ */
++    short size;
-+static inline int fp_exception_el(CPUARMState *env)
++    char sz, suffix;
 +};
 +
 +static const struct TypeSize vec_lanes[] = {
 +    /* quads */
 +    { "uint128", 128, 'q', 'u' },
 +    { "int128", 128, 'q', 's' },
 +    /* 64 bit */
 +    { "ieee_double", 64, 'd', 'f' },
 +    { "uint64", 64, 'd', 'u' },
 +    { "int64", 64, 'd', 's' },
 +    /* 32 bit */
 +    { "ieee_single", 32, 's', 'f' },
 +    { "uint32", 32, 's', 'u' },
 +    { "int32", 32, 's', 's' },
 +    /* 16 bit */
 +    { "ieee_half", 16, 'h', 'f' },
 +    { "uint16", 16, 'h', 'u' },
 +    { "int16", 16, 'h', 's' },
 +    /* bytes */
 +    { "uint8", 8, 'b', 'u' },
 +    { "int8", 8, 'b', 's' },
 +};
 +
 +int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +{
-+    int fpen;
++    ARMCPU *cpu = ARM_CPU(cs);
-+    int cur_el = arm_current_el(env);
++    GString *s = g_string_new(NULL);
-+
++    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-+    /* CPACR and the CPTR registers don't exist before v6, so FP is
++    g_autoptr(GString) ts = g_string_new("");
-+     * always accessible
++    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
 +    info->num = 0;
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +
 +    /* First define types and totals in a whole VL */
 +    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 +        int count = reg_width / vec_lanes[i].size;
 +        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
 +        g_string_append_printf(s,
 +                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
 +                               ts->str, vec_lanes[i].gdb_type, count);
 +    }
 +    /*
 +     * Now define a union for each size group containing unsigned and
 +     * signed and potentially float versions of each size from 128 to
 +     * 8 bits.
 +     */
-+    if (!arm_feature(env, ARM_FEATURE_V6)) {
++    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-+        return 0;
++        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-+    }
++        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
-+
++        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
-+    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
++            if (vec_lanes[j].size == bits) {
-+     * 0, 2 : trap EL0 and EL1/PL1 accesses
++                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-+     * 1    : trap only EL0 accesses
++                                       vec_lanes[j].suffix,
-+     * 3    : trap no accesses
++                                       vec_lanes[j].sz, vec_lanes[j].suffix);
 +     */
 +    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
 +    switch (fpen) {
 +    case 0:
 +    case 2:
 +        if (cur_el == 0 || cur_el == 1) {
 +            /* Trap to PL1, which might be EL1 or EL3 */
 +            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 +                return 3;
 +            }
 +            return 1;
 +        }
 +        if (cur_el == 3 && !is_a64(env)) {
 +            /* Secure PL1 running at EL3 */
 +            return 3;
 +        }
 +        break;
 +    case 1:
 +        if (cur_el == 0) {
 +            return 1;
 +        }
 +        break;
 +    case 3:
 +        break;
 +    }
 +
 +    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
 +     * check because zero bits in the registers mean "don't trap".
 +     */
 +
 +    /* CPTR_EL2 : present in v7VE or v8 */
 +    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
 +        && !arm_is_secure_below_el3(env)) {
 +        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
 +        return 2;
 +    }
 +
 +    /* CPTR_EL3 : present in v8 */
 +    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
 +        /* Trap all FP ops to EL3 */
 +        return 3;
 +    }
 +
 +    return 0;
 +}
 +
 +void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
 +                          target_ulong *cs_base, uint32_t *flags)
 +{
 +    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
 +    if (is_a64(env)) {
 +        *pc = env->pc;
 +        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
 +        /* Get control bits for tagged addresses */
 +        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
 +        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
 +    } else {
 +        *pc = env->regs[15];
 +        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
 +            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
 +            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
 +            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
 +            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
 +        if (!(access_secure_reg(env))) {
 +            *flags |= ARM_TBFLAG_NS_MASK;
 +        }
 +        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
 +            || arm_el_is_aa64(env, 1)) {
 +            *flags |= ARM_TBFLAG_VFPEN_MASK;
 +        }
 +        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 +                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 +    }
 +
 +    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 +
 +    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
 +     * states defined in the ARM ARM for software singlestep:
 +     *  SS_ACTIVE   PSTATE.SS   State
 +     *     0            x       Inactive (the TB flag for SS is always 0)
 +     *     1            0       Active-pending
 +     *     1            1       Active-not-pending
 +     */
 +    if (arm_singlestep_active(env)) {
 +        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
 +        if (is_a64(env)) {
 +            if (env->pstate & PSTATE_SS) {
 +                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +            }
 +        } else {
 +            if (env->uncached_cpsr & PSTATE_SS) {
 +                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +            }
 +        }
-+    }
++        g_string_append(s, "</union>");
-+    if (arm_cpu_data_is_big_endian(env)) {
++    }
-+        *flags |= ARM_TBFLAG_BE_DATA_MASK;
++    /* And now the final union of unions */
-+    }
++    g_string_append(s, "<union id=\"svev\">");
-+    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
++    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-+
++        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-+    if (arm_v7m_is_handler_mode(env)) {
++        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-+        *flags |= ARM_TBFLAG_HANDLER_MASK;
++                               suf[i], suf[i]);
 +    }
-+
++    g_string_append(s, "</union>");
-+    *cs_base = 0;
++
 +    /* Finally the sve prefix type */
 +    g_string_append_printf(s,
 +                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
 +                           reg_width / 8);
 +
 +    /* Then define each register in parts for each vq */
 +    for (i = 0; i < 32; i++) {
 +        g_string_append_printf(s,
 +                               "<reg name=\"z%d\" bitsize=\"%d\""
 +                               " regnum=\"%d\" type=\"svev\"/>",
 +                               i, reg_width, base_reg++);
 +        info->num++;
 +    }
 +    /* fpscr & status registers */
 +    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
 +                           " regnum=\"%d\" group=\"float\""
 +                           " type=\"int\"/>", base_reg++);
 +    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
 +                           " regnum=\"%d\" group=\"float\""
 +                           " type=\"int\"/>", base_reg++);
 +    info->num += 2;
 +
 +    for (i = 0; i < 16; i++) {
 +        g_string_append_printf(s,
 +                               "<reg name=\"p%d\" bitsize=\"%d\""
 +                               " regnum=\"%d\" type=\"svep\"/>",
 +                               i, cpu->sve_max_vq * 16, base_reg++);
 +        info->num++;
 +    }
 +    g_string_append_printf(s,
 +                           "<reg name=\"ffr\" bitsize=\"%d\""
 +                           " regnum=\"%d\" group=\"vector\""
 +                           " type=\"svep\"/>",
 +                           cpu->sve_max_vq * 16, base_reg++);
 +    g_string_append_printf(s,
 +                           "<reg name=\"vg\" bitsize=\"64\""
 +                           " regnum=\"%d\" type=\"int\"/>",
 +                           base_reg++);
 +    info->num += 2;
 +    g_string_append_printf(s, "</feature>");
 +    info->desc = g_string_free(s, false);
 +
 +    return info->num;
 +}
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 09/21] vmstate: Add VMSTATE_UINT64_SUB_ARRAY
+[PULL 04/21] target/arm: Split out output_vector_union_type
 From: Richard Henderson <richard.henderson@linaro.org>
-At the same time, move VMSTATE_UINT32_SUB_ARRAY
+Create a subroutine for creating the union of unions
-beside the other UINT32 definitions.
+of the various type sizes that a vector may contain.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-8-richard.henderson@linaro.org
+Message-id: 20230227213329.793795-5-richard.henderson@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/migration/vmstate.h | 9 ++++++---
+ target/arm/gdbstub64.c | 83 +++++++++++++++++++++++-------------------
-file changed, 6 insertions(+), 3 deletions(-)
+file changed, 45 insertions(+), 38 deletions(-)
-diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/target/arm/gdbstub64.c
-+++ b/include/migration/vmstate.h
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
- #define VMSTATE_UINT32_ARRAY(_f, _s, _n)                              \
+     return 0;
-     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, 0)
+ }
-+#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
+-struct TypeSize {
-+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
+-    const char *gdb_type;
 -    short size;
 -    char sz, suffix;
 -};
 -
 -static const struct TypeSize vec_lanes[] = {
 -    /* quads */
 -    { "uint128", 128, 'q', 'u' },
 -    { "int128", 128, 'q', 's' },
 -    /* 64 bit */
 -    { "ieee_double", 64, 'd', 'f' },
 -    { "uint64", 64, 'd', 'u' },
 -    { "int64", 64, 'd', 's' },
 -    /* 32 bit */
 -    { "ieee_single", 32, 's', 'f' },
 -    { "uint32", 32, 's', 'u' },
 -    { "int32", 32, 's', 's' },
 -    /* 16 bit */
 -    { "ieee_half", 16, 'h', 'f' },
 -    { "uint16", 16, 'h', 'u' },
 -    { "int16", 16, 'h', 's' },
 -    /* bytes */
 -    { "uint8", 8, 'b', 'u' },
 -    { "int8", 8, 'b', 's' },
 -};
 -
 -int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +static void output_vector_union_type(GString *s, int reg_width)
  {
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    GString *s = g_string_new(NULL);
 -    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 +    struct TypeSize {
 +        const char *gdb_type;
 +        short size;
 +        char sz, suffix;
 +    };
 +
- #define VMSTATE_UINT32_2DARRAY(_f, _s, _n1, _n2)                      \
++    static const struct TypeSize vec_lanes[] = {
-     VMSTATE_UINT32_2DARRAY_V(_f, _s, _n1, _n2, 0)
++        /* quads */
++        { "uint128", 128, 'q', 'u' },
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
++        { "int128", 128, 'q', 's' },
- #define VMSTATE_UINT64_ARRAY(_f, _s, _n)                              \
++        /* 64 bit */
-     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, 0)
++        { "ieee_double", 64, 'd', 'f' },
++        { "uint64", 64, 'd', 'u' },
-+#define VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)                \
++        { "int64", 64, 'd', 's' },
-+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint64, uint64_t)
++        /* 32 bit */
 +        { "ieee_single", 32, 's', 'f' },
 +        { "uint32", 32, 's', 'u' },
 +        { "int32", 32, 's', 's' },
 +        /* 16 bit */
 +        { "ieee_half", 16, 'h', 'f' },
 +        { "uint16", 16, 'h', 'u' },
 +        { "int16", 16, 'h', 's' },
 +        /* bytes */
 +        { "uint8", 8, 'b', 'u' },
 +        { "int8", 8, 'b', 's' },
 +    };
 +
- #define VMSTATE_UINT64_2DARRAY(_f, _s, _n1, _n2)                      \
++    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-     VMSTATE_UINT64_2DARRAY_V(_f, _s, _n1, _n2, 0)
++
+     g_autoptr(GString) ts = g_string_new("");
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
- #define VMSTATE_INT32_ARRAY(_f, _s, _n)                               \
+-    info->num = 0;
-     VMSTATE_INT32_ARRAY_V(_f, _s, _n, 0)
+-    g_string_printf(s, "<?xml version=\"1.0\"?>");
+-    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
--#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
+-    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
--    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
++    int i, j, bits;
--
- #define VMSTATE_INT64_ARRAY_V(_f, _s, _n, _v)                         \
+     /* First define types and totals in a whole VL */
-     VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_int64, int64_t)
+     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
       * 8 bits.
       */
      for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
          g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
          for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
              if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
      /* And now the final union of unions */
      g_string_append(s, "<union id=\"svev\">");
      for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
          g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
                                 suf[i], suf[i]);
      }
      g_string_append(s, "</union>");
 +}
 +
 +int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    GString *s = g_string_new(NULL);
 +    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 +    int i, reg_width = (cpu->sve_max_vq * 128);
 +    info->num = 0;
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +
 +    output_vector_union_type(s, reg_width);
      /* Finally the sve prefix type */
      g_string_append_printf(s,
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 12/21] target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
+[PULL 05/21] target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
 From: Richard Henderson <richard.henderson@linaro.org>
+Rather than increment base_reg and num, compute num from the change
+to base_reg at the end.  Clean up some nearby comments.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-15-richard.henderson@linaro.org
+Message-id: 20230227213329.793795-6-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 35 +++++++++++++++++++----------------
+ target/arm/gdbstub64.c | 27 ++++++++++++++++-----------
-file changed, 19 insertions(+), 16 deletions(-)
+file changed, 16 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/gdbstub64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
      g_string_append(s, "</union>");
  }
- void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
--                          target_ulong *cs_base, uint32_t *flags)
++int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
 +                          target_ulong *cs_base, uint32_t *pflags)
  {
-     ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+     ARMCPU *cpu = ARM_CPU(cs);
-+    uint32_t flags;
+     GString *s = g_string_new(NULL);
      DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 -    int i, reg_width = (cpu->sve_max_vq * 128);
 -    info->num = 0;
 +    int reg_width = cpu->sve_max_vq * 128;
 +    int base_reg = orig_base_reg;
 +    int i;
 +
-     if (is_a64(env)) {
+     g_string_printf(s, "<?xml version=\"1.0\"?>");
-         *pc = env->pc;
+     g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
--        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
-+        flags = ARM_TBFLAG_AARCH64_STATE_MASK;
-         /* Get control bits for tagged addresses */
++    /* Create the vector union type. */
--        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+     output_vector_union_type(s, reg_width);
--        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
-+        flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+-    /* Finally the sve prefix type */
-+        flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
++    /* Create the predicate vector type. */
-     } else {
+     g_string_append_printf(s,
-         *pc = env->regs[15];
+                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
--        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+                            reg_width / 8);
-+        flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
-             | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
+-    /* Then define each register in parts for each vq */
-             | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
++    /* Define the vector registers. */
-             | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
+     for (i = 0; i < 32; i++) {
-             | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
+         g_string_append_printf(s,
-         if (!(access_secure_reg(env))) {
+                                "<reg name=\"z%d\" bitsize=\"%d\""
--            *flags |= ARM_TBFLAG_NS_MASK;
+                                " regnum=\"%d\" type=\"svev\"/>",
-+            flags |= ARM_TBFLAG_NS_MASK;
+                                i, reg_width, base_reg++);
-         }
+-        info->num++;
          if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
              || arm_el_is_aa64(env, 1)) {
 -            *flags |= ARM_TBFLAG_VFPEN_MASK;
 +            flags |= ARM_TBFLAG_VFPEN_MASK;
          }
 -        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 -                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 +        flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 +                  << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
      }
++
--    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+     /* fpscr & status registers */
-+    flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+     g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
+                            " regnum=\"%d\" group=\"float\""
-     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
-      * states defined in the ARM ARM for software singlestep:
+     g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
-@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                            " regnum=\"%d\" group=\"float\""
-      *     1            1       Active-not-pending
+                            " type=\"int\"/>", base_reg++);
-      */
+-    info->num += 2;
-     if (arm_singlestep_active(env)) {
--        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
++    /* Define the predicate registers. */
-+        flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
+     for (i = 0; i < 16; i++) {
-         if (is_a64(env)) {
+         g_string_append_printf(s,
-             if (env->pstate & PSTATE_SS) {
+                                "<reg name=\"p%d\" bitsize=\"%d\""
--                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                                " regnum=\"%d\" type=\"svep\"/>",
-+                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                                i, cpu->sve_max_vq * 16, base_reg++);
-             }
+-        info->num++;
          } else {
              if (env->uncached_cpsr & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
              }
          }
      }
-     if (arm_cpu_data_is_big_endian(env)) {
+     g_string_append_printf(s,
--        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+                            "<reg name=\"ffr\" bitsize=\"%d\""
-+        flags |= ARM_TBFLAG_BE_DATA_MASK;
+                            " regnum=\"%d\" group=\"vector\""
-     }
+                            " type=\"svep\"/>",
--    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+                            cpu->sve_max_vq * 16, base_reg++);
-+    flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
++
++    /* Define the vector length pseudo-register. */
-     if (arm_v7m_is_handler_mode(env)) {
+     g_string_append_printf(s,
--        *flags |= ARM_TBFLAG_HANDLER_MASK;
+                            "<reg name=\"vg\" bitsize=\"64\""
-+        flags |= ARM_TBFLAG_HANDLER_MASK;
+                            " regnum=\"%d\" type=\"int\"/>",
-     }
+                            base_reg++);
+-    info->num += 2;
-+    *pflags = flags;
+-    g_string_append_printf(s, "</feature>");
-     *cs_base = 0;
+-    info->desc = g_string_free(s, false);
 +    g_string_append_printf(s, "</feature>");
 +
 +    info->desc = g_string_free(s, false);
 +    info->num = base_reg - orig_base_reg;
      return info->num;
  }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 01/21] target/arm: Fix 32-bit address truncation
+[PULL 06/21] target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
-From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Commit ("3b39d734141a target/arm: Handle page table walk load failures
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
-correctly") modified both versions of the page table walking code (i.e.,
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-a temporary 'data' variable so that it can be inspected before being
+Message-id: 20230227213329.793795-7-richard.henderson@linaro.org
 returned. However, arm_ldq_ptw() returns an uint64_t, and using a
 temporary uint32_t variable truncates the upper bits, corrupting the
 result. This causes problems when using more than 4 GB of memory in
 a TCG guest. So use a uint64_t instead.
 Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
 Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ target/arm/gdbstub64.c | 5 +++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/gdbstub64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
-     MemTxAttrs attrs = {};
+     GString *s = g_string_new(NULL);
-     MemTxResult result = MEMTX_OK;
+     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-     AddressSpace *as;
+     int reg_width = cpu->sve_max_vq * 128;
--    uint32_t data;
++    int pred_width = cpu->sve_max_vq * 16;
-+    uint64_t data;
+     int base_reg = orig_base_reg;
+     int i;
-     attrs.secure = is_secure;
-     as = arm_addressspace(cs, attrs);
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
          g_string_append_printf(s,
                                 "<reg name=\"p%d\" bitsize=\"%d\""
                                 " regnum=\"%d\" type=\"svep\"/>",
 -                               i, cpu->sve_max_vq * 16, base_reg++);
 +                               i, pred_width, base_reg++);
      }
      g_string_append_printf(s,
                             "<reg name=\"ffr\" bitsize=\"%d\""
                             " regnum=\"%d\" group=\"vector\""
                             " type=\"svep\"/>",
 -                           cpu->sve_max_vq * 16, base_reg++);
 +                           pred_width, base_reg++);
      /* Define the vector length pseudo-register. */
      g_string_append_printf(s,
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 18/21] hw/arm/virt: Check that the CPU realize method succeeded
+[PULL 07/21] target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
-We were passing a NULL error pointer to the object_property_set_bool()
+From: Richard Henderson <richard.henderson@linaro.org>
 call that realizes the CPU object. This meant that we wouldn't detect
 failure, and would plough blindly on to crash later trying to use a
 NULL CPU object pointer. Detect errors and fail instead.
-In particular, this will be necessary to detect the user error
+Define svep based on the size of the predicates,
-of using "-cpu host" without "-enable-kvm" once we make the host
+not the primary vector registers.
 CPU type be registered unconditionally rather than only in
 kvm_arch_init().
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230227213329.793795-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 2 +-
+ target/arm/gdbstub64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/arm/gdbstub64.c
-+++ b/hw/arm/virt.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
-                                      "secure-memory", &error_abort);
+     /* Create the predicate vector type. */
-         }
+     g_string_append_printf(s,
+                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
--        object_property_set_bool(cpuobj, true, "realized", NULL);
+-                           reg_width / 8);
-+        object_property_set_bool(cpuobj, true, "realized", &error_fatal);
++                           pred_width / 8);
-         object_unref(cpuobj);
-     }
+     /* Define the vector registers. */
-     fdt_add_timer_nodes(vms);
+     for (i = 0; i < 32; i++) {
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 06/21] target/arm: Use pointers in neon tbl helper
+[PULL 08/21] target/arm: Add name argument to output_vector_union_type
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than passing a regno to the helper, pass pointers to the
+This will make the function usable between SVE and SME.
 vector register directly.  This eliminates the need to pass in
 the environment pointer and reduces the number of places that
 directly access env->vfp.regs[].
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-5-richard.henderson@linaro.org
+Message-id: 20230227213329.793795-9-richard.henderson@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h    |  2 +-
+ target/arm/gdbstub64.c | 28 ++++++++++++++--------------
- target/arm/op_helper.c | 17 +++++++----------
+file changed, 14 insertions(+), 14 deletions(-)
  target/arm/translate.c |  8 ++++----
 files changed, 12 insertions(+), 15 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/gdbstub64.c
-+++ b/target/arm/helper.h
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+     return 0;
  DEF_HELPER_2(recpe_u32, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32, ptr)
 -DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int exception_target_el(CPUARMState *env)
      return target_el;
  }
--uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
+-static void output_vector_union_type(GString *s, int reg_width)
--                          uint32_t rn, uint32_t maxindex)
++static void output_vector_union_type(GString *s, int reg_width,
-+uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
++                                     const char *name)
 +                          uint32_t maxindex)
  {
--    uint32_t val;
+     struct TypeSize {
--    uint32_t tmp;
+         const char *gdb_type;
--    int index;
+@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
--    int shift;
+     };
--    uint64_t *table;
--    table = (uint64_t *)&env->vfp.regs[rn];
+     static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-+    uint32_t val, shift;
+-
-+    uint64_t *table = vn;
+-    g_autoptr(GString) ts = g_string_new("");
      int i, j, bits;
      /* First define types and totals in a whole VL */
      for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 -        int count = reg_width / vec_lanes[i].size;
 -        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
          g_string_append_printf(s,
 -                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
 -                               ts->str, vec_lanes[i].gdb_type, count);
 +                               "<vector id=\"%s%c%c\" type=\"%s\" count=\"%d\"/>",
 +                               name, vec_lanes[i].sz, vec_lanes[i].suffix,
 +                               vec_lanes[i].gdb_type, reg_width / vec_lanes[i].size);
      }
 +
-     val = 0;
+     /*
-     for (shift = 0; shift < 32; shift += 8) {
+      * Now define a union for each size group containing unsigned and
--        index = (ireg >> shift) & 0xff;
+      * signed and potentially float versions of each size from 128 to
-+        uint32_t index = (ireg >> shift) & 0xff;
+      * 8 bits.
-         if (index < maxindex) {
+      */
--            tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-+            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
-             val |= tmp << shift;
++        g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
-         } else {
+         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
-             val |= def & (0xff << shift);
+             if (vec_lanes[j].size == bits) {
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-index XXXXXXX..XXXXXXX 100644
+-                                       vec_lanes[j].suffix,
---- a/target/arm/translate.c
++                g_string_append_printf(s, "<field name=\"%c\" type=\"%s%c%c\"/>",
-+++ b/target/arm/translate.c
++                                       vec_lanes[j].suffix, name,
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                                        vec_lanes[j].sz, vec_lanes[j].suffix);
-                     tcg_gen_movi_i32(tmp, 0);
+             }
-                 }
+         }
-                 tmp2 = neon_load_reg(rm, 0);
+         g_string_append(s, "</union>");
--                tmp4 = tcg_const_i32(rn);
+     }
-+                ptr1 = vfp_reg_ptr(true, rn);
++
-                 tmp5 = tcg_const_i32(n);
+     /* And now the final union of unions */
--                gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
+-    g_string_append(s, "<union id=\"svev\">");
-+                gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp5);
++    g_string_append_printf(s, "<union id=\"%s\">", name);
-                 tcg_temp_free_i32(tmp);
+     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-                 if (insn & (1 << 6)) {
+-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-                     tmp = neon_load_reg(rd, 1);
+-                               suf[i], suf[i]);
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
++        g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
-                     tcg_gen_movi_i32(tmp, 0);
++                               suf[i], name, suf[i]);
-                 }
+     }
-                 tmp3 = neon_load_reg(rm, 1);
+     g_string_append(s, "</union>");
--                gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
+ }
-+                gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp5);
+@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
-                 tcg_temp_free_i32(tmp5);
+     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
--                tcg_temp_free_i32(tmp4);
-+                tcg_temp_free_ptr(ptr1);
+     /* Create the vector union type. */
-                 neon_store_reg(rd, 0, tmp2);
+-    output_vector_union_type(s, reg_width);
-                 neon_store_reg(rd, 1, tmp3);
++    output_vector_union_type(s, reg_width, "svev");
-                 tcg_temp_free_i32(tmp);
      /* Create the predicate vector type. */
      g_string_append_printf(s,
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 16/21] hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
+[PULL 09/21] target/arm: Simplify iteration over bit widths
-From: Luc MICHEL <luc.michel@git.antfield.fr>
+From: Richard Henderson <richard.henderson@linaro.org>
-When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is
+Order suf[] by the log8 of the width.
-, the non-secure BPR value is used. However, this value must be
+Use ARRAY_SIZE instead of hard-coding 128.
 incremented by one so that it matches the secure world number of
 implemented priority bits (NS world has one less priority bit compared
 to the Secure world).
-Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
+This changes the order of the union definitions,
-Message-id: 20180119145756.7629-5-luc.michel@greensocs.com
+but retains the order of the union-of-union members.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: add assert, as the gicv3 code has]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gic.c | 3 ++-
+ target/arm/gdbstub64.c | 10 ++++++----
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 6 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/target/arm/gdbstub64.c
-+++ b/hw/intc/arm_gic.c
++++ b/target/arm/gdbstub64.c
-@@ -XXX,XX +XXX,XX @@ static int gic_get_group_priority(GICState *s, int cpu, int irq)
+@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
-     if (gic_has_groups(s) &&
+         { "int8", 8, 'b', 's' },
-         !(s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) &&
+     };
-         GIC_TEST_GROUP(irq, (1 << cpu))) {
--        bpr = s->abpr[cpu];
+-    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-+        bpr = s->abpr[cpu] - 1;
+-    int i, j, bits;
-+        assert(bpr >= 0);
++    static const char suf[] = { 'b', 'h', 's', 'd', 'q' };
-     } else {
++    int i, j;
-         bpr = s->bpr[cpu];
      /* First define types and totals in a whole VL */
      for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
       * signed and potentially float versions of each size from 128 to
       * 8 bits.
       */
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +    for (i = 0; i < ARRAY_SIZE(suf); i++) {
 +        int bits = 8 << i;
 +
          g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
          for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
              if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
      /* And now the final union of unions */
      g_string_append_printf(s, "<union id=\"%s\">", name);
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +    for (i = ARRAY_SIZE(suf) - 1; i >= 0; i--) {
          g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
                                 suf[i], name, suf[i]);
      }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 21/21] pl110: Implement vertical compare/next base interrupts
+[PULL 10/21] target/arm: Create pauth_ptr_mask
-From: Linus Walleij <linus.walleij@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-This implements rudimentary support for interrupt generation on the
+Keep the logic for pauth within pauth_helper.c, and expose
-PL110. I am working on a new DRI/KMS driver for Linux and since that
+a helper function for use with the gdbstub pac extension.
 uses the blanking interrupt, we need something to fire here. Without
 any interrupt support Linux waits for a while and then gives ugly
 messages about the vblank not working in the console (it does not
 hang perpetually or anything though, DRI is pretty forgiving).
-I solved it for now by setting up a timer to fire at 60Hz and pull
-the interrupts for "vertical compare" and "next memory base"
-at this interval. This works fine and fires roughly the same number
-of IRQs on QEMU as on the hardware and leaves the console clean
-and nice.
-People who want to create more accurate emulation can probably work
-on top of this if need be. It is certainly closer to the hardware
-behaviour than what we have today anyway.
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
-Message-id: 20180123225654.5764-1-linus.walleij@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: folded long lines]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/display/pl110.c | 30 +++++++++++++++++++++++++++++-
+ target/arm/internals.h        | 10 ++++++++++
-file changed, 29 insertions(+), 1 deletion(-)
+ target/arm/tcg/pauth_helper.c | 26 ++++++++++++++++++++++----
 files changed, 32 insertions(+), 4 deletions(-)
-diff --git a/hw/display/pl110.c b/hw/display/pl110.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110.c
+--- a/target/arm/internals.h
-+++ b/hw/display/pl110.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
- #include "ui/console.h"
+ bool arm_singlestep_active(CPUARMState *env);
- #include "framebuffer.h"
+ bool arm_generate_debug_exceptions(CPUARMState *env);
- #include "ui/pixel_ops.h"
-+#include "qemu/timer.h"
++/**
- #include "qemu/log.h"
++ * pauth_ptr_mask:
++ * @env: cpu context
- #define PL110_CR_EN   0x001
++ * @ptr: selects between TTBR0 and TTBR1
-@@ -XXX,XX +XXX,XX @@
++ * @data: selects between TBI and TBID
- #define PL110_CR_BEBO 0x200
++ *
- #define PL110_CR_BEPO 0x400
++ * Return a mask of the bits of @ptr that contain the authentication code.
- #define PL110_CR_PWR  0x800
++ */
-+#define PL110_IE_NB   0x004
++uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
-+#define PL110_IE_VC   0x008
++
+ /* Add the cpreg definitions for debug related system registers */
- enum pl110_bppmode
+ void define_debug_regs(ARMCPU *cpu);
 diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/pauth_helper.c
 +++ b/target/arm/tcg/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
      return pac | ext | ptr;
  }
 -static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
 +static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
  {
-@@ -XXX,XX +XXX,XX @@ typedef struct PL110State {
+-    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
-     MemoryRegion iomem;
+-    uint64_t extfield = sextract64(ptr, 55, 1);
-     MemoryRegionSection fbsection;
+     int bot_pac_bit = 64 - param.tsz;
-     QemuConsole *con;
+     int top_pac_bit = 64 - 8 * param.tbi;
-+    QEMUTimer *vblank_timer;
+-    return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
-     int version;
++    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
-     uint32_t timing[4];
++}
-@@ -XXX,XX +XXX,XX @@ static void pl110_resize(PL110State *s, int width, int height)
++
- /* Update interrupts.  */
++static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
- static void pl110_update(PL110State *s)
++{
- {
++    uint64_t mask = pauth_ptr_mask_internal(param);
--  /* TODO: Implement interrupts.  */
++
-+    /* Raise IRQ if enabled and any status bit is 1 */
++    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
-+    if (s->int_status & s->int_mask) {
++    if (extract64(ptr, 55, 1)) {
-+        qemu_irq_raise(s->irq);
++        return ptr | mask;
 +    } else {
-+        qemu_irq_lower(s->irq);
++        return ptr & ~mask;
 +    }
 +}
 +
-+static void pl110_vblank_interrupt(void *opaque)
++uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
 +{
-+    PL110State *s = opaque;
++    ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
 +    ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
 +
-+    /* Fire the vertical compare and next base IRQs and re-arm */
++    return pauth_ptr_mask_internal(param);
 +    s->int_status |= (PL110_IE_NB | PL110_IE_VC);
 +    timer_mod(s->vblank_timer,
 +              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +                                NANOSECONDS_PER_SECOND / 60);
 +    pl110_update(s);
  }
- static uint64_t pl110_read(void *opaque, hwaddr offset,
+ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
@@ -XXX,XX +XXX,XX @@ static void pl110_write(void *opaque, hwaddr offset,
          s->bpp = (val >> 1) & 7;
          if (pl110_enabled(s)) {
              qemu_console_resize(s->con, s->cols, s->rows);
 +            timer_mod(s->vblank_timer,
 +                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +                                        NANOSECONDS_PER_SECOND / 60);
 +        } else {
 +            timer_del(s->vblank_timer);
          }
          break;
      case 10: /* LCDICR */
@@ -XXX,XX +XXX,XX @@ static void pl110_realize(DeviceState *dev, Error **errp)
      memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->irq);
 +    s->vblank_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                   pl110_vblank_interrupt, s);
      qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
      s->con = graphic_console_init(dev, 0, &pl110_gfx_ops, s);
  }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 04/21] target/arm: Use pointers in crypto helpers
+[PULL 11/21] target/arm: Implement gdbstub pauth extension
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than passing regnos to the helpers, pass pointers to the
+The extension is primarily defined by the Linux kernel NT_ARM_PAC_MASK
-vector registers directly.  This eliminates the need to pass in
+ptrace register set.
 the environment pointer and reduces the number of places that
 directly access env->vfp.regs[].
+The original gdb feature consists of two masks, data and code, which are
+used to mask out the authentication code within a pointer.  Following
+discussion with Luis Machado, add two more masks in order to support
+pointers within the high half of the address space (i.e. TTBR1 vs TTBR0).
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1105
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230227213329.793795-12-richard.henderson@linaro.org
 Message-id: 20180119045438.28582-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  18 ++---
+ configs/targets/aarch64-linux-user.mak    |  2 +-
- target/arm/crypto_helper.c | 184 +++++++++++++++++----------------------------
+ configs/targets/aarch64-softmmu.mak       |  2 +-
- target/arm/translate-a64.c |  75 ++++++++++--------
+ configs/targets/aarch64_be-linux-user.mak |  2 +-
- target/arm/translate.c     |  68 +++++++++--------
+ target/arm/internals.h                    |  2 ++
-files changed, 161 insertions(+), 184 deletions(-)
+ target/arm/gdbstub.c                      |  5 ++++
  target/arm/gdbstub64.c                    | 34 +++++++++++++++++++++++
  gdb-xml/aarch64-pauth.xml                 | 15 ++++++++++
 files changed, 59 insertions(+), 3 deletions(-)
  create mode 100644 gdb-xml/aarch64-pauth.xml
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/configs/targets/aarch64-linux-user.mak
-+++ b/target/arm/helper.h
++++ b/configs/targets/aarch64-linux-user.mak
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
+@@ -XXX,XX +XXX,XX @@
- DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
+ TARGET_ARCH=aarch64
- DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
+ TARGET_BASE_ARCH=arm
+-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
--DEF_HELPER_4(crypto_aese, void, env, i32, i32, i32)
++TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
--DEF_HELPER_4(crypto_aesmc, void, env, i32, i32, i32)
+ TARGET_HAS_BFLT=y
-+DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+ CONFIG_SEMIHOSTING=y
-+DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+ CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
+diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
 -DEF_HELPER_5(crypto_sha1_3reg, void, env, i32, i32, i32, i32)
 -DEF_HELPER_3(crypto_sha1h, void, env, i32, i32)
 -DEF_HELPER_3(crypto_sha1su1, void, env, i32, i32)
 +DEF_HELPER_FLAGS_4(crypto_sha1_3reg, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_2(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr)
 -DEF_HELPER_4(crypto_sha256h, void, env, i32, i32, i32)
 -DEF_HELPER_4(crypto_sha256h2, void, env, i32, i32, i32)
 -DEF_HELPER_3(crypto_sha256su0, void, env, i32, i32)
 -DEF_HELPER_4(crypto_sha256su1, void, env, i32, i32, i32)
 +DEF_HELPER_FLAGS_3(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 +DEF_HELPER_FLAGS_3(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 +DEF_HELPER_FLAGS_2(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_3(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
  DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
  DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/crypto_helper.c
+--- a/configs/targets/aarch64-softmmu.mak
-+++ b/target/arm/crypto_helper.c
++++ b/configs/targets/aarch64-softmmu.mak
-@@ -XXX,XX +XXX,XX @@ union CRYPTO_STATE {
+@@ -XXX,XX +XXX,XX @@
- #define CR_ST_WORD(state, i)   (state.words[i])
+ TARGET_ARCH=aarch64
  TARGET_BASE_ARCH=arm
  TARGET_SUPPORTS_MTTCG=y
 -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
 +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
  TARGET_NEED_FDT=y
 diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/aarch64_be-linux-user.mak
 +++ b/configs/targets/aarch64_be-linux-user.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=aarch64
  TARGET_BASE_ARCH=arm
  TARGET_BIG_ENDIAN=y
 -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
 +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
  TARGET_HAS_BFLT=y
  CONFIG_SEMIHOSTING=y
  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
  int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
 +int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg);
 +int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg);
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                       aarch64_gdb_set_fpu_reg,
 , "aarch64-fpu.xml", 0);
          }
 +        if (isar_feature_aa64_pauth(&cpu->isar)) {
 +            gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
 +                                     aarch64_gdb_set_pauth_reg,
 +                                     4, "aarch64-pauth.xml", 0);
 +        }
  #endif
+     } else {
--void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
+         if (arm_feature(env, ARM_FEATURE_NEON)) {
--                         uint32_t decrypt)
+diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
-+void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/target/arm/gdbstub64.c
-     static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
++++ b/target/arm/gdbstub64.c
-     static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
+@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
--
+     return 0;
 -    union CRYPTO_STATE rk = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 -    union CRYPTO_STATE st = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
 +    union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
      int i;
      assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
          CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
      }
 -    env->vfp.regs[rd] = make_float64(st.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
 +    rd[0] = st.l[0];
 +    rd[1] = st.l[1];
  }
--void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
++int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
 -                          uint32_t decrypt)
 +void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t decrypt)
  {
      static uint32_t const mc[][256] = { {
          /* MixColumns lookup table */
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
 x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
 xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
      } };
 -    union CRYPTO_STATE st = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
      int i;
      assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
              rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
      }
 -    env->vfp.regs[rd] = make_float64(st.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
 +    rd[0] = st.l[0];
 +    rd[1] = st.l[1];
  }
  /*
@@ -XXX,XX +XXX,XX @@ static uint32_t maj(uint32_t x, uint32_t y, uint32_t z)
      return (x & y) | ((x | y) & z);
  }
 -void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                              uint32_t rm, uint32_t op)
 +void HELPER(crypto_sha1_3reg)(void *vd, void *vn, void *vm, uint32_t op)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      if (op == 3) { /* sha1su0 */
          d.l[0] ^= d.l[1] ^ m.l[0];
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
              CR_ST_WORD(d, 0) = t;
          }
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha1h)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(m, 0) = ror32(CR_ST_WORD(m, 0), 2);
      CR_ST_WORD(m, 1) = CR_ST_WORD(m, 2) = CR_ST_WORD(m, 3) = 0;
 -    env->vfp.regs[rd] = make_float64(m.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(m.l[1]);
 +    rd[0] = m.l[0];
 +    rd[1] = m.l[1];
  }
 -void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha1su1)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) = rol32(CR_ST_WORD(d, 0) ^ CR_ST_WORD(m, 1), 1);
      CR_ST_WORD(d, 1) = rol32(CR_ST_WORD(d, 1) ^ CR_ST_WORD(m, 2), 1);
      CR_ST_WORD(d, 2) = rol32(CR_ST_WORD(d, 2) ^ CR_ST_WORD(m, 3), 1);
      CR_ST_WORD(d, 3) = rol32(CR_ST_WORD(d, 3) ^ CR_ST_WORD(d, 0), 1);
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
  /*
@@ -XXX,XX +XXX,XX @@ static uint32_t s1(uint32_t x)
      return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
  }
 -void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                            uint32_t rm)
 +void HELPER(crypto_sha256h)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      int i;
      for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
          CR_ST_WORD(d, 0) = t;
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                             uint32_t rm)
 +void HELPER(crypto_sha256h2)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      int i;
      for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
          CR_ST_WORD(d, 0) = CR_ST_WORD(n, 3 - i) + t;
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha256su0)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) += s0(CR_ST_WORD(d, 1));
      CR_ST_WORD(d, 1) += s0(CR_ST_WORD(d, 2));
      CR_ST_WORD(d, 2) += s0(CR_ST_WORD(d, 3));
      CR_ST_WORD(d, 3) += s0(CR_ST_WORD(m, 0));
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                              uint32_t rm)
 +void HELPER(crypto_sha256su1)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) += s1(CR_ST_WORD(m, 2)) + CR_ST_WORD(n, 1);
      CR_ST_WORD(d, 1) += s1(CR_ST_WORD(m, 3)) + CR_ST_WORD(n, 2);
      CR_ST_WORD(d, 2) += s1(CR_ST_WORD(d, 0)) + CR_ST_WORD(n, 3);
      CR_ST_WORD(d, 3) += s1(CR_ST_WORD(d, 1)) + CR_ST_WORD(m, 0);
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
  typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
  typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
  typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
 -typedef void CryptoTwoOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32);
 -typedef void CryptoThreeOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32, TCGv_i32);
 +typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
 +typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 +typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  /* initialize TCG globals.  */
  void a64_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static inline int vec_reg_offset(DisasContext *s, int regno,
      return offs;
  }
 +/* Return the offset info CPUARMState of the "whole" vector register Qn.  */
 +static inline int vec_full_reg_offset(DisasContext *s, int regno)
 +{
-+    assert_fp_access_checked(s);
++    switch (reg) {
-+    return offsetof(CPUARMState, vfp.regs[regno * 2]);
++    case 0: /* pauth_dmask */
 +    case 1: /* pauth_cmask */
 +    case 2: /* pauth_dmask_high */
 +    case 3: /* pauth_cmask_high */
 +        /*
 +         * Note that older versions of this feature only contained
 +         * pauth_{d,c}mask, for use with Linux user processes, and
 +         * thus exclusively in the low half of the address space.
 +         *
 +         * To support system mode, and to debug kernels, two new regs
 +         * were added to cover the high half of the address space.
 +         * For the purpose of pauth_ptr_mask, we can use any well-formed
 +         * address within the address space half -- here, 0 and -1.
 +         */
 +        {
 +            bool is_data = !(reg & 1);
 +            bool is_high = reg & 2;
 +            uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
 +            return gdb_get_reg64(buf, mask);
 +        }
 +    default:
 +        return 0;
 +    }
 +}
 +
-+/* Return a newly allocated pointer to the vector register.  */
++int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg)
 +static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
 +{
-+    TCGv_ptr ret = tcg_temp_new_ptr();
++    /* All pseudo registers are read-only. */
-+    tcg_gen_addi_ptr(ret, cpu_env, vec_full_reg_offset(s, regno));
++    return 0;
 +    return ret;
 +}
 +
- /* Return the offset into CPUARMState of a slice (from
+ static void output_vector_union_type(GString *s, int reg_width,
-  * the least significant end) of FP register Qn (ie
+                                      const char *name)
-  * Dn, Sn, Hn or Bn).
+ {
-@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
+diff --git a/gdb-xml/aarch64-pauth.xml b/gdb-xml/aarch64-pauth.xml
-     int rn = extract32(insn, 5, 5);
+new file mode 100644
-     int rd = extract32(insn, 0, 5);
+index XXXXXXX..XXXXXXX
-     int decrypt;
+--- /dev/null
--    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_decrypt;
++++ b/gdb-xml/aarch64-pauth.xml
--    CryptoThreeOpEnvFn *genfn;
+@@ -XXX,XX +XXX,XX @@
-+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
++<?xml version="1.0"?>
-+    TCGv_i32 tcg_decrypt;
++<!-- Copyright (C) 2018-2022 Free Software Foundation, Inc.
 +    CryptoThreeOpIntFn *genfn;
      if (!arm_dc_feature(s, ARM_FEATURE_V8_AES)
          || size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
          return;
      }
 -    /* Note that we convert the Vx register indexes into the
 -     * index within the vfp.regs[] array, so we can share the
 -     * helper with the AArch32 instructions.
 -     */
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
      tcg_decrypt = tcg_const_i32(decrypt);
 -    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_decrypt);
 +    genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_decrypt);
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
      tcg_temp_free_i32(tcg_decrypt);
  }
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
      int rm = extract32(insn, 16, 5);
      int rn = extract32(insn, 5, 5);
      int rd = extract32(insn, 0, 5);
 -    CryptoThreeOpEnvFn *genfn;
 -    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_rm_regno;
 +    CryptoThreeOpFn *genfn;
 +    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr;
      int feature = ARM_FEATURE_V8_SHA256;
      if (size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 -    tcg_rm_regno = tcg_const_i32(rm << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 +    tcg_rm_ptr = vec_full_reg_ptr(s, rm);
      if (genfn) {
 -        genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_rm_regno);
 +        genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr);
      } else {
          TCGv_i32 tcg_opcode = tcg_const_i32(opcode);
 -        gen_helper_crypto_sha1_3reg(cpu_env, tcg_rd_regno,
 -                                    tcg_rn_regno, tcg_rm_regno, tcg_opcode);
 +        gen_helper_crypto_sha1_3reg(tcg_rd_ptr, tcg_rn_ptr,
 +                                    tcg_rm_ptr, tcg_opcode);
          tcg_temp_free_i32(tcg_opcode);
      }
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 -    tcg_temp_free_i32(tcg_rm_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
 +    tcg_temp_free_ptr(tcg_rm_ptr);
  }
  /* Crypto two-reg SHA
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
      int opcode = extract32(insn, 12, 5);
      int rn = extract32(insn, 5, 5);
      int rd = extract32(insn, 0, 5);
 -    CryptoTwoOpEnvFn *genfn;
 +    CryptoTwoOpFn *genfn;
      int feature;
 -    TCGv_i32 tcg_rd_regno, tcg_rn_regno;
 +    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
      if (size != 0) {
          unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 -    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno);
 +    genfn(tcg_rd_ptr, tcg_rn_ptr);
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
  }
  /* C3.6 Data processing - SIMD, inc Crypto
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void neon_store_reg64(TCGv_i64 var, int reg)
      tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
  }
 +static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 +{
 +    TCGv_ptr ret = tcg_temp_new_ptr();
 +    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
 +    return ret;
 +}
 +
- #define tcg_gen_ld_f32 tcg_gen_ld_i32
++     Copying and distribution of this file, with or without modification,
- #define tcg_gen_ld_f64 tcg_gen_ld_i64
++     are permitted in any medium without royalty provided the copyright
- #define tcg_gen_st_f32 tcg_gen_st_i32
++     notice and this notice are preserved.  -->
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
++
-     int u;
++<!DOCTYPE feature SYSTEM "gdb-target.dtd">
-     uint32_t imm, mask;
++<feature name="org.gnu.gdb.aarch64.pauth">
-     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
++  <reg name="pauth_dmask" bitsize="64"/>
-+    TCGv_ptr ptr1, ptr2, ptr3;
++  <reg name="pauth_cmask" bitsize="64"/>
-     TCGv_i64 tmp64;
++  <reg name="pauth_dmask_high" bitsize="64"/>
++  <reg name="pauth_cmask_high" bitsize="64"/>
-     /* FIXME: this access check should not take precedence over UNDEF
++</feature>
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
++
                  if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                      return 1;
                  }
 -                tmp = tcg_const_i32(rd);
 -                tmp2 = tcg_const_i32(rn);
 -                tmp3 = tcg_const_i32(rm);
 +                ptr1 = vfp_reg_ptr(true, rd);
 +                ptr2 = vfp_reg_ptr(true, rn);
 +                ptr3 = vfp_reg_ptr(true, rm);
                  tmp4 = tcg_const_i32(size);
 -                gen_helper_crypto_sha1_3reg(cpu_env, tmp, tmp2, tmp3, tmp4);
 +                gen_helper_crypto_sha1_3reg(ptr1, ptr2, ptr3, tmp4);
                  tcg_temp_free_i32(tmp4);
              } else { /* SHA-256 */
                  if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256) || size == 3) {
                      return 1;
                  }
 -                tmp = tcg_const_i32(rd);
 -                tmp2 = tcg_const_i32(rn);
 -                tmp3 = tcg_const_i32(rm);
 +                ptr1 = vfp_reg_ptr(true, rd);
 +                ptr2 = vfp_reg_ptr(true, rn);
 +                ptr3 = vfp_reg_ptr(true, rm);
                  switch (size) {
                  case 0:
 -                    gen_helper_crypto_sha256h(cpu_env, tmp, tmp2, tmp3);
 +                    gen_helper_crypto_sha256h(ptr1, ptr2, ptr3);
                      break;
                  case 1:
 -                    gen_helper_crypto_sha256h2(cpu_env, tmp, tmp2, tmp3);
 +                    gen_helper_crypto_sha256h2(ptr1, ptr2, ptr3);
                      break;
                  case 2:
 -                    gen_helper_crypto_sha256su1(cpu_env, tmp, tmp2, tmp3);
 +                    gen_helper_crypto_sha256su1(ptr1, ptr2, ptr3);
                      break;
                  }
              }
 -            tcg_temp_free_i32(tmp);
 -            tcg_temp_free_i32(tmp2);
 -            tcg_temp_free_i32(tmp3);
 +            tcg_temp_free_ptr(ptr1);
 +            tcg_temp_free_ptr(ptr2);
 +            tcg_temp_free_ptr(ptr3);
              return 0;
          }
          if (size == 3 && op != NEON_3R_LOGIC) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          || ((rm | rd) & 1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
                       /* Bit 6 is the lowest opcode bit; it distinguishes between
                        * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                      tmp3 = tcg_const_i32(extract32(insn, 6, 1));
                      if (op == NEON_2RM_AESE) {
 -                        gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
 +                        gen_helper_crypto_aese(ptr1, ptr2, tmp3);
                      } else {
 -                        gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
 +                        gen_helper_crypto_aesmc(ptr1, ptr2, tmp3);
                      }
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      tcg_temp_free_i32(tmp3);
                      break;
                  case NEON_2RM_SHA1H:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          || ((rm | rd) & 1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
 -                    gen_helper_crypto_sha1h(cpu_env, tmp, tmp2);
 +                    gen_helper_crypto_sha1h(ptr1, ptr2);
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      break;
                  case NEON_2RM_SHA1SU1:
                      if ((rm | rd) & 1) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                      } else if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
                      if (q) {
 -                        gen_helper_crypto_sha256su0(cpu_env, tmp, tmp2);
 +                        gen_helper_crypto_sha256su0(ptr1, ptr2);
                      } else {
 -                        gen_helper_crypto_sha1su1(cpu_env, tmp, tmp2);
 +                        gen_helper_crypto_sha1su1(ptr1, ptr2);
                      }
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      break;
                  default:
                  elementwise:
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 17/21] hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
+[PULL 12/21] target/arm: Export arm_v7m_mrs_control
-From: Luc MICHEL <luc.michel@git.antfield.fr>
+From: David Reiss <dreiss@meta.com>
-When C_CTRL.CBPR is 1, the Non-Secure view of C_BPR is altered:
+Allow the function to be used outside of m_helper.c.
-  - A Non-Secure read of C_BPR should return the BPR value plus 1,
+Rename with an "arm_" prefix.
   saturated to 7,
   - A Non-Secure write should be ignored.
-Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
-Message-id: 20180119145756.7629-6-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: fixed comment typo]
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: David Reiss <dreiss@meta.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-13-richard.henderson@linaro.org
 [rth: Split out of a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gic.c | 16 +++++++++++++---
+ target/arm/internals.h    | 3 +++
-file changed, 13 insertions(+), 3 deletions(-)
+ target/arm/tcg/m_helper.c | 6 +++---
 files changed, 6 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/target/arm/internals.h
-+++ b/hw/intc/arm_gic.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
-         break;
+ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
-     case 0x08: /* Binary Point */
+ #endif
-         if (s->security_extn && !attrs.secure) {
--            /* BPR is banked. Non-secure copy stored in ABPR. */
++/* Read the CONTROL register as the MRS instruction would. */
--            *data = s->abpr[cpu];
++uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
-+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
++
-+                /* NS view of BPR when CBPR is 1 */
+ #ifdef CONFIG_USER_ONLY
-+                *data = MIN(s->bpr[cpu] + 1, 7);
+ static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
-+            } else {
+ #else
-+                /* BPR is banked. Non-secure copy stored in ABPR. */
+diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
-+                *data = s->abpr[cpu];
+index XXXXXXX..XXXXXXX 100644
-+            }
+--- a/target/arm/tcg/m_helper.c
-         } else {
++++ b/target/arm/tcg/m_helper.c
-             *data = s->bpr[cpu];
+@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
-         }
+     return xpsr_read(env) & mask;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
+ }
-         break;
-     case 0x08: /* Binary Point */
+-static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
-         if (s->security_extn && !attrs.secure) {
++uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
--            s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+ {
-+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
+     uint32_t value = env->v7m.control[secure];
-+                /* WI when CBPR is 1 */
-+                return MEMTX_OK;
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
-+            } else {
+     case 0 ... 7: /* xPSR sub-fields */
-+                s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+         return v7m_mrs_xpsr(env, reg, 0);
-+            }
+     case 20: /* CONTROL */
-         } else {
+-        return v7m_mrs_control(env, 0);
-             s->bpr[cpu] = MAX(value & 0x7, GIC_MIN_BPR);
++        return arm_v7m_mrs_control(env, 0);
-         }
+     default:
          /* Unprivileged reads others as zero.  */
          return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
      case 0 ... 7: /* xPSR sub-fields */
          return v7m_mrs_xpsr(env, reg, el);
      case 20: /* CONTROL */
 -        return v7m_mrs_control(env, env->v7m.secure);
 +        return arm_v7m_mrs_control(env, env->v7m.secure);
      case 0x94: /* CONTROL_NS */
          /*
           * We have to handle this here because unprivileged Secure code
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 02/21] i.MX: Fix FEC/ENET receive funtions
+[PULL 13/21] target/arm: Export arm_v7m_get_sp_ptr
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
+From: David Reiss <dreiss@meta.com>
-The actual imx_eth_enable_rx() function is buggy.
+Allow the function to be used outside of m_helper.c.
 Move to be outside of ifndef CONFIG_USER_ONLY block.
 Rename from get_v7m_sp_ptr.
-It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets().
-qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself
-is going to call imx_eth_enable_rx().
-By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets()
-we end up updating the register with an outdated value which might
-lead to disabling the receive function in the i.MX FEC/ENET device.
-This patch change the place where the register update is done so that the
-register value stays up to date and the receive function can keep
-running.
-Reported-by: Fyleo <fyleo45@gmail.com>
-Tested-by: Fyleo  <fyleo45@gmail.com>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 20180113113445.2705-1-jcd@tribudubois.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Signed-off-by: David Reiss <dreiss@meta.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-14-richard.henderson@linaro.org
 [rth: Split out of a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/imx_fec.c | 8 ++------
+ target/arm/internals.h    | 10 +++++
-file changed, 2 insertions(+), 6 deletions(-)
+ target/arm/tcg/m_helper.c | 84 +++++++++++++++++++--------------------
 files changed, 51 insertions(+), 43 deletions(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/target/arm/internals.h
-+++ b/hw/net/imx_fec.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
- static void imx_eth_enable_rx(IMXFECState *s, bool flush)
+ /* Read the CONTROL register as the MRS instruction would. */
  uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
 +/*
 + * Return a pointer to the location where we currently store the
 + * stack pointer for the requested security state and thread mode.
 + * This pointer will become invalid if the CPU state is updated
 + * such that the stack pointers are switched around (eg changing
 + * the SPSEL control bit).
 + */
 +uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure,
 +                             bool threadmode, bool spsel);
 +
  #ifdef CONFIG_USER_ONLY
  static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
  #else
 diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/m_helper.c
 +++ b/target/arm/tcg/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
      arm_rebuild_hflags(env);
  }
 -static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
 -                                bool spsel)
 -{
 -    /*
 -     * Return a pointer to the location where we currently store the
 -     * stack pointer for the requested security state and thread mode.
 -     * This pointer will become invalid if the CPU state is updated
 -     * such that the stack pointers are switched around (eg changing
 -     * the SPSEL control bit).
 -     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
 -     * Unlike that pseudocode, we require the caller to pass us in the
 -     * SPSEL control bit value; this is because we also use this
 -     * function in handling of pushing of the callee-saves registers
 -     * part of the v8M stack frame (pseudocode PushCalleeStack()),
 -     * and in the tailchain codepath the SPSEL bit comes from the exception
 -     * return magic LR value from the previous exception. The pseudocode
 -     * opencodes the stack-selection in PushCalleeStack(), but we prefer
 -     * to make this utility function generic enough to do the job.
 -     */
 -    bool want_psp = threadmode && spsel;
 -
 -    if (secure == env->v7m.secure) {
 -        if (want_psp == v7m_using_psp(env)) {
 -            return &env->regs[13];
 -        } else {
 -            return &env->v7m.other_sp;
 -        }
 -    } else {
 -        if (want_psp) {
 -            return &env->v7m.other_ss_psp;
 -        } else {
 -            return &env->v7m.other_ss_msp;
 -        }
 -    }
 -}
 -
  static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
                                  uint32_t *pvec)
  {
-     IMXFECBufDesc bd;
+@@ -XXX,XX +XXX,XX @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
--    bool rx_ring_full;
+             !mode;
-     imx_fec_read_bd(&bd, s->rx_descriptor);
+         mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
+-        frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
--    rx_ring_full = !(bd.flags & ENET_BD_E);
+-                                    lr & R_V7M_EXCRET_SPSEL_MASK);
-+    s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0;
++        frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
++                                        lr & R_V7M_EXCRET_SPSEL_MASK);
--    if (rx_ring_full) {
+         want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
-+    if (!s->regs[ENET_RDAR]) {
+         if (want_psp) {
-         FEC_PRINTF("RX buffer full\n");
+             limit = env->v7m.psplim[M_REG_S];
-     } else if (flush) {
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         qemu_flush_queued_packets(qemu_get_queue(s->nic));
+          * use 'frame_sp_p' after we do something that makes it invalid.
-     }
+          */
--
+         bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
--    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
+-        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
 -                                              return_to_secure,
 -                                              !return_to_handler,
 -                                              spsel);
 +        uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
 +                                                  !return_to_handler, spsel);
          uint32_t frameptr = *frame_sp_p;
          bool pop_ok = true;
          ARMMMUIdx mmu_idx;
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
          threadmode = !arm_v7m_is_handler_mode(env);
          spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
 -        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
 +        frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
          frameptr = *frame_sp_p;
          /*
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
  }
- static void imx_eth_reset(DeviceState *d)
+ #endif /* !CONFIG_USER_ONLY */
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
++
-     case ENET_RDAR:
++uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
-         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
++                             bool spsel)
-             if (!s->regs[index]) {
++{
--                s->regs[index] = ENET_RDAR_RDAR;
++    /*
-                 imx_eth_enable_rx(s, true);
++     * Return a pointer to the location where we currently store the
-             }
++     * stack pointer for the requested security state and thread mode.
-         } else {
++     * This pointer will become invalid if the CPU state is updated
 +     * such that the stack pointers are switched around (eg changing
 +     * the SPSEL control bit).
 +     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
 +     * Unlike that pseudocode, we require the caller to pass us in the
 +     * SPSEL control bit value; this is because we also use this
 +     * function in handling of pushing of the callee-saves registers
 +     * part of the v8M stack frame (pseudocode PushCalleeStack()),
 +     * and in the tailchain codepath the SPSEL bit comes from the exception
 +     * return magic LR value from the previous exception. The pseudocode
 +     * opencodes the stack-selection in PushCalleeStack(), but we prefer
 +     * to make this utility function generic enough to do the job.
 +     */
 +    bool want_psp = threadmode && spsel;
 +
 +    if (secure == env->v7m.secure) {
 +        if (want_psp == v7m_using_psp(env)) {
 +            return &env->regs[13];
 +        } else {
 +            return &env->v7m.other_sp;
 +        }
 +    } else {
 +        if (want_psp) {
 +            return &env->v7m.other_ss_psp;
 +        } else {
 +            return &env->v7m.other_ss_msp;
 +        }
 +    }
 +}
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 20/21] xilinx_spips: Correct usage of an uninitialized local variable
+[PULL 14/21] target/arm: Implement gdbstub m-profile systemreg and secext
-From: Francisco Iglesias <frasse.iglesias@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Coverity found that the variable tx_rx in the function
+The upstream gdb xml only implements {MSP,PSP}{,_NS,S}, but
-xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
+go ahead and implement the other system registers as well.
-patch corrects this by always initializing tx_rx to zeros.
+Since there is significant overlap between the two, implement
-Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+them with common code.  The only exception is the systemreg
-Message-id: 20180124215708.30400-1-frasse.iglesias@gmail.com
+view of CONTROL, which merges the banked bits as per MRS.
 Signed-off-by: David Reiss <dreiss@meta.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-15-richard.henderson@linaro.org
 [rth: Substatial rewrite using enumerator and shared code.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/xilinx_spips.c | 18 +++++++++++++++++-
+ target/arm/cpu.h     |   2 +
-file changed, 17 insertions(+), 1 deletion(-)
+ target/arm/gdbstub.c | 178 +++++++++++++++++++++++++++++++++++++++++++
+files changed, 180 insertions(+)
-diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
+--- a/target/arm/cpu.h
-+++ b/hw/ssi/xilinx_spips.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
- #define SNOOP_NONE 0xEE
- #define SNOOP_STRIPING 0
+     DynamicGDBXMLInfo dyn_sysreg_xml;
+     DynamicGDBXMLInfo dyn_svereg_xml;
-+#define MIN_NUM_BUSSES 1
++    DynamicGDBXMLInfo dyn_m_systemreg_xml;
-+#define MAX_NUM_BUSSES 2
++    DynamicGDBXMLInfo dyn_m_secextreg_xml;
-+
- static inline int num_effective_busses(XilinxSPIPS *s)
+     /* Timers used by the generic (architected) timer */
      QEMUTimer *gt_timer[NUM_GTIMERS];
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
      return cpu->dyn_sysreg_xml.num;
  }
 +typedef enum {
 +    M_SYSREG_MSP,
 +    M_SYSREG_PSP,
 +    M_SYSREG_PRIMASK,
 +    M_SYSREG_CONTROL,
 +    M_SYSREG_BASEPRI,
 +    M_SYSREG_FAULTMASK,
 +    M_SYSREG_MSPLIM,
 +    M_SYSREG_PSPLIM,
 +} MProfileSysreg;
 +
 +static const struct {
 +    const char *name;
 +    int feature;
 +} m_sysreg_def[] = {
 +    [M_SYSREG_MSP] = { "msp", ARM_FEATURE_M },
 +    [M_SYSREG_PSP] = { "psp", ARM_FEATURE_M },
 +    [M_SYSREG_PRIMASK] = { "primask", ARM_FEATURE_M },
 +    [M_SYSREG_CONTROL] = { "control", ARM_FEATURE_M },
 +    [M_SYSREG_BASEPRI] = { "basepri", ARM_FEATURE_M_MAIN },
 +    [M_SYSREG_FAULTMASK] = { "faultmask", ARM_FEATURE_M_MAIN },
 +    [M_SYSREG_MSPLIM] = { "msplim", ARM_FEATURE_V8 },
 +    [M_SYSREG_PSPLIM] = { "psplim", ARM_FEATURE_V8 },
 +};
 +
 +static uint32_t *m_sysreg_ptr(CPUARMState *env, MProfileSysreg reg, bool sec)
 +{
 +    uint32_t *ptr;
 +
 +    switch (reg) {
 +    case M_SYSREG_MSP:
 +        ptr = arm_v7m_get_sp_ptr(env, sec, false, true);
 +        break;
 +    case M_SYSREG_PSP:
 +        ptr = arm_v7m_get_sp_ptr(env, sec, true, true);
 +        break;
 +    case M_SYSREG_MSPLIM:
 +        ptr = &env->v7m.msplim[sec];
 +        break;
 +    case M_SYSREG_PSPLIM:
 +        ptr = &env->v7m.psplim[sec];
 +        break;
 +    case M_SYSREG_PRIMASK:
 +        ptr = &env->v7m.primask[sec];
 +        break;
 +    case M_SYSREG_BASEPRI:
 +        ptr = &env->v7m.basepri[sec];
 +        break;
 +    case M_SYSREG_FAULTMASK:
 +        ptr = &env->v7m.faultmask[sec];
 +        break;
 +    case M_SYSREG_CONTROL:
 +        ptr = &env->v7m.control[sec];
 +        break;
 +    default:
 +        return NULL;
 +    }
 +    return arm_feature(env, m_sysreg_def[reg].feature) ? ptr : NULL;
 +}
 +
 +static int m_sysreg_get(CPUARMState *env, GByteArray *buf,
 +                        MProfileSysreg reg, bool secure)
 +{
 +    uint32_t *ptr = m_sysreg_ptr(env, reg, secure);
 +
 +    if (ptr == NULL) {
 +        return 0;
 +    }
 +    return gdb_get_reg32(buf, *ptr);
 +}
 +
 +static int arm_gdb_get_m_systemreg(CPUARMState *env, GByteArray *buf, int reg)
 +{
 +    /*
 +     * Here, we emulate MRS instruction, where CONTROL has a mix of
 +     * banked and non-banked bits.
 +     */
 +    if (reg == M_SYSREG_CONTROL) {
 +        return gdb_get_reg32(buf, arm_v7m_mrs_control(env, env->v7m.secure));
 +    }
 +    return m_sysreg_get(env, buf, reg, env->v7m.secure);
 +}
 +
 +static int arm_gdb_set_m_systemreg(CPUARMState *env, uint8_t *buf, int reg)
 +{
 +    return 0; /* TODO */
 +}
 +
 +static int arm_gen_dynamic_m_systemreg_xml(CPUState *cs, int orig_base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    GString *s = g_string_new(NULL);
 +    int base_reg = orig_base_reg;
 +    int i;
 +
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.m-system\">\n");
 +
 +    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
 +        if (arm_feature(env, m_sysreg_def[i].feature)) {
 +            g_string_append_printf(s,
 +                "<reg name=\"%s\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +                m_sysreg_def[i].name, base_reg++);
 +        }
 +    }
 +
 +    g_string_append_printf(s, "</feature>");
 +    cpu->dyn_m_systemreg_xml.desc = g_string_free(s, false);
 +    cpu->dyn_m_systemreg_xml.num = base_reg - orig_base_reg;
 +
 +    return cpu->dyn_m_systemreg_xml.num;
 +}
 +
 +#ifndef CONFIG_USER_ONLY
 +/*
 + * For user-only, we see the non-secure registers via m_systemreg above.
 + * For secext, encode the non-secure view as even and secure view as odd.
 + */
 +static int arm_gdb_get_m_secextreg(CPUARMState *env, GByteArray *buf, int reg)
 +{
 +    return m_sysreg_get(env, buf, reg >> 1, reg & 1);
 +}
 +
 +static int arm_gdb_set_m_secextreg(CPUARMState *env, uint8_t *buf, int reg)
 +{
 +    return 0; /* TODO */
 +}
 +
 +static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    GString *s = g_string_new(NULL);
 +    int base_reg = orig_base_reg;
 +    int i;
 +
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.secext\">\n");
 +
 +    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
 +        g_string_append_printf(s,
 +            "<reg name=\"%s_ns\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +            m_sysreg_def[i].name, base_reg++);
 +        g_string_append_printf(s,
 +            "<reg name=\"%s_s\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +            m_sysreg_def[i].name, base_reg++);
 +    }
 +
 +    g_string_append_printf(s, "</feature>");
 +    cpu->dyn_m_secextreg_xml.desc = g_string_free(s, false);
 +    cpu->dyn_m_secextreg_xml.num = base_reg - orig_base_reg;
 +
 +    return cpu->dyn_m_secextreg_xml.num;
 +}
 +#endif
 +
  const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
  {
-     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
+     ARMCPU *cpu = ARM_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
+@@ -XXX,XX +XXX,XX @@ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
-     for (;;) {
+         return cpu->dyn_sysreg_xml.desc;
-         int i;
+     } else if (strcmp(xmlname, "sve-registers.xml") == 0) {
-         uint8_t tx = 0;
+         return cpu->dyn_svereg_xml.desc;
--        uint8_t tx_rx[num_effective_busses(s)];
++    } else if (strcmp(xmlname, "arm-m-system.xml") == 0) {
-+        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
++        return cpu->dyn_m_systemreg_xml.desc;
-         uint8_t dummy_cycles = 0;
++#ifndef CONFIG_USER_ONLY
-         uint8_t addr_length;
++    } else if (strcmp(xmlname, "arm-m-secext.xml") == 0) {
++        return cpu->dyn_m_secextreg_xml.desc;
-@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
++#endif
+     }
-     DB_PRINT_L(0, "realized spips\n");
+     return NULL;
+ }
-+    if (s->num_busses > MAX_NUM_BUSSES) {
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
-+        error_setg(errp,
+                              arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
-+                   "requested number of SPI busses %u exceeds maximum %d",
+                              "system-registers.xml", 0);
-+                   s->num_busses, MAX_NUM_BUSSES);
-+        return;
++    if (arm_feature(env, ARM_FEATURE_M)) {
-+    }
++        gdb_register_coprocessor(cs,
-+    if (s->num_busses < MIN_NUM_BUSSES) {
++            arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
-+        error_setg(errp,
++            arm_gen_dynamic_m_systemreg_xml(cs, cs->gdb_num_regs),
-+                   "requested number of SPI busses %u is below minimum %d",
++            "arm-m-system.xml", 0);
-+                   s->num_busses, MIN_NUM_BUSSES);
++#ifndef CONFIG_USER_ONLY
-+        return;
++        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-+    }
++            gdb_register_coprocessor(cs,
-+
++                arm_gdb_get_m_secextreg, arm_gdb_set_m_secextreg,
-     s->spi = g_new(SSIBus *, s->num_busses);
++                arm_gen_dynamic_m_secextreg_xml(cs, cs->gdb_num_regs),
-     for (i = 0; i < s->num_busses; ++i) {
++                "arm-m-secext.xml", 0);
-         char bus_name[16];
++        }
 +#endif
 +    }
  }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 10/21] target/arm: Add ARM_FEATURE_SVE
+[PULL 15/21] target/arm: Handle m-profile in arm_is_secure
 From: Richard Henderson <richard.henderson@linaro.org>
-Not enabled anywhere so far.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1421
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-11-richard.henderson@linaro.org
+Message-id: 20230227225832.816605-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 1 +
+ target/arm/cpu.h | 3 +++
-file changed, 1 insertion(+)
+file changed, 3 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
-     ARM_FEATURE_VBAR, /* has cp15 VBAR */
+ /* Return true if the processor is in secure state */
-     ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
+ static inline bool arm_is_secure(CPUARMState *env)
-     ARM_FEATURE_JAZELLE, /* has (trivial) Jazelle implementation */
+ {
-+    ARM_FEATURE_SVE, /* has Scalable Vector Extension */
++    if (arm_feature(env, ARM_FEATURE_M)) {
- };
++        return env->v7m.secure;
++    }
- static inline int arm_feature(CPUARMState *env, int feature)
+     if (arm_is_el3_or_mon(env)) {
          return true;
      }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 13/21] target/arm: Simplify fp_exception_el for user-only
+[PULL 16/21] target/arm: Stub arm_hcr_el2_eff for m-profile
 From: Richard Henderson <richard.henderson@linaro.org>
+M-profile doesn't have HCR_EL2.  While we could test features
+before each call, zero is a generally safe return value to
+disable the code in the caller.  This test is required to
+avoid an assert in arm_is_secure_below_el3.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-16-richard.henderson@linaro.org
+Message-id: 20230227225832.816605-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 3 ++-
+ target/arm/helper.c | 3 +++
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 3 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
+@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
-  */
- static inline int fp_exception_el(CPUARMState *env)
+ uint64_t arm_hcr_el2_eff(CPUARMState *env)
  {
-+#ifndef CONFIG_USER_ONLY
++    if (arm_feature(env, ARM_FEATURE_M)) {
-     int fpen;
++        return 0;
-     int cur_el = arm_current_el(env);
++    }
+     return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
          /* Trap all FP ops to EL3 */
          return 3;
      }
 -
 +#endif
      return 0;
  }
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 07/21] target/arm: Change the type of vfp.regs
+[PULL 17/21] target/arm: Diagnose incorrect usage of arm_is_secure subroutines
 From: Richard Henderson <richard.henderson@linaro.org>
-All direct users of this field want an integral value.  Drop all
+In several places we use arm_is_secure_below_el3 and
-of the extra casting between uint64_t and float64.
+arm_is_el3_or_mon separately from arm_is_secure.
 These functions make no sense for m-profile, and
 would indicate prior incorrect feature testing.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-6-richard.henderson@linaro.org
+Message-id: 20230227225832.816605-4-richard.henderson@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h           |  2 +-
+ target/arm/cpu.h | 5 ++++-
- target/arm/arch_dump.c     |  4 ++--
+file changed, 4 insertions(+), 1 deletion(-)
  target/arm/helper.c        | 20 ++++++++++----------
  target/arm/machine.c       |  2 +-
  target/arm/translate-a64.c |  8 ++++----
  target/arm/translate.c     |  2 +-
 files changed, 19 insertions(+), 19 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
-          * the two execution states, and means we do not need to explicitly
+ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
-          * map these registers when changing states.
-          */
+ #if !defined(CONFIG_USER_ONLY)
--        float64 regs[64];
+-/* Return true if exception levels below EL3 are in secure state,
-+        uint64_t regs[64];
++/*
++ * Return true if exception levels below EL3 are in secure state,
-         uint32_t xregs[16];
+  * or would be following an exception return to that level.
-         /* We store these fpcsr fields separately for convenience.  */
+  * Unlike arm_is_secure() (which is always a question about the
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+  * _current_ state of the CPU) this doesn't care about the current
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
---- a/target/arm/arch_dump.c
+  */
-+++ b/target/arm/arch_dump.c
+ static inline bool arm_is_secure_below_el3(CPUARMState *env)
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+ {
-     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
++    assert(!arm_feature(env, ARM_FEATURE_M));
+     if (arm_feature(env, ARM_FEATURE_EL3)) {
-     for (i = 0; i < 64; ++i) {
+         return !(env->cp15.scr_el3 & SCR_NS);
--        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+     } else {
-+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure_below_el3(CPUARMState *env)
-     }
+ /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
+ static inline bool arm_is_el3_or_mon(CPUARMState *env)
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
+ {
-@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
++    assert(!arm_feature(env, ARM_FEATURE_M));
-     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
+     if (arm_feature(env, ARM_FEATURE_EL3)) {
+         if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) {
-     for (i = 0; i < 32; ++i) {
+             /* CPU currently in AArch64 state and EL3 */
 -        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
 +        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
      }
      note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      /* VFP data registers are always little-endian.  */
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        stfq_le_p(buf, env->vfp.regs[reg]);
 +        stq_le_p(buf, env->vfp.regs[reg]);
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          /* Aliases for Q regs.  */
          nregs += 16;
          if (reg < nregs) {
 -            stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 -            stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 +            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 +            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        env->vfp.regs[reg] = ldfq_le_p(buf);
 +        env->vfp.regs[reg] = ldq_le_p(buf);
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          nregs += 16;
          if (reg < nregs) {
 -            env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
 -            env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
 +            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
 +            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        stfq_le_p(buf, env->vfp.regs[reg * 2]);
 -        stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
 +        stq_le_p(buf, env->vfp.regs[reg * 2]);
 +        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
          return 16;
      case 32:
          /* FPSR */
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        env->vfp.regs[reg * 2] = ldfq_le_p(buf);
 -        env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
 +        env->vfp.regs[reg * 2] = ldq_le_p(buf);
 +        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
          return 16;
      case 32:
          /* FPSR */
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vfp = {
      .minimum_version_id = 3,
      .needed = vfp_needed,
      .fields = (VMStateField[]) {
 -        VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 64),
 +        VMSTATE_UINT64_ARRAY(env.vfp.regs, ARMCPU, 64),
          /* The xregs array is a little awkward because element 1 (FPSCR)
           * requires a specific accessor, so we have to split it up in
           * the vmstate:
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
      if (flags & CPU_DUMP_FPU) {
          int numvfpregs = 32;
          for (i = 0; i < numvfpregs; i += 2) {
 -            uint64_t vlo = float64_val(env->vfp.regs[i * 2]);
 -            uint64_t vhi = float64_val(env->vfp.regs[(i * 2) + 1]);
 +            uint64_t vlo = env->vfp.regs[i * 2];
 +            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
              cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
                          i, vhi, vlo);
 -            vlo = float64_val(env->vfp.regs[(i + 1) * 2]);
 -            vhi = float64_val(env->vfp.regs[((i + 1) * 2) + 1]);
 +            vlo = env->vfp.regs[(i + 1) * 2];
 +            vhi = env->vfp.regs[((i + 1) * 2) + 1];
              cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
                          i + 1, vhi, vlo);
          }
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
              numvfpregs += 16;
          }
          for (i = 0; i < numvfpregs; i++) {
 -            uint64_t v = float64_val(env->vfp.regs[i]);
 +            uint64_t v = env->vfp.regs[i];
              cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                          i * 2, (uint32_t)v,
                          i * 2 + 1, (uint32_t)(v >> 32),
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 03/21] target/arm: Mark disas_set_insn_syndrome inline
+[PULL 18/21] target/arm: Rewrite check_s2_mmu_setup
 From: Richard Henderson <richard.henderson@linaro.org>
-If it isn't used when translate.h is included,
+Integrate neighboring code from get_phys_addr_lpae which computed
-we'll get a compiler Werror.
+starting level, as it is easier to validate when doing both at the
+same time.  Mirror the checks at the start of AArch{64,32}.S2Walk,
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+especially S2InvalidSL and S2InconsistentSL.
 This reverts 49ba115bb74, which was incorrect -- there is nothing
 in the ARM pseudocode that depends on TxSZ, i.e. outputsize; the
 pseudocode is consistent in referencing PAMax.
 Fixes: 49ba115bb74 ("target/arm: Pass outputsize down to check_s2_mmu_setup")
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230227225832.816605-5-richard.henderson@linaro.org
 Message-id: 20180119045438.28582-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.h | 2 +-
+ target/arm/ptw.c | 173 ++++++++++++++++++++++++++---------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 97 insertions(+), 76 deletions(-)
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
+--- a/target/arm/ptw.c
-+++ b/target/arm/translate.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
-             ? 3 : MAX(1, s->current_el);
+  * check_s2_mmu_setup
   * @cpu:        ARMCPU
   * @is_aa64:    True if the translation regime is in AArch64 state
 - * @startlevel: Suggested starting level
 - * @inputsize:  Bitsize of IPAs
 + * @tcr:        VTCR_EL2 or VSTCR_EL2
 + * @ds:         Effective value of TCR.DS.
 + * @iasize:     Bitsize of IPAs
   * @stride:     Page-table stride (See the ARM ARM)
   *
 - * Returns true if the suggested S2 translation parameters are OK and
 - * false otherwise.
 + * Decode the starting level of the S2 lookup, returning INT_MIN if
 + * the configuration is invalid.
   */
 -static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
 -                               int inputsize, int stride, int outputsize)
 +static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
 +                              bool ds, int iasize, int stride)
  {
 -    const int grainsize = stride + 3;
 -    int startsizecheck;
 -
 -    /*
 -     * Negative levels are usually not allowed...
 -     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
 -     * begins with level -1.  Note that previous feature tests will have
 -     * eliminated this combination if it is not enabled.
 -     */
 -    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
 -        return false;
 -    }
 -
 -    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
 -    if (startsizecheck < 1 || startsizecheck > stride + 4) {
 -        return false;
 -    }
 +    int sl0, sl2, startlevel, granulebits, levels;
 +    int s1_min_iasize, s1_max_iasize;
 +    sl0 = extract32(tcr, 6, 2);
      if (is_aa64) {
 +        /*
 +         * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
 +         * get_phys_addr_lpae, that used aa64_va_parameters which apply
 +         * to aarch64.  If Stage1 is aarch32, the min_txsz is larger.
 +         * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
 +         * inputsize is 64 - 24 = 40.
 +         */
 +        if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
 +            goto fail;
 +        }
 +
 +        /*
 +         * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
 +         * so interleave AArch64.S2StartLevel.
 +         */
          switch (stride) {
 -        case 13: /* 64KB Pages.  */
 -            if (level == 0 || (level == 1 && outputsize <= 42)) {
 -                return false;
 +        case 9: /* 4KB */
 +            /* SL2 is RES0 unless DS=1 & 4KB granule. */
 +            sl2 = extract64(tcr, 33, 1);
 +            if (ds && sl2) {
 +                if (sl0 != 0) {
 +                    goto fail;
 +                }
 +                startlevel = -1;
 +            } else {
 +                startlevel = 2 - sl0;
 +                switch (sl0) {
 +                case 2:
 +                    if (arm_pamax(cpu) < 44) {
 +                        goto fail;
 +                    }
 +                    break;
 +                case 3:
 +                    if (!cpu_isar_feature(aa64_st, cpu)) {
 +                        goto fail;
 +                    }
 +                    startlevel = 3;
 +                    break;
 +                }
              }
              break;
 -        case 11: /* 16KB Pages.  */
 -            if (level == 0 || (level == 1 && outputsize <= 40)) {
 -                return false;
 +        case 11: /* 16KB */
 +            switch (sl0) {
 +            case 2:
 +                if (arm_pamax(cpu) < 42) {
 +                    goto fail;
 +                }
 +                break;
 +            case 3:
 +                if (!ds) {
 +                    goto fail;
 +                }
 +                break;
              }
 +            startlevel = 3 - sl0;
              break;
 -        case 9: /* 4KB Pages.  */
 -            if (level == 0 && outputsize <= 42) {
 -                return false;
 +        case 13: /* 64KB */
 +            switch (sl0) {
 +            case 2:
 +                if (arm_pamax(cpu) < 44) {
 +                    goto fail;
 +                }
 +                break;
 +            case 3:
 +                goto fail;
              }
 +            startlevel = 3 - sl0;
              break;
          default:
              g_assert_not_reached();
          }
 -
 -        /* Inputsize checks.  */
 -        if (inputsize > outputsize &&
 -            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
 -            /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
 -            return false;
 -        }
      } else {
 -        /* AArch32 only supports 4KB pages. Assert on that.  */
 +        /*
 +         * Things are simpler for AArch32 EL2, with only 4k pages.
 +         * There is no separate S2InvalidSL function, but AArch32.S2Walk
 +         * begins with walkparms.sl0 in {'1x'}.
 +         */
          assert(stride == 9);
 -
 -        if (level == 0) {
 -            return false;
 +        if (sl0 >= 2) {
 +            goto fail;
          }
 +        startlevel = 2 - sl0;
      }
 -    return true;
 +
 +    /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
 +    levels = 3 - startlevel;
 +    granulebits = stride + 3;
 +
 +    s1_min_iasize = levels * stride + granulebits + 1;
 +    s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
 +
 +    if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
 +        return startlevel;
 +    }
 +
 + fail:
 +    return INT_MIN;
  }
--static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+ /**
-+static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
- {
+          */
-     /* We don't need to save all of the syndrome so we mask and shift
+         level = 4 - (inputsize - 4) / stride;
-      * out unneeded bits to help the sleb128 encoder do a better job.
+     } else {
 -        /*
 -         * For stage 2 translations the starting level is specified by the
 -         * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
 -         */
 -        uint32_t sl0 = extract32(tcr, 6, 2);
 -        uint32_t sl2 = extract64(tcr, 33, 1);
 -        int32_t startlevel;
 -        bool ok;
 -
 -        /* SL2 is RES0 unless DS=1 & 4kb granule. */
 -        if (param.ds && stride == 9 && sl2) {
 -            if (sl0 != 0) {
 -                level = 0;
 -                goto do_translation_fault;
 -            }
 -            startlevel = -1;
 -        } else if (!aarch64 || stride == 9) {
 -            /* AArch32 or 4KB pages */
 -            startlevel = 2 - sl0;
 -
 -            if (cpu_isar_feature(aa64_st, cpu)) {
 -                startlevel &= 3;
 -            }
 -        } else {
 -            /* 16KB or 64KB pages */
 -            startlevel = 3 - sl0;
 -        }
 -
 -        /* Check that the starting level is valid. */
 -        ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
 -                                inputsize, stride, outputsize);
 -        if (!ok) {
 +        int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
 +                                            inputsize, stride);
 +        if (startlevel == INT_MIN) {
 +            level = 0;
              goto do_translation_fault;
          }
          level = startlevel;
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 15/21] hw/intc/arm_gic: Fix C_RPR value on idle priority
+[PULL 19/21] hw: arm: Support direct boot for Linux/arm64 EFI zboot images
-From: Luc MICHEL <luc.michel@git.antfield.fr>
+From: Ard Biesheuvel <ardb@kernel.org>
-When there is no active interrupts in the GIC, a read to the C_RPR
+Fedora 39 will ship its arm64 kernels in the new generic EFI zboot
-register should return the value of the "Idle priority", which is either
+format, using gzip compression for the payload.
 the maximum value an IRQ priority field can be set to, or 0xff.
-Since the QEMU GIC model implements all the 8 priority bits, the Idle
+For doing EFI boot in QEMU, this is completely transparent, as the
-priority is 0xff.
+firmware or bootloader will take care of this. However, for direct
 kernel boot without firmware, we will lose the ability to boot such
 distro kernels unless we deal with the new format directly.
-Internally, when there is no active interrupt, the running priority
+EFI zboot images contain metadata in the header regarding the placement
-value is 0x100. The gic_get_running_priority function returns an uint8_t
+of the compressed payload inside the image, and the type of compression
-and thus, truncate this value to 0x00 when returning it. This is wrong since
+used. This means we can wire up the existing gzip support without too
-a value of 0x00 correspond to the maximum possible priority.
+much hassle, by parsing the header and grabbing the payload from inside
 the loaded zboot image.
-This commit fixes the returned value when the internal value is 0x100.
+Cc: Peter Maydell <peter.maydell@linaro.org>
+Cc: Alex Bennée <alex.bennee@linaro.org>
-Note that it is correct for the Non-Secure view to return 0xff even
+Cc: Richard Henderson <richard.henderson@linaro.org>
-though from the NS world point of view, only 7 priority bits are
+Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
-implemented. The specification states that the Idle priority can be 0xff
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
-even when not all the 8 priority bits are implemented. This has been
+Message-id: 20230303160109.3626966-1-ardb@kernel.org
 verified against a real GICv2 hardware on a Xilinx ZynqMP based board.
 Regarding the ARM11MPCore version of the GIC, the specification is not
 clear on that point, so this commit does not alter its behavior.
 Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
 Message-id: 20180119145756.7629-4-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: tweaked comment formatting, fixed checkpatch nits]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gic.c | 5 +++++
+ include/hw/loader.h | 19 ++++++++++
-file changed, 5 insertions(+)
+ hw/arm/boot.c       |  6 +++
  hw/core/loader.c    | 91 +++++++++++++++++++++++++++++++++++++++++++++
 files changed, 116 insertions(+)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/include/hw/loader.h b/include/hw/loader.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/include/hw/loader.h
-+++ b/hw/intc/arm_gic.c
++++ b/include/hw/loader.h
-@@ -XXX,XX +XXX,XX @@ static void gic_set_cpu_control(GICState *s, int cpu, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
+                                   uint8_t **buffer);
- static uint8_t gic_get_running_priority(GICState *s, int cpu, MemTxAttrs attrs)
+ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
- {
-+    if ((s->revision != REV_11MPCORE) && (s->running_priority[cpu] > 0xff)) {
++/**
-+        /* Idle priority */
++ * unpack_efi_zboot_image:
-+        return 0xff;
++ * @buffer: pointer to a variable holding the address of a buffer containing the
 + *          image
 + * @size: pointer to a variable holding the size of the buffer
 + *
 + * Check whether the buffer contains a EFI zboot image, and if it does, extract
 + * the compressed payload and decompress it into a new buffer. If successful,
 + * the old buffer is freed, and the *buffer and size variables pointed to by the
 + * function arguments are updated to refer to the newly populated buffer.
 + *
 + * Returns 0 if the image could not be identified as a EFI zboot image.
 + * Returns -1 if the buffer contents were identified as a EFI zboot image, but
 + * unpacking failed for any reason.
 + * Returns the size of the decompressed payload if decompression was performed
 + * successfully.
 + */
 +ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size);
 +
  #define ELF_LOAD_FAILED       -1
  #define ELF_LOAD_NOT_ELF      -2
  #define ELF_LOAD_WRONG_ARCH   -3
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
              return -1;
          }
          size = len;
 +
 +        /* Unpack the image if it is a EFI zboot image */
 +        if (unpack_efi_zboot_image(&buffer, &size) < 0) {
 +            g_free(buffer);
 +            return -1;
 +        }
      }
      /* check the arm64 magic header value -- very old kernels may not have it */
 diff --git a/hw/core/loader.c b/hw/core/loader.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/loader.c
 +++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
      return bytes;
  }
 +/* The PE/COFF MS-DOS stub magic number */
 +#define EFI_PE_MSDOS_MAGIC        "MZ"
 +
 +/*
 + * The Linux header magic number for a EFI PE/COFF
 + * image targetting an unspecified architecture.
 + */
 +#define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
 +
 +/*
 + * Bootable Linux kernel images may be packaged as EFI zboot images, which are
 + * self-decompressing executables when loaded via EFI. The compressed payload
 + * can also be extracted from the image and decompressed by a non-EFI loader.
 + *
 + * The de facto specification for this format is at the following URL:
 + *
 + * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
 + *
 + * This definition is based on Linux upstream commit 29636a5ce87beba.
 + */
 +struct linux_efi_zboot_header {
 +    uint8_t     msdos_magic[2];         /* PE/COFF 'MZ' magic number */
 +    uint8_t     reserved0[2];
 +    uint8_t     zimg[4];                /* "zimg" for Linux EFI zboot images */
 +    uint32_t    payload_offset;         /* LE offset to compressed payload */
 +    uint32_t    payload_size;           /* LE size of the compressed payload */
 +    uint8_t     reserved1[8];
 +    char        compression_type[32];   /* Compression type, NUL terminated */
 +    uint8_t     linux_magic[4];         /* Linux header magic */
 +    uint32_t    pe_header_offset;       /* LE offset to the PE header */
 +};
 +
 +/*
 + * Check whether *buffer points to a Linux EFI zboot image in memory.
 + *
 + * If it does, attempt to decompress it to a new buffer, and free the old one.
 + * If any of this fails, return an error to the caller.
 + *
 + * If the image is not a Linux EFI zboot image, do nothing and return success.
 + */
 +ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
 +{
 +    const struct linux_efi_zboot_header *header;
 +    uint8_t *data = NULL;
 +    int ploff, plsize;
 +    ssize_t bytes;
 +
 +    /* ignore if this is too small to be a EFI zboot image */
 +    if (*size < sizeof(*header)) {
 +        return 0;
 +    }
 +
-     if (s->security_extn && !attrs.secure) {
++    header = (struct linux_efi_zboot_header *)*buffer;
-         if (s->running_priority[cpu] & 0x80) {
++
-             /* Running priority in upper half of range: return the Non-secure
++    /* ignore if this is not a Linux EFI zboot image */
 +    if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
 +        memcmp(&header->zimg, "zimg", 4) != 0 ||
 +        memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
 +        return 0;
 +    }
 +
 +    if (strcmp(header->compression_type, "gzip") != 0) {
 +        fprintf(stderr,
 +                "unable to handle EFI zboot image with \"%.*s\" compression\n",
 +                (int)sizeof(header->compression_type) - 1,
 +                header->compression_type);
 +        return -1;
 +    }
 +
 +    ploff = ldl_le_p(&header->payload_offset);
 +    plsize = ldl_le_p(&header->payload_size);
 +
 +    if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
 +        fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
 +        return -1;
 +    }
 +
 +    data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
 +    bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
 +    if (bytes < 0) {
 +        fprintf(stderr, "failed to decompress EFI zboot image\n");
 +        g_free(data);
 +        return -1;
 +    }
 +
 +    g_free(*buffer);
 +    *buffer = g_realloc(data, bytes);
 +    *size = bytes;
 +    return bytes;
 +}
 +
  /*
   * Functions for reboot-persistent memory regions.
   *  - used for vga bios and option roms.
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 19/21] sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object
+[PULL 20/21] hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: qianfan Zhao <qianfanguijin@163.com>
-missed in 60765b6ceeb4.
+TWI_CNTR_INT_FLAG is W1C(write 1 to clear and write 0 has non-effect)
 register on SUN6i based SoCs, we should lower interrupt when the guest
 set this bit.
-  Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault.
+The linux kernel will hang in irq handler(mv64xxx_i2c_intr) if no
-  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
+device connected on the i2c bus, next is the trace log:
         as->root = root;
   (gdb) bt
   #0  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
   #1  0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564
   #2  0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151
   #3  0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966
   #4  0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20,
       errp=0x7fff7f931270) at qom/object.c:1906
   #5  0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60,
       name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+allwinner_i2c_write write   CNTR(0x0c): 0xc4 A_ACK BUS_EN INT_EN
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+allwinner_i2c_write write   CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
-Message-id: 20180123132051.24448-1-f4bug@amsat.org
+allwinner_i2c_read  read    CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
 allwinner_i2c_read  read    STAT(0x10): 0x20 STAT_M_ADDR_WR_NACK
 allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
 allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
 allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
 allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
 ...
 Fix it.
 Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
 Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
 Tested-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/sd/sdhci.h | 1 +
+ include/hw/i2c/allwinner-i2c.h |  6 ++++++
- hw/sd/sdhci.c         | 1 +
+ hw/i2c/allwinner-i2c.c         | 26 ++++++++++++++++++++++++--
-files changed, 2 insertions(+)
+files changed, 30 insertions(+), 2 deletions(-)
-diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
+diff --git a/include/hw/i2c/allwinner-i2c.h b/include/hw/i2c/allwinner-i2c.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/include/hw/i2c/allwinner-i2c.h
-+++ b/include/hw/sd/sdhci.h
++++ b/include/hw/i2c/allwinner-i2c.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@
-     /*< public >*/
+ #include "qom/object.h"
-     SDBus sdbus;
-     MemoryRegion iomem;
+ #define TYPE_AW_I2C "allwinner.i2c"
-+    AddressSpace sysbus_dma_as;
++
-     AddressSpace *dma_as;
++/** Allwinner I2C sun6i family and newer (A31, H2+, H3, etc) */
-     MemoryRegion *dma_mr;
++#define TYPE_AW_I2C_SUN6I    TYPE_AW_I2C "-sun6i"
++
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+ OBJECT_DECLARE_SIMPLE_TYPE(AWI2CState, AW_I2C)
  #define AW_I2C_MEM_SIZE         0x24
@@ -XXX,XX +XXX,XX @@ struct AWI2CState {
      uint8_t srst;
      uint8_t efr;
      uint8_t lcr;
 +
 +    bool irq_clear_inverted;
  };
  #endif /* ALLWINNER_I2C_H */
 diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sdhci.c
+--- a/hw/i2c/allwinner-i2c.c
-+++ b/hw/sd/sdhci.c
++++ b/hw/i2c/allwinner-i2c.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
+@@ -XXX,XX +XXX,XX @@ static void allwinner_i2c_write(void *opaque, hwaddr offset,
-     }
+                 s->stat = STAT_FROM_STA(STAT_IDLE);
+                 s->cntr &= ~TWI_CNTR_M_STP;
-     if (s->dma_mr) {
+             }
-+        s->dma_as = &s->sysbus_dma_as;
+-            if ((s->cntr & TWI_CNTR_INT_FLAG) == 0) {
-         address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
+-                /* Interrupt flag cleared */
-     } else {
++
-         /* use system_memory() if property "dma" not set */
++            if (!s->irq_clear_inverted && !(s->cntr & TWI_CNTR_INT_FLAG)) {
 +                /* Write 0 to clear this flag */
 +                qemu_irq_lower(s->irq);
 +            } else if (s->irq_clear_inverted && (s->cntr & TWI_CNTR_INT_FLAG)) {
 +                /* Write 1 to clear this flag */
 +                s->cntr &= ~TWI_CNTR_INT_FLAG;
                  qemu_irq_lower(s->irq);
              }
 +
              if ((s->cntr & TWI_CNTR_A_ACK) == 0) {
                  if (STAT_TO_STA(s->stat) == STAT_M_DATA_RX_ACK) {
                      s->stat = STAT_FROM_STA(STAT_M_DATA_RX_NACK);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_i2c_type_info = {
      .class_init = allwinner_i2c_class_init,
  };
 +static void allwinner_i2c_sun6i_init(Object *obj)
 +{
 +    AWI2CState *s = AW_I2C(obj);
 +
 +    s->irq_clear_inverted = true;
 +}
 +
 +static const TypeInfo allwinner_i2c_sun6i_type_info = {
 +    .name = TYPE_AW_I2C_SUN6I,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(AWI2CState),
 +    .instance_init = allwinner_i2c_sun6i_init,
 +    .class_init = allwinner_i2c_class_init,
 +};
 +
  static void allwinner_i2c_register_types(void)
  {
      type_register_static(&allwinner_i2c_type_info);
 +    type_register_static(&allwinner_i2c_sun6i_type_info);
  }
  type_init(allwinner_i2c_register_types)
 --
-.7.4
+.34.1

-[Qemu-devel] [PULL 14/21] hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
+[PULL 21/21] hw: arm: allwinner-h3: Fix and complete H3 i2c devices
-From: Luc MICHEL <luc.michel@git.antfield.fr>
+From: qianfan Zhao <qianfanguijin@163.com>
-In the GIC, when an IRQ is acknowledged, its state goes from "pending"
+Allwinner h3 has 4 twi(i2c) devices named twi0, twi1, twi2 and r_twi.
-to:
+The registers are compatible with TYPE_AW_I2C_SUN6I, write 1 to clear
-   - "active" if the corresponding IRQ pin has been de-asserted
+control register's INT_FLAG bit.
    - "active and pending" otherwise.
 The GICv2 manual states that when a IRQ becomes active (or active and
 pending), the GIC should either signal another (higher priority) IRQ to
 the CPU if there is one, or de-assert the CPU IRQ pin.
-The current implementation of the GIC in QEMU does not check if the
+Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
-IRQ is already active when looking for pending interrupts with
+Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
 sufficient priority in gic_update(). This can lead to signaling an
 interrupt that is already active.
 This usually happens when splitting priority drop and interrupt
 deactivation. On priority drop, the IRQ stays active until deactivation.
 If it becomes pending again, chances are that it will be incorrectly
 selected as best_irq in gic_update().
 This commit fixes this by checking if the IRQ is not already active when
 looking for best_irq in gic_update().
 Note that regarding the ARM11MPCore GIC version, the corresponding
 manual is not clear on that point, but it has has no priority
 drop/interrupt deactivation separation, so this case should not happen.
 Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
 Message-id: 20180119145756.7629-3-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gic.c | 1 +
+ include/hw/arm/allwinner-h3.h |  6 ++++++
-file changed, 1 insertion(+)
+ hw/arm/allwinner-h3.c         | 29 +++++++++++++++++++++++++----
 files changed, 31 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/include/hw/arm/allwinner-h3.h
-+++ b/hw/intc/arm_gic.c
++++ b/include/hw/arm/allwinner-h3.h
-@@ -XXX,XX +XXX,XX @@ void gic_update(GICState *s)
+@@ -XXX,XX +XXX,XX @@ enum {
-         best_irq = 1023;
+     AW_H3_DEV_UART3,
-         for (irq = 0; irq < s->num_irq; irq++) {
+     AW_H3_DEV_EMAC,
-             if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&
+     AW_H3_DEV_TWI0,
-+                (!GIC_TEST_ACTIVE(irq, cm)) &&
++    AW_H3_DEV_TWI1,
-                 (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {
++    AW_H3_DEV_TWI2,
-                 if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
+     AW_H3_DEV_DRAMCOM,
-                     best_prio = GIC_GET_PRIORITY(irq, cpu);
+     AW_H3_DEV_DRAMCTL,
      AW_H3_DEV_DRAMPHY,
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_DEV_GIC_VCPU,
      AW_H3_DEV_RTC,
      AW_H3_DEV_CPUCFG,
 +    AW_H3_DEV_R_TWI,
      AW_H3_DEV_SDRAM
  };
@@ -XXX,XX +XXX,XX @@ struct AwH3State {
      AwSidState sid;
      AwSdHostState mmc0;
      AWI2CState i2c0;
 +    AWI2CState i2c1;
 +    AWI2CState i2c2;
 +    AWI2CState r_twi;
      AwSun8iEmacState emac;
      AwRtcState rtc;
      GICState gic;
 diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/allwinner-h3.c
 +++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_DEV_UART2]      = 0x01c28800,
      [AW_H3_DEV_UART3]      = 0x01c28c00,
      [AW_H3_DEV_TWI0]       = 0x01c2ac00,
 +    [AW_H3_DEV_TWI1]       = 0x01c2b000,
 +    [AW_H3_DEV_TWI2]       = 0x01c2b400,
      [AW_H3_DEV_EMAC]       = 0x01c30000,
      [AW_H3_DEV_DRAMCOM]    = 0x01c62000,
      [AW_H3_DEV_DRAMCTL]    = 0x01c63000,
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
      [AW_H3_DEV_GIC_VCPU]   = 0x01c86000,
      [AW_H3_DEV_RTC]        = 0x01f00000,
      [AW_H3_DEV_CPUCFG]     = 0x01f01c00,
 +    [AW_H3_DEV_R_TWI]      = 0x01f02400,
      [AW_H3_DEV_SDRAM]      = 0x40000000
  };
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
      { "uart1",     0x01c28400, 1 * KiB },
      { "uart2",     0x01c28800, 1 * KiB },
      { "uart3",     0x01c28c00, 1 * KiB },
 -    { "twi1",      0x01c2b000, 1 * KiB },
 -    { "twi2",      0x01c2b400, 1 * KiB },
      { "scr",       0x01c2c400, 1 * KiB },
      { "gpu",       0x01c40000, 64 * KiB },
      { "hstmr",     0x01c60000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
      { "r_prcm",    0x01f01400, 1 * KiB },
      { "r_twd",     0x01f01800, 1 * KiB },
      { "r_cir-rx",  0x01f02000, 1 * KiB },
 -    { "r_twi",     0x01f02400, 1 * KiB },
      { "r_uart",    0x01f02800, 1 * KiB },
      { "r_pio",     0x01f02c00, 1 * KiB },
      { "r_pwm",     0x01f03800, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
      AW_H3_GIC_SPI_UART2     =  2,
      AW_H3_GIC_SPI_UART3     =  3,
      AW_H3_GIC_SPI_TWI0      =  6,
 +    AW_H3_GIC_SPI_TWI1      =  7,
 +    AW_H3_GIC_SPI_TWI2      =  8,
      AW_H3_GIC_SPI_TIMER0    = 18,
      AW_H3_GIC_SPI_TIMER1    = 19,
 +    AW_H3_GIC_SPI_R_TWI     = 44,
      AW_H3_GIC_SPI_MMC0      = 60,
      AW_H3_GIC_SPI_EHCI0     = 72,
      AW_H3_GIC_SPI_OHCI0     = 73,
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
      object_initialize_child(obj, "rtc", &s->rtc, TYPE_AW_RTC_SUN6I);
 -    object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C);
 +    object_initialize_child(obj, "twi0",  &s->i2c0,  TYPE_AW_I2C_SUN6I);
 +    object_initialize_child(obj, "twi1",  &s->i2c1,  TYPE_AW_I2C_SUN6I);
 +    object_initialize_child(obj, "twi2",  &s->i2c2,  TYPE_AW_I2C_SUN6I);
 +    object_initialize_child(obj, "r_twi", &s->r_twi, TYPE_AW_I2C_SUN6I);
  }
  static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c0), 0,
                         qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI0));
 +    sysbus_realize(SYS_BUS_DEVICE(&s->i2c1), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c1), 0, s->memmap[AW_H3_DEV_TWI1]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c1), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI1));
 +
 +    sysbus_realize(SYS_BUS_DEVICE(&s->i2c2), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c2), 0, s->memmap[AW_H3_DEV_TWI2]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c2), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI2));
 +
 +    sysbus_realize(SYS_BUS_DEVICE(&s->r_twi), &error_fatal);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->r_twi), 0, s->memmap[AW_H3_DEV_R_TWI]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->r_twi), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_R_TWI));
 +
      /* Unimplemented devices */
      for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
          create_unimplemented_device(unimplemented[i].device_name,
 --
-.7.4
+.34.1

Arm queue built up to a point where it seems worth sending:
various bug fixes, plus RTH's refactoring in preparation for SVE.

thanks
-- PMM
 
 
The following changes since commit 0f79bfe38a2cf0f43c7ea4959da7f8ebd7858f3d:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging (2018-01-25 09:53:53 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180125

for you to fetch changes up to 24da047af0e99a83fcc0d50b86c0f2627f7418b3:

pl110: Implement vertical compare/next base interrupts (2018-01-25 11:45:30 +0000)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix address truncation in 64-bit pagetable walks
 * i.MX: Fix FEC/ENET receive functions
 * target/arm: preparatory refactoring for SVE emulation
 * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
 * hw/intc/arm_gic: Fix C_RPR value on idle priority
 * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
 * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
 * hw/arm/virt: Check that the CPU realize method succeeded
 * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object
 * xilinx_spips: Correct usage of an uninitialized local variable
 * pl110: Implement vertical compare/next base interrupts

----------------------------------------------------------------
Ard Biesheuvel (1):
      target/arm: Fix 32-bit address truncation

Francisco Iglesias (1):
      xilinx_spips: Correct usage of an uninitialized local variable

Jean-Christophe Dubois (1):
      i.MX: Fix FEC/ENET receive funtions

Linus Walleij (1):
      pl110: Implement vertical compare/next base interrupts

Luc MICHEL (4):
      hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
      hw/intc/arm_gic: Fix C_RPR value on idle priority
      hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
      hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1

Peter Maydell (1):
      hw/arm/virt: Check that the CPU realize method succeeded

Philippe Mathieu-Daudé (1):
      sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object

Richard Henderson (11):
      target/arm: Mark disas_set_insn_syndrome inline
      target/arm: Use pointers in crypto helpers
      target/arm: Use pointers in neon zip/uzp helpers
      target/arm: Use pointers in neon tbl helper
      target/arm: Change the type of vfp.regs
      target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
      vmstate: Add VMSTATE_UINT64_SUB_ARRAY
      target/arm: Add ARM_FEATURE_SVE
      target/arm: Move cpu_get_tb_cpu_state out of line
      target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
      target/arm: Simplify fp_exception_el for user-only

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Commit ("3b39d734141a target/arm: Handle page table walk load failures
correctly") modified both versions of the page table walking code (i.e.,
arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
a temporary 'data' variable so that it can be inspected before being
returned. However, arm_ldq_ptw() returns an uint64_t, and using a
temporary uint32_t variable truncates the upper bits, corrupting the
result. This causes problems when using more than 4 GB of memory in
a TCG guest. So use a uint64_t instead.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     MemTxAttrs attrs = {};
     MemTxResult result = MEMTX_OK;
     AddressSpace *as;
-    uint32_t data;
+    uint64_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
-- 
2.7.4

From: Jean-Christophe Dubois <jcd@tribudubois.net>

The actual imx_eth_enable_rx() function is buggy.

It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets().

qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself
is going to call imx_eth_enable_rx().

By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets()
we end up updating the register with an outdated value which might
lead to disabling the receive function in the i.MX FEC/ENET device.

This patch change the place where the register update is done so that the
register value stays up to date and the receive function can keep
running.

Reported-by: Fyleo <fyleo45@gmail.com>
Tested-by: Fyleo  <fyleo45@gmail.com>
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 20180113113445.2705-1-jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
 static void imx_eth_enable_rx(IMXFECState *s, bool flush)
 {
     IMXFECBufDesc bd;
-    bool rx_ring_full;
 
     imx_fec_read_bd(&bd, s->rx_descriptor);
 
-    rx_ring_full = !(bd.flags & ENET_BD_E);
+    s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0;
 
-    if (rx_ring_full) {
+    if (!s->regs[ENET_RDAR]) {
         FEC_PRINTF("RX buffer full\n");
     } else if (flush) {
         qemu_flush_queued_packets(qemu_get_queue(s->nic));
     }
-
-    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
 }
 
 static void imx_eth_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
     case ENET_RDAR:
         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
             if (!s->regs[index]) {
-                s->regs[index] = ENET_RDAR_RDAR;
                 imx_eth_enable_rx(s, true);
             }
         } else {
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

If it isn't used when translate.h is included,
we'll get a compiler Werror.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
             ? 3 : MAX(1, s->current_el);
 }
 
-static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
 {
     /* We don't need to save all of the syndrome so we mask and shift
      * out unneeded bits to help the sleb128 encoder do a better job.
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Rather than passing regnos to the helpers, pass pointers to the
vector registers directly.  This eliminates the need to pass in
the environment pointer and reduces the number of places that
directly access env->vfp.regs[].

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  18 ++---
 target/arm/crypto_helper.c | 184 +++++++++++++++++----------------------------
 target/arm/translate-a64.c |  75 ++++++++++--------
 target/arm/translate.c     |  68 +++++++++--------
 4 files changed, 161 insertions(+), 184 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
 DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
 DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
 
-DEF_HELPER_4(crypto_aese, void, env, i32, i32, i32)
-DEF_HELPER_4(crypto_aesmc, void, env, i32, i32, i32)
+DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
-DEF_HELPER_5(crypto_sha1_3reg, void, env, i32, i32, i32, i32)
-DEF_HELPER_3(crypto_sha1h, void, env, i32, i32)
-DEF_HELPER_3(crypto_sha1su1, void, env, i32, i32)
+DEF_HELPER_FLAGS_4(crypto_sha1_3reg, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_2(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr)
 
-DEF_HELPER_4(crypto_sha256h, void, env, i32, i32, i32)
-DEF_HELPER_4(crypto_sha256h2, void, env, i32, i32, i32)
-DEF_HELPER_3(crypto_sha256su0, void, env, i32, i32)
-DEF_HELPER_4(crypto_sha256su1, void, env, i32, i32, i32)
+DEF_HELPER_FLAGS_3(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
+DEF_HELPER_FLAGS_3(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
+DEF_HELPER_FLAGS_2(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_3(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 
 DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ union CRYPTO_STATE {
 #define CR_ST_WORD(state, i)   (state.words[i])
 #endif
 
-void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
-                         uint32_t decrypt)
+void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
 {
     static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
     static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
-
-    union CRYPTO_STATE rk = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
-    union CRYPTO_STATE st = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
+    union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
     int i;
 
     assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
         CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
     }
 
-    env->vfp.regs[rd] = make_float64(st.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
+    rd[0] = st.l[0];
+    rd[1] = st.l[1];
 }
 
-void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
-                          uint32_t decrypt)
+void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t decrypt)
 {
     static uint32_t const mc[][256] = { {
         /* MixColumns lookup table */
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
         0x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
         0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
     } };
-    union CRYPTO_STATE st = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
     int i;
 
     assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
             rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
     }
 
-    env->vfp.regs[rd] = make_float64(st.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
+    rd[0] = st.l[0];
+    rd[1] = st.l[1];
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static uint32_t maj(uint32_t x, uint32_t y, uint32_t z)
     return (x & y) | ((x | y) & z);
 }
 
-void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                              uint32_t rm, uint32_t op)
+void HELPER(crypto_sha1_3reg)(void *vd, void *vn, void *vm, uint32_t op)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     if (op == 3) { /* sha1su0 */
         d.l[0] ^= d.l[1] ^ m.l[0];
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
             CR_ST_WORD(d, 0) = t;
         }
     }
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha1h)(void *vd, void *vm)
 {
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(m, 0) = ror32(CR_ST_WORD(m, 0), 2);
     CR_ST_WORD(m, 1) = CR_ST_WORD(m, 2) = CR_ST_WORD(m, 3) = 0;
 
-    env->vfp.regs[rd] = make_float64(m.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(m.l[1]);
+    rd[0] = m.l[0];
+    rd[1] = m.l[1];
 }
 
-void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha1su1)(void *vd, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) = rol32(CR_ST_WORD(d, 0) ^ CR_ST_WORD(m, 1), 1);
     CR_ST_WORD(d, 1) = rol32(CR_ST_WORD(d, 1) ^ CR_ST_WORD(m, 2), 1);
     CR_ST_WORD(d, 2) = rol32(CR_ST_WORD(d, 2) ^ CR_ST_WORD(m, 3), 1);
     CR_ST_WORD(d, 3) = rol32(CR_ST_WORD(d, 3) ^ CR_ST_WORD(d, 0), 1);
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static uint32_t s1(uint32_t x)
     return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
 }
 
-void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                            uint32_t rm)
+void HELPER(crypto_sha256h)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
         CR_ST_WORD(d, 0) = t;
     }
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                             uint32_t rm)
+void HELPER(crypto_sha256h2)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
         CR_ST_WORD(d, 0) = CR_ST_WORD(n, 3 - i) + t;
     }
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha256su0)(void *vd, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) += s0(CR_ST_WORD(d, 1));
     CR_ST_WORD(d, 1) += s0(CR_ST_WORD(d, 2));
     CR_ST_WORD(d, 2) += s0(CR_ST_WORD(d, 3));
     CR_ST_WORD(d, 3) += s0(CR_ST_WORD(m, 0));
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                              uint32_t rm)
+void HELPER(crypto_sha256su1)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) += s1(CR_ST_WORD(m, 2)) + CR_ST_WORD(n, 1);
     CR_ST_WORD(d, 1) += s1(CR_ST_WORD(m, 3)) + CR_ST_WORD(n, 2);
     CR_ST_WORD(d, 2) += s1(CR_ST_WORD(d, 0)) + CR_ST_WORD(n, 3);
     CR_ST_WORD(d, 3) += s1(CR_ST_WORD(d, 1)) + CR_ST_WORD(m, 0);
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
 typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
 typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
-typedef void CryptoTwoOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32);
-typedef void CryptoThreeOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32, TCGv_i32);
+typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
+typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
+typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void a64_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static inline int vec_reg_offset(DisasContext *s, int regno,
     return offs;
 }
 
+/* Return the offset info CPUARMState of the "whole" vector register Qn.  */
+static inline int vec_full_reg_offset(DisasContext *s, int regno)
+{
+    assert_fp_access_checked(s);
+    return offsetof(CPUARMState, vfp.regs[regno * 2]);
+}
+
+/* Return a newly allocated pointer to the vector register.  */
+static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vec_full_reg_offset(s, regno));
+    return ret;
+}
+
 /* Return the offset into CPUARMState of a slice (from
  * the least significant end) of FP register Qn (ie
  * Dn, Sn, Hn or Bn).
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
     int decrypt;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_decrypt;
-    CryptoThreeOpEnvFn *genfn;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
+    TCGv_i32 tcg_decrypt;
+    CryptoThreeOpIntFn *genfn;
 
     if (!arm_dc_feature(s, ARM_FEATURE_V8_AES)
         || size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Note that we convert the Vx register indexes into the
-     * index within the vfp.regs[] array, so we can share the
-     * helper with the AArch32 instructions.
-     */
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
     tcg_decrypt = tcg_const_i32(decrypt);
 
-    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_decrypt);
+    genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_decrypt);
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
     tcg_temp_free_i32(tcg_decrypt);
 }
 
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
     int rm = extract32(insn, 16, 5);
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
-    CryptoThreeOpEnvFn *genfn;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_rm_regno;
+    CryptoThreeOpFn *genfn;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr;
     int feature = ARM_FEATURE_V8_SHA256;
 
     if (size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
-    tcg_rm_regno = tcg_const_i32(rm << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
+    tcg_rm_ptr = vec_full_reg_ptr(s, rm);
 
     if (genfn) {
-        genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_rm_regno);
+        genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr);
     } else {
         TCGv_i32 tcg_opcode = tcg_const_i32(opcode);
 
-        gen_helper_crypto_sha1_3reg(cpu_env, tcg_rd_regno,
-                                    tcg_rn_regno, tcg_rm_regno, tcg_opcode);
+        gen_helper_crypto_sha1_3reg(tcg_rd_ptr, tcg_rn_ptr,
+                                    tcg_rm_ptr, tcg_opcode);
         tcg_temp_free_i32(tcg_opcode);
     }
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
-    tcg_temp_free_i32(tcg_rm_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
+    tcg_temp_free_ptr(tcg_rm_ptr);
 }
 
 /* Crypto two-reg SHA
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
     int opcode = extract32(insn, 12, 5);
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
-    CryptoTwoOpEnvFn *genfn;
+    CryptoTwoOpFn *genfn;
     int feature;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
 
     if (size != 0) {
         unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 
-    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno);
+    genfn(tcg_rd_ptr, tcg_rn_ptr);
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
 }
 
 /* C3.6 Data processing - SIMD, inc Crypto
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void neon_store_reg64(TCGv_i64 var, int reg)
     tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
 }
 
+static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
+    return ret;
+}
+
 #define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_ld_f64 tcg_gen_ld_i64
 #define tcg_gen_st_f32 tcg_gen_st_i32
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     int u;
     uint32_t imm, mask;
     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
+    TCGv_ptr ptr1, ptr2, ptr3;
     TCGv_i64 tmp64;
 
     /* FIXME: this access check should not take precedence over UNDEF
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                     return 1;
                 }
-                tmp = tcg_const_i32(rd);
-                tmp2 = tcg_const_i32(rn);
-                tmp3 = tcg_const_i32(rm);
+                ptr1 = vfp_reg_ptr(true, rd);
+                ptr2 = vfp_reg_ptr(true, rn);
+                ptr3 = vfp_reg_ptr(true, rm);
                 tmp4 = tcg_const_i32(size);
-                gen_helper_crypto_sha1_3reg(cpu_env, tmp, tmp2, tmp3, tmp4);
+                gen_helper_crypto_sha1_3reg(ptr1, ptr2, ptr3, tmp4);
                 tcg_temp_free_i32(tmp4);
             } else { /* SHA-256 */
                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256) || size == 3) {
                     return 1;
                 }
-                tmp = tcg_const_i32(rd);
-                tmp2 = tcg_const_i32(rn);
-                tmp3 = tcg_const_i32(rm);
+                ptr1 = vfp_reg_ptr(true, rd);
+                ptr2 = vfp_reg_ptr(true, rn);
+                ptr3 = vfp_reg_ptr(true, rm);
                 switch (size) {
                 case 0:
-                    gen_helper_crypto_sha256h(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256h(ptr1, ptr2, ptr3);
                     break;
                 case 1:
-                    gen_helper_crypto_sha256h2(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256h2(ptr1, ptr2, ptr3);
                     break;
                 case 2:
-                    gen_helper_crypto_sha256su1(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256su1(ptr1, ptr2, ptr3);
                     break;
                 }
             }
-            tcg_temp_free_i32(tmp);
-            tcg_temp_free_i32(tmp2);
-            tcg_temp_free_i32(tmp3);
+            tcg_temp_free_ptr(ptr1);
+            tcg_temp_free_ptr(ptr2);
+            tcg_temp_free_ptr(ptr3);
             return 0;
         }
         if (size == 3 && op != NEON_3R_LOGIC) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         || ((rm | rd) & 1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
 
                      /* Bit 6 is the lowest opcode bit; it distinguishes between
                       * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp3 = tcg_const_i32(extract32(insn, 6, 1));
 
                     if (op == NEON_2RM_AESE) {
-                        gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
+                        gen_helper_crypto_aese(ptr1, ptr2, tmp3);
                     } else {
-                        gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
+                        gen_helper_crypto_aesmc(ptr1, ptr2, tmp3);
                     }
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     tcg_temp_free_i32(tmp3);
                     break;
                 case NEON_2RM_SHA1H:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         || ((rm | rd) & 1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
 
-                    gen_helper_crypto_sha1h(cpu_env, tmp, tmp2);
+                    gen_helper_crypto_sha1h(ptr1, ptr2);
 
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     break;
                 case NEON_2RM_SHA1SU1:
                     if ((rm | rd) & 1) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     } else if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
                     if (q) {
-                        gen_helper_crypto_sha256su0(cpu_env, tmp, tmp2);
+                        gen_helper_crypto_sha256su0(ptr1, ptr2);
                     } else {
-                        gen_helper_crypto_sha1su1(cpu_env, tmp, tmp2);
+                        gen_helper_crypto_sha1su1(ptr1, ptr2);
                     }
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     break;
                 default:
                 elementwise:
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h      |  20 +++---
 target/arm/neon_helper.c | 162 +++++++++++++++++++++++++----------------------
 target/arm/translate.c   |  42 ++++++------
 3 files changed, 120 insertions(+), 104 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
 DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
 DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
 
-DEF_HELPER_3(neon_unzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_unzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip32, void, env, i32, i32)
-DEF_HELPER_3(neon_zip8, void, env, i32, i32)
-DEF_HELPER_3(neon_zip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
+DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
 
 DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon_helper.c
+++ b/target/arm/neon_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_acgt_f64)(uint64_t a, uint64_t b, void *fpstp)
 
 #define ELEM(V, N, SIZE) (((V) >> ((N) * (SIZE))) & ((1ull << (SIZE)) - 1))
 
-void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip8)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zd0, 2, 8) << 8)
         | (ELEM(zd0, 4, 8) << 16) | (ELEM(zd0, 6, 8) << 24)
         | (ELEM(zd1, 0, 8) << 32) | (ELEM(zd1, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zm0, 5, 8) << 16) | (ELEM(zm0, 7, 8) << 24)
         | (ELEM(zm1, 1, 8) << 32) | (ELEM(zm1, 3, 8) << 40)
         | (ELEM(zm1, 5, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip16)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zd0, 2, 16) << 16)
         | (ELEM(zd1, 0, 16) << 32) | (ELEM(zd1, 2, 16) << 48);
     uint64_t d1 = ELEM(zm0, 0, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 1, 16) << 32) | (ELEM(zd1, 3, 16) << 48);
     uint64_t m1 = ELEM(zm0, 1, 16) | (ELEM(zm0, 3, 16) << 16)
         | (ELEM(zm1, 1, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qunzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip32)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zd1, 0, 32) << 32);
     uint64_t d1 = ELEM(zm0, 0, 32) | (ELEM(zm1, 0, 32) << 32);
     uint64_t m0 = ELEM(zd0, 1, 32) | (ELEM(zd1, 1, 32) << 32);
     uint64_t m1 = ELEM(zm0, 1, 32) | (ELEM(zm1, 1, 32) << 32);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_unzip8)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zd, 2, 8) << 8)
         | (ELEM(zd, 4, 8) << 16) | (ELEM(zd, 6, 8) << 24)
         | (ELEM(zm, 0, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd, 5, 8) << 16) | (ELEM(zd, 7, 8) << 24)
         | (ELEM(zm, 1, 8) << 32) | (ELEM(zm, 3, 8) << 40)
         | (ELEM(zm, 5, 8) << 48) | (ELEM(zm, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_unzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_unzip16)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zd, 2, 16) << 16)
         | (ELEM(zm, 0, 16) << 32) | (ELEM(zm, 2, 16) << 48);
     uint64_t m0 = ELEM(zd, 1, 16) | (ELEM(zd, 3, 16) << 16)
         | (ELEM(zm, 1, 16) << 32) | (ELEM(zm, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip8)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zm0, 0, 8) << 8)
         | (ELEM(zd0, 1, 8) << 16) | (ELEM(zm0, 1, 8) << 24)
         | (ELEM(zd0, 2, 8) << 32) | (ELEM(zm0, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 5, 8) << 16) | (ELEM(zm1, 5, 8) << 24)
         | (ELEM(zd1, 6, 8) << 32) | (ELEM(zm1, 6, 8) << 40)
         | (ELEM(zd1, 7, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip16)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zm0, 0, 16) << 16)
         | (ELEM(zd0, 1, 16) << 32) | (ELEM(zm0, 1, 16) << 48);
     uint64_t d1 = ELEM(zd0, 2, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 1, 16) << 32) | (ELEM(zm1, 1, 16) << 48);
     uint64_t m1 = ELEM(zd1, 2, 16) | (ELEM(zm1, 2, 16) << 16)
         | (ELEM(zd1, 3, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip32)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zm0, 0, 32) << 32);
     uint64_t d1 = ELEM(zd0, 1, 32) | (ELEM(zm0, 1, 32) << 32);
     uint64_t m0 = ELEM(zd1, 0, 32) | (ELEM(zm1, 0, 32) << 32);
     uint64_t m1 = ELEM(zd1, 1, 32) | (ELEM(zm1, 1, 32) << 32);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_zip8)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zm, 0, 8) << 8)
         | (ELEM(zd, 1, 8) << 16) | (ELEM(zm, 1, 8) << 24)
         | (ELEM(zd, 2, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd, 5, 8) << 16) | (ELEM(zm, 5, 8) << 24)
         | (ELEM(zd, 6, 8) << 32) | (ELEM(zm, 6, 8) << 40)
         | (ELEM(zd, 7, 8) << 48) | (ELEM(zm, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_zip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_zip16)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zm, 0, 16) << 16)
         | (ELEM(zd, 1, 16) << 32) | (ELEM(zm, 1, 16) << 48);
     uint64_t m0 = ELEM(zd, 2, 16) | (ELEM(zm, 2, 16) << 16)
         | (ELEM(zd, 3, 16) << 32) | (ELEM(zm, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
 /* Helper function for 64 bit polynomial multiply case:
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 neon_get_scalar(int size, int reg)
 
 static int gen_neon_unzip(int rd, int rm, int size, int q)
 {
-    TCGv_i32 tmp, tmp2;
+    TCGv_ptr pd, pm;
+    
     if (!q && size == 2) {
         return 1;
     }
-    tmp = tcg_const_i32(rd);
-    tmp2 = tcg_const_i32(rm);
+    pd = vfp_reg_ptr(true, rd);
+    pm = vfp_reg_ptr(true, rm);
     if (q) {
         switch (size) {
         case 0:
-            gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip16(pd, pm);
             break;
         case 2:
-            gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip32(pd, pm);
             break;
         default:
             abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_unzip(int rd, int rm, int size, int q)
     } else {
         switch (size) {
         case 0:
-            gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_unzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_unzip16(pd, pm);
             break;
         default:
             abort();
         }
     }
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp2);
+    tcg_temp_free_ptr(pd);
+    tcg_temp_free_ptr(pm);
     return 0;
 }
 
 static int gen_neon_zip(int rd, int rm, int size, int q)
 {
-    TCGv_i32 tmp, tmp2;
+    TCGv_ptr pd, pm;
+
     if (!q && size == 2) {
         return 1;
     }
-    tmp = tcg_const_i32(rd);
-    tmp2 = tcg_const_i32(rm);
+    pd = vfp_reg_ptr(true, rd);
+    pm = vfp_reg_ptr(true, rm);
     if (q) {
         switch (size) {
         case 0:
-            gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip16(pd, pm);
             break;
         case 2:
-            gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip32(pd, pm);
             break;
         default:
             abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_zip(int rd, int rm, int size, int q)
     } else {
         switch (size) {
         case 0:
-            gen_helper_neon_zip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_zip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_zip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_zip16(pd, pm);
             break;
         default:
             abort();
         }
     }
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp2);
+    tcg_temp_free_ptr(pd);
+    tcg_temp_free_ptr(pm);
     return 0;
 }
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Rather than passing a regno to the helper, pass pointers to the
vector register directly.  This eliminates the need to pass in
the environment pointer and reduces the number of places that
directly access env->vfp.regs[].

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-5-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    |  2 +-
 target/arm/op_helper.c | 17 +++++++----------
 target/arm/translate.c |  8 ++++----
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_2(recpe_u32, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32, ptr)
-DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int exception_target_el(CPUARMState *env)
     return target_el;
 }
 
-uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
-                          uint32_t rn, uint32_t maxindex)
+uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
+                          uint32_t maxindex)
 {
-    uint32_t val;
-    uint32_t tmp;
-    int index;
-    int shift;
-    uint64_t *table;
-    table = (uint64_t *)&env->vfp.regs[rn];
+    uint32_t val, shift;
+    uint64_t *table = vn;
+
     val = 0;
     for (shift = 0; shift < 32; shift += 8) {
-        index = (ireg >> shift) & 0xff;
+        uint32_t index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
             val |= tmp << shift;
         } else {
             val |= def & (0xff << shift);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tcg_gen_movi_i32(tmp, 0);
                 }
                 tmp2 = neon_load_reg(rm, 0);
-                tmp4 = tcg_const_i32(rn);
+                ptr1 = vfp_reg_ptr(true, rn);
                 tmp5 = tcg_const_i32(n);
-                gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
+                gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp5);
                 tcg_temp_free_i32(tmp);
                 if (insn & (1 << 6)) {
                     tmp = neon_load_reg(rd, 1);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tcg_gen_movi_i32(tmp, 0);
                 }
                 tmp3 = neon_load_reg(rm, 1);
-                gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
+                gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp5);
                 tcg_temp_free_i32(tmp5);
-                tcg_temp_free_i32(tmp4);
+                tcg_temp_free_ptr(ptr1);
                 neon_store_reg(rd, 0, tmp2);
                 neon_store_reg(rd, 1, tmp3);
                 tcg_temp_free_i32(tmp);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

All direct users of this field want an integral value.  Drop all
of the extra casting between uint64_t and float64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-6-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  2 +-
 target/arm/arch_dump.c     |  4 ++--
 target/arm/helper.c        | 20 ++++++++++----------
 target/arm/machine.c       |  2 +-
 target/arm/translate-a64.c |  8 ++++----
 target/arm/translate.c     |  2 +-
 6 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          * the two execution states, and means we do not need to explicitly
          * map these registers when changing states.
          */
-        float64 regs[64];
+        uint64_t regs[64];
 
         uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 
     for (i = 0; i < 64; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
 
     for (i = 0; i < 32; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
     }
 
     note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     /* VFP data registers are always little-endian.  */
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        stfq_le_p(buf, env->vfp.regs[reg]);
+        stq_le_p(buf, env->vfp.regs[reg]);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         /* Aliases for Q regs.  */
         nregs += 16;
         if (reg < nregs) {
-            stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
-            stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
+            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
+            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        env->vfp.regs[reg] = ldfq_le_p(buf);
+        env->vfp.regs[reg] = ldq_le_p(buf);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         nregs += 16;
         if (reg < nregs) {
-            env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
-            env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
+            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
+            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        stfq_le_p(buf, env->vfp.regs[reg * 2]);
-        stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
+        stq_le_p(buf, env->vfp.regs[reg * 2]);
+        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
         return 16;
     case 32:
         /* FPSR */
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        env->vfp.regs[reg * 2] = ldfq_le_p(buf);
-        env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
+        env->vfp.regs[reg * 2] = ldq_le_p(buf);
+        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
         return 16;
     case 32:
         /* FPSR */
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vfp = {
     .minimum_version_id = 3,
     .needed = vfp_needed,
     .fields = (VMStateField[]) {
-        VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 64),
+        VMSTATE_UINT64_ARRAY(env.vfp.regs, ARMCPU, 64),
         /* The xregs array is a little awkward because element 1 (FPSCR)
          * requires a specific accessor, so we have to split it up in
          * the vmstate:
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
     if (flags & CPU_DUMP_FPU) {
         int numvfpregs = 32;
         for (i = 0; i < numvfpregs; i += 2) {
-            uint64_t vlo = float64_val(env->vfp.regs[i * 2]);
-            uint64_t vhi = float64_val(env->vfp.regs[(i * 2) + 1]);
+            uint64_t vlo = env->vfp.regs[i * 2];
+            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
             cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
                         i, vhi, vlo);
-            vlo = float64_val(env->vfp.regs[(i + 1) * 2]);
-            vhi = float64_val(env->vfp.regs[((i + 1) * 2) + 1]);
+            vlo = env->vfp.regs[(i + 1) * 2];
+            vhi = env->vfp.regs[((i + 1) * 2) + 1];
             cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
                         i + 1, vhi, vlo);
         }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
             numvfpregs += 16;
         }
         for (i = 0; i < numvfpregs; i++) {
-            uint64_t v = float64_val(env->vfp.regs[i]);
+            uint64_t v = env->vfp.regs[i];
             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                         i * 2, (uint32_t)v,
                         i * 2 + 1, (uint32_t)(v >> 32),
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Helpers that return a pointer into env->vfp.regs so that we isolate
the logic of how to index the regs array for different cpu modes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-7-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 27 +++++++++++++++++++++++++++
 linux-user/signal.c        | 22 ++++++++++++----------
 target/arm/arch_dump.c     |  8 +++++---
 target/arm/helper-a64.c    |  5 +++--
 target/arm/helper.c        | 32 ++++++++++++++++++++------------
 target/arm/kvm32.c         |  4 ++--
 target/arm/kvm64.c         | 31 ++++++++++---------------------
 target/arm/translate-a64.c | 25 ++++++++-----------------
 target/arm/translate.c     | 16 +++++++++-------
 9 files changed, 96 insertions(+), 74 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
     return cpu->el_change_hook_opaque;
 }
 
+/**
+ * aa32_vfp_dreg:
+ * Return a pointer to the Dn register within env in 32-bit mode.
+ */
+static inline uint64_t *aa32_vfp_dreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[regno];
+}
+
+/**
+ * aa32_vfp_qreg:
+ * Return a pointer to the Qn register within env in 32-bit mode.
+ */
+static inline uint64_t *aa32_vfp_qreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[2 * regno];
+}
+
+/**
+ * aa64_vfp_qreg:
+ * Return a pointer to the Qn register within env in 64-bit mode.
+ */
+static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[2 * regno];
+}
+
 #endif
diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ static int target_setup_sigframe(struct target_rt_sigframe *sf,
     }
 
     for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef TARGET_WORDS_BIGENDIAN
-        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
-        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
+        __put_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
+        __put_user(q[1], &aux->fpsimd.vregs[i * 2]);
 #else
-        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
-        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
+        __put_user(q[0], &aux->fpsimd.vregs[i * 2]);
+        __put_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
 #endif
     }
     __put_user(vfp_get_fpsr(env), &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static int target_restore_sigframe(CPUARMState *env,
     }
 
     for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef TARGET_WORDS_BIGENDIAN
-        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
-        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
+        __get_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
+        __get_user(q[1], &aux->fpsimd.vregs[i * 2]);
 #else
-        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
-        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
+        __get_user(q[0], &aux->fpsimd.vregs[i * 2]);
+        __get_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
 #endif
     }
     __get_user(fpsr, &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *setup_sigframe_v2_vfp(abi_ulong *regspace, CPUARMState *env)
     __put_user(TARGET_VFP_MAGIC, &vfpframe->magic);
     __put_user(sizeof(*vfpframe), &vfpframe->size);
     for (i = 0; i < 32; i++) {
-        __put_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
+        __put_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
     }
     __put_user(vfp_get_fpscr(env), &vfpframe->ufp.fpscr);
     __put_user(env->vfp.xregs[ARM_VFP_FPEXC], &vfpframe->ufp_exc.fpexc);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *restore_sigframe_v2_vfp(CPUARMState *env, abi_ulong *regspace)
         return 0;
     }
     for (i = 0; i < 32; i++) {
-        __get_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
+        __get_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
     }
     __get_user(fpscr, &vfpframe->ufp.fpscr);
     vfp_set_fpscr(env, fpscr);
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 
-    for (i = 0; i < 64; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+    for (i = 0; i < 32; ++i) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
+        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
 
     for (i = 0; i < 32; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+        note.vfp.vregs[i] = cpu_to_dump64(s, *aa32_vfp_dreg(env, i));
     }
 
     note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(simd_tbl)(CPUARMState *env, uint64_t result, uint64_t indices,
         if (index < 16 * numregs) {
             /* Convert index (a byte offset into the virtual table
              * which is a series of 128-bit vectors concatenated)
-             * into the correct vfp.regs[] element plus a bit offset
+             * into the correct register element plus a bit offset
              * into that element, bearing in mind that the table
              * can wrap around from V31 to V0.
              */
             int elt = (rn * 2 + (index >> 3)) % 64;
             int bitidx = (index & 7) * 8;
-            uint64_t val = extract64(env->vfp.regs[elt], bitidx, 8);
+            uint64_t *q = aa64_vfp_qreg(env, elt >> 1);
+            uint64_t val = extract64(q[elt & 1], bitidx, 8);
 
             result = deposit64(result, shift, 8, val);
         }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     /* VFP data registers are always little-endian.  */
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        stq_le_p(buf, env->vfp.regs[reg]);
+        stq_le_p(buf, *aa32_vfp_dreg(env, reg));
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         /* Aliases for Q regs.  */
         nregs += 16;
         if (reg < nregs) {
-            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
-            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
+            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
+            stq_le_p(buf, q[0]);
+            stq_le_p(buf + 8, q[1]);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        env->vfp.regs[reg] = ldq_le_p(buf);
+        *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         nregs += 16;
         if (reg < nregs) {
-            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
-            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
+            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
+            q[0] = ldq_le_p(buf);
+            q[1] = ldq_le_p(buf + 8);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        stq_le_p(buf, env->vfp.regs[reg * 2]);
-        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
-        return 16;
+        {
+            uint64_t *q = aa64_vfp_qreg(env, reg);
+            stq_le_p(buf, q[0]);
+            stq_le_p(buf + 8, q[1]);
+            return 16;
+        }
     case 32:
         /* FPSR */
         stl_p(buf, vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        env->vfp.regs[reg * 2] = ldq_le_p(buf);
-        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
-        return 16;
+        {
+            uint64_t *q = aa64_vfp_qreg(env, reg);
+            q[0] = ldq_le_p(buf);
+            q[1] = ldq_le_p(buf + 8);
+            return 16;
+        }
     case 32:
         /* FPSR */
         vfp_set_fpsr(env, ldl_p(buf));
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
-        r.addr = (uintptr_t)(&env->vfp.regs[i]);
+        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
-        r.addr = (uintptr_t)(&env->vfp.regs[i]);
+        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
         if (ret) {
             return ret;
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         }
     }
 
-    /* Advanced SIMD and FP registers
-     * We map Qn = regs[2n+1]:regs[2n]
-     */
+    /* Advanced SIMD and FP registers. */
     for (i = 0; i < 32; i++) {
-        int rd = i << 1;
-        uint64_t fp_val[2];
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef HOST_WORDS_BIGENDIAN
-        fp_val[0] = env->vfp.regs[rd + 1];
-        fp_val[1] = env->vfp.regs[rd];
+        uint64_t fp_val[2] = { q[1], q[0] };
+        reg.addr = (uintptr_t)fp_val;
 #else
-        fp_val[1] = env->vfp.regs[rd + 1];
-        fp_val[0] = env->vfp.regs[rd];
+        reg.addr = (uintptr_t)q;
 #endif
         reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)(&fp_val);
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         env->spsr = env->banked_spsr[i];
     }
 
-    /* Advanced SIMD and FP registers
-     * We map Qn = regs[2n+1]:regs[2n]
-     */
+    /* Advanced SIMD and FP registers */
     for (i = 0; i < 32; i++) {
-        uint64_t fp_val[2];
+        uint64_t *q = aa64_vfp_qreg(env, i);
         reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)(&fp_val);
+        reg.addr = (uintptr_t)q;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret) {
             return ret;
         } else {
-            int rd = i << 1;
 #ifdef HOST_WORDS_BIGENDIAN
-            env->vfp.regs[rd + 1] = fp_val[0];
-            env->vfp.regs[rd] = fp_val[1];
-#else
-            env->vfp.regs[rd + 1] = fp_val[1];
-            env->vfp.regs[rd] = fp_val[0];
+            uint64_t t;
+            t = q[0], q[0] = q[1], q[1] = t;
 #endif
         }
     }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
 
     if (flags & CPU_DUMP_FPU) {
         int numvfpregs = 32;
-        for (i = 0; i < numvfpregs; i += 2) {
-            uint64_t vlo = env->vfp.regs[i * 2];
-            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
-            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
-                        i, vhi, vlo);
-            vlo = env->vfp.regs[(i + 1) * 2];
-            vhi = env->vfp.regs[((i + 1) * 2) + 1];
-            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
-                        i + 1, vhi, vlo);
+        for (i = 0; i < numvfpregs; i++) {
+            uint64_t *q = aa64_vfp_qreg(env, i);
+            uint64_t vlo = q[0];
+            uint64_t vhi = q[1];
+            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "%c",
+                        i, vhi, vlo, (i & 1 ? '\n' : ' '));
         }
         cpu_fprintf(f, "FPCR: %08x  FPSR: %08x\n",
                     vfp_get_fpcr(env), vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
  */
 static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
 {
-    int offs = offsetof(CPUARMState, vfp.regs[regno * 2]);
-#ifdef HOST_WORDS_BIGENDIAN
-    offs += (8 - (1 << size));
-#endif
-    assert_fp_access_checked(s);
-    return offs;
+    return vec_reg_offset(s, regno, 0, size);
 }
 
 /* Offset of the high half of the 128 bit vector Qn */
 static inline int fp_reg_hi_offset(DisasContext *s, int regno)
 {
-    assert_fp_access_checked(s);
-    return offsetof(CPUARMState, vfp.regs[regno * 2 + 1]);
+    return vec_reg_offset(s, regno, 1, MO_64);
 }
 
 /* Convenience accessors for reading and writing single and double
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
 static inline long
 vfp_reg_offset (int dp, int reg)
 {
-    if (dp)
+    if (dp) {
         return offsetof(CPUARMState, vfp.regs[reg]);
-    else if (reg & 1) {
-        return offsetof(CPUARMState, vfp.regs[reg >> 1])
-          + offsetof(CPU_DoubleU, l.upper);
     } else {
-        return offsetof(CPUARMState, vfp.regs[reg >> 1])
-          + offsetof(CPU_DoubleU, l.lower);
+        long ofs = offsetof(CPUARMState, vfp.regs[reg >> 1]);
+        if (reg & 1) {
+            ofs += offsetof(CPU_DoubleU, l.upper);
+        } else {
+            ofs += offsetof(CPU_DoubleU, l.lower);
+        }
+        return ofs;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
             numvfpregs += 16;
         }
         for (i = 0; i < numvfpregs; i++) {
-            uint64_t v = env->vfp.regs[i];
+            uint64_t v = *aa32_vfp_dreg(env, i);
             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                         i * 2, (uint32_t)v,
                         i * 2 + 1, (uint32_t)(v >> 32),
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

At the same time, move VMSTATE_UINT32_SUB_ARRAY
beside the other UINT32 definitions.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-8-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/migration/vmstate.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_UINT32_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, 0)
 
+#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
+
 #define VMSTATE_UINT32_2DARRAY(_f, _s, _n1, _n2)                      \
     VMSTATE_UINT32_2DARRAY_V(_f, _s, _n1, _n2, 0)
 
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_UINT64_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, 0)
 
+#define VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)                \
+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint64, uint64_t)
+
 #define VMSTATE_UINT64_2DARRAY(_f, _s, _n1, _n2)                      \
     VMSTATE_UINT64_2DARRAY_V(_f, _s, _n1, _n2, 0)
 
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_INT32_ARRAY(_f, _s, _n)                               \
     VMSTATE_INT32_ARRAY_V(_f, _s, _n, 0)
 
-#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
-    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
-
 #define VMSTATE_INT64_ARRAY_V(_f, _s, _n, _v)                         \
     VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_int64, int64_t)
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-14-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 127 +---------------------------------------------------
 target/arm/helper.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 125 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
 #endif
 }
 
-/* Return the exception level to which FP-disabled exceptions should
- * be taken, or 0 if FP is enabled.
- */
-static inline int fp_exception_el(CPUARMState *env)
-{
-    int fpen;
-    int cur_el = arm_current_el(env);
-
-    /* CPACR and the CPTR registers don't exist before v6, so FP is
-     * always accessible
-     */
-    if (!arm_feature(env, ARM_FEATURE_V6)) {
-        return 0;
-    }
-
-    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
-     * 0, 2 : trap EL0 and EL1/PL1 accesses
-     * 1    : trap only EL0 accesses
-     * 3    : trap no accesses
-     */
-    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
-    switch (fpen) {
-    case 0:
-    case 2:
-        if (cur_el == 0 || cur_el == 1) {
-            /* Trap to PL1, which might be EL1 or EL3 */
-            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-                return 3;
-            }
-            return 1;
-        }
-        if (cur_el == 3 && !is_a64(env)) {
-            /* Secure PL1 running at EL3 */
-            return 3;
-        }
-        break;
-    case 1:
-        if (cur_el == 0) {
-            return 1;
-        }
-        break;
-    case 3:
-        break;
-    }
-
-    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
-     * check because zero bits in the registers mean "don't trap".
-     */
-
-    /* CPTR_EL2 : present in v7VE or v8 */
-    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
-        && !arm_is_secure_below_el3(env)) {
-        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
-        return 2;
-    }
-
-    /* CPTR_EL3 : present in v8 */
-    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
-        /* Trap all FP ops to EL3 */
-        return 3;
-    }
-
-    return 0;
-}
-
 #ifdef CONFIG_USER_ONLY
 static inline bool arm_cpu_bswap_data(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
 }
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
-{
-    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
-    if (is_a64(env)) {
-        *pc = env->pc;
-        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
-        /* Get control bits for tagged addresses */
-        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
-        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
-    } else {
-        *pc = env->regs[15];
-        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
-            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
-            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
-            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
-            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
-        if (!(access_secure_reg(env))) {
-            *flags |= ARM_TBFLAG_NS_MASK;
-        }
-        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
-            || arm_el_is_aa64(env, 1)) {
-            *flags |= ARM_TBFLAG_VFPEN_MASK;
-        }
-        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
-                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
-    }
-
-    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
-
-    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
-     * states defined in the ARM ARM for software singlestep:
-     *  SS_ACTIVE   PSTATE.SS   State
-     *     0            x       Inactive (the TB flag for SS is always 0)
-     *     1            0       Active-pending
-     *     1            1       Active-not-pending
-     */
-    if (arm_singlestep_active(env)) {
-        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
-        if (is_a64(env)) {
-            if (env->pstate & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
-            }
-        } else {
-            if (env->uncached_cpsr & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
-            }
-        }
-    }
-    if (arm_cpu_data_is_big_endian(env)) {
-        *flags |= ARM_TBFLAG_BE_DATA_MASK;
-    }
-    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
-
-    if (arm_v7m_is_handler_mode(env)) {
-        *flags |= ARM_TBFLAG_HANDLER_MASK;
-    }
-
-    *cs_base = 0;
-}
+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                          target_ulong *cs_base, uint32_t *flags);
 
 enum {
     QEMU_PSCI_CONDUIT_DISABLED = 0,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
     /* Linux crc32c converts the output to one's complement.  */
     return crc32c(acc, buf, bytes) ^ 0xffffffff;
 }
+
+/* Return the exception level to which FP-disabled exceptions should
+ * be taken, or 0 if FP is enabled.
+ */
+static inline int fp_exception_el(CPUARMState *env)
+{
+    int fpen;
+    int cur_el = arm_current_el(env);
+
+    /* CPACR and the CPTR registers don't exist before v6, so FP is
+     * always accessible
+     */
+    if (!arm_feature(env, ARM_FEATURE_V6)) {
+        return 0;
+    }
+
+    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
+     * 0, 2 : trap EL0 and EL1/PL1 accesses
+     * 1    : trap only EL0 accesses
+     * 3    : trap no accesses
+     */
+    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
+    switch (fpen) {
+    case 0:
+    case 2:
+        if (cur_el == 0 || cur_el == 1) {
+            /* Trap to PL1, which might be EL1 or EL3 */
+            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
+                return 3;
+            }
+            return 1;
+        }
+        if (cur_el == 3 && !is_a64(env)) {
+            /* Secure PL1 running at EL3 */
+            return 3;
+        }
+        break;
+    case 1:
+        if (cur_el == 0) {
+            return 1;
+        }
+        break;
+    case 3:
+        break;
+    }
+
+    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
+     * check because zero bits in the registers mean "don't trap".
+     */
+
+    /* CPTR_EL2 : present in v7VE or v8 */
+    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
+        && !arm_is_secure_below_el3(env)) {
+        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
+        return 2;
+    }
+
+    /* CPTR_EL3 : present in v8 */
+    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
+        /* Trap all FP ops to EL3 */
+        return 3;
+    }
+
+    return 0;
+}
+
+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                          target_ulong *cs_base, uint32_t *flags)
+{
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+    if (is_a64(env)) {
+        *pc = env->pc;
+        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+        /* Get control bits for tagged addresses */
+        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+    } else {
+        *pc = env->regs[15];
+        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
+            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
+            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
+            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
+        if (!(access_secure_reg(env))) {
+            *flags |= ARM_TBFLAG_NS_MASK;
+        }
+        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
+            || arm_el_is_aa64(env, 1)) {
+            *flags |= ARM_TBFLAG_VFPEN_MASK;
+        }
+        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
+                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
+    }
+
+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+
+    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
+     * states defined in the ARM ARM for software singlestep:
+     *  SS_ACTIVE   PSTATE.SS   State
+     *     0            x       Inactive (the TB flag for SS is always 0)
+     *     1            0       Active-pending
+     *     1            1       Active-not-pending
+     */
+    if (arm_singlestep_active(env)) {
+        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
+        if (is_a64(env)) {
+            if (env->pstate & PSTATE_SS) {
+                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+            }
+        } else {
+            if (env->uncached_cpsr & PSTATE_SS) {
+                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+            }
+        }
+    }
+    if (arm_cpu_data_is_big_endian(env)) {
+        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+    }
+    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+
+    if (arm_v7m_is_handler_mode(env)) {
+        *flags |= ARM_TBFLAG_HANDLER_MASK;
+    }
+
+    *cs_base = 0;
+}
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-15-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
 }
 
 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *flags)
+                          target_ulong *cs_base, uint32_t *pflags)
 {
     ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+    uint32_t flags;
+
     if (is_a64(env)) {
         *pc = env->pc;
-        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+        flags = ARM_TBFLAG_AARCH64_STATE_MASK;
         /* Get control bits for tagged addresses */
-        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
-        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+        flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+        flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
     } else {
         *pc = env->regs[15];
-        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+        flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
             | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
             | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
             | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
             | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
         if (!(access_secure_reg(env))) {
-            *flags |= ARM_TBFLAG_NS_MASK;
+            flags |= ARM_TBFLAG_NS_MASK;
         }
         if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
             || arm_el_is_aa64(env, 1)) {
-            *flags |= ARM_TBFLAG_VFPEN_MASK;
+            flags |= ARM_TBFLAG_VFPEN_MASK;
         }
-        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
-                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
+        flags |= (extract32(env->cp15.c15_cpar, 0, 2)
+                  << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
     }
 
-    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+    flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 
     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
      * states defined in the ARM ARM for software singlestep:
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
      *     1            1       Active-not-pending
      */
     if (arm_singlestep_active(env)) {
-        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
+        flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
         if (is_a64(env)) {
             if (env->pstate & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
             }
         } else {
             if (env->uncached_cpsr & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
             }
         }
     }
     if (arm_cpu_data_is_big_endian(env)) {
-        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+        flags |= ARM_TBFLAG_BE_DATA_MASK;
     }
-    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+    flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
 
     if (arm_v7m_is_handler_mode(env)) {
-        *flags |= ARM_TBFLAG_HANDLER_MASK;
+        flags |= ARM_TBFLAG_HANDLER_MASK;
     }
 
+    *pflags = flags;
     *cs_base = 0;
 }
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

In the GIC, when an IRQ is acknowledged, its state goes from "pending"
to:
   - "active" if the corresponding IRQ pin has been de-asserted
   - "active and pending" otherwise.
The GICv2 manual states that when a IRQ becomes active (or active and
pending), the GIC should either signal another (higher priority) IRQ to
the CPU if there is one, or de-assert the CPU IRQ pin.

The current implementation of the GIC in QEMU does not check if the
IRQ is already active when looking for pending interrupts with
sufficient priority in gic_update(). This can lead to signaling an
interrupt that is already active.

This usually happens when splitting priority drop and interrupt
deactivation. On priority drop, the IRQ stays active until deactivation.
If it becomes pending again, chances are that it will be incorrectly
selected as best_irq in gic_update().

This commit fixes this by checking if the IRQ is not already active when
looking for best_irq in gic_update().

Note that regarding the ARM11MPCore GIC version, the corresponding
manual is not clear on that point, but it has has no priority
drop/interrupt deactivation separation, so this case should not happen.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-3-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ void gic_update(GICState *s)
         best_irq = 1023;
         for (irq = 0; irq < s->num_irq; irq++) {
             if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&
+                (!GIC_TEST_ACTIVE(irq, cm)) &&
                 (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {
                 if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
                     best_prio = GIC_GET_PRIORITY(irq, cpu);
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When there is no active interrupts in the GIC, a read to the C_RPR
register should return the value of the "Idle priority", which is either
the maximum value an IRQ priority field can be set to, or 0xff.

Since the QEMU GIC model implements all the 8 priority bits, the Idle
priority is 0xff.

Internally, when there is no active interrupt, the running priority
value is 0x100. The gic_get_running_priority function returns an uint8_t
and thus, truncate this value to 0x00 when returning it. This is wrong since
a value of 0x00 correspond to the maximum possible priority.

This commit fixes the returned value when the internal value is 0x100.

Note that it is correct for the Non-Secure view to return 0xff even
though from the NS world point of view, only 7 priority bits are
implemented. The specification states that the Idle priority can be 0xff
even when not all the 8 priority bits are implemented. This has been
verified against a real GICv2 hardware on a Xilinx ZynqMP based board.

Regarding the ARM11MPCore version of the GIC, the specification is not
clear on that point, so this commit does not alter its behavior.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-4-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static void gic_set_cpu_control(GICState *s, int cpu, uint32_t value,
 
 static uint8_t gic_get_running_priority(GICState *s, int cpu, MemTxAttrs attrs)
 {
+    if ((s->revision != REV_11MPCORE) && (s->running_priority[cpu] > 0xff)) {
+        /* Idle priority */
+        return 0xff;
+    }
+
     if (s->security_extn && !attrs.secure) {
         if (s->running_priority[cpu] & 0x80) {
             /* Running priority in upper half of range: return the Non-secure
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is
0, the non-secure BPR value is used. However, this value must be
incremented by one so that it matches the secure world number of
implemented priority bits (NS world has one less priority bit compared
to the Secure world).

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-5-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: add assert, as the gicv3 code has]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static int gic_get_group_priority(GICState *s, int cpu, int irq)
     if (gic_has_groups(s) &&
         !(s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) &&
         GIC_TEST_GROUP(irq, (1 << cpu))) {
-        bpr = s->abpr[cpu];
+        bpr = s->abpr[cpu] - 1;
+        assert(bpr >= 0);
     } else {
         bpr = s->bpr[cpu];
     }
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When C_CTRL.CBPR is 1, the Non-Secure view of C_BPR is altered:
  - A Non-Secure read of C_BPR should return the BPR value plus 1,
  saturated to 7,
  - A Non-Secure write should be ignored.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-6-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: fixed comment typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
         break;
     case 0x08: /* Binary Point */
         if (s->security_extn && !attrs.secure) {
-            /* BPR is banked. Non-secure copy stored in ABPR. */
-            *data = s->abpr[cpu];
+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
+                /* NS view of BPR when CBPR is 1 */
+                *data = MIN(s->bpr[cpu] + 1, 7);
+            } else {
+                /* BPR is banked. Non-secure copy stored in ABPR. */
+                *data = s->abpr[cpu];
+            }
         } else {
             *data = s->bpr[cpu];
         }
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
         break;
     case 0x08: /* Binary Point */
         if (s->security_extn && !attrs.secure) {
-            s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
+                /* WI when CBPR is 1 */
+                return MEMTX_OK;
+            } else {
+                s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+            }
         } else {
             s->bpr[cpu] = MAX(value & 0x7, GIC_MIN_BPR);
         }
-- 
2.7.4

We were passing a NULL error pointer to the object_property_set_bool()
call that realizes the CPU object. This meant that we wouldn't detect
failure, and would plough blindly on to crash later trying to use a
NULL CPU object pointer. Detect errors and fail instead.

In particular, this will be necessary to detect the user error
of using "-cpu host" without "-enable-kvm" once we make the host
CPU type be registered unconditionally rather than only in
kvm_arch_init().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                      "secure-memory", &error_abort);
         }
 
-        object_property_set_bool(cpuobj, true, "realized", NULL);
+        object_property_set_bool(cpuobj, true, "realized", &error_fatal);
         object_unref(cpuobj);
     }
     fdt_add_timer_nodes(vms);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

missed in 60765b6ceeb4.

Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault.
  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  3050	    as->root = root;
  (gdb) bt
  #0  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  #1  0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564
  #2  0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151
  #3  0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966
  #4  0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20,
      errp=0x7fff7f931270) at qom/object.c:1906
  #5  0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60,
      name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180123132051.24448-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h | 1 +
 hw/sd/sdhci.c         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
+    AddressSpace sysbus_dma_as;
     AddressSpace *dma_as;
     MemoryRegion *dma_mr;
 
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     }
 
     if (s->dma_mr) {
+        s->dma_as = &s->sysbus_dma_as;
         address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
     } else {
         /* use system_memory() if property "dma" not set */
-- 
2.7.4

From: Francisco Iglesias <frasse.iglesias@gmail.com>

Coverity found that the variable tx_rx in the function
xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
patch corrects this by always initializing tx_rx to zeros.

Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20180124215708.30400-1-frasse.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@
 #define SNOOP_NONE 0xEE
 #define SNOOP_STRIPING 0
 
+#define MIN_NUM_BUSSES 1
+#define MAX_NUM_BUSSES 2
+
 static inline int num_effective_busses(XilinxSPIPS *s)
 {
     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
     for (;;) {
         int i;
         uint8_t tx = 0;
-        uint8_t tx_rx[num_effective_busses(s)];
+        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
         uint8_t dummy_cycles = 0;
         uint8_t addr_length;
 
@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
 
     DB_PRINT_L(0, "realized spips\n");
 
+    if (s->num_busses > MAX_NUM_BUSSES) {
+        error_setg(errp,
+                   "requested number of SPI busses %u exceeds maximum %d",
+                   s->num_busses, MAX_NUM_BUSSES);
+        return;
+    }
+    if (s->num_busses < MIN_NUM_BUSSES) {
+        error_setg(errp,
+                   "requested number of SPI busses %u is below minimum %d",
+                   s->num_busses, MIN_NUM_BUSSES);
+        return;
+    }
+
     s->spi = g_new(SSIBus *, s->num_busses);
     for (i = 0; i < s->num_busses; ++i) {
         char bus_name[16];
-- 
2.7.4

From: Linus Walleij <linus.walleij@linaro.org>

This implements rudimentary support for interrupt generation on the
PL110. I am working on a new DRI/KMS driver for Linux and since that
uses the blanking interrupt, we need something to fire here. Without
any interrupt support Linux waits for a while and then gives ugly
messages about the vblank not working in the console (it does not
hang perpetually or anything though, DRI is pretty forgiving).

I solved it for now by setting up a timer to fire at 60Hz and pull
the interrupts for "vertical compare" and "next memory base"
at this interval. This works fine and fires roughly the same number
of IRQs on QEMU as on the hardware and leaves the console clean
and nice.

People who want to create more accurate emulation can probably work
on top of this if need be. It is certainly closer to the hardware
behaviour than what we have today anyway.

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Message-id: 20180123225654.5764-1-linus.walleij@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: folded long lines]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/pl110.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "framebuffer.h"
 #include "ui/pixel_ops.h"
+#include "qemu/timer.h"
 #include "qemu/log.h"
 
 #define PL110_CR_EN   0x001
@@ -XXX,XX +XXX,XX @@
 #define PL110_CR_BEBO 0x200
 #define PL110_CR_BEPO 0x400
 #define PL110_CR_PWR  0x800
+#define PL110_IE_NB   0x004
+#define PL110_IE_VC   0x008
 
 enum pl110_bppmode
 {
@@ -XXX,XX +XXX,XX @@ typedef struct PL110State {
     MemoryRegion iomem;
     MemoryRegionSection fbsection;
     QemuConsole *con;
+    QEMUTimer *vblank_timer;
 
     int version;
     uint32_t timing[4];
@@ -XXX,XX +XXX,XX @@ static void pl110_resize(PL110State *s, int width, int height)
 /* Update interrupts.  */
 static void pl110_update(PL110State *s)
 {
-  /* TODO: Implement interrupts.  */
+    /* Raise IRQ if enabled and any status bit is 1 */
+    if (s->int_status & s->int_mask) {
+        qemu_irq_raise(s->irq);
+    } else {
+        qemu_irq_lower(s->irq);
+    }
+}
+
+static void pl110_vblank_interrupt(void *opaque)
+{
+    PL110State *s = opaque;
+
+    /* Fire the vertical compare and next base IRQs and re-arm */
+    s->int_status |= (PL110_IE_NB | PL110_IE_VC);
+    timer_mod(s->vblank_timer,
+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                                NANOSECONDS_PER_SECOND / 60);
+    pl110_update(s);
 }
 
 static uint64_t pl110_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void pl110_write(void *opaque, hwaddr offset,
         s->bpp = (val >> 1) & 7;
         if (pl110_enabled(s)) {
             qemu_console_resize(s->con, s->cols, s->rows);
+            timer_mod(s->vblank_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                                        NANOSECONDS_PER_SECOND / 60);
+        } else {
+            timer_del(s->vblank_timer);
         }
         break;
     case 10: /* LCDICR */
@@ -XXX,XX +XXX,XX @@ static void pl110_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq);
+    s->vblank_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                   pl110_vblank_interrupt, s);
     qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
     s->con = graphic_console_init(dev, 0, &pl110_gfx_ops, s);
 }
-- 
2.7.4

The following changes since commit f003dd8d81f7d88f4b1f8802309eaa76f6eb223a:

Merge tag 'pull-tcg-20230305' of https://gitlab.com/rth7680/qemu into staging (2023-03-06 10:20:04 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230306

for you to fetch changes up to 2ddc45954f97cd1d7ee5cbca0def05e980d1da9f:

hw: arm: allwinner-h3: Fix and complete H3 i2c devices (2023-03-06 15:31:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * allwinner-h3: Fix I2C controller model for Sun6i SoCs
 * allwinner-h3: Add missing i2c controllers
 * Expose M-profile system registers to gdbstub
 * Expose pauth information to gdbstub
 * Support direct boot for Linux/arm64 EFI zboot images
 * Fix incorrect stage 2 MMU setup validation

----------------------------------------------------------------
Ard Biesheuvel (1):
      hw: arm: Support direct boot for Linux/arm64 EFI zboot images

David Reiss (2):
      target/arm: Export arm_v7m_mrs_control
      target/arm: Export arm_v7m_get_sp_ptr

Richard Henderson (16):
      target/arm: Normalize aarch64 gdbstub get/set function names
      target/arm: Unexport arm_gen_dynamic_sysreg_xml
      target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
      target/arm: Split out output_vector_union_type
      target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
      target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
      target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
      target/arm: Add name argument to output_vector_union_type
      target/arm: Simplify iteration over bit widths
      target/arm: Create pauth_ptr_mask
      target/arm: Implement gdbstub pauth extension
      target/arm: Implement gdbstub m-profile systemreg and secext
      target/arm: Handle m-profile in arm_is_secure
      target/arm: Stub arm_hcr_el2_eff for m-profile
      target/arm: Diagnose incorrect usage of arm_is_secure subroutines
      target/arm: Rewrite check_s2_mmu_setup

qianfan Zhao (2):
      hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
      hw: arm: allwinner-h3: Fix and complete H3 i2c devices

From: Richard Henderson <richard.henderson@linaro.org>

Make the form of the function names between fp and sve the same:
  - arm_gdb_*_svereg -> aarch64_gdb_*_sve_reg.
  - aarch64_fpu_gdb_*_reg -> aarch64_gdb_*_fpu_reg.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 8 ++++----
 target/arm/gdbstub.c   | 9 +++++----
 target/arm/gdbstub64.c | 8 ++++----
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 }
 
 #ifdef TARGET_AARCH64
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
          */
 #ifdef TARGET_AARCH64
         if (isar_feature_aa64_sve(&cpu->isar)) {
-            gdb_register_coprocessor(cs, arm_gdb_get_svereg, arm_gdb_set_svereg,
-                                     arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs),
+            int nreg = arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs);
+            gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
+                                     aarch64_gdb_set_sve_reg, nreg,
                                      "sve-registers.xml", 0);
         } else {
-            gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
-                                     aarch64_fpu_gdb_set_reg,
+            gdb_register_coprocessor(cs, aarch64_gdb_get_fpu_reg,
+                                     aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
 #endif
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     return 0;
 }
 
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg)
 {
     switch (reg) {
     case 0 ... 31:
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
     }
 }
 
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     switch (reg) {
     case 0 ... 31:
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     }
 }
 
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg)
 {
     ARMCPU *cpu = env_archcpu(env);
 
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
     return 0;
 }
 
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg)
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     ARMCPU *cpu = env_archcpu(env);
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is not used outside gdbstub.c.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 1 -
 target/arm/gdbstub.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  * Helpers to dynamically generates XML descriptions of the sysregs
  * and SVE registers. Returns the number of registers in each set.
  */
-int arm_gen_dynamic_sysreg_xml(CPUState *cpu, int base_reg);
 int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
 
 /* Returns the dynamically generated XML for the gdb stub.
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
     }
 }
 
-int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
+static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     GString *s = g_string_new(NULL);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The function is only used for aarch64, so move it to the
file that has the other aarch64 gdbstub stuff.  Move the
declaration to internals.h.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |   6 ---
 target/arm/internals.h |   1 +
 target/arm/gdbstub.c   | 120 -----------------------------------------
 target/arm/gdbstub64.c | 118 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 119 insertions(+), 126 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
 int arm_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
-/*
- * Helpers to dynamically generates XML descriptions of the sysregs
- * and SVE registers. Returns the number of registers in each set.
- */
-int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
-
 /* Returns the dynamically generated XML for the gdb stub.
  * Returns a pointer to the XML contents for the specified XML file or NULL
  * if the XML name doesn't match the predefined one.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 }
 
 #ifdef TARGET_AARCH64
+int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
 int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
     return cpu->dyn_sysreg_xml.num;
 }
 
-struct TypeSize {
-    const char *gdb_type;
-    int  size;
-    const char sz, suffix;
-};
-
-static const struct TypeSize vec_lanes[] = {
-    /* quads */
-    { "uint128", 128, 'q', 'u' },
-    { "int128", 128, 'q', 's' },
-    /* 64 bit */
-    { "ieee_double", 64, 'd', 'f' },
-    { "uint64", 64, 'd', 'u' },
-    { "int64", 64, 'd', 's' },
-    /* 32 bit */
-    { "ieee_single", 32, 's', 'f' },
-    { "uint32", 32, 's', 'u' },
-    { "int32", 32, 's', 's' },
-    /* 16 bit */
-    { "ieee_half", 16, 'h', 'f' },
-    { "uint16", 16, 'h', 'u' },
-    { "int16", 16, 'h', 's' },
-    /* bytes */
-    { "uint8", 8, 'b', 'u' },
-    { "int8", 8, 'b', 's' },
-};
-
-
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
-{
-    ARMCPU *cpu = ARM_CPU(cs);
-    GString *s = g_string_new(NULL);
-    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-    g_autoptr(GString) ts = g_string_new("");
-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
-    g_string_printf(s, "<?xml version=\"1.0\"?>");
-    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
-    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
-
-    /* First define types and totals in a whole VL */
-    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
-        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
-        g_string_append_printf(s,
-                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
-                               ts->str, vec_lanes[i].gdb_type, count);
-    }
-    /*
-     * Now define a union for each size group containing unsigned and
-     * signed and potentially float versions of each size from 128 to
-     * 8 bits.
-     */
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
-        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
-            if (vec_lanes[j].size == bits) {
-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-                                       vec_lanes[j].suffix,
-                                       vec_lanes[j].sz, vec_lanes[j].suffix);
-            }
-        }
-        g_string_append(s, "</union>");
-    }
-    /* And now the final union of unions */
-    g_string_append(s, "<union id=\"svev\">");
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-                               suf[i], suf[i]);
-    }
-    g_string_append(s, "</union>");
-
-    /* Finally the sve prefix type */
-    g_string_append_printf(s,
-                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
-                           reg_width / 8);
-
-    /* Then define each register in parts for each vq */
-    for (i = 0; i < 32; i++) {
-        g_string_append_printf(s,
-                               "<reg name=\"z%d\" bitsize=\"%d\""
-                               " regnum=\"%d\" type=\"svev\"/>",
-                               i, reg_width, base_reg++);
-        info->num++;
-    }
-    /* fpscr & status registers */
-    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
-                           " regnum=\"%d\" group=\"float\""
-                           " type=\"int\"/>", base_reg++);
-    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
-                           " regnum=\"%d\" group=\"float\""
-                           " type=\"int\"/>", base_reg++);
-    info->num += 2;
-
-    for (i = 0; i < 16; i++) {
-        g_string_append_printf(s,
-                               "<reg name=\"p%d\" bitsize=\"%d\""
-                               " regnum=\"%d\" type=\"svep\"/>",
-                               i, cpu->sve_max_vq * 16, base_reg++);
-        info->num++;
-    }
-    g_string_append_printf(s,
-                           "<reg name=\"ffr\" bitsize=\"%d\""
-                           " regnum=\"%d\" group=\"vector\""
-                           " type=\"svep\"/>",
-                           cpu->sve_max_vq * 16, base_reg++);
-    g_string_append_printf(s,
-                           "<reg name=\"vg\" bitsize=\"64\""
-                           " regnum=\"%d\" type=\"int\"/>",
-                           base_reg++);
-    info->num += 2;
-    g_string_append_printf(s, "</feature>");
-    cpu->dyn_svereg_xml.desc = g_string_free(s, false);
-
-    return cpu->dyn_svereg_xml.num;
-}
-
-
 const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
 {
     ARMCPU *cpu = ARM_CPU(cs);
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     return 0;
 }
+
+struct TypeSize {
+    const char *gdb_type;
+    short size;
+    char sz, suffix;
+};
+
+static const struct TypeSize vec_lanes[] = {
+    /* quads */
+    { "uint128", 128, 'q', 'u' },
+    { "int128", 128, 'q', 's' },
+    /* 64 bit */
+    { "ieee_double", 64, 'd', 'f' },
+    { "uint64", 64, 'd', 'u' },
+    { "int64", 64, 'd', 's' },
+    /* 32 bit */
+    { "ieee_single", 32, 's', 'f' },
+    { "uint32", 32, 's', 'u' },
+    { "int32", 32, 's', 's' },
+    /* 16 bit */
+    { "ieee_half", 16, 'h', 'f' },
+    { "uint16", 16, 'h', 'u' },
+    { "int16", 16, 'h', 's' },
+    /* bytes */
+    { "uint8", 8, 'b', 'u' },
+    { "int8", 8, 'b', 's' },
+};
+
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    g_autoptr(GString) ts = g_string_new("");
+    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
+    info->num = 0;
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+
+    /* First define types and totals in a whole VL */
+    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
+        int count = reg_width / vec_lanes[i].size;
+        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
+        g_string_append_printf(s,
+                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
+                               ts->str, vec_lanes[i].gdb_type, count);
+    }
+    /*
+     * Now define a union for each size group containing unsigned and
+     * signed and potentially float versions of each size from 128 to
+     * 8 bits.
+     */
+    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
+        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
+            if (vec_lanes[j].size == bits) {
+                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
+                                       vec_lanes[j].suffix,
+                                       vec_lanes[j].sz, vec_lanes[j].suffix);
+            }
+        }
+        g_string_append(s, "</union>");
+    }
+    /* And now the final union of unions */
+    g_string_append(s, "<union id=\"svev\">");
+    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
+                               suf[i], suf[i]);
+    }
+    g_string_append(s, "</union>");
+
+    /* Finally the sve prefix type */
+    g_string_append_printf(s,
+                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
+                           reg_width / 8);
+
+    /* Then define each register in parts for each vq */
+    for (i = 0; i < 32; i++) {
+        g_string_append_printf(s,
+                               "<reg name=\"z%d\" bitsize=\"%d\""
+                               " regnum=\"%d\" type=\"svev\"/>",
+                               i, reg_width, base_reg++);
+        info->num++;
+    }
+    /* fpscr & status registers */
+    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
+                           " regnum=\"%d\" group=\"float\""
+                           " type=\"int\"/>", base_reg++);
+    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
+                           " regnum=\"%d\" group=\"float\""
+                           " type=\"int\"/>", base_reg++);
+    info->num += 2;
+
+    for (i = 0; i < 16; i++) {
+        g_string_append_printf(s,
+                               "<reg name=\"p%d\" bitsize=\"%d\""
+                               " regnum=\"%d\" type=\"svep\"/>",
+                               i, cpu->sve_max_vq * 16, base_reg++);
+        info->num++;
+    }
+    g_string_append_printf(s,
+                           "<reg name=\"ffr\" bitsize=\"%d\""
+                           " regnum=\"%d\" group=\"vector\""
+                           " type=\"svep\"/>",
+                           cpu->sve_max_vq * 16, base_reg++);
+    g_string_append_printf(s,
+                           "<reg name=\"vg\" bitsize=\"64\""
+                           " regnum=\"%d\" type=\"int\"/>",
+                           base_reg++);
+    info->num += 2;
+    g_string_append_printf(s, "</feature>");
+    info->desc = g_string_free(s, false);
+
+    return info->num;
+}
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a subroutine for creating the union of unions
of the various type sizes that a vector may contain.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 83 +++++++++++++++++++++++-------------------
 1 file changed, 45 insertions(+), 38 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
-struct TypeSize {
-    const char *gdb_type;
-    short size;
-    char sz, suffix;
-};
-
-static const struct TypeSize vec_lanes[] = {
-    /* quads */
-    { "uint128", 128, 'q', 'u' },
-    { "int128", 128, 'q', 's' },
-    /* 64 bit */
-    { "ieee_double", 64, 'd', 'f' },
-    { "uint64", 64, 'd', 'u' },
-    { "int64", 64, 'd', 's' },
-    /* 32 bit */
-    { "ieee_single", 32, 's', 'f' },
-    { "uint32", 32, 's', 'u' },
-    { "int32", 32, 's', 's' },
-    /* 16 bit */
-    { "ieee_half", 16, 'h', 'f' },
-    { "uint16", 16, 'h', 'u' },
-    { "int16", 16, 'h', 's' },
-    /* bytes */
-    { "uint8", 8, 'b', 'u' },
-    { "int8", 8, 'b', 's' },
-};
-
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+static void output_vector_union_type(GString *s, int reg_width)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    GString *s = g_string_new(NULL);
-    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    struct TypeSize {
+        const char *gdb_type;
+        short size;
+        char sz, suffix;
+    };
+
+    static const struct TypeSize vec_lanes[] = {
+        /* quads */
+        { "uint128", 128, 'q', 'u' },
+        { "int128", 128, 'q', 's' },
+        /* 64 bit */
+        { "ieee_double", 64, 'd', 'f' },
+        { "uint64", 64, 'd', 'u' },
+        { "int64", 64, 'd', 's' },
+        /* 32 bit */
+        { "ieee_single", 32, 's', 'f' },
+        { "uint32", 32, 's', 'u' },
+        { "int32", 32, 's', 's' },
+        /* 16 bit */
+        { "ieee_half", 16, 'h', 'f' },
+        { "uint16", 16, 'h', 'u' },
+        { "int16", 16, 'h', 's' },
+        /* bytes */
+        { "uint8", 8, 'b', 'u' },
+        { "int8", 8, 'b', 's' },
+    };
+
+    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+
     g_autoptr(GString) ts = g_string_new("");
-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
-    g_string_printf(s, "<?xml version=\"1.0\"?>");
-    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
-    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+    int i, j, bits;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
      * 8 bits.
      */
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
         g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
     /* And now the final union of unions */
     g_string_append(s, "<union id=\"svev\">");
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
         g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
                                suf[i], suf[i]);
     }
     g_string_append(s, "</union>");
+}
+
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    int i, reg_width = (cpu->sve_max_vq * 128);
+    info->num = 0;
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+
+    output_vector_union_type(s, reg_width);
 
     /* Finally the sve prefix type */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Rather than increment base_reg and num, compute num from the change
to base_reg at the end.  Clean up some nearby comments.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
     g_string_append(s, "</union>");
 }
 
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     GString *s = g_string_new(NULL);
     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-    int i, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
+    int reg_width = cpu->sve_max_vq * 128;
+    int base_reg = orig_base_reg;
+    int i;
+
     g_string_printf(s, "<?xml version=\"1.0\"?>");
     g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 
+    /* Create the vector union type. */
     output_vector_union_type(s, reg_width);
 
-    /* Finally the sve prefix type */
+    /* Create the predicate vector type. */
     g_string_append_printf(s,
                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
                            reg_width / 8);
 
-    /* Then define each register in parts for each vq */
+    /* Define the vector registers. */
     for (i = 0; i < 32; i++) {
         g_string_append_printf(s,
                                "<reg name=\"z%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svev\"/>",
                                i, reg_width, base_reg++);
-        info->num++;
     }
+
     /* fpscr & status registers */
     g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
                            " regnum=\"%d\" group=\"float\""
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
     g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
                            " regnum=\"%d\" group=\"float\""
                            " type=\"int\"/>", base_reg++);
-    info->num += 2;
 
+    /* Define the predicate registers. */
     for (i = 0; i < 16; i++) {
         g_string_append_printf(s,
                                "<reg name=\"p%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svep\"/>",
                                i, cpu->sve_max_vq * 16, base_reg++);
-        info->num++;
     }
     g_string_append_printf(s,
                            "<reg name=\"ffr\" bitsize=\"%d\""
                            " regnum=\"%d\" group=\"vector\""
                            " type=\"svep\"/>",
                            cpu->sve_max_vq * 16, base_reg++);
+
+    /* Define the vector length pseudo-register. */
     g_string_append_printf(s,
                            "<reg name=\"vg\" bitsize=\"64\""
                            " regnum=\"%d\" type=\"int\"/>",
                            base_reg++);
-    info->num += 2;
-    g_string_append_printf(s, "</feature>");
-    info->desc = g_string_free(s, false);
 
+    g_string_append_printf(s, "</feature>");
+
+    info->desc = g_string_free(s, false);
+    info->num = base_reg - orig_base_reg;
     return info->num;
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     GString *s = g_string_new(NULL);
     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
     int reg_width = cpu->sve_max_vq * 128;
+    int pred_width = cpu->sve_max_vq * 16;
     int base_reg = orig_base_reg;
     int i;
 
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
         g_string_append_printf(s,
                                "<reg name=\"p%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svep\"/>",
-                               i, cpu->sve_max_vq * 16, base_reg++);
+                               i, pred_width, base_reg++);
     }
     g_string_append_printf(s,
                            "<reg name=\"ffr\" bitsize=\"%d\""
                            " regnum=\"%d\" group=\"vector\""
                            " type=\"svep\"/>",
-                           cpu->sve_max_vq * 16, base_reg++);
+                           pred_width, base_reg++);
 
     /* Define the vector length pseudo-register. */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Define svep based on the size of the predicates,
not the primary vector registers.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     /* Create the predicate vector type. */
     g_string_append_printf(s,
                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
-                           reg_width / 8);
+                           pred_width / 8);
 
     /* Define the vector registers. */
     for (i = 0; i < 32; i++) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This will make the function usable between SVE and SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
-static void output_vector_union_type(GString *s, int reg_width)
+static void output_vector_union_type(GString *s, int reg_width,
+                                     const char *name)
 {
     struct TypeSize {
         const char *gdb_type;
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
     };
 
     static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-
-    g_autoptr(GString) ts = g_string_new("");
     int i, j, bits;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
-        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
         g_string_append_printf(s,
-                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
-                               ts->str, vec_lanes[i].gdb_type, count);
+                               "<vector id=\"%s%c%c\" type=\"%s\" count=\"%d\"/>",
+                               name, vec_lanes[i].sz, vec_lanes[i].suffix,
+                               vec_lanes[i].gdb_type, reg_width / vec_lanes[i].size);
     }
+
     /*
      * Now define a union for each size group containing unsigned and
      * signed and potentially float versions of each size from 128 to
      * 8 bits.
      */
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
+        g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-                                       vec_lanes[j].suffix,
+                g_string_append_printf(s, "<field name=\"%c\" type=\"%s%c%c\"/>",
+                                       vec_lanes[j].suffix, name,
                                        vec_lanes[j].sz, vec_lanes[j].suffix);
             }
         }
         g_string_append(s, "</union>");
     }
+
     /* And now the final union of unions */
-    g_string_append(s, "<union id=\"svev\">");
+    g_string_append_printf(s, "<union id=\"%s\">", name);
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-                               suf[i], suf[i]);
+        g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
+                               suf[i], name, suf[i]);
     }
     g_string_append(s, "</union>");
 }
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 
     /* Create the vector union type. */
-    output_vector_union_type(s, reg_width);
+    output_vector_union_type(s, reg_width, "svev");
 
     /* Create the predicate vector type. */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Order suf[] by the log8 of the width.
Use ARRAY_SIZE instead of hard-coding 128.

This changes the order of the union definitions,
but retains the order of the union-of-union members.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
         { "int8", 8, 'b', 's' },
     };
 
-    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-    int i, j, bits;
+    static const char suf[] = { 'b', 'h', 's', 'd', 'q' };
+    int i, j;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
      * signed and potentially float versions of each size from 128 to
      * 8 bits.
      */
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+    for (i = 0; i < ARRAY_SIZE(suf); i++) {
+        int bits = 8 << i;
+
         g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
 
     /* And now the final union of unions */
     g_string_append_printf(s, "<union id=\"%s\">", name);
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+    for (i = ARRAY_SIZE(suf) - 1; i >= 0; i--) {
         g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
                                suf[i], name, suf[i]);
     }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Keep the logic for pauth within pauth_helper.c, and expose
a helper function for use with the gdbstub pac extension.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h        | 10 ++++++++++
 target/arm/tcg/pauth_helper.c | 26 ++++++++++++++++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
 bool arm_singlestep_active(CPUARMState *env);
 bool arm_generate_debug_exceptions(CPUARMState *env);
 
+/**
+ * pauth_ptr_mask:
+ * @env: cpu context
+ * @ptr: selects between TTBR0 and TTBR1
+ * @data: selects between TBI and TBID
+ *
+ * Return a mask of the bits of @ptr that contain the authentication code.
+ */
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
+
 /* Add the cpreg definitions for debug related system registers */
 void define_debug_regs(ARMCPU *cpu);
 
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
     return pac | ext | ptr;
 }
 
-static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
+static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
 {
-    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
-    uint64_t extfield = sextract64(ptr, 55, 1);
     int bot_pac_bit = 64 - param.tsz;
     int top_pac_bit = 64 - 8 * param.tbi;
 
-    return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
+    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
+}
+
+static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
+{
+    uint64_t mask = pauth_ptr_mask_internal(param);
+
+    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
+    if (extract64(ptr, 55, 1)) {
+        return ptr | mask;
+    } else {
+        return ptr & ~mask;
+    }
+}
+
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
+{
+    ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
+    ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+
+    return pauth_ptr_mask_internal(param);
 }
 
 static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The extension is primarily defined by the Linux kernel NT_ARM_PAC_MASK
ptrace register set.

The original gdb feature consists of two masks, data and code, which are
used to mask out the authentication code within a pointer.  Following
discussion with Luis Machado, add two more masks in order to support
pointers within the high half of the address space (i.e. TTBR1 vs TTBR0).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1105
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/targets/aarch64-linux-user.mak    |  2 +-
 configs/targets/aarch64-softmmu.mak       |  2 +-
 configs/targets/aarch64_be-linux-user.mak |  2 +-
 target/arm/internals.h                    |  2 ++
 target/arm/gdbstub.c                      |  5 ++++
 target/arm/gdbstub64.c                    | 34 +++++++++++++++++++++++
 gdb-xml/aarch64-pauth.xml                 | 15 ++++++++++
 7 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 gdb-xml/aarch64-pauth.xml

diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64-linux-user.mak
+++ b/configs/targets/aarch64-linux-user.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64-softmmu.mak
+++ b/configs/targets/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_SUPPORTS_MTTCG=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
 TARGET_NEED_FDT=y
diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64_be-linux-user.mak
+++ b/configs/targets/aarch64_be-linux-user.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_BIG_ENDIAN=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
+        if (isar_feature_aa64_pauth(&cpu->isar)) {
+            gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
+                                     aarch64_gdb_set_pauth_reg,
+                                     4, "aarch64-pauth.xml", 0);
+        }
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    switch (reg) {
+    case 0: /* pauth_dmask */
+    case 1: /* pauth_cmask */
+    case 2: /* pauth_dmask_high */
+    case 3: /* pauth_cmask_high */
+        /*
+         * Note that older versions of this feature only contained
+         * pauth_{d,c}mask, for use with Linux user processes, and
+         * thus exclusively in the low half of the address space.
+         *
+         * To support system mode, and to debug kernels, two new regs
+         * were added to cover the high half of the address space.
+         * For the purpose of pauth_ptr_mask, we can use any well-formed
+         * address within the address space half -- here, 0 and -1.
+         */
+        {
+            bool is_data = !(reg & 1);
+            bool is_high = reg & 2;
+            uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
+            return gdb_get_reg64(buf, mask);
+        }
+    default:
+        return 0;
+    }
+}
+
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    /* All pseudo registers are read-only. */
+    return 0;
+}
+
 static void output_vector_union_type(GString *s, int reg_width,
                                      const char *name)
 {
diff --git a/gdb-xml/aarch64-pauth.xml b/gdb-xml/aarch64-pauth.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/aarch64-pauth.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.aarch64.pauth">
+  <reg name="pauth_dmask" bitsize="64"/>
+  <reg name="pauth_cmask" bitsize="64"/>
+  <reg name="pauth_dmask_high" bitsize="64"/>
+  <reg name="pauth_cmask_high" bitsize="64"/>
+</feature>
+
-- 
2.34.1

From: David Reiss <dreiss@meta.com>

Allow the function to be used outside of m_helper.c.
Rename with an "arm_" prefix.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-13-richard.henderson@linaro.org
[rth: Split out of a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 3 +++
 target/arm/tcg/m_helper.c | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
 
+/* Read the CONTROL register as the MRS instruction would. */
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
+
 #ifdef CONFIG_USER_ONLY
 static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 #else
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
     return xpsr_read(env) & mask;
 }
 
-static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
 {
     uint32_t value = env->v7m.control[secure];
 
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
     case 0 ... 7: /* xPSR sub-fields */
         return v7m_mrs_xpsr(env, reg, 0);
     case 20: /* CONTROL */
-        return v7m_mrs_control(env, 0);
+        return arm_v7m_mrs_control(env, 0);
     default:
         /* Unprivileged reads others as zero.  */
         return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
     case 0 ... 7: /* xPSR sub-fields */
         return v7m_mrs_xpsr(env, reg, el);
     case 20: /* CONTROL */
-        return v7m_mrs_control(env, env->v7m.secure);
+        return arm_v7m_mrs_control(env, env->v7m.secure);
     case 0x94: /* CONTROL_NS */
         /*
          * We have to handle this here because unprivileged Secure code
-- 
2.34.1

From: David Reiss <dreiss@meta.com>

Allow the function to be used outside of m_helper.c.
Move to be outside of ifndef CONFIG_USER_ONLY block.
Rename from get_v7m_sp_ptr.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-14-richard.henderson@linaro.org
[rth: Split out of a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 10 +++++
 target/arm/tcg/m_helper.c | 84 +++++++++++++++++++--------------------
 2 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 /* Read the CONTROL register as the MRS instruction would. */
 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
 
+/*
+ * Return a pointer to the location where we currently store the
+ * stack pointer for the requested security state and thread mode.
+ * This pointer will become invalid if the CPU state is updated
+ * such that the stack pointers are switched around (eg changing
+ * the SPSEL control bit).
+ */
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure,
+                             bool threadmode, bool spsel);
+
 #ifdef CONFIG_USER_ONLY
 static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 #else
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
     arm_rebuild_hflags(env);
 }
 
-static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
-                                bool spsel)
-{
-    /*
-     * Return a pointer to the location where we currently store the
-     * stack pointer for the requested security state and thread mode.
-     * This pointer will become invalid if the CPU state is updated
-     * such that the stack pointers are switched around (eg changing
-     * the SPSEL control bit).
-     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
-     * Unlike that pseudocode, we require the caller to pass us in the
-     * SPSEL control bit value; this is because we also use this
-     * function in handling of pushing of the callee-saves registers
-     * part of the v8M stack frame (pseudocode PushCalleeStack()),
-     * and in the tailchain codepath the SPSEL bit comes from the exception
-     * return magic LR value from the previous exception. The pseudocode
-     * opencodes the stack-selection in PushCalleeStack(), but we prefer
-     * to make this utility function generic enough to do the job.
-     */
-    bool want_psp = threadmode && spsel;
-
-    if (secure == env->v7m.secure) {
-        if (want_psp == v7m_using_psp(env)) {
-            return &env->regs[13];
-        } else {
-            return &env->v7m.other_sp;
-        }
-    } else {
-        if (want_psp) {
-            return &env->v7m.other_ss_psp;
-        } else {
-            return &env->v7m.other_ss_msp;
-        }
-    }
-}
-
 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
                                 uint32_t *pvec)
 {
@@ -XXX,XX +XXX,XX @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
             !mode;
 
         mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
-        frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
-                                    lr & R_V7M_EXCRET_SPSEL_MASK);
+        frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
+                                        lr & R_V7M_EXCRET_SPSEL_MASK);
         want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
         if (want_psp) {
             limit = env->v7m.psplim[M_REG_S];
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * use 'frame_sp_p' after we do something that makes it invalid.
          */
         bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
-        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
-                                              return_to_secure,
-                                              !return_to_handler,
-                                              spsel);
+        uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
+                                                  !return_to_handler, spsel);
         uint32_t frameptr = *frame_sp_p;
         bool pop_ok = true;
         ARMMMUIdx mmu_idx;
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
         threadmode = !arm_v7m_is_handler_mode(env);
         spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
 
-        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
+        frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
         frameptr = *frame_sp_p;
 
         /*
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
 }
 
 #endif /* !CONFIG_USER_ONLY */
+
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+                             bool spsel)
+{
+    /*
+     * Return a pointer to the location where we currently store the
+     * stack pointer for the requested security state and thread mode.
+     * This pointer will become invalid if the CPU state is updated
+     * such that the stack pointers are switched around (eg changing
+     * the SPSEL control bit).
+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
+     * Unlike that pseudocode, we require the caller to pass us in the
+     * SPSEL control bit value; this is because we also use this
+     * function in handling of pushing of the callee-saves registers
+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+     * and in the tailchain codepath the SPSEL bit comes from the exception
+     * return magic LR value from the previous exception. The pseudocode
+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+     * to make this utility function generic enough to do the job.
+     */
+    bool want_psp = threadmode && spsel;
+
+    if (secure == env->v7m.secure) {
+        if (want_psp == v7m_using_psp(env)) {
+            return &env->regs[13];
+        } else {
+            return &env->v7m.other_sp;
+        }
+    } else {
+        if (want_psp) {
+            return &env->v7m.other_ss_psp;
+        } else {
+            return &env->v7m.other_ss_msp;
+        }
+    }
+}
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The upstream gdb xml only implements {MSP,PSP}{,_NS,S}, but
go ahead and implement the other system registers as well.

Since there is significant overlap between the two, implement
them with common code.  The only exception is the systemreg
view of CONTROL, which merges the banked bits as per MRS.

Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-15-richard.henderson@linaro.org
[rth: Substatial rewrite using enumerator and shared code.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |   2 +
 target/arm/gdbstub.c | 178 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 180 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
     DynamicGDBXMLInfo dyn_sysreg_xml;
     DynamicGDBXMLInfo dyn_svereg_xml;
+    DynamicGDBXMLInfo dyn_m_systemreg_xml;
+    DynamicGDBXMLInfo dyn_m_secextreg_xml;
 
     /* Timers used by the generic (architected) timer */
     QEMUTimer *gt_timer[NUM_GTIMERS];
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
     return cpu->dyn_sysreg_xml.num;
 }
 
+typedef enum {
+    M_SYSREG_MSP,
+    M_SYSREG_PSP,
+    M_SYSREG_PRIMASK,
+    M_SYSREG_CONTROL,
+    M_SYSREG_BASEPRI,
+    M_SYSREG_FAULTMASK,
+    M_SYSREG_MSPLIM,
+    M_SYSREG_PSPLIM,
+} MProfileSysreg;
+
+static const struct {
+    const char *name;
+    int feature;
+} m_sysreg_def[] = {
+    [M_SYSREG_MSP] = { "msp", ARM_FEATURE_M },
+    [M_SYSREG_PSP] = { "psp", ARM_FEATURE_M },
+    [M_SYSREG_PRIMASK] = { "primask", ARM_FEATURE_M },
+    [M_SYSREG_CONTROL] = { "control", ARM_FEATURE_M },
+    [M_SYSREG_BASEPRI] = { "basepri", ARM_FEATURE_M_MAIN },
+    [M_SYSREG_FAULTMASK] = { "faultmask", ARM_FEATURE_M_MAIN },
+    [M_SYSREG_MSPLIM] = { "msplim", ARM_FEATURE_V8 },
+    [M_SYSREG_PSPLIM] = { "psplim", ARM_FEATURE_V8 },
+};
+
+static uint32_t *m_sysreg_ptr(CPUARMState *env, MProfileSysreg reg, bool sec)
+{
+    uint32_t *ptr;
+
+    switch (reg) {
+    case M_SYSREG_MSP:
+        ptr = arm_v7m_get_sp_ptr(env, sec, false, true);
+        break;
+    case M_SYSREG_PSP:
+        ptr = arm_v7m_get_sp_ptr(env, sec, true, true);
+        break;
+    case M_SYSREG_MSPLIM:
+        ptr = &env->v7m.msplim[sec];
+        break;
+    case M_SYSREG_PSPLIM:
+        ptr = &env->v7m.psplim[sec];
+        break;
+    case M_SYSREG_PRIMASK:
+        ptr = &env->v7m.primask[sec];
+        break;
+    case M_SYSREG_BASEPRI:
+        ptr = &env->v7m.basepri[sec];
+        break;
+    case M_SYSREG_FAULTMASK:
+        ptr = &env->v7m.faultmask[sec];
+        break;
+    case M_SYSREG_CONTROL:
+        ptr = &env->v7m.control[sec];
+        break;
+    default:
+        return NULL;
+    }
+    return arm_feature(env, m_sysreg_def[reg].feature) ? ptr : NULL;
+}
+
+static int m_sysreg_get(CPUARMState *env, GByteArray *buf,
+                        MProfileSysreg reg, bool secure)
+{
+    uint32_t *ptr = m_sysreg_ptr(env, reg, secure);
+
+    if (ptr == NULL) {
+        return 0;
+    }
+    return gdb_get_reg32(buf, *ptr);
+}
+
+static int arm_gdb_get_m_systemreg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    /*
+     * Here, we emulate MRS instruction, where CONTROL has a mix of
+     * banked and non-banked bits.
+     */
+    if (reg == M_SYSREG_CONTROL) {
+        return gdb_get_reg32(buf, arm_v7m_mrs_control(env, env->v7m.secure));
+    }
+    return m_sysreg_get(env, buf, reg, env->v7m.secure);
+}
+
+static int arm_gdb_set_m_systemreg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    return 0; /* TODO */
+}
+
+static int arm_gen_dynamic_m_systemreg_xml(CPUState *cs, int orig_base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    GString *s = g_string_new(NULL);
+    int base_reg = orig_base_reg;
+    int i;
+
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.m-system\">\n");
+
+    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
+        if (arm_feature(env, m_sysreg_def[i].feature)) {
+            g_string_append_printf(s,
+                "<reg name=\"%s\" bitsize=\"32\" regnum=\"%d\"/>\n",
+                m_sysreg_def[i].name, base_reg++);
+        }
+    }
+
+    g_string_append_printf(s, "</feature>");
+    cpu->dyn_m_systemreg_xml.desc = g_string_free(s, false);
+    cpu->dyn_m_systemreg_xml.num = base_reg - orig_base_reg;
+
+    return cpu->dyn_m_systemreg_xml.num;
+}
+
+#ifndef CONFIG_USER_ONLY
+/*
+ * For user-only, we see the non-secure registers via m_systemreg above.
+ * For secext, encode the non-secure view as even and secure view as odd.
+ */
+static int arm_gdb_get_m_secextreg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    return m_sysreg_get(env, buf, reg >> 1, reg & 1);
+}
+
+static int arm_gdb_set_m_secextreg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    return 0; /* TODO */
+}
+
+static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    int base_reg = orig_base_reg;
+    int i;
+
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.secext\">\n");
+
+    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
+        g_string_append_printf(s,
+            "<reg name=\"%s_ns\" bitsize=\"32\" regnum=\"%d\"/>\n",
+            m_sysreg_def[i].name, base_reg++);
+        g_string_append_printf(s,
+            "<reg name=\"%s_s\" bitsize=\"32\" regnum=\"%d\"/>\n",
+            m_sysreg_def[i].name, base_reg++);
+    }
+
+    g_string_append_printf(s, "</feature>");
+    cpu->dyn_m_secextreg_xml.desc = g_string_free(s, false);
+    cpu->dyn_m_secextreg_xml.num = base_reg - orig_base_reg;
+
+    return cpu->dyn_m_secextreg_xml.num;
+}
+#endif
+
 const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
         return cpu->dyn_sysreg_xml.desc;
     } else if (strcmp(xmlname, "sve-registers.xml") == 0) {
         return cpu->dyn_svereg_xml.desc;
+    } else if (strcmp(xmlname, "arm-m-system.xml") == 0) {
+        return cpu->dyn_m_systemreg_xml.desc;
+#ifndef CONFIG_USER_ONLY
+    } else if (strcmp(xmlname, "arm-m-secext.xml") == 0) {
+        return cpu->dyn_m_secextreg_xml.desc;
+#endif
     }
     return NULL;
 }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                              arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
                              "system-registers.xml", 0);
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        gdb_register_coprocessor(cs,
+            arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
+            arm_gen_dynamic_m_systemreg_xml(cs, cs->gdb_num_regs),
+            "arm-m-system.xml", 0);
+#ifndef CONFIG_USER_ONLY
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            gdb_register_coprocessor(cs,
+                arm_gdb_get_m_secextreg, arm_gdb_set_m_secextreg,
+                arm_gen_dynamic_m_secextreg_xml(cs, cs->gdb_num_regs),
+                "arm-m-secext.xml", 0);
+        }
+#endif
+    }
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

M-profile doesn't have HCR_EL2.  While we could test features
before each call, zero is a generally safe return value to
disable the code in the caller.  This test is required to
avoid an assert in arm_is_secure_below_el3.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
 
 uint64_t arm_hcr_el2_eff(CPUARMState *env)
 {
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return 0;
+    }
     return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
 }
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

In several places we use arm_is_secure_below_el3 and
arm_is_el3_or_mon separately from arm_is_secure.
These functions make no sense for m-profile, and
would indicate prior incorrect feature testing.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
 
 #if !defined(CONFIG_USER_ONLY)
-/* Return true if exception levels below EL3 are in secure state,
+/*
+ * Return true if exception levels below EL3 are in secure state,
  * or would be following an exception return to that level.
  * Unlike arm_is_secure() (which is always a question about the
  * _current_ state of the CPU) this doesn't care about the current
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
  */
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
+    assert(!arm_feature(env, ARM_FEATURE_M));
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         return !(env->cp15.scr_el3 & SCR_NS);
     } else {
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure_below_el3(CPUARMState *env)
 /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
 static inline bool arm_is_el3_or_mon(CPUARMState *env)
 {
+    assert(!arm_feature(env, ARM_FEATURE_M));
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) {
             /* CPU currently in AArch64 state and EL3 */
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Integrate neighboring code from get_phys_addr_lpae which computed
starting level, as it is easier to validate when doing both at the
same time.  Mirror the checks at the start of AArch{64,32}.S2Walk,
especially S2InvalidSL and S2InconsistentSL.

This reverts 49ba115bb74, which was incorrect -- there is nothing
in the ARM pseudocode that depends on TxSZ, i.e. outputsize; the
pseudocode is consistent in referencing PAMax.

Fixes: 49ba115bb74 ("target/arm: Pass outputsize down to check_s2_mmu_setup")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 173 ++++++++++++++++++++++++++---------------------
 1 file changed, 97 insertions(+), 76 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
  * check_s2_mmu_setup
  * @cpu:        ARMCPU
  * @is_aa64:    True if the translation regime is in AArch64 state
- * @startlevel: Suggested starting level
- * @inputsize:  Bitsize of IPAs
+ * @tcr:        VTCR_EL2 or VSTCR_EL2
+ * @ds:         Effective value of TCR.DS.
+ * @iasize:     Bitsize of IPAs
  * @stride:     Page-table stride (See the ARM ARM)
  *
- * Returns true if the suggested S2 translation parameters are OK and
- * false otherwise.
+ * Decode the starting level of the S2 lookup, returning INT_MIN if
+ * the configuration is invalid.
  */
-static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
-                               int inputsize, int stride, int outputsize)
+static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
+                              bool ds, int iasize, int stride)
 {
-    const int grainsize = stride + 3;
-    int startsizecheck;
-
-    /*
-     * Negative levels are usually not allowed...
-     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
-     * begins with level -1.  Note that previous feature tests will have
-     * eliminated this combination if it is not enabled.
-     */
-    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
-        return false;
-    }
-
-    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
-    if (startsizecheck < 1 || startsizecheck > stride + 4) {
-        return false;
-    }
+    int sl0, sl2, startlevel, granulebits, levels;
+    int s1_min_iasize, s1_max_iasize;
 
+    sl0 = extract32(tcr, 6, 2);
     if (is_aa64) {
+        /*
+         * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
+         * get_phys_addr_lpae, that used aa64_va_parameters which apply
+         * to aarch64.  If Stage1 is aarch32, the min_txsz is larger.
+         * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
+         * inputsize is 64 - 24 = 40.
+         */
+        if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
+            goto fail;
+        }
+
+        /*
+         * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
+         * so interleave AArch64.S2StartLevel.
+         */
         switch (stride) {
-        case 13: /* 64KB Pages.  */
-            if (level == 0 || (level == 1 && outputsize <= 42)) {
-                return false;
+        case 9: /* 4KB */
+            /* SL2 is RES0 unless DS=1 & 4KB granule. */
+            sl2 = extract64(tcr, 33, 1);
+            if (ds && sl2) {
+                if (sl0 != 0) {
+                    goto fail;
+                }
+                startlevel = -1;
+            } else {
+                startlevel = 2 - sl0;
+                switch (sl0) {
+                case 2:
+                    if (arm_pamax(cpu) < 44) {
+                        goto fail;
+                    }
+                    break;
+                case 3:
+                    if (!cpu_isar_feature(aa64_st, cpu)) {
+                        goto fail;
+                    }
+                    startlevel = 3;
+                    break;
+                }
             }
             break;
-        case 11: /* 16KB Pages.  */
-            if (level == 0 || (level == 1 && outputsize <= 40)) {
-                return false;
+        case 11: /* 16KB */
+            switch (sl0) {
+            case 2:
+                if (arm_pamax(cpu) < 42) {
+                    goto fail;
+                }
+                break;
+            case 3:
+                if (!ds) {
+                    goto fail;
+                }
+                break;
             }
+            startlevel = 3 - sl0;
             break;
-        case 9: /* 4KB Pages.  */
-            if (level == 0 && outputsize <= 42) {
-                return false;
+        case 13: /* 64KB */
+            switch (sl0) {
+            case 2:
+                if (arm_pamax(cpu) < 44) {
+                    goto fail;
+                }
+                break;
+            case 3:
+                goto fail;
             }
+            startlevel = 3 - sl0;
             break;
         default:
             g_assert_not_reached();
         }
-
-        /* Inputsize checks.  */
-        if (inputsize > outputsize &&
-            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
-            /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
-            return false;
-        }
     } else {
-        /* AArch32 only supports 4KB pages. Assert on that.  */
+        /*
+         * Things are simpler for AArch32 EL2, with only 4k pages.
+         * There is no separate S2InvalidSL function, but AArch32.S2Walk
+         * begins with walkparms.sl0 in {'1x'}.
+         */
         assert(stride == 9);
-
-        if (level == 0) {
-            return false;
+        if (sl0 >= 2) {
+            goto fail;
         }
+        startlevel = 2 - sl0;
     }
-    return true;
+
+    /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
+    levels = 3 - startlevel;
+    granulebits = stride + 3;
+
+    s1_min_iasize = levels * stride + granulebits + 1;
+    s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
+
+    if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
+        return startlevel;
+    }
+
+ fail:
+    return INT_MIN;
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          */
         level = 4 - (inputsize - 4) / stride;
     } else {
-        /*
-         * For stage 2 translations the starting level is specified by the
-         * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
-         */
-        uint32_t sl0 = extract32(tcr, 6, 2);
-        uint32_t sl2 = extract64(tcr, 33, 1);
-        int32_t startlevel;
-        bool ok;
-
-        /* SL2 is RES0 unless DS=1 & 4kb granule. */
-        if (param.ds && stride == 9 && sl2) {
-            if (sl0 != 0) {
-                level = 0;
-                goto do_translation_fault;
-            }
-            startlevel = -1;
-        } else if (!aarch64 || stride == 9) {
-            /* AArch32 or 4KB pages */
-            startlevel = 2 - sl0;
-
-            if (cpu_isar_feature(aa64_st, cpu)) {
-                startlevel &= 3;
-            }
-        } else {
-            /* 16KB or 64KB pages */
-            startlevel = 3 - sl0;
-        }
-
-        /* Check that the starting level is valid. */
-        ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
-                                inputsize, stride, outputsize);
-        if (!ok) {
+        int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
+                                            inputsize, stride);
+        if (startlevel == INT_MIN) {
+            level = 0;
             goto do_translation_fault;
         }
         level = startlevel;
-- 
2.34.1

From: Ard Biesheuvel <ardb@kernel.org>

Fedora 39 will ship its arm64 kernels in the new generic EFI zboot
format, using gzip compression for the payload.

For doing EFI boot in QEMU, this is completely transparent, as the
firmware or bootloader will take care of this. However, for direct
kernel boot without firmware, we will lose the ability to boot such
distro kernels unless we deal with the new format directly.

EFI zboot images contain metadata in the header regarding the placement
of the compressed payload inside the image, and the type of compression
used. This means we can wire up the existing gzip support without too
much hassle, by parsing the header and grabbing the payload from inside
the loaded zboot image.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Alex Bennée <alex.bennee@linaro.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Message-id: 20230303160109.3626966-1-ardb@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked comment formatting, fixed checkpatch nits]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/loader.h | 19 ++++++++++
 hw/arm/boot.c       |  6 +++
 hw/core/loader.c    | 91 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 116 insertions(+)

diff --git a/include/hw/loader.h b/include/hw/loader.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
                                   uint8_t **buffer);
 ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
 
+/**
+ * unpack_efi_zboot_image:
+ * @buffer: pointer to a variable holding the address of a buffer containing the
+ *          image
+ * @size: pointer to a variable holding the size of the buffer
+ *
+ * Check whether the buffer contains a EFI zboot image, and if it does, extract
+ * the compressed payload and decompress it into a new buffer. If successful,
+ * the old buffer is freed, and the *buffer and size variables pointed to by the
+ * function arguments are updated to refer to the newly populated buffer.
+ *
+ * Returns 0 if the image could not be identified as a EFI zboot image.
+ * Returns -1 if the buffer contents were identified as a EFI zboot image, but
+ * unpacking failed for any reason.
+ * Returns the size of the decompressed payload if decompression was performed
+ * successfully.
+ */
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size);
+
 #define ELF_LOAD_FAILED       -1
 #define ELF_LOAD_NOT_ELF      -2
 #define ELF_LOAD_WRONG_ARCH   -3
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
             return -1;
         }
         size = len;
+
+        /* Unpack the image if it is a EFI zboot image */
+        if (unpack_efi_zboot_image(&buffer, &size) < 0) {
+            g_free(buffer);
+            return -1;
+        }
     }
 
     /* check the arm64 magic header value -- very old kernels may not have it */
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
     return bytes;
 }
 
+/* The PE/COFF MS-DOS stub magic number */
+#define EFI_PE_MSDOS_MAGIC        "MZ"
+
+/*
+ * The Linux header magic number for a EFI PE/COFF
+ * image targetting an unspecified architecture.
+ */
+#define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
+
+/*
+ * Bootable Linux kernel images may be packaged as EFI zboot images, which are
+ * self-decompressing executables when loaded via EFI. The compressed payload
+ * can also be extracted from the image and decompressed by a non-EFI loader.
+ *
+ * The de facto specification for this format is at the following URL:
+ *
+ * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
+ *
+ * This definition is based on Linux upstream commit 29636a5ce87beba.
+ */
+struct linux_efi_zboot_header {
+    uint8_t     msdos_magic[2];         /* PE/COFF 'MZ' magic number */
+    uint8_t     reserved0[2];
+    uint8_t     zimg[4];                /* "zimg" for Linux EFI zboot images */
+    uint32_t    payload_offset;         /* LE offset to compressed payload */
+    uint32_t    payload_size;           /* LE size of the compressed payload */
+    uint8_t     reserved1[8];
+    char        compression_type[32];   /* Compression type, NUL terminated */
+    uint8_t     linux_magic[4];         /* Linux header magic */
+    uint32_t    pe_header_offset;       /* LE offset to the PE header */
+};
+
+/*
+ * Check whether *buffer points to a Linux EFI zboot image in memory.
+ *
+ * If it does, attempt to decompress it to a new buffer, and free the old one.
+ * If any of this fails, return an error to the caller.
+ *
+ * If the image is not a Linux EFI zboot image, do nothing and return success.
+ */
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
+{
+    const struct linux_efi_zboot_header *header;
+    uint8_t *data = NULL;
+    int ploff, plsize;
+    ssize_t bytes;
+
+    /* ignore if this is too small to be a EFI zboot image */
+    if (*size < sizeof(*header)) {
+        return 0;
+    }
+
+    header = (struct linux_efi_zboot_header *)*buffer;
+
+    /* ignore if this is not a Linux EFI zboot image */
+    if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
+        memcmp(&header->zimg, "zimg", 4) != 0 ||
+        memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
+        return 0;
+    }
+
+    if (strcmp(header->compression_type, "gzip") != 0) {
+        fprintf(stderr,
+                "unable to handle EFI zboot image with \"%.*s\" compression\n",
+                (int)sizeof(header->compression_type) - 1,
+                header->compression_type);
+        return -1;
+    }
+
+    ploff = ldl_le_p(&header->payload_offset);
+    plsize = ldl_le_p(&header->payload_size);
+
+    if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
+        fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
+        return -1;
+    }
+
+    data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
+    bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
+    if (bytes < 0) {
+        fprintf(stderr, "failed to decompress EFI zboot image\n");
+        g_free(data);
+        return -1;
+    }
+
+    g_free(*buffer);
+    *buffer = g_realloc(data, bytes);
+    *size = bytes;
+    return bytes;
+}
+
 /*
  * Functions for reboot-persistent memory regions.
  *  - used for vga bios and option roms.
-- 
2.34.1

From: qianfan Zhao <qianfanguijin@163.com>

TWI_CNTR_INT_FLAG is W1C(write 1 to clear and write 0 has non-effect)
register on SUN6i based SoCs, we should lower interrupt when the guest
set this bit.

The linux kernel will hang in irq handler(mv64xxx_i2c_intr) if no
device connected on the i2c bus, next is the trace log:

allwinner_i2c_write write   CNTR(0x0c): 0xc4 A_ACK BUS_EN INT_EN
allwinner_i2c_write write   CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
allwinner_i2c_read  read    CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
allwinner_i2c_read  read    STAT(0x10): 0x20 STAT_M_ADDR_WR_NACK
allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
...

Fix it.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Tested-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i2c/allwinner-i2c.h |  6 ++++++
 hw/i2c/allwinner-i2c.c         | 26 ++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/include/hw/i2c/allwinner-i2c.h b/include/hw/i2c/allwinner-i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/allwinner-i2c.h
+++ b/include/hw/i2c/allwinner-i2c.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_AW_I2C "allwinner.i2c"
+
+/** Allwinner I2C sun6i family and newer (A31, H2+, H3, etc) */
+#define TYPE_AW_I2C_SUN6I    TYPE_AW_I2C "-sun6i"
+
 OBJECT_DECLARE_SIMPLE_TYPE(AWI2CState, AW_I2C)
 
 #define AW_I2C_MEM_SIZE         0x24
@@ -XXX,XX +XXX,XX @@ struct AWI2CState {
     uint8_t srst;
     uint8_t efr;
     uint8_t lcr;
+
+    bool irq_clear_inverted;
 };
 
 #endif /* ALLWINNER_I2C_H */
diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/allwinner-i2c.c
+++ b/hw/i2c/allwinner-i2c.c
@@ -XXX,XX +XXX,XX @@ static void allwinner_i2c_write(void *opaque, hwaddr offset,
                 s->stat = STAT_FROM_STA(STAT_IDLE);
                 s->cntr &= ~TWI_CNTR_M_STP;
             }
-            if ((s->cntr & TWI_CNTR_INT_FLAG) == 0) {
-                /* Interrupt flag cleared */
+
+            if (!s->irq_clear_inverted && !(s->cntr & TWI_CNTR_INT_FLAG)) {
+                /* Write 0 to clear this flag */
+                qemu_irq_lower(s->irq);
+            } else if (s->irq_clear_inverted && (s->cntr & TWI_CNTR_INT_FLAG)) {
+                /* Write 1 to clear this flag */
+                s->cntr &= ~TWI_CNTR_INT_FLAG;
                 qemu_irq_lower(s->irq);
             }
+
             if ((s->cntr & TWI_CNTR_A_ACK) == 0) {
                 if (STAT_TO_STA(s->stat) == STAT_M_DATA_RX_ACK) {
                     s->stat = STAT_FROM_STA(STAT_M_DATA_RX_NACK);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_i2c_type_info = {
     .class_init = allwinner_i2c_class_init,
 };
 
+static void allwinner_i2c_sun6i_init(Object *obj)
+{
+    AWI2CState *s = AW_I2C(obj);
+
+    s->irq_clear_inverted = true;
+}
+
+static const TypeInfo allwinner_i2c_sun6i_type_info = {
+    .name = TYPE_AW_I2C_SUN6I,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(AWI2CState),
+    .instance_init = allwinner_i2c_sun6i_init,
+    .class_init = allwinner_i2c_class_init,
+};
+
 static void allwinner_i2c_register_types(void)
 {
     type_register_static(&allwinner_i2c_type_info);
+    type_register_static(&allwinner_i2c_sun6i_type_info);
 }
 
 type_init(allwinner_i2c_register_types)
-- 
2.34.1

From: qianfan Zhao <qianfanguijin@163.com>

Allwinner h3 has 4 twi(i2c) devices named twi0, twi1, twi2 and r_twi.
The registers are compatible with TYPE_AW_I2C_SUN6I, write 1 to clear
control register's INT_FLAG bit.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-h3.h |  6 ++++++
 hw/arm/allwinner-h3.c         | 29 +++++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_DEV_UART3,
     AW_H3_DEV_EMAC,
     AW_H3_DEV_TWI0,
+    AW_H3_DEV_TWI1,
+    AW_H3_DEV_TWI2,
     AW_H3_DEV_DRAMCOM,
     AW_H3_DEV_DRAMCTL,
     AW_H3_DEV_DRAMPHY,
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_DEV_GIC_VCPU,
     AW_H3_DEV_RTC,
     AW_H3_DEV_CPUCFG,
+    AW_H3_DEV_R_TWI,
     AW_H3_DEV_SDRAM
 };
 
@@ -XXX,XX +XXX,XX @@ struct AwH3State {
     AwSidState sid;
     AwSdHostState mmc0;
     AWI2CState i2c0;
+    AWI2CState i2c1;
+    AWI2CState i2c2;
+    AWI2CState r_twi;
     AwSun8iEmacState emac;
     AwRtcState rtc;
     GICState gic;
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_DEV_UART2]      = 0x01c28800,
     [AW_H3_DEV_UART3]      = 0x01c28c00,
     [AW_H3_DEV_TWI0]       = 0x01c2ac00,
+    [AW_H3_DEV_TWI1]       = 0x01c2b000,
+    [AW_H3_DEV_TWI2]       = 0x01c2b400,
     [AW_H3_DEV_EMAC]       = 0x01c30000,
     [AW_H3_DEV_DRAMCOM]    = 0x01c62000,
     [AW_H3_DEV_DRAMCTL]    = 0x01c63000,
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_DEV_GIC_VCPU]   = 0x01c86000,
     [AW_H3_DEV_RTC]        = 0x01f00000,
     [AW_H3_DEV_CPUCFG]     = 0x01f01c00,
+    [AW_H3_DEV_R_TWI]      = 0x01f02400,
     [AW_H3_DEV_SDRAM]      = 0x40000000
 };
 
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "uart1",     0x01c28400, 1 * KiB },
     { "uart2",     0x01c28800, 1 * KiB },
     { "uart3",     0x01c28c00, 1 * KiB },
-    { "twi1",      0x01c2b000, 1 * KiB },
-    { "twi2",      0x01c2b400, 1 * KiB },
     { "scr",       0x01c2c400, 1 * KiB },
     { "gpu",       0x01c40000, 64 * KiB },
     { "hstmr",     0x01c60000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "r_prcm",    0x01f01400, 1 * KiB },
     { "r_twd",     0x01f01800, 1 * KiB },
     { "r_cir-rx",  0x01f02000, 1 * KiB },
-    { "r_twi",     0x01f02400, 1 * KiB },
     { "r_uart",    0x01f02800, 1 * KiB },
     { "r_pio",     0x01f02c00, 1 * KiB },
     { "r_pwm",     0x01f03800, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_SPI_UART2     =  2,
     AW_H3_GIC_SPI_UART3     =  3,
     AW_H3_GIC_SPI_TWI0      =  6,
+    AW_H3_GIC_SPI_TWI1      =  7,
+    AW_H3_GIC_SPI_TWI2      =  8,
     AW_H3_GIC_SPI_TIMER0    = 18,
     AW_H3_GIC_SPI_TIMER1    = 19,
+    AW_H3_GIC_SPI_R_TWI     = 44,
     AW_H3_GIC_SPI_MMC0      = 60,
     AW_H3_GIC_SPI_EHCI0     = 72,
     AW_H3_GIC_SPI_OHCI0     = 73,
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
 
     object_initialize_child(obj, "rtc", &s->rtc, TYPE_AW_RTC_SUN6I);
 
-    object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C);
+    object_initialize_child(obj, "twi0",  &s->i2c0,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "twi1",  &s->i2c1,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "twi2",  &s->i2c2,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "r_twi", &s->r_twi, TYPE_AW_I2C_SUN6I);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c0), 0,
                        qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI0));
 
+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c1), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c1), 0, s->memmap[AW_H3_DEV_TWI1]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c1), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI1));
+
+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c2), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c2), 0, s->memmap[AW_H3_DEV_TWI2]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c2), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI2));
+
+    sysbus_realize(SYS_BUS_DEVICE(&s->r_twi), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->r_twi), 0, s->memmap[AW_H3_DEV_R_TWI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->r_twi), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_R_TWI));
+
     /* Unimplemented devices */
     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
         create_unimplemented_device(unimplemented[i].device_name,
-- 
2.34.1